in ransomware/artifact.lua [150:190]
function utils.NormalizePath(filePath)
filePath = filePath:lower()
filePath = filePath:gsub('progra~1', 'program files')
filePath = filePath:gsub('progra~2', 'program files (x86)')
local match = filePath:match('^%a:\\')
if match == nil then
return nil
end
local match = filePath:match('^%a:\\programdata\\.-\\')
if match ~= nil then
return match
end
match = filePath:match('^%a:\\program files\\.-\\')
if match ~= nil then
return match
end
match = filePath:match('^%a:\\program files %(x86%)\\.-\\')
if match ~= nil then
return match
end
match = filePath:match('^%a:\\.-\\')
if match ~= nil then
return match
end
match = filePath:match('(.*[/\\])')
if match ~= nil then
return match
end
return nil
end